[Bug analyzer/98247] Analyzer fails to detect certain out-of-bounds uses of flexible array members

["dmalcolm at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98247

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
            Summary|RFE: detect Flexible Array  |Analyzer fails to detect
                   |Member misuse in analyzer   |certain out-of-bounds uses
                   |                            |of flexible array members
   Last reconfirmed|                            |2022-09-09
             Status|UNCONFIRMED                 |NEW
            Version|11.0                        |13.0

--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
The above patch adds test coverage for various uses of the flexible array
member idiom, inspired by your test case above (thanks!)

It adds one xfail; in test_symbolic_size_oob, where there's a false negative,
where it fails to complain about this code:

struct str *
test_symbolic_size_oob (size_t len)
{
  /* Forgetting to add space for the trailing array.  */
  struct str *str = malloc(sizeof(str));
  if (str) {
    str->len = len;
    memset(str->data, 'x', len); /* { dg-warning "heap-based buffer overflow"
"PR analyzer/98247" { xfail *-*-* } } */
    // TODO(xfail): we don't yet complain about this case, which occurs when
len > 0
    return str;
  }
  return NULL;
}

I'm going to repurpose this bug to track fixing that false negative; updating
subject accordingly.