analyzer: handle function attribute "alloc_size" [PR110426]

This patch makes -fanalyzer make use of the function attribute
"alloc_size", allowing -fanalyzer to emit -Wanalyzer-allocation-size,
-Wanalyzer-out-of-bounds, and -Wanalyzer-tainted-allocation-size on
execution paths involving allocations using such functions.

gcc/analyzer/ChangeLog:
	PR analyzer/110426
	* bounds-checking.cc (region_model::check_region_bounds): Handle
	symbolic base regions.
	* call-details.cc: Include "stringpool.h" and "attribs.h".
	(call_details::lookup_function_attribute): New function.
	* call-details.h (call_details::lookup_function_attribute): New
	function decl.
	* region-model-manager.cc
	(region_model_manager::maybe_fold_binop): Add reference to
	PR analyzer/110902.
	* region-model-reachability.cc (reachable_regions::handle_sval):
	Add symbolic regions for pointers that are conjured svalues for
	the LHS of a stmt.
	* region-model.cc (region_model::canonicalize): Purge dynamic
	extents for regions that aren't referenced.
	(get_result_size_in_bytes): New function.
	(region_model::on_call_pre): Use get_result_size_in_bytes and
	potentially set the dynamic extents of the region pointed to by
	the return value.
	(region_model::deref_rvalue): Add param "add_nonnull_constraint"
	and use it to conditionalize adding the constraint.
	(pending_diagnostic_subclass::dubious_allocation_size): Add "stmt"
	param to both ctors and use it to initialize new "m_stmt" field.
	(pending_diagnostic_subclass::operator==): Use m_stmt; don't use
	m_lhs or m_rhs.
	(pending_diagnostic_subclass::m_stmt): New field.
	(region_model::check_region_size): Generalize to any kind of
	pointer svalue by using deref_rvalue rather than checking for
	region_svalue.  Pass stmt to dubious_allocation_size ctor.
	* region-model.h (region_model::deref_rvalue): Add param
	"add_nonnull_constraint".
	* svalue.cc (conjured_svalue::lhs_value_p): New function.
	* svalue.h (conjured_svalue::lhs_value_p): New decl.

gcc/testsuite/ChangeLog:
	PR analyzer/110426
	* gcc.dg/analyzer/allocation-size-1.c: Update expected message to
	reflect consolidation of size and assignment into a single event.
	* gcc.dg/analyzer/allocation-size-2.c: Likewise.
	* gcc.dg/analyzer/allocation-size-3.c: Likewise.
	* gcc.dg/analyzer/allocation-size-4.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-1.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-2.c: Likewise.
	* gcc.dg/analyzer/allocation-size-multiline-3.c: Likewise.
	* gcc.dg/analyzer/attr-alloc_size-1.c: New test.
	* gcc.dg/analyzer/attr-alloc_size-2.c: New test.
	* gcc.dg/analyzer/attr-alloc_size-3.c: New test.
	* gcc.dg/analyzer/explode-4.c: New test.
	* gcc.dg/analyzer/taint-size-1.c: Add test coverage for
	__attribute__ alloc_size.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

9 files changed, 155 insertions, 27 deletions

diff --git a/gcc/analyzer/bounds-checking.cc b/gcc/analyzer/bounds-checking.cc
index 5e8de9a..f49cf7c 100644
--- a/gcc/analyzer/bounds-checking.cc
+++ b/gcc/analyzer/bounds-checking.cc
@@ -981,12 +981,6 @@ region_model::check_region_bounds (const region *reg,
   region_offset reg_offset = reg->get_offset (m_mgr);
   const region *base_reg = reg_offset.get_base_region ();
 
