Browse zlib specs (35 of 62)

Proofs / zlib / Sizes and memory

res_bound

One deflate(Z_FINISH) into exactly deflateBound bytes returns Z_STREAM_END, with a dictionary, a gzip header or neither, for data under 4 GiB and a bound below 2^32.

spec
77 lines of C
with its headers
169 lines
status
Proved
35 of 62
On this page

The spec

The spec is the C program harness/res_bound.c, 77 lines, shown whole as it is in the repository at 37189f4. It includes harness/laws_common.h (40 lines) and harness/laws_session.h (52 lines). Its first comment states the property in full, with every bound.

C
// Law res_bound: After deflateInit2 with any level, windowBits, memLevel and strategy in zlib.h's ranges (it returns
// Z_OK; Z_MEM_ERROR ends the run) and, or not, deflateSetDictionary with any dictionary (zlib or raw; up to 2^32 - 1
// bytes, as much as it takes) or deflateSetHeader with any gzip header (text, time, os, hcrc; an extra field up to
// 65535 bytes, a name and a comment up to 2^32 - 2 bytes, each present or not), one deflate(Z_FINISH) offered any data
// and exactly deflateBound bytes of output space (zlib.h's guarantee is for that one call: data and bound below 2^32)
// returns Z_STREAM_END, having read all of the data (avail_in 0, next_in at its end, total_in up by its length) and
// written at most deflateBound bytes (total_out as many).
#include "laws_common.h"
#include "laws_session.h"

static unsigned char *any_string(size_t len) {
	unsigned char *string = alloc_any_bytes(len + 1);
	if (string == NULL)
		return NULL;
	for (size_t i = 0; i < len; i++)
		gp_assume(string[i] != 0);
	string[len] = 0;
	return string;
}

int main(void) {
	int level = (int) nondet_u32();
	int window_bits = (int) nondet_u32();
	int mem_level = (int) nondet_u32();
	int strategy = (int) nondet_u32();
	gp_assume(deflate_params_ok(level, window_bits, mem_level, strategy));
	size_t data_len = nondet_u32();
	unsigned char *data = alloc_any_bytes(data_len);
	unsigned char choice = nondet_u8();
	size_t dict_len = nondet_u32();
	size_t extra_len = upto(65535);
	size_t name_len = upto(UINT_MAX - 1);
	size_t comment_len = upto(UINT_MAX - 1);
	unsigned char *dict = alloc_any_bytes(dict_len);
	unsigned char *extra = alloc_any_bytes(extra_len);
	unsigned char *name = any_string(name_len);
	unsigned char *comment = any_string(comment_len);
	if (!data || !dict || !extra || !name || !comment)
		return 0;
	gz_header head;
	head.text = (int) nondet_u32();
	head.time = nondet_u32();
	head.os = (int) nondet_u32();
	head.hcrc = (int) nondet_u32();
	head.extra = (choice & 2) ? extra : Z_NULL;
	head.extra_len = (uInt) extra_len;
	head.name = (choice & 4) ? name : Z_NULL;
	head.comment = (choice & 8) ? comment : Z_NULL;
	z_stream strm;
	new_stream(&strm);
	int code = deflateInit2(&strm, level, Z_DEFLATED, window_bits, mem_level, strategy);
	if (code == Z_MEM_ERROR)
		return 0;
	gp_assert(code == Z_OK);
	if ((choice & 1) && window_bits > 15)
		gp_assert(deflateSetHeader(&strm, &head) == Z_OK);
	if ((choice & 1) && window_bits <= 15)
		gp_assert(deflateSetDictionary(&strm, dict, (uInt) dict_len) == Z_OK);
	uLong bound = deflateBound(&strm, data_len);
	gp_assume(bound <= UINT_MAX);
	unsigned char *compressed = malloc(bound);
	if (compressed == NULL)
		return 0;
	set_buffer(&strm, data, data_len, compressed, bound);
	uLong total_in = strm.total_in;
	// zlib.h, deflateBound: "If that first deflate() call is provided the sourceLen input bytes, an output buffer
	// allocated to the size returned by deflateBound(), and the flush value Z_FINISH, then deflate() is guaranteed
	// to return Z_STREAM_END."

	code = deflate(&strm, Z_FINISH);

