analyzer: handle function attribute "alloc_size" [PR110426]

This patch makes -fanalyzer make use of the function attribute
"alloc_size", allowing -fanalyzer to emit -Wanalyzer-allocation-size,
-Wanalyzer-out-of-bounds, and -Wanalyzer-tainted-allocation-size on
execution paths involving allocations using such functions.

gcc/analyzer/ChangeLog:
	PR analyzer/110426
	* bounds-checking.cc (region_model::check_region_bounds): Handle
	symbolic base regions.
	* call-details.cc: Include "stringpool.h" and "attribs.h".
	(call_details::lookup_function_attribute): New function.
	* call-details.h (call_details::lookup_function_attribute): New
	function decl.
	* region-model-manager.cc
	(region_model_manager::maybe_fold_binop): Add reference to
	PR analyzer/110902.
	* region-model-reachability.cc (reachable_regions::handle_sval):
	Add symbolic regions for pointers that are conjured svalues for
	the LHS of a stmt.
	* region-model.cc (region_model::canonicalize): Purge dynamic
	extents for regions that aren't referenced.
	(get_result_size_in_bytes): New function.
	(region_model::on_call_pre): Use get_result_size_in_bytes and
	potentially set the dynamic extents of the region pointed to by
	the return value.
	(region_model::deref_rvalue): Add param "add_nonnull_constraint"
	and use it to conditionalize adding the constraint.
	(pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
	param to both ctors and use it to initialize new "m_stmt" field.
	(pending_diagnostic_subclass::operator==): Use m_stmt; don't use
	m_lhs or m_rhs.
	(pending_diagnostic_subclass::m_stmt): New field.
	(region_model::check_region_size): Generalize to any kind of
	pointer svalue by using deref_rvalue rather than checking for
	region_svalue.  Pass stmt to dubious_allocation_size ctor.
	* region-model.h (region_model::deref_rvalue): Add param
	"add_nonnull_constraint".
	* svalue.cc (conjured_svalue::lhs_value_p): New function.
	* svalue.h (conjured_svalue::lhs_value_p): New decl.

gcc/testsuite/ChangeLog:
	PR analyzer/110426
	* gcc.dg/analyzer/allocation-size-1.c: Update expected message to
	reflect consolidation of size and assignment into a single event.
	* gcc.dg/analyzer/allocation-size-2.c: Likewise.
	* gcc.dg/analyzer/allocation-size-3.c: Likewise.
	* gcc.dg/analyzer/allocation-size-4.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-1.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-2.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-3.c: Likewise.
	* gcc.dg/analyzer/attr-alloc_size-1.c: New test.
	* gcc.dg/analyzer/attr-alloc_size-2.c: New test.
	* gcc.dg/analyzer/attr-alloc_size-3.c: New test.
	* gcc.dg/analyzer/explode-4.c: New test.
	* gcc.dg/analyzer/taint-size-1.c: Add test coverage for
	__attribute__ alloc_size.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

21 files changed, 458 insertions, 63 deletions

diff --git a/gcc/analyzer/bounds-checking.cc b/gcc/analyzer/bounds-checking.cc
index 5e8de9a..f49cf7c 100644
--- a/gcc/analyzer/bounds-checking.cc
+++ b/gcc/analyzer/bounds-checking.cc
@@ -981,12 +981,6 @@ region_model::check_region_bounds (const region *reg,
   region_offset reg_offset = reg->get_offset (m_mgr);
   const region *base_reg = reg_offset.get_base_region ();
 
-  /* Bail out on symbolic regions.
-     (e.g. because the analyzer did not see previous offsets on the latter,
-     it might think that a negative access is before the buffer).  */
-  if (base_reg->symbolic_p ())
-	  return true;
-
   /* Find out how many bytes were accessed.  */
   const svalue *num_bytes_sval = reg->get_byte_size_sval (m_mgr);
   tree num_bytes_tree = maybe_get_integer_cst_tree (num_bytes_sval);
@@ -1010,9 +1004,9 @@ region_model::check_region_bounds (const region *reg,
     offset = wi::sext (reg_offset.get_bit_offset () >> LOG2_BITS_PER_UNIT,
 		       TYPE_PRECISION (size_type_node));
 
-  /* If either the offset or the number of bytes accessed are symbolic,
-     we have to reason about symbolic values.  */
-  if (reg_offset.symbolic_p () || !num_bytes_tree)
+  /* If any of the base region, the offset, or the number of bytes accessed
+     are symbolic, we have to reason about symbolic values.  */
+  if (base_reg->symbolic_p () || reg_offset.symbolic_p () || !num_bytes_tree)
     {
       const svalue* byte_offset_sval;
       if (!reg_offset.symbolic_p ())
diff --git a/gcc/analyzer/call-details.cc b/gcc/analyzer/call-details.cc
index 17edaf2..793317e 100644
--- a/gcc/analyzer/call-details.cc
+++ b/gcc/analyzer/call-details.cc
@@ -34,6 +34,8 @@ along with GCC; see the file COPYING3.  If not see
 #include "gimple-pretty-print.h"
 #include "analyzer/region-model.h"
 #include "analyzer/call-details.h"
+#include "stringpool.h"
+#include "attribs.h"
 
