analyzer: handle function attribute "alloc_size" [PR110426]

This patch makes -fanalyzer make use of the function attribute
"alloc_size", allowing -fanalyzer to emit -Wanalyzer-allocation-size,
-Wanalyzer-out-of-bounds, and -Wanalyzer-tainted-allocation-size on
execution paths involving allocations using such functions.

gcc/analyzer/ChangeLog:
	PR analyzer/110426
	* bounds-checking.cc (region_model::check_region_bounds): Handle
	symbolic base regions.
	* call-details.cc: Include "stringpool.h" and "attribs.h".
	(call_details::lookup_function_attribute): New function.
	* call-details.h (call_details::lookup_function_attribute): New
	function decl.
	* region-model-manager.cc
	(region_model_manager::maybe_fold_binop): Add reference to
	PR analyzer/110902.
	* region-model-reachability.cc (reachable_regions::handle_sval):
	Add symbolic regions for pointers that are conjured svalues for
	the LHS of a stmt.
	* region-model.cc (region_model::canonicalize): Purge dynamic
	extents for regions that aren't referenced.
	(get_result_size_in_bytes): New function.
	(region_model::on_call_pre): Use get_result_size_in_bytes and
	potentially set the dynamic extents of the region pointed to by
	the return value.
	(region_model::deref_rvalue): Add param "add_nonnull_constraint"
	and use it to conditionalize adding the constraint.
	(pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
	param to both ctors and use it to initialize new "m_stmt" field.
	(pending_diagnostic_subclass::operator==): Use m_stmt; don't use
	m_lhs or m_rhs.
	(pending_diagnostic_subclass::m_stmt): New field.
	(region_model::check_region_size): Generalize to any kind of
	pointer svalue by using deref_rvalue rather than checking for
	region_svalue.  Pass stmt to dubious_allocation_size ctor.
	* region-model.h (region_model::deref_rvalue): Add param
	"add_nonnull_constraint".
	* svalue.cc (conjured_svalue::lhs_value_p): New function.
	* svalue.h (conjured_svalue::lhs_value_p): New decl.

gcc/testsuite/ChangeLog:
	PR analyzer/110426
	* gcc.dg/analyzer/allocation-size-1.c: Update expected message to
	reflect consolidation of size and assignment into a single event.
	* gcc.dg/analyzer/allocation-size-2.c: Likewise.
	* gcc.dg/analyzer/allocation-size-3.c: Likewise.
	* gcc.dg/analyzer/allocation-size-4.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-1.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-2.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-3.c: Likewise.
	* gcc.dg/analyzer/attr-alloc_size-1.c: New test.
	* gcc.dg/analyzer/attr-alloc_size-2.c: New test.
	* gcc.dg/analyzer/attr-alloc_size-3.c: New test.
	* gcc.dg/analyzer/explode-4.c: New test.
	* gcc.dg/analyzer/taint-size-1.c: Add test coverage for
	__attribute__ alloc_size.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

1 files changed, 21 insertions, 0 deletions

diff --git a/gcc/analyzer/region-model-reachability.cc b/gcc/analyzer/region-model-reachability.cc
index a5c12f4..1c747e1 100644
--- a/gcc/analyzer/region-model-reachability.cc
+++ b/gcc/analyzer/region-model-reachability.cc
@@ -184,6 +184,27 @@ reachable_regions::handle_sval (const svalue *sval)
 	}
       add (pointee, ptr_is_mutable);
     }
+  else if (sval->get_type ()
+	   && TREE_CODE (sval->get_type ()) == POINTER_TYPE
+	   && sval->get_kind () == SK_CONJURED)
+    {
+      /* Also add symbolic regions for pointers, but only for conjured svalues
+	 for the LHS of a stmt.  Doing it for more leads to state explosions
+	 on chains of calls to external functions, due to each conjured svalue
+	 potentially being modified at each successive call, recursively.  */
+      const conjured_svalue *conjured_sval = (const conjured_svalue *)sval;
+      if (conjured_sval->lhs_value_p ())
+	{
+	  const region *pointee
+	    = m_model->get_manager ()->get_symbolic_region (sval);
+	  /* Use const-ness of pointer type to affect mutability.  */
+	  bool ptr_is_mutable = true;
+	  if (TYPE_READONLY (TREE_TYPE (sval->get_type ())))
+	    ptr_is_mutable = false;
+	  add (pointee, ptr_is_mutable);
+	}
+    }
+
   /* Treat all svalues within a compound_svalue as reachable.  */
   if (const compound_svalue *compound_sval
       = sval->dyn_cast_compound_svalue ())