analyzer: new warning: -Wanalyzer-undefined-behavior-ptrdiff (PR analyzer/105892)

Add a new warning to complain about pointer subtraction involving
different chunks of memory.

For example, given:

  #include <stddef.h>

  int arr[42];
  int sentinel;

  ptrdiff_t
  test_invalid_calc_of_array_size (void)
  {
    return &sentinel - arr;
  }

this emits:

demo.c: In function ‘test_invalid_calc_of_array_size’:
demo.c:9:20: warning: undefined behavior when subtracting pointers [CWE-469] [-Wanalyzer-undefined-behavior-ptrdiff]
    9 |   return &sentinel - arr;
      |                    ^
  events 1-2
    │
    │    3 | int arr[42];
    │      |     ~~~
    │      |     |
    │      |     (2) underlying object for right-hand side of subtraction created here
    │    4 | int sentinel;
    │      |     ^~~~~~~~
    │      |     |
    │      |     (1) underlying object for left-hand side of subtraction created here
    │
    └──> ‘test_invalid_calc_of_array_size’: event 3
           │
           │    9 |   return &sentinel - arr;
           │      |                    ^
           │      |                    |
           │      |                    (3) ⚠️  subtraction of pointers has undefined behavior if they do not point into the same array object
           │

gcc/analyzer/ChangeLog:
	PR analyzer/105892
	* analyzer.opt (Wanalyzer-undefined-behavior-ptrdiff): New option.
	* analyzer.opt.urls: Regenerate.
	* region-model.cc (class undefined_ptrdiff_diagnostic): New.
	(check_for_invalid_ptrdiff): New.
	(region_model::get_gassign_result): Call it for POINTER_DIFF_EXPR.

gcc/ChangeLog:
	* doc/invoke.texi: Add -Wanalyzer-undefined-behavior-ptrdiff.

gcc/testsuite/ChangeLog:
	PR analyzer/105892
	* c-c++-common/analyzer/out-of-bounds-pr110387.c: Add
	expected warnings about pointer subtraction.
	* c-c++-common/analyzer/ptr-subtraction-1.c: New test.
	* c-c++-common/analyzer/ptr-subtraction-CWE-469-example.c: New test.

Signed-off-by: David Malcolm <dmalcolm@redhat.com>

0 files changed, 0 insertions, 0 deletions