[Bug analyzer/113333] analyzer: False positives with calloc()

["dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113333

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-01-11
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this bug.

Looking at trunk with:

extern void __analyzer_describe (int verbosity, ...);
extern void __analyzer_eval (int);

#include <stdlib.h>
char **f(void) {
    char **vec = calloc(1, sizeof(char *));
    if (vec)
        {
           char **p=vec;       
          __analyzer_describe (0, p);
          __analyzer_describe (0, *p);
          __analyzer_eval (*p == 0);
        }
    return vec;
}

https://gcc.godbolt.org/z/z3vnxbTaT

source>: In function 'f':
<source>:10:11: warning: svalue: '&HEAP_ALLOCATED_REGION(14)'
   10 |           __analyzer_describe (0, p);
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:11:11: warning: svalue: 'CAST(char *, REPEATED(outer_size: (long
unsigned int)8, inner_val: (char)0))'
   11 |           __analyzer_describe (0, *p);
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~
<source>:12:11: warning: UNKNOWN
   12 |           __analyzer_eval (*p == 0);
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~

i.e. the analyzer "sees" that *p is the 0-byte repeated 8 times, cast to a char
*, but doesn't simplify that to just a NULL pointer.

I'm looking at a fix.