메뉴
Use when the condition involves nonlinear arithmetic over symbolic integers (e.g., multiplications like 4*a*b or squaring (c-a-b)*(c-a-b)) that the SMT solver struggles to reason about
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when printf statements output strings without trailing newlines
Use when array is accessed with direct user input as index (0-based indexing)
Use when the program accesses a precomputed table using an offset (e.g., arr[n-1]) that introduces an arithmetic operation between the symbolic input and the index
Use when loop variables iterate over character values (e.g., ASCII codes) to represent different operations or choices
Use when code uses a loop to search for an input value in an array and then uses the found index for further computation
Use when code reads a fixed number of characters into an array and only accesses individual elements
| name | avoid-nonlinear-symbolic-constraints |
| description | Use when the condition involves nonlinear arithmetic over symbolic integers (e.g., multiplications like 4*a*b or squaring (c-a-b)*(c-a-b)) that the SMT solver struggles to reason about |
A KLEE-coverage code transformation. Applying it rewrites C source so symbolic execution explores more of the program's behavior.
When the condition involves nonlinear arithmetic over symbolic integers (e.g., multiplications like 4ab or squaring (c-a-b)*(c-a-b)) that the SMT solver struggles to reason about
Reformulate the predicate using a concrete library call (e.g., sqrtl) on the symbolic inputs so the comparison becomes effectively linear at the SMT level, replacing multiplied symbolic terms with a single computed value
KLEE relies on an SMT solver that handles linear integer arithmetic efficiently but times out or imprecisely models nonlinear multiplications of symbolic variables; offloading the nonlinear part to a concrete float computation reduces constraint complexity and lets KLEE explore both branches and generate diverse inputs
Before:
#include <stdio.h>
int main(){
long long int a,b,c;
scanf("%lld%lld%lld", &a, &b, &c);
if(4*a*b < (c-a-b)*(c-a-b) && c-a-b > 0) {
puts("Yes");
}
else {
puts("No");
}
}
After:
#include <stdio.h>
#include <math.h>
int main(){
int a,b,c;
scanf("%d%d%d",&a,&b,&c);
puts(a+2*sqrtl((long long)a*b)+b<c ? "Yes" : "No");
}
b0808d9d