	gp_assert(code == Z_STREAM_END);
	size_t wrote = (size_t) (strm.next_out - compressed);
	gp_assert(wrote <= bound && strm.avail_in == 0 && strm.next_in == data + data_len);
	gp_assert(strm.total_in == total_in + data_len && strm.total_out == wrote);
	return 0;
}
harness/laws_common.h, 40 lines
C
// laws_common.h: trivial helpers shared by the zlib laws (each law includes it once). No models, no algorithms.
#include <limits.h>
#include <stdlib.h>
#include "quickproof.h"
#include "zlib.h"
static size_t upto(size_t max) {
	size_t value = nondet_size();
	return value < max ? value : max;
}
static uInt clip(size_t n) { return n < UINT_MAX ? (uInt) n : UINT_MAX; }
static unsigned char *alloc_any_bytes(size_t n) {
	unsigned char *bytes = malloc(n);
	if (bytes != NULL)
		nondet_bytes(bytes, n);
	return bytes;
}
static unsigned char *copy_of(const unsigned char *source, size_t n) {
	unsigned char *copy = malloc(n);
	for (size_t i = 0; copy != NULL && i < n; i++)
		copy[i] = source[i];
	return copy;
}
static int bytes_eq(const unsigned char *a, const unsigned char *b, size_t n) {
	for (size_t i = 0; i < n; i++)
		if (a[i] != b[i])
			return 0;
	return 1;
}
static void set_buffer(z_stream *strm, unsigned char *in, size_t in_len, unsigned char *out, size_t out_len) {
	strm->next_in = in;
	strm->avail_in = (uInt) in_len;
	strm->next_out = out;
	strm->avail_out = (uInt) out_len;
}
static void new_stream(z_stream *strm) {
	strm->zalloc = Z_NULL;
	strm->zfree = Z_NULL;
	strm->opaque = Z_NULL;
	set_buffer(strm, Z_NULL, 0, Z_NULL, 0);
}
harness/laws_session.h, 52 lines
C
// laws_session.h: helpers of the laws that drive a z_stream, included after laws_common.h. No models, no algorithms.
static int deflate_params_ok(int level, int window_bits, int mem_level, int strategy) {
	// zlib.h, deflateInit2: level "Z_DEFAULT_COMPRESSION, or between 0 and 9"; memLevel 1..MAX_MEM_LEVEL (9,
	// zconf.h); strategy Z_DEFAULT_STRATEGY (0) .. Z_FIXED (4); windowBits 8..15, "-8..-15 for raw deflate", "Add 16
	// to windowBits to write a simple gzip header", but "For raw deflate or gzip encoding, a request for a 256-byte
	// window is rejected as invalid"
	int zlib_window = window_bits >= 8 && window_bits <= 15;
	int raw_window = window_bits >= -15 && window_bits <= -9;
	int gzip_window = window_bits >= 16 + 9 && window_bits <= 16 + 15;
	int valid = level >= -1 && level <= 9 && mem_level >= 1 && mem_level <= 9 && strategy >= 0 && strategy <= Z_FIXED;
	return valid && (zlib_window || raw_window || gzip_window);
}
static int inflate_window_ok(int window_bits) {
	// zlib.h, inflateInit2: windowBits "should be in the range 8..15", "can also be zero to request that inflate
	// use the window size in the zlib header", "can also be -8..-15 for raw inflate", "Add 32 to windowBits to
	// enable zlib and gzip decoding with automatic header detection, or add 16 to decode only the gzip format"
	int low = window_bits & 15;
	int raw = window_bits >= -15 && window_bits <= -8;
	int wrapped = window_bits >= 0 && window_bits < 48 && (low == 0 || low >= 8);
	return raw || wrapped;
}
struct position {
	unsigned char *next_in;
	uInt avail_in;
	unsigned char *next_out;
	uInt avail_out;
	uLong total_in;
	uLong total_out;
};
static void position_of(z_stream *strm, struct position *at) {
	at->next_in = strm->next_in;
	at->avail_in = strm->avail_in;
	at->next_out = strm->next_out;
	at->avail_out = strm->avail_out;
	at->total_in = strm->total_in;
	at->total_out = strm->total_out;
}
static int unmoved(z_stream *strm, struct position *at) {
	int in = strm->next_in == at->next_in && strm->avail_in == at->avail_in && strm->total_in == at->total_in;
	int out = strm->next_out == at->next_out && strm->avail_out == at->avail_out && strm->total_out == at->total_out;
	return in && out;
}
static int accounted(z_stream *strm, struct position *at) {
	int in = strm->avail_in <= at->avail_in && strm->next_in + strm->avail_in == at->next_in + at->avail_in;
	int out = strm->avail_out <= at->avail_out && strm->next_out + strm->avail_out == at->next_out + at->avail_out;
	return in && out;
}
static int counted(z_stream *strm, struct position *at) {
	int in = strm->total_in == at->total_in + (at->avail_in - strm->avail_in);
	int out = strm->total_out == at->total_out + (at->avail_out - strm->avail_out);
	return in && out;
}

The theorem

QuickProof generated this statement from the spec, in src/contracts/res_bound.v:

Rocq
Theorem res_bound : harness_safe whole_prog.

src/contracts/laws.v states it on the spec's own program, whole_prog (the spec linked with the code under test), with its proof:

Rocq
Theorem res_bound : harness_safe Zlib.contracts.res_bound.whole_prog.
Proof. exact (proj1 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 (proj2 Zlib.contracts.suite.suite))))))))))))))))). Qed.

Read as a statement about runs, it says that no run of the program has undefined behaviour or a failing check, for every value the spec can draw. That reading rests on VST's adequacy theorem, which is not yet instantiated in Rocq (formerly Coq) for QuickProof's environment.

The C files (units) its program links
  • adler32.c
  • crc32.c
  • deflate.c
  • trees.c
  • zutil.c
  • quickproof/libc/libc.c

What it leaves out

  • What the first comment of the spec excludes, and its bounds.
  • Like every spec of this proof: termination (a run that never returns is not a counterexample), and binaries built by a compiler (the theorem is about the code as CompCert defines C for x86_64, LP64), one thread.
  • Where zlib reports Z_MEM_ERROR, most specs end the run and claim nothing about it; the first comment of the spec says so.
  • The edits to zlib's code, listed in the repository, are tested, not proved.

The summary page says what the proof as a whole covers.

How it was proved

AI agents wrote the proof, and Rocq checks it. qp verify passes on this repository: this statement is the one generated from the spec at the contract commit, and its proof uses only Rocq's standard axioms and VST's abstract malloc library.