 #if ENABLE_ANALYZER
 
@@ -226,6 +228,25 @@ call_details::get_or_create_conjured_svalue (const region *reg) const
 					     conjured_purge (m_model, m_ctxt));
 }
 
+/* Look for a function attribute with name ATTR_NAME on the called
+   function (or on its type).
+   Return the attribute if one is found, otherwise return NULL_TREE.  */
+
+tree
+call_details::lookup_function_attribute (const char *attr_name) const
+{
+  tree allocfntype;
+  if (tree fndecl = get_fndecl_for_call ())
+    allocfntype = TREE_TYPE (fndecl);
+  else
+    allocfntype = gimple_call_fntype (m_call);
+
+  if (!allocfntype)
+    return NULL_TREE;
+
+  return lookup_attribute (attr_name, TYPE_ATTRIBUTES (allocfntype));
+}
+
 } // namespace ana
 
 #endif /* #if ENABLE_ANALYZER */
diff --git a/gcc/analyzer/call-details.h b/gcc/analyzer/call-details.h
index 14a206f..25ea554 100644
--- a/gcc/analyzer/call-details.h
+++ b/gcc/analyzer/call-details.h
@@ -64,6 +64,8 @@ public:
 
   const svalue *get_or_create_conjured_svalue (const region *) const;
 
+  tree lookup_function_attribute (const char *attr_name) const;
+
 private:
   const gcall *m_call;
   region_model *m_model;
diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index 46d271a..65b7190 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -654,6 +654,8 @@ region_model_manager::maybe_fold_binop (tree type, enum tree_code op,
 	return get_or_create_constant_svalue (build_int_cst (type, 0));
       /* (VAL * 1) -> VAL.  */
       if (cst1 && integer_onep (cst1))
+	/* TODO: we ought to have a cast to TYPE here, but doing so introduces
+	   regressions; see PR analyzer/110902.  */
 	return arg0;
       break;
     case BIT_AND_EXPR:
diff --git a/gcc/analyzer/region-model-reachability.cc b/gcc/analyzer/region-model-reachability.cc
index a5c12f4..1c747e1 100644
--- a/gcc/analyzer/region-model-reachability.cc
+++ b/gcc/analyzer/region-model-reachability.cc
@@ -184,6 +184,27 @@ reachable_regions::handle_sval (const svalue *sval)
 	}
       add (pointee, ptr_is_mutable);
     }
+  else if (sval->get_type ()
+	   && TREE_CODE (sval->get_type ()) == POINTER_TYPE
+	   && sval->get_kind () == SK_CONJURED)
+    {
+      /* Also add symbolic regions for pointers, but only for conjured svalues
+	 for the LHS of a stmt.  Doing it for more leads to state explosions
+	 on chains of calls to external functions, due to each conjured svalue
+	 potentially being modified at each successive call, recursively.  */
+      const conjured_svalue *conjured_sval = (const conjured_svalue *)sval;
+      if (conjured_sval->lhs_value_p ())
+	{
+	  const region *pointee
+	    = m_model->get_manager ()->get_symbolic_region (sval);
+	  /* Use const-ness of pointer type to affect mutability.  */
+	  bool ptr_is_mutable = true;
+	  if (TYPE_READONLY (TREE_TYPE (sval->get_type ())))
+	    ptr_is_mutable = false;
+	  add (pointee, ptr_is_mutable);
+	}
+    }
+
   /* Treat all svalues within a compound_svalue as reachable.  */
   if (const compound_svalue *compound_sval
       = sval->dyn_cast_compound_svalue ())
diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 5ed735d..e92b3f7 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -441,6 +441,29 @@ region_model::canonicalize ()
 {
   m_store.canonicalize (m_mgr->get_store_manager ());
   m_constraints->canonicalize ();
+
+  if (!m_dynamic_extents.is_empty ())
+    {
+      /* Purge any dynamic extents for regions that aren't referenced.
+	 Normally these are eliminated when leaks are detected, but we
+	 can also gain stray heap_allocated_regions that aren't seen
+	 by the leak-detection code.  This happens when
+	 region_model::on_call_pre provides a default result for a
+	 function with both attributes "malloc" and "alloc_size" that
+	 also has a known_function implementation.
+	 Purge dynamic extent information for such regions.  */
+      auto_bitmap referenced_base_region_ids;
+      get_referenced_base_regions (referenced_base_region_ids);
+      auto_vec<const region *> purgable_dyn_extents;
+      for (auto iter : m_dynamic_extents)
+	{
+	  const region *reg = iter.first;
+	  if (!bitmap_bit_p (referenced_base_region_ids, reg->get_id ()))
+	    purgable_dyn_extents.safe_push (reg);
+	}
+      for (auto reg : purgable_dyn_extents)
+	m_dynamic_extents.remove (reg);
+    }
 }
 
