[Bug c/101648] New: False positive -Wanalyzer-malloc-leak when calling a malloc function inside another malloc function

[Bug c/101648] New: False positive -Wanalyzer-malloc-leak when calling a malloc function inside another malloc function

[rajdakin at box86 dot org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101648

            Bug ID: 101648
           Summary: False positive -Wanalyzer-malloc-leak when calling a
                    malloc function inside another malloc function
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rajdakin at box86 dot org
  Target Milestone: ---

Created attachment 51214
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51214&action=edit
File used to reproduce the bug

Output of `LANG=C ../Git/gcc/host-x86_64-pc-linux-gnu/gcc/xgcc -v`:
Using built-in specs.
COLLECT_GCC=../Git/gcc/host-x86_64-pc-linux-gnu/gcc/xgcc
Target: x86_64-pc-linux-gnu
Configured with: ../gcc/configure --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210727 (experimental) (GCC) 

Also tested with installed GCC:
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/local/libexec/gcc/x86_64-pc-linux-gnu/11.1.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc/configure --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.1.0 (GCC) 

Complete command line:
LANG=C gcc -c test.c -o test.o -fanalyzer
-fdiagnostics-path-format=separate-events # for GCC 11.1
LANG=C PATH="../Git/gcc/host-x86_64-pc-linux-gnu/gcc:$PATH"
../Git/gcc/host-x86_64-pc-linux-gnu/gcc/xgcc -c test.c -o test.o -fanalyzer
-fdiagnostics-path-format=separate-events # for GCC 12.0

Note: this also doesn't work with '-O0' or '-O2'.

Output:
test.c: In function 'malloc_like':
test.c:5:16: warning: leak of 'malloc_like()' [CWE-401]
[-Wanalyzer-malloc-leak]
    5 |         return (void*)0;
      |                ^
test.c:8:7: note: (1) entry to 'malloc_wrapper'
    8 | void *malloc_wrapper(void) {
      |       ^~~~~~~~~~~~~~
test.c:9:16: note: (2) allocated here
    9 |         return malloc_like();
      |                ^~~~~~~~~~~~~
test.c:9:16: note: (3) calling 'malloc_like' from 'malloc_wrapper'
test.c:4:7: note: (4) entry to 'malloc_like'
    4 | void *malloc_like(void) {
      |       ^~~~~~~~~~~
test.c:5:16: note: (5) 'malloc_like()' leaks here; was allocated at (2)
    5 |         return (void*)0;
      |                ^

Expected output: No warning

Note: using g++ changes nearly nothing.