[Bug c/103872] New: testcase fail in gcc.dg/analyzer/pr103526.c on riscv64-unknown-elf-gcc

["shihua at iscas dot ac.cn" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103872

            Bug ID: 103872
           Summary: testcase fail in gcc.dg/analyzer/pr103526.c on
                    riscv64-unknown-elf-gcc
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: shihua at iscas dot ac.cn
  Target Milestone: ---

analyzer can not properly detects the non-free'd pointer as escaping via the
return value in riscv*-**-gcc



riscv64-unknown-elf-gcc -S -fanalyzer -Wanalyzer-too-complex
-fanalyzer-call-summaries riscv-gcc/gcc/testsuite/gcc.dg/analyzer/pr103526.c
riscv-gcc/gcc/testsuite/gcc.dg/analyzer/pr103526.c: In function 'game_new':
riscv-gcc/gcc/testsuite/gcc.dg/analyzer/pr103526.c:31:1: warning: leak of
'tmp.word_state' [CWE-401] [-Wanalyzer-malloc-leak]
   31 | } /* { dg-bogus "leak" } */
      | ^
  'game_new': events 1-7
    |
    |   20 |         if ((tmp.word_state = malloc(wordlen+1)) == NULL)
    |      |            ~                  ^~~~~~~~~~~~~~~~~
    |      |            |                  |
    |      |            |                  (1) allocated here
    |      |            (2) assuming 'tmp.word_state' is non-NULL
    |      |            (3) following 'false' branch...
    |   21 |                 goto err;
    |   22 |         if ((rval = malloc(sizeof(*rval))) == NULL)
    |      |            ~        ~~~~~~~~~~~~~~~~~~~~~
    |      |            |        |
    |      |            |        (4) ...to here
    |      |            (5) following 'false' branch (when 'rval' is
non-NULL)...
    |   23 |                 goto err;
    |   24 |         memcpy(rval, &tmp, sizeof(*rval));
    |      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |         |
    |      |         (6) ...to here
    |......
    |   31 | } /* { dg-bogus "leak" } */
    |      | ~
    |      | |
    |      | (7) 'tmp.word_state' leaks here; was allocated at (1)
    |