 /* Return true if this region_model is in canonical form.  */
@@ -1462,6 +1485,48 @@ region_model::get_known_function (enum internal_fn ifn) const
   return known_fn_mgr->get_internal_fn (ifn);
 }
 
+/* Look for attribute "alloc_size" on the called function and, if found,
+   return a symbolic value of type size_type_node for the allocation size
+   based on the call's parameters.
+   Otherwise, return null.  */
+
+static const svalue *
+get_result_size_in_bytes (const call_details &cd)
+{
+  const tree attr = cd.lookup_function_attribute ("alloc_size");
+  if (!attr)
+    return nullptr;
+
+  const tree atval_1 = TREE_VALUE (attr);
+  if (!atval_1)
+    return nullptr;
+
+  unsigned argidx1 = TREE_INT_CST_LOW (TREE_VALUE (atval_1)) - 1;
+  if (cd.num_args () <= argidx1)
+    return nullptr;
+
+  const svalue *sval_arg1 = cd.get_arg_svalue (argidx1);
+
+  if (const tree atval_2 = TREE_CHAIN (atval_1))
+    {
+      /* Two arguments.  */
+      unsigned argidx2 = TREE_INT_CST_LOW (TREE_VALUE (atval_2)) - 1;
+      if (cd.num_args () <= argidx2)
+	return nullptr;
+      const svalue *sval_arg2 = cd.get_arg_svalue (argidx2);
+      /* TODO: ideally we shouldn't need this cast here;
+	 see PR analyzer/110902.  */
+      return cd.get_manager ()->get_or_create_cast
+	(size_type_node,
+	 cd.get_manager ()->get_or_create_binop (size_type_node,
+						 MULT_EXPR,
+						 sval_arg1, sval_arg2));
+    }
+  else
+    /* Single argument.  */
+    return cd.get_manager ()->get_or_create_cast (size_type_node, sval_arg1);
+}
+
 /* Update this model for the CALL stmt, using CTXT to report any
    diagnostics - the first half.
 
@@ -1522,6 +1587,11 @@ region_model::on_call_pre (const gcall *call, region_model_context *ctxt)
 							 lhs_region,
 							 conjured_purge (this,
 									 ctxt));
+	  if (const svalue *size_in_bytes = get_result_size_in_bytes (cd))
+	    {
+	      const region *reg = deref_rvalue (sval, NULL_TREE, ctxt, false);
+	      set_dynamic_extents (reg, size_in_bytes, ctxt);
+	    }
 	}
       set_value (lhs_region, sval, ctxt);
     }
@@ -2461,7 +2531,8 @@ region_model::region_exists_p (const region *reg) const
 
 const region *
 region_model::deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
-			    region_model_context *ctxt) const
+			    region_model_context *ctxt,
+			    bool add_nonnull_constraint) const
 {
   gcc_assert (ptr_sval);
   gcc_assert (POINTER_TYPE_P (ptr_sval->get_type ()));
@@ -2471,9 +2542,13 @@ region_model::deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
      -Wanalyzer-null-dereference for the case where we later have an
      if (PTR_SVAL) that would occur if we considered the false branch
      and transitioned the malloc state machine from start->null.  */
-  tree null_ptr_cst = build_int_cst (ptr_sval->get_type (), 0);
-  const svalue *null_ptr = m_mgr->get_or_create_constant_svalue (null_ptr_cst);
-  m_constraints->add_constraint (ptr_sval, NE_EXPR, null_ptr);
+  if (add_nonnull_constraint)
+    {
+      tree null_ptr_cst = build_int_cst (ptr_sval->get_type (), 0);
+      const svalue *null_ptr
+	= m_mgr->get_or_create_constant_svalue (null_ptr_cst);
+      m_constraints->add_constraint (ptr_sval, NE_EXPR, null_ptr);
+    }
 
   switch (ptr_sval->get_kind ())
     {
@@ -2851,14 +2926,15 @@ class dubious_allocation_size
 : public pending_diagnostic_subclass<dubious_allocation_size>
 {
 public:
-  dubious_allocation_size (const region *lhs, const region *rhs)
-  : m_lhs (lhs), m_rhs (rhs), m_expr (NULL_TREE),
+  dubious_allocation_size (const region *lhs, const region *rhs,
+			   const gimple *stmt)
+  : m_lhs (lhs), m_rhs (rhs), m_expr (NULL_TREE), m_stmt (stmt),
     m_has_allocation_event (false)
   {}
 
   dubious_allocation_size (const region *lhs, const region *rhs,
-			   tree expr)
-  : m_lhs (lhs), m_rhs (rhs), m_expr (expr),
+			   tree expr, const gimple *stmt)
+  : m_lhs (lhs), m_rhs (rhs), m_expr (expr), m_stmt (stmt),
     m_has_allocation_event (false)
   {}
 