-  /* Bail out on symbolic regions.
-     (e.g. because the analyzer did not see previous offsets on the latter,
-     it might think that a negative access is before the buffer).  */
-  if (base_reg->symbolic_p ())
-	  return true;
-
   /* Find out how many bytes were accessed.  */
   const svalue *num_bytes_sval = reg->get_byte_size_sval (m_mgr);
   tree num_bytes_tree = maybe_get_integer_cst_tree (num_bytes_sval);
@@ -1010,9 +1004,9 @@ region_model::check_region_bounds (const region *reg,
     offset = wi::sext (reg_offset.get_bit_offset () >> LOG2_BITS_PER_UNIT,
 		       TYPE_PRECISION (size_type_node));
 
-  /* If either the offset or the number of bytes accessed are symbolic,
-     we have to reason about symbolic values.  */
-  if (reg_offset.symbolic_p () || !num_bytes_tree)
+  /* If any of the base region, the offset, or the number of bytes accessed
+     are symbolic, we have to reason about symbolic values.  */
+  if (base_reg->symbolic_p () || reg_offset.symbolic_p () || !num_bytes_tree)
     {
       const svalue* byte_offset_sval;
       if (!reg_offset.symbolic_p ())
diff --git a/gcc/analyzer/call-details.cc b/gcc/analyzer/call-details.cc
index 17edaf2..793317e 100644
--- a/gcc/analyzer/call-details.cc
+++ b/gcc/analyzer/call-details.cc
@@ -34,6 +34,8 @@ along with GCC; see the file COPYING3.  If not see
 #include "gimple-pretty-print.h"
 #include "analyzer/region-model.h"
 #include "analyzer/call-details.h"
+#include "stringpool.h"
+#include "attribs.h"
 
 #if ENABLE_ANALYZER
 
@@ -226,6 +228,25 @@ call_details::get_or_create_conjured_svalue (const region *reg) const
 					     conjured_purge (m_model, m_ctxt));
 }
 
+/* Look for a function attribute with name ATTR_NAME on the called
+   function (or on its type).
+   Return the attribute if one is found, otherwise return NULL_TREE.  */
+
+tree
+call_details::lookup_function_attribute (const char *attr_name) const
+{
+  tree allocfntype;
+  if (tree fndecl = get_fndecl_for_call ())
+    allocfntype = TREE_TYPE (fndecl);
+  else
+    allocfntype = gimple_call_fntype (m_call);
+
+  if (!allocfntype)
+    return NULL_TREE;
+
+  return lookup_attribute (attr_name, TYPE_ATTRIBUTES (allocfntype));
+}
+
 } // namespace ana
 
 #endif /* #if ENABLE_ANALYZER */
diff --git a/gcc/analyzer/call-details.h b/gcc/analyzer/call-details.h
index 14a206f..25ea554 100644
--- a/gcc/analyzer/call-details.h
+++ b/gcc/analyzer/call-details.h
@@ -64,6 +64,8 @@ public:
 
   const svalue *get_or_create_conjured_svalue (const region *) const;
 
