@@ -130,14 +130,14 @@ this proof relies on the hypothesis that the `box` argument of
130
130
This assumption is checked in any analyzed function that would call `zeros_buffer`.
131
131
Thus, if you verify all the functions in a program, we prove it memory-safe.
132
132
133
- {: .note }
134
- While codex **ensures spatial memory safety** (no invalid pointer read/write),
135
- it does **not ensure termination**.
136
- Even with our given types, the `zeros_buffer` function may loop infinitely.
137
- Indeed, we cannot express the invariant stating the list is circular. It is sort
138
- of implied by the constraints that the `next` pointer is never null, since memory
139
- is finite, the list will eventually reach a loop. However, we may have a lasso-shape,
140
- where the first few `message`s are not part of that loop.
133
+ [//]: # {: .note }
134
+ [//]: # While codex **ensures spatial memory safety** (no invalid pointer read/write),
135
+ [//]: # it does **not ensure termination**.
136
+ [//]: # Even with our given types, the `zeros_buffer` function may loop infinitely.
137
+ [//]: # Indeed, we cannot express the invariant stating the list is circular. It is sort
138
+ [//]: # of implied by the constraints that the `next` pointer is never null, since memory
139
+ [//]: # is finite, the list will eventually reach a loop. However, we may have a lasso-shape,
140
+ [//]: # where the first few `message`s are not part of that loop.
141
141
142
142
Finally, this verification of `zeros_buffer` can be made not only on
143
143
the C source code, but also on the compiled machine code, i.e. Codex
0 commit comments