analyzer: provide placeholder implementation of sprintf

Previously, the analyzer lacked a known_function implementation of
sprintf, and thus would handle calls to sprintf with the "anything could
happen" fallback.

Whilst working on PR analyzer/107565 I noticed that this was preventing
a lot of genuine memory leaks from being reported for Doom; fixing
thusly.

Integration testing of the effect of the patch shows a big increase in
true positives due to the case mentioned in Doom, and one new false
positive (in pcre2), which I'm tracking as PR analyzer/109014.

Comparison:
  GOOD:  67 -> 123 (+56); 10.91% -> 18.33%
   BAD: 547 -> 548 (+1)

where the affected warnings/projects are:

  -Wanalyzer-malloc-leak:
    GOOD:  0 -> 56 (+56);  0.00% -> 41.48%
     BAD: 79
      True positives: 0 -> 56 (+56)
        (all in Doom)

  -Wanalyzer-use-of-uninitialized-value:
    GOOD: 0;  0.00%
     BAD: 80 -> 81 (+1)
      False positives:
        pcre2-10.42: 0 -> 1 (+1)

gcc/analyzer/ChangeLog:
	* kf.cc (class kf_sprintf): New.
	(register_known_functions): Register it.

gcc/testsuite/ChangeLog:
	* gcc.dg/analyzer/doom-d_main-IdentifyVersion.c: New test.
	* gcc.dg/analyzer/sprintf-1.c: New test.
	* gcc.dg/analyzer/sprintf-concat.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

1 files changed, 29 insertions, 0 deletions

diff --git a/gcc/analyzer/kf.cc b/gcc/analyzer/kf.cc
index ed5f703..93c4663 100644
--- a/gcc/analyzer/kf.cc
+++ b/gcc/analyzer/kf.cc
@@ -778,6 +778,34 @@ kf_strchr::impl_call_post (const call_details &cd) const
     }
 }
 
+/* Handler for "sprintf".
+     int sprintf(char *str, const char *format, ...);
+*/
+
+class kf_sprintf : public known_function
+{
+public:
+  bool matches_call_types_p (const call_details &cd) const final override
+  {
+    return (cd.num_args () >= 2
+	    && cd.arg_is_pointer_p (0)
+	    && cd.arg_is_pointer_p (1));
+  }
+
+  void impl_call_pre (const call_details &cd) const final override
+  {
+    /* For now, merely assume that the destination buffer gets set to a
+       new svalue.  */
+    region_model *model = cd.get_model ();
+    region_model_context *ctxt = cd.get_ctxt ();
+    const svalue *dst_ptr = cd.get_arg_svalue (0);
+    const region *dst_reg
+      = model->deref_rvalue (dst_ptr, cd.get_arg_tree (0), ctxt);
+    const svalue *content = cd.get_or_create_conjured_svalue (dst_reg);
+    model->set_value (dst_reg, content, ctxt);
+  }
+};
+
 /* Handler for "__builtin_stack_restore".  */
 
 class kf_stack_restore : public known_function
@@ -990,6 +1018,7 @@ register_known_functions (known_function_manager &kfm)
     kfm.add (BUILT_IN_MEMSET, make_unique<kf_memset> ());
     kfm.add (BUILT_IN_MEMSET_CHK, make_unique<kf_memset> ());
     kfm.add (BUILT_IN_REALLOC, make_unique<kf_realloc> ());
+    kfm.add (BUILT_IN_SPRINTF, make_unique<kf_sprintf> ());
     kfm.add (BUILT_IN_STACK_RESTORE, make_unique<kf_stack_restore> ());
     kfm.add (BUILT_IN_STACK_SAVE, make_unique<kf_stack_save> ());
     kfm.add (BUILT_IN_STRCHR, make_unique<kf_strchr> ());