+  tree lookup_function_attribute (const char *attr_name) const;
+
 private:
   const gcall *m_call;
   region_model *m_model;
diff --git a/gcc/analyzer/region-model-manager.cc b/gcc/analyzer/region-model-manager.cc
index 46d271a..65b7190 100644
--- a/gcc/analyzer/region-model-manager.cc
+++ b/gcc/analyzer/region-model-manager.cc
@@ -654,6 +654,8 @@ region_model_manager::maybe_fold_binop (tree type, enum tree_code op,
 	return get_or_create_constant_svalue (build_int_cst (type, 0));
       /* (VAL * 1) -> VAL.  */
       if (cst1 && integer_onep (cst1))
+	/* TODO: we ought to have a cast to TYPE here, but doing so introduces
+	   regressions; see PR analyzer/110902.  */
 	return arg0;
       break;
     case BIT_AND_EXPR:
diff --git a/gcc/analyzer/region-model-reachability.cc b/gcc/analyzer/region-model-reachability.cc
index a5c12f4..1c747e1 100644
--- a/gcc/analyzer/region-model-reachability.cc
+++ b/gcc/analyzer/region-model-reachability.cc
@@ -184,6 +184,27 @@ reachable_regions::handle_sval (const svalue *sval)
 	}
       add (pointee, ptr_is_mutable);
     }
+  else if (sval->get_type ()
+	   && TREE_CODE (sval->get_type ()) == POINTER_TYPE
+	   && sval->get_kind () == SK_CONJURED)
+    {
+      /* Also add symbolic regions for pointers, but only for conjured svalues
+	 for the LHS of a stmt.  Doing it for more leads to state explosions
+	 on chains of calls to external functions, due to each conjured svalue
+	 potentially being modified at each successive call, recursively.  */
+      const conjured_svalue *conjured_sval = (const conjured_svalue *)sval;
+      if (conjured_sval->lhs_value_p ())
+	{
+	  const region *pointee
+	    = m_model->get_manager ()->get_symbolic_region (sval);
+	  /* Use const-ness of pointer type to affect mutability.  */
+	  bool ptr_is_mutable = true;
+	  if (TYPE_READONLY (TREE_TYPE (sval->get_type ())))
+	    ptr_is_mutable = false;
+	  add (pointee, ptr_is_mutable);
+	}
+    }
+
   /* Treat all svalues within a compound_svalue as reachable.  */
   if (const compound_svalue *compound_sval
       = sval->dyn_cast_compound_svalue ())
diff --git a/gcc/analyzer/region-model.cc b/gcc/analyzer/region-model.cc
index 5ed735d..e92b3f7 100644
--- a/gcc/analyzer/region-model.cc
+++ b/gcc/analyzer/region-model.cc
@@ -441,6 +441,29 @@ region_model::canonicalize ()
 {
   m_store.canonicalize (m_mgr->get_store_manager ());
   m_constraints->canonicalize ();
+
+  if (!m_dynamic_extents.is_empty ())
+    {
+      /* Purge any dynamic extents for regions that aren't referenced.
+	 Normally these are eliminated when leaks are detected, but we
+	 can also gain stray heap_allocated_regions that aren't seen
+	 by the leak-detection code.  This happens when
+	 region_model::on_call_pre provides a default result for a
+	 function with both attributes "malloc" and "alloc_size" that
+	 also has a known_function implementation.
+	 Purge dynamic extent information for such regions.  */
+      auto_bitmap referenced_base_region_ids;
+      get_referenced_base_regions (referenced_base_region_ids);
+      auto_vec<const region *> purgable_dyn_extents;
+      for (auto iter : m_dynamic_extents)
+	{
+	  const region *reg = iter.first;
+	  if (!bitmap_bit_p (referenced_base_region_ids, reg->get_id ()))
+	    purgable_dyn_extents.safe_push (reg);
+	}
+      for (auto reg : purgable_dyn_extents)
+	m_dynamic_extents.remove (reg);
+    }
 }
 
 /* Return true if this region_model is in canonical form.  */
@@ -1462,6 +1485,48 @@ region_model::get_known_function (enum internal_fn ifn) const
   return known_fn_mgr->get_internal_fn (ifn);
 }
 
+/* Look for attribute "alloc_size" on the called function and, if found,
+   return a symbolic value of type size_type_node for the allocation size
+   based on the call's parameters.
+   Otherwise, return null.  */
+
+static const svalue *
+get_result_size_in_bytes (const call_details &cd)
+{
+  const tree attr = cd.lookup_function_attribute ("alloc_size");
+  if (!attr)
+    return nullptr;
+
+  const tree atval_1 = TREE_VALUE (attr);
+  if (!atval_1)
+    return nullptr;
+
+  unsigned argidx1 = TREE_INT_CST_LOW (TREE_VALUE (atval_1)) - 1;
+  if (cd.num_args () <= argidx1)
+    return nullptr;
+
+  const svalue *sval_arg1 = cd.get_arg_svalue (argidx1);
+
+  if (const tree atval_2 = TREE_CHAIN (atval_1))
+    {
+      /* Two arguments.  */
+      unsigned argidx2 = TREE_INT_CST_LOW (TREE_VALUE (atval_2)) - 1;
+      if (cd.num_args () <= argidx2)
+	return nullptr;
+      const svalue *sval_arg2 = cd.get_arg_svalue (argidx2);
+      /* TODO: ideally we shouldn't need this cast here;
+	 see PR analyzer/110902.  */
+      return cd.get_manager ()->get_or_create_cast
+	(size_type_node,
+	 cd.get_manager ()->get_or_create_binop (size_type_node,
+						 MULT_EXPR,
+						 sval_arg1, sval_arg2));
+    }
+  else
+    /* Single argument.  */
+    return cd.get_manager ()->get_or_create_cast (size_type_node, sval_arg1);
+}
+
 /* Update this model for the CALL stmt, using CTXT to report any
    diagnostics - the first half.
 
