# Frama-C-discuss mailing list archives

This page gathers the archives of the old Frama-C-discuss archives, that was hosted by Inria's gforge before its demise at the end of 2020. To search for mails newer than September 2020, please visit the page of the new mailing list on Renater.

# [Frama-c-discuss] recursive function int overflow

```
Le 30/03/2015 14:12, Fritjof Bornebusch a ?crit :
> Hi,
>
> is there a way to verify recursive functions regarding overflows.

There is nothing special about recursive functions that would make
proving absence of overflows more difficult than for non-recursive ones.

> If I remove the #pragma statement in this example:
>
> the verification fails.

Of course, since this code overflows as soon as the argument is larger
than 12. (assuming "int" is 32-bit).

Here is a possible way to handle this. To prove the lemma, you need Z3.

/*@ axiomatic Factorial {
@   logic integer factorial(integer n);
@   axiom factorial_0: factorial(0) == 1;
@   axiom factorial_succ:
@     \forall integer n; n > 0 ==> factorial(n) == n * factorial(n-1);
@ }
@*/

/*@ lemma fact_bound: \forall integer n; 0 <= n <= 11 ==>
@      1 <= factorial(n) <= 39916800;
@*/

/*@ requires 0 <= n <= 12;
@ decreases n;
@ ensures \result == factorial(n);
@*/
int fact(int n) {
if (n == 0) return 1;
return n * fact(n-1);
}

--
Claude March?                          | tel: +33 1 69 15 66 08
INRIA Saclay - ?le-de-France           |
Universit? Paris-sud, Bat. 650         | http://www.lri.fr/~marche/
F-91405 ORSAY Cedex                    |

```