@@ -2869,8 +2945,8 @@ public:
 
   bool operator== (const dubious_allocation_size &other) const
   {
-    return m_lhs == other.m_lhs && m_rhs == other.m_rhs
-	   && pending_diagnostic::same_tree_p (m_expr, other.m_expr);
+    return (m_stmt == other.m_stmt
+	    && pending_diagnostic::same_tree_p (m_expr, other.m_expr));
   }
 
   int get_controlling_option () const final override
@@ -2940,6 +3016,7 @@ private:
   const region *m_lhs;
   const region *m_rhs;
   const tree m_expr;
+  const gimple *m_stmt;
   bool m_has_allocation_event;
 };
 
@@ -3139,10 +3216,6 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
   if (!is_any_cast_p (ctxt->get_stmt ()))
     return;
 
-  const region_svalue *reg_sval = dyn_cast <const region_svalue *> (rhs_sval);
-  if (!reg_sval)
-    return;
-
   tree pointer_type = lhs_reg->get_type ();
   if (pointer_type == NULL_TREE || !POINTER_TYPE_P (pointer_type))
     return;
@@ -3167,7 +3240,7 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
       || integer_onep (pointee_size_tree))
     return;
 
-  const region *rhs_reg = reg_sval->get_pointee ();
+  const region *rhs_reg = deref_rvalue (rhs_sval, NULL_TREE, ctxt, false);
   const svalue *capacity = get_capacity (rhs_reg);
   switch (capacity->get_kind ())
     {
@@ -3180,7 +3253,8 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
 	    && !capacity_compatible_with_type (cst_cap, pointee_size_tree,
 					       is_struct))
 	  ctxt->warn (make_unique <dubious_allocation_size> (lhs_reg, rhs_reg,
-							     cst_cap));
+							     cst_cap,
+							     ctxt->get_stmt ()));
       }
       break;
     default:
@@ -3193,7 +3267,8 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
 		tree expr = get_representative_tree (capacity);
 		ctxt->warn (make_unique <dubious_allocation_size> (lhs_reg,
 								   rhs_reg,
-								   expr));
+								   expr,
+								   ctxt->get_stmt ()));
 	      }
 	  }
       break;
diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h
index d6d9615..0cf3871 100644
--- a/gcc/analyzer/region-model.h
+++ b/gcc/analyzer/region-model.h
@@ -352,7 +352,8 @@ class region_model
   const svalue *get_rvalue (tree expr, region_model_context *ctxt) const;
 
   const region *deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
-			       region_model_context *ctxt) const;
+			      region_model_context *ctxt,
+			      bool add_nonnull_constraint = true) const;
 
   const svalue *get_rvalue_for_bits (tree type,
 				     const region *reg,
diff --git a/gcc/analyzer/svalue.cc b/gcc/analyzer/svalue.cc
index 5d5c80f..064627f 100644
--- a/gcc/analyzer/svalue.cc
+++ b/gcc/analyzer/svalue.cc
@@ -1940,6 +1940,17 @@ conjured_svalue::accept (visitor *v) const
   v->visit_conjured_svalue (this);
 }
 
+/* Return true iff this conjured_svalue is for the LHS of the
+   stmt that conjured it.  */
+
+bool
+conjured_svalue::lhs_value_p () const
+{
+  if (tree decl = m_id_reg->maybe_get_decl ())
+    return decl == gimple_get_lhs (m_stmt);
+  return false;
+}
+
 /* class asm_output_svalue : public svalue.  */
 
 /* Implementation of svalue::dump_to_pp vfunc for asm_output_svalue.  */
diff --git a/gcc/analyzer/svalue.h b/gcc/analyzer/svalue.h
index fbb1018..5492b1e 100644
--- a/gcc/analyzer/svalue.h
+++ b/gcc/analyzer/svalue.h
@@ -1411,6 +1411,7 @@ public:
 
   const gimple *get_stmt () const { return m_stmt; }
   const region *get_id_region () const { return m_id_reg; }
+  bool lhs_value_p () const;
 
  private:
   const gimple *m_stmt;
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-1.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-1.c
index 003914e..dcffc11 100644
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/allocation-size-1.c
@@ -16,8 +16,7 @@ void test_2 (void)
   free (ptr);
 
   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
-  /* { dg-message "42 bytes" "note" { target *-*-* } malloc2 } */
-  /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
+  /* { dg-message "allocated 42 bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
 }
 
 void test_3 (void)
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-2.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-2.c
index eb770f7..d26c267 100644
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/allocation-size-2.c
@@ -19,8 +19,7 @@ void test_2 (int32_t n)
   free (ptr);
 
   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
-  /* { dg-message "'\[a-z0-9\\*\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc2 } */
-  /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4" "note" { target *-*-* } malloc2 } */
+  /* { dg-message "allocated '\[a-z0-9\\*\\(\\)\\s\]*' bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4" "note" { target *-*-* } malloc2 } */
 }
 
 void test_3 (int32_t n)
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-3.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-3.c
index 6751441..6b75307 100644
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-3.c
+++ b/gcc/testsuite/gcc.dg/analyzer/allocation-size-3.c
@@ -20,8 +20,7 @@ void test_1 (void)
   free (id_sequence);
 
