[Bug c/99193] Bogus "should have been deallocated with 'free' but was deallocated with 'realloc' [CWE-762] [-Werror=analyzer-mismatching-deallocation]"

["rjones at redhat dot com" <gcc-bugzilla@gcc.gnu.org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99193

--- Comment #3 from Richard W.M. Jones <rjones at redhat dot com> ---
This seems to be the same thing at a different place in the code:

https://github.com/libguestfs/libguestfs/blob/f19fd566f6387ce7e4d82409528c9dde374d25e0/df/main.c#L404

  CC       virt_df-main.o
main.c: In function 'make_display_name':
main.c:404:11: error: 'ret' should have been deallocated with 'free' but was
deallocated with 'realloc' [CWE-762]
[-Werror=analyzer-mismatching-deallocation]
  404 |     ret = realloc (ret, len + pluses + 1);
      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  'make_display_name': event 1
    |
    |  378 | make_display_name (struct drv *drvs)
    |      | ^~~~~~~~~~~~~~~~~
    |      | |
    |      | (1) entry to 'make_display_name'
    |
  'make_display_name': event 2
    |
    |  382 |   assert (drvs != NULL);
    |      |   ^~~~~~
    |      |   |
    |      |   (2) following 'true' branch (when 'drvs' is non-NULL)...
    |
  'make_display_name': events 3-4
    |
    |  385 |   if (drvs->next == NULL)
    |      |   ^~ ~
    |      |   |  |
    |      |   |  (4) following 'false' branch...
    |      |   (3) ...to here
    |
  'make_display_name': event 5
    |
    |cc1:
    | (5): ...to here
    |
  'make_display_name': events 6-8
    |
    |  396 |     while (drvs->next != NULL) {
    |      |                       ^
    |      |                       |
    |      |                       (6) following 'true' branch...
    |  397 |       drvs = drvs->next;
    |      |       ~~~~             
    |      |       |
    |      |       (7) ...to here
    |......
    |  401 |     ret = single_drive_display_name (drvs);
    |      |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |           |
    |      |           (8) calling 'single_drive_display_name' from
'make_display_name'
    |
    +--> 'single_drive_display_name': event 9
           |
           |  322 | single_drive_display_name (struct drv *drvs)
           |      | ^~~~~~~~~~~~~~~~~~~~~~~~~
           |      | |
           |      | (9) entry to 'single_drive_display_name'
           |
         'single_drive_display_name': event 10
           |
           |  327 |   assert (drvs != NULL);
           |      |   ^~~~~~
           |      |   |
           |      |   (10) following 'true' branch (when 'drvs' is non-NULL)...
           |
         'single_drive_display_name': event 11
           |
           |  328 |   assert (drvs->next == NULL);
           |      |   ^~~~~~
           |      |   |
           |      |   (11) ...to here
           |
         'single_drive_display_name': event 12
           |
           |  328 |   assert (drvs->next == NULL);
           |      |   ^~~~~~
           |      |   |
           |      |   (12) following 'true' branch...
           |
         'single_drive_display_name