@@ -1522,6 +1587,11 @@ region_model::on_call_pre (const gcall *call, region_model_context *ctxt)
 							 lhs_region,
 							 conjured_purge (this,
 									 ctxt));
+	  if (const svalue *size_in_bytes = get_result_size_in_bytes (cd))
+	    {
+	      const region *reg = deref_rvalue (sval, NULL_TREE, ctxt, false);
+	      set_dynamic_extents (reg, size_in_bytes, ctxt);
+	    }
 	}
       set_value (lhs_region, sval, ctxt);
     }
@@ -2461,7 +2531,8 @@ region_model::region_exists_p (const region *reg) const
 
 const region *
 region_model::deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
-			    region_model_context *ctxt) const
+			    region_model_context *ctxt,
+			    bool add_nonnull_constraint) const
 {
   gcc_assert (ptr_sval);
   gcc_assert (POINTER_TYPE_P (ptr_sval->get_type ()));
@@ -2471,9 +2542,13 @@ region_model::deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
      -Wanalyzer-null-dereference for the case where we later have an
      if (PTR_SVAL) that would occur if we considered the false branch
      and transitioned the malloc state machine from start->null.  */
-  tree null_ptr_cst = build_int_cst (ptr_sval->get_type (), 0);
-  const svalue *null_ptr = m_mgr->get_or_create_constant_svalue (null_ptr_cst);
-  m_constraints->add_constraint (ptr_sval, NE_EXPR, null_ptr);
+  if (add_nonnull_constraint)
+    {
+      tree null_ptr_cst = build_int_cst (ptr_sval->get_type (), 0);
+      const svalue *null_ptr
+	= m_mgr->get_or_create_constant_svalue (null_ptr_cst);
+      m_constraints->add_constraint (ptr_sval, NE_EXPR, null_ptr);
+    }
 
   switch (ptr_sval->get_kind ())
     {
@@ -2851,14 +2926,15 @@ class dubious_allocation_size
 : public pending_diagnostic_subclass<dubious_allocation_size>
 {
 public:
-  dubious_allocation_size (const region *lhs, const region *rhs)
-  : m_lhs (lhs), m_rhs (rhs), m_expr (NULL_TREE),
+  dubious_allocation_size (const region *lhs, const region *rhs,
+			   const gimple *stmt)
+  : m_lhs (lhs), m_rhs (rhs), m_expr (NULL_TREE), m_stmt (stmt),
     m_has_allocation_event (false)
   {}
 
   dubious_allocation_size (const region *lhs, const region *rhs,
-			   tree expr)
-  : m_lhs (lhs), m_rhs (rhs), m_expr (expr),
+			   tree expr, const gimple *stmt)
+  : m_lhs (lhs), m_rhs (rhs), m_expr (expr), m_stmt (stmt),
     m_has_allocation_event (false)
   {}
 
@@ -2869,8 +2945,8 @@ public:
 
   bool operator== (const dubious_allocation_size &other) const
   {
-    return m_lhs == other.m_lhs && m_rhs == other.m_rhs
-	   && pending_diagnostic::same_tree_p (m_expr, other.m_expr);
+    return (m_stmt == other.m_stmt
+	    && pending_diagnostic::same_tree_p (m_expr, other.m_expr));
   }
 
   int get_controlling_option () const final override
@@ -2940,6 +3016,7 @@ private:
   const region *m_lhs;
   const region *m_rhs;
   const tree m_expr;
+  const gimple *m_stmt;
   bool m_has_allocation_event;
 };
 