   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc1 } */
-  /* { dg-message "3 bytes" "note" { target *-*-* } malloc1 } */
-  /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc1 } */
+  /* { dg-message "allocated 3 bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc1 } */
 }
 
 void test_2 (void)
@@ -30,8 +29,7 @@ void test_2 (void)
   free (ptr);
 
   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
-  /* { dg-message "14 bytes" "note" { target *-*-* } malloc2 } */
-  /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
+  /* { dg-message "allocated 14 bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
 }
 
 void test_3 (int32_t n)
@@ -40,8 +38,7 @@ void test_3 (int32_t n)
   free (ptr);
 
   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc3 } */
-  /* { dg-message "'\[a-z0-9\\+\\(\\)\\s\]*' bytes" "note" { target *-*-* } malloc3 } */
-  /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc3 } */
+  /* { dg-message "allocated '\[a-z0-9\\+\\(\\)\\s\]*' bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc3 } */
 }
 
 void test_4 (int32_t n, int32_t m)
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-4.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-4.c
index a56b25b..642e8f5 100644
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-4.c
+++ b/gcc/testsuite/gcc.dg/analyzer/allocation-size-4.c
@@ -30,8 +30,7 @@ void test_2 (void)
   free (ptr);
 
   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc2 } */
-  /* { dg-message "\\d+ bytes" "note" { target *-*-* } malloc2 } */
-  /* { dg-message "'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
+  /* { dg-message "allocated \\d+ bytes and assigned to 'int32_t \\*' (\\\{aka '(long )?int \\*'\\\})? here; 'sizeof \\(int32_t (\\\{aka (long )?int\\\})?\\)' is '4'" "note" { target *-*-* } malloc2 } */
 }
 
 void test_3 (void)
@@ -56,6 +55,5 @@ void test_5 (void)
   free (ptr);
 
   /* { dg-warning "allocated buffer size is not a multiple of the pointee's size \\\[CWE-131\\\]" "warning" { target *-*-* } malloc5 } */
-  /* { dg-message "allocated 1 byte here" "note" { target *-*-* } malloc5 } */
-  /* { dg-message "'struct base \\*' here; 'sizeof \\(struct base\\)' is '\\d+'" "note" { target *-*-* } malloc5 } */
+  /* { dg-message "allocated 1 bytes and assigned to 'struct base \\*' here; 'sizeof \\(struct base\\)' is '\\d+'" "note" { target *-*-* } malloc5 } */
 }
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
index 7251665..9938ba2 100644
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-1.c
@@ -11,13 +11,12 @@ void test_constant_1 (void)
 /* { dg-begin-multiline-output "" }
    int32_t *ptr = __builtin_malloc (1);
                   ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_1': events 1-2
+  'test_constant_1': event 1
     |
     |   int32_t *ptr = __builtin_malloc (1);
     |                  ^~~~~~~~~~~~~~~~~~~~
     |                  |
-    |                  (1) allocated 1 byte here
-    |                  (2) assigned to 'int32_t *'
+    |                  (1) allocated 1 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
 
@@ -30,13 +29,12 @@ void test_constant_2 (void)
 /* { dg-begin-multiline-output "" }
    int32_t *ptr = __builtin_malloc (2);
                   ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_2': events 1-2
+  'test_constant_2': event 1
     |
     |   int32_t *ptr = __builtin_malloc (2);
     |                  ^~~~~~~~~~~~~~~~~~~~
     |                  |
-    |                  (1) allocated 2 bytes here
-    |                  (2) assigned to 'int32_t *'
+    |                  (1) allocated 2 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
 
@@ -54,6 +52,6 @@ void test_symbolic (int n)
     |   int32_t *ptr = __builtin_malloc (n * 2);
     |                  ^~~~~~~~~~~~~~~~~~~~~~~~
     |                  |
-    |                  (1) allocated 'n * 2' bytes and assigned to 'int32_t *'
+    |                  (1) allocated 'n * 2' bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
index 7cadbb7..9e1269c 100644
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
+++ b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-2.c
@@ -11,13 +11,12 @@ void test_constant_1 (void)
 /* { dg-begin-multiline-output "" }
    int32_t *ptr = __builtin_alloca (1);
                   ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_1': events 1-2
+  'test_constant_1': event 1
     |
     |   int32_t *ptr = __builtin_alloca (1);
     |                  ^~~~~~~~~~~~~~~~~~~~
     |                  |
-    |                  (1) allocated 1 byte here
-    |                  (2) assigned to 'int32_t *'
+    |                  (1) allocated 1 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
 
@@ -29,13 +28,12 @@ void test_constant_2 (void)
 /* { dg-begin-multiline-output "" }
    int32_t *ptr = __builtin_alloca (2);
                   ^~~~~~~~~~~~~~~~~~~~
-  'test_constant_2': events 1-2
+  'test_constant_2': event 1
     |
     |   int32_t *ptr = __builtin_alloca (2);
     |                  ^~~~~~~~~~~~~~~~~~~~
     |                  |
-    |                  (1) allocated 2 bytes here
-    |                  (2) assigned to 'int32_t *'
+    |                  (1) allocated 2 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
 
