analyzer: out-of-bounds checker [PR106000]

This patch adds an experimental out-of-bounds checker to the analyzer.

The checker was tested on coreutils, curl, httpd and openssh. It is mostly
accurate but does produce false-positives on yacc-generated files and
sometimes when the analyzer misses an invariant. These cases will be
documented in bugzilla.
Regression-tested on Linux x86-64, further ran the analyzer tests with
the -m32 option.

2022-08-11  Tim Lange  <mail@tim-lange.me>

gcc/analyzer/ChangeLog:

	PR analyzer/106000
	* analyzer.opt: Add Wanalyzer-out-of-bounds.
	* region-model.cc (class out_of_bounds): Diagnostics base class
	for all out-of-bounds diagnostics.
	(class past_the_end): Base class derived from out_of_bounds for
	the buffer_overflow and buffer_overread diagnostics.
	(class buffer_overflow): Buffer overflow diagnostics.
	(class buffer_overread): Buffer overread diagnostics.
	(class buffer_underflow): Buffer underflow diagnostics.
	(class buffer_underread): Buffer overread diagnostics.
	(region_model::check_region_bounds): New function to check region
	bounds for out-of-bounds accesses.
	(region_model::check_region_access):
	Add call to check_region_bounds.
	(region_model::get_representative_tree): New function that accepts
	a region instead of an svalue.
	* region-model.h (class region_model):
	Add region_model::check_region_bounds.
	* region.cc (region::symbolic_p): New predicate.
	(offset_region::get_byte_size_sval): Only return the remaining
	byte size on offset_regions.
	* region.h: Add region::symbolic_p.
	* store.cc (byte_range::intersects_p):
	Add new function equivalent to bit_range::intersects_p.
	(byte_range::exceeds_p): New function.
	(byte_range::falls_short_of_p): New function.
	* store.h (struct byte_range): Add byte_range::intersects_p,
	byte_range::exceeds_p and byte_range::falls_short_of_p.

gcc/ChangeLog:

	PR analyzer/106000
	* doc/invoke.texi: Add Wanalyzer-out-of-bounds.

gcc/testsuite/ChangeLog:

	PR analyzer/106000
	* g++.dg/analyzer/pr100244.C: Disable out-of-bounds warning.
	* gcc.dg/analyzer/allocation-size-3.c:
	Disable out-of-bounds warning.
	* gcc.dg/analyzer/memcpy-2.c: Disable out-of-bounds warning.
	* gcc.dg/analyzer/pr101962.c: Add dg-warning.
	* gcc.dg/analyzer/pr96764.c: Disable out-of-bounds warning.
	* gcc.dg/analyzer/pr97029.c:
	Add dummy buffer to prevent an out-of-bounds warning.
	* gcc.dg/analyzer/realloc-5.c: Add dg-warning.
	* gcc.dg/analyzer/test-setjmp.h:
	Add dummy buffer to prevent an out-of-bounds warning.
	* gcc.dg/analyzer/zlib-3.c: Add dg-bogus.
	* g++.dg/analyzer/out-of-bounds-placement-new.C: New test.
	* gcc.dg/analyzer/out-of-bounds-1.c: New test.
	* gcc.dg/analyzer/out-of-bounds-2.c: New test.
	* gcc.dg/analyzer/out-of-bounds-3.c: New test.
	* gcc.dg/analyzer/out-of-bounds-container_of.c: New test.
	* gcc.dg/analyzer/out-of-bounds-coreutils.c: New test.
	* gcc.dg/analyzer/out-of-bounds-curl.c: New test.

1 files changed, 4 insertions, 0 deletions

diff --git a/gcc/analyzer/region.h b/gcc/analyzer/region.h
index a5b3029..20dffc7 100644
--- a/gcc/analyzer/region.h
+++ b/gcc/analyzer/region.h
@@ -211,6 +211,8 @@ public:
 
   bool symbolic_for_unknown_ptr_p () const;
 
+  bool symbolic_p () const;
+
   /* For most base regions it makes sense to track the bindings of the region
      within the store.  As an optimization, some are not tracked (to avoid
      bloating the store object with redundant binding clusters).  */
@@ -917,6 +919,8 @@ public:
   const svalue *get_byte_offset () const { return m_byte_offset; }
 
   bool get_relative_concrete_offset (bit_offset_t *out) const final override;
+  const svalue * get_byte_size_sval (region_model_manager *mgr) const;
+
 
 private:
   const svalue *m_byte_offset;