@@ -3139,10 +3216,6 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
   if (!is_any_cast_p (ctxt->get_stmt ()))
     return;
 
-  const region_svalue *reg_sval = dyn_cast <const region_svalue *> (rhs_sval);
-  if (!reg_sval)
-    return;
-
   tree pointer_type = lhs_reg->get_type ();
   if (pointer_type == NULL_TREE || !POINTER_TYPE_P (pointer_type))
     return;
@@ -3167,7 +3240,7 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
       || integer_onep (pointee_size_tree))
     return;
 
-  const region *rhs_reg = reg_sval->get_pointee ();
+  const region *rhs_reg = deref_rvalue (rhs_sval, NULL_TREE, ctxt, false);
   const svalue *capacity = get_capacity (rhs_reg);
   switch (capacity->get_kind ())
     {
@@ -3180,7 +3253,8 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
 	    && !capacity_compatible_with_type (cst_cap, pointee_size_tree,
 					       is_struct))
 	  ctxt->warn (make_unique <dubious_allocation_size> (lhs_reg, rhs_reg,
-							     cst_cap));
+							     cst_cap,
+							     ctxt->get_stmt ()));
       }
       break;
     default:
@@ -3193,7 +3267,8 @@ region_model::check_region_size (const region *lhs_reg, const svalue *rhs_sval,
 		tree expr = get_representative_tree (capacity);
 		ctxt->warn (make_unique <dubious_allocation_size> (lhs_reg,
 								   rhs_reg,
-								   expr));
+								   expr,
+								   ctxt->get_stmt ()));
 	      }
 	  }
       break;
diff --git a/gcc/analyzer/region-model.h b/gcc/analyzer/region-model.h
index d6d9615..0cf3871 100644
--- a/gcc/analyzer/region-model.h
+++ b/gcc/analyzer/region-model.h
@@ -352,7 +352,8 @@ class region_model
   const svalue *get_rvalue (tree expr, region_model_context *ctxt) const;
 
   const region *deref_rvalue (const svalue *ptr_sval, tree ptr_tree,
-			       region_model_context *ctxt) const;
+			      region_model_context *ctxt,
+			      bool add_nonnull_constraint = true) const;
 
   const svalue *get_rvalue_for_bits (tree type,
 				     const region *reg,
diff --git a/gcc/analyzer/svalue.cc b/gcc/analyzer/svalue.cc
index 5d5c80f..064627f 100644
--- a/gcc/analyzer/svalue.cc
+++ b/gcc/analyzer/svalue.cc
@@ -1940,6 +1940,17 @@ conjured_svalue::accept (visitor *v) const
   v->visit_conjured_svalue (this);
 }
 
+/* Return true iff this conjured_svalue is for the LHS of the
+   stmt that conjured it.  */
+
+bool
+conjured_svalue::lhs_value_p () const
+{
+  if (tree decl = m_id_reg->maybe_get_decl ())
+    return decl == gimple_get_lhs (m_stmt);
+  return false;
+}
+
 /* class asm_output_svalue : public svalue.  */
 
 /* Implementation of svalue::dump_to_pp vfunc for asm_output_svalue.  */
diff --git a/gcc/analyzer/svalue.h b/gcc/analyzer/svalue.h
index fbb1018..5492b1e 100644
--- a/gcc/analyzer/svalue.h
+++ b/gcc/analyzer/svalue.h
@@ -1411,6 +1411,7 @@ public:
 
   const gimple *get_stmt () const { return m_stmt; }
   const region *get_id_region () const { return m_id_reg; }
+  bool lhs_value_p () const;
 
  private:
   const gimple *m_stmt;