@@ -47,13 +45,12 @@ void test_symbolic (int n)
 /* { dg-begin-multiline-output "" }
    int32_t *ptr = __builtin_alloca (n * 2);
                   ^~~~~~~~~~~~~~~~~~~~~~~~
-  'test_symbolic': events 1-2
+  'test_symbolic': event 1
     |
     |   int32_t *ptr = __builtin_alloca (n * 2);
     |                  ^~~~~~~~~~~~~~~~~~~~~~~~
     |                  |
-    |                  (1) allocated 'n * 2' bytes here
-    |                  (2) assigned to 'int32_t *'
+    |                  (1) allocated 'n * 2' bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
 
diff --git a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
index b3de582..71790d9 100644
--- a/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
+++ b/gcc/testsuite/gcc.dg/analyzer/allocation-size-multiline-3.c
@@ -15,13 +15,12 @@ void test_constant_99 (void)
 /* { dg-begin-multiline-output "" }
    int32_t *ptr = alloca (99);
                   ^~~~~~
-  'test_constant_99': events 1-2
+  'test_constant_99': event 1
     |
     |   int32_t *ptr = alloca (99);
     |                  ^~~~~~
     |                  |
-    |                  (1) allocated 99 bytes here
-    |                  (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |                  (1) allocated 99 bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
 
@@ -33,12 +32,11 @@ void test_symbolic (int n)
 /* { dg-begin-multiline-output "" }
    int32_t *ptr = alloca (n * 2);
                   ^~~~~~
-  'test_symbolic': events 1-2
+  'test_symbolic': event 1
     |
     |   int32_t *ptr = alloca (n * 2);
     |                  ^~~~~~
     |                  |
-    |                  (1) allocated 'n * 2' bytes here
-    |                  (2) assigned to 'int32_t *' {aka '{re:long :re?}int *'} here; 'sizeof (int32_t {aka {re:long :re?}int})' is '4'
+    |                  (1) allocated 'n * 2' bytes and assigned to 'int32_t *' {aka 'int *'} here; 'sizeof (int32_t {aka int})' is '4'
     |
    { dg-end-multiline-output "" } */
diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-1.c b/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-1.c
new file mode 100644
index 0000000..eb3c695
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-1.c
@@ -0,0 +1,81 @@
+#include "analyzer-decls.h"
+
+typedef __SIZE_TYPE__ size_t;
+
+extern void* (*my_alloc)(size_t) __attribute__ ((alloc_size (1)));
+extern void* (*my_alloc_2)(size_t, size_t) __attribute__ ((alloc_size (1, 2)));
+
+int test_one_arg_concrete_int_ptr (void)
+{
+  int *x = my_alloc (1); /* { dg-warning "allocated buffer size is not a multiple of the pointee's size" } */
+  __analyzer_dump_capacity (x); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)1'" } */
+  x[0] = 0; /* { dg-warning "buffer overflow" } */
+  return 0;
+}
+
+void test_one_arg_concrete (void)
+{
+  char *p = my_alloc (10);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
+  p[0] = 'a';
+  p[9] = 'b';
+  p[10] = 'c'; /* { dg-warning "buffer overflow" } */
+  p[11] = 'c'; /* { dg-warning "buffer overflow" } */
+}
+
+void test_one_arg_symbolic (size_t sz)
+{
+  char *p = my_alloc (sz);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: 'INIT_VAL\\(sz" } */
+}
+
+void test_two_args_concrete (void)
+{
+  char *p = my_alloc_2 (2, 5);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
+  p[0] = 'a';
+  p[9] = 'b';
+  p[10] = 'c'; /* { dg-warning "buffer overflow" } */
+  p[11] = 'c'; /* { dg-warning "buffer overflow" } */
+}
+
+void test_two_args_symbolic_first (size_t sz)
+{
+  char *p = my_alloc_2 (sz, 5);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(sz\[^\n\r\]*\\*\\(size_t\\)5\\)'" } */
+}
+
+void test_two_args_symbolic_second (size_t sz)
+{
+  char *p = my_alloc_2 (5, sz);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(sz\[^\n\r\]*\\*\\(size_t\\)5\\)'" } */
+}
+
+void test_two_args_symbolic_both (size_t a, size_t b)
+{
+  char *p = my_alloc_2 (a, b);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(INIT_VAL\\(a\[^\n\r\]*\\*INIT_VAL\\(b" } */
+}
+
+typedef void* (*my_alloc_t)(size_t) __attribute__ ((alloc_size (1)));
+typedef void* (*my_alloc_2_t)(size_t, size_t) __attribute__ ((alloc_size (1, 2)));
+
+void test_one_arg_concrete_fnptr (my_alloc_t fnptr)
+{
+  char *p = fnptr (10);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
+  p[0] = 'a';
+  p[9] = 'b';
+  p[10] = 'c'; /* { dg-warning "buffer overflow" } */
+  p[11] = 'c'; /* { dg-warning "buffer overflow" } */
+}
+
+void test_two_args_concrete_fnptr (my_alloc_2_t fnptr)
+{
+  char *p = fnptr (2, 5);
+  __analyzer_dump_capacity (p); /* { dg-warning "capacity: '\\(\[^\n\r\]*\\)10'" } */
+  p[0] = 'a';
+  p[9] = 'b';
+  p[10] = 'c'; /* { dg-warning "buffer overflow" } */
+  p[11] = 'c'; /* { dg-warning "buffer overflow" } */
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-2.c b/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-2.c
new file mode 100644
index 0000000..7b787f9
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-2.c
@@ -0,0 +1,19 @@
+typedef signed long idx_t;
+
+void *xirealloc (void *p, idx_t s)
+  __attribute__ ((__alloc_size__ (2))) __attribute__ ((__returns_nonnull__));
+
+char *
+test_cast_1 (char *buf, idx_t buf_count)
+{
+  return xirealloc (buf, buf_count + 1);
+}
+
+void *alloc_cast_2 (signed char x, signed char y)
+  __attribute__ ((__alloc_size__ (1, 2)));
+
+void *
+test_cast_2 (signed char a, signed char b)
+{
+  return alloc_cast_2 (a + 1, b + 1);
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c b/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c
new file mode 100644
index 0000000..9a33922
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/attr-alloc_size-3.c
@@ -0,0 +1,14 @@
+typedef long int idx_t;
+extern void rpl_free (void *ptr);
+
+void *xicalloc (idx_t n, idx_t s)
+  __attribute__ ((__malloc__))
+  __attribute__ ((__malloc__ (rpl_free, 1)))
+  __attribute__ ((__alloc_size__ (1, 2)))
+  __attribute__ ((__returns_nonnull__));
+
+void *
+xizalloc (idx_t s)
+{
+  return xicalloc (s, 1);
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/explode-4.c b/gcc/testsuite/gcc.dg/analyzer/explode-4.c
new file mode 100644
index 0000000..874b1e9
--- /dev/null
+++ b/gcc/testsuite/gcc.dg/analyzer/explode-4.c
@@ -0,0 +1,157 @@
+/* Regression test for state explosion seen whilst implementing
+   PR analyzer/110426, involving an explosion in the number of
+   conjured_svalues whilst handling a long chain of external
+   function calls.  */
+
+/* { dg-additional-options "-Wno-implicit-function-declaration -Wno-int-conversion -Wno-analyzer-too-complex" } */
+
+#define NULL ((void *)0)
+typedef unsigned char uint8_t;
+typedef unsigned short int uint16_t;
+typedef unsigned int uint32_t;
+typedef struct Error Error;
+typedef struct QEMUTimer QEMUTimer;
+enum libusb_class_code {
+  LIBUSB_CLASS_PER_INTERFACE = 0x00,
+};
+struct libusb_device_descriptor {};
+struct libusb_endpoint_descriptor {
+  uint8_t bEndpointAddress;
+  uint8_t bmAttributes;
+};
+struct libusb_interface_descriptor {
+  uint8_t bNumEndpoints;
+  const struct libusb_endpoint_descriptor *endpoint;
+};
+struct libusb_interface {
+  const struct libusb_interface_descriptor *altsetting;
+};
+struct libusb_config_descriptor {
+  uint8_t bNumInterfaces;
+  const struct libusb_interface *interface;
+};
+typedef struct libusb_context libusb_context;
+typedef struct libusb_device libusb_device;
+typedef struct libusb_device_handle libusb_device_handle;
+enum libusb_speed {
+  LIBUSB_SUCCESS = 0,
+  LIBUSB_TRANSFER_TYPE_BULK = 2U,
+};
+typedef struct USBDevice USBDevice;
+typedef struct USBHostDevice USBHostDevice;
+struct USBAutoFilter {
+  uint32_t bus_num;
+};
+struct USBHostDevice {
+  struct USBAutoFilter match;
+  struct USBHostDevice *tqe_next;
+  int bus_num;
+  int addr;
+  char port[16];
+  libusb_device *dev;
+  libusb_device_handle *dh;
+  struct libusb_device_descriptor ddesc;
+};
+static union { struct USBHostDevice *tqh_first; } hostdevs = {};
+static libusb_context *ctx;
+static void usb_host_ep_update(USBHostDevice *s) {
+  static const char *tname[] = {};
+  USBDevice *udev = USB_DEVICE(s);
+  struct libusb_config_descriptor *conf;
+  const struct libusb_interface_descriptor *intf;
+  const struct libusb_endpoint_descriptor *endp;
+  struct libusb_ss_endpoint_companion_descriptor *endp_ss_comp;
+  uint8_t devep, type;
+  int ep;
+  int rc, i, e;
+  usb_ep_reset(udev);
+  rc = libusb_get_active_config_descriptor(s->dev, &conf);
+  for (i = 0; i < conf->bNumInterfaces; i++) {
+    intf = &conf->interface[i].altsetting[0];
+    trace_usb_host_parse_interface();
+    for (e = 0; e < intf->bNumEndpoints; e++) {
+      endp = &intf->endpoint[e];
+      devep = endp->bEndpointAddress;
+      ep = devep & 0xf;
+      type = endp->bmAttributes & 0x3;
+      if (usb_ep_get_type(udev) != 255) {
+        trace_usb_host_parse_error();
+      }
+      trace_usb_host_parse_endpoint(s->bus_num, s->addr);
+      usb_ep_set_max_packet_size(udev);
+      usb_ep_set_type(udev);
+      usb_ep_set_ifnum(udev);
+      usb_ep_set_halted(udev);
+      if (type == LIBUSB_TRANSFER_TYPE_BULK &&
+          libusb_get_ss_endpoint_companion_descriptor(
+              ctx, endp, &endp_ss_comp) == LIBUSB_SUCCESS) {
+        usb_ep_set_max_streams(udev);
+        libusb_free_ss_endpoint_companion_descriptor(endp_ss_comp);
+      }
+    }
+  }
+}
+static int usb_host_open(USBHostDevice *s, libusb_device *dev, int hostfd) {
+  USBDevice *udev = USB_DEVICE(s);
+  int bus_num = 0;
+  int addr = 0;
+  Error *local_err = NULL;
+  if (dev) {
+    bus_num = libusb_get_bus_number(dev);
+    addr = libusb_get_device_address(dev);
+    trace_usb_host_open_started(bus_num, addr);
+    libusb_open(dev, &s->dh);
+    trace_usb_host_open_hostfd(hostfd);
+    libusb_wrap_sys_device(ctx, &s->dh);
+    dev = libusb_get_device(s->dh);
+    bus_num = libusb_get_bus_number(dev);
+    addr = libusb_get_device_address(dev);
+  }
+  usb_host_detach_kernel(s);
+  libusb_get_device_descriptor(dev, &s->ddesc);
+  usb_host_get_port(s->dev, s->port, sizeof(s->port));
+  usb_ep_init(udev);
+  usb_host_ep_update(s);
+  libusb_get_device_speed(dev);
+  usb_device_attach(udev, &local_err);
+  if (local_err) {
+    error_report_err(local_err);
+    goto fail;
+  }
+  return 0;
+fail:
+  trace_usb_host_open_failure();
+  if (s->dh != NULL) {
+    usb_host_release_interfaces(s);
+    libusb_reset_device(s->dh);
+    usb_host_attach_kernel(s);
+  }
+}
+static QEMUTimer *usb_auto_timer;
+static void usb_host_vm_state(void *unused, _Bool running) {}
+static void usb_host_auto_check(void *unused) {
+  struct USBHostDevice *s;
+  struct USBAutoFilter *f;
+  libusb_device **devs = NULL;
+  struct libusb_device_descriptor ddesc;
+  int i, n;
+  if (usb_host_init() != 0) {
+    n = libusb_get_device_list(ctx, &devs);
+    for (i = 0; i < n; i++) {
+      if (libusb_get_device_descriptor(devs[i], &ddesc) != 0) {
+      }
+      for ((s) = ((&hostdevs)->tqh_first); (s); (s) = ((s)->tqe_next)) {
+        f = &s->match;
+        if (f->bus_num > 0 && f->bus_num != libusb_get_bus_number(devs[i])) {
+        }
+        if (usb_host_open(s, devs[i], 0) < 0) {
+        }
+      }
+    }
+    libusb_free_device_list(devs, 1);
+    qemu_add_vm_change_state_handler(usb_host_vm_state, NULL);
+    timer_new_ms(usb_host_auto_check, NULL);
+    trace_usb_host_auto_scan_enabled();
+  }
+  timer_mod(usb_auto_timer, qemu_clock_get_ms() + 2000);
+}
diff --git a/gcc/testsuite/gcc.dg/analyzer/taint-size-1.c b/gcc/testsuite/gcc.dg/analyzer/taint-size-1.c
index 0b166f7..1fd5fd4 100644
--- a/gcc/testsuite/gcc.dg/analyzer/taint-size-1.c
+++ b/gcc/testsuite/gcc.dg/analyzer/taint-size-1.c
@@ -39,3 +39,13 @@ test_2 (size_t sz)
 {
   memcpy (buf, buf2, sz); /* { dg-warning "use of attacker-controlled value 'sz' as size without upper-bounds checking" } */
 }
+
+/* __attribute__ alloc_size with tainted size.  */
+
+extern void* (*my_alloc)(size_t) __attribute__ ((alloc_size (1)));
+
+void * __attribute__((tainted_args))
+test_attr_alloc_size (size_t sz)
+{
+  return my_alloc (sz); /* { dg-warning "use of attacker-controlled value 'sz' as allocation size without upper-bounds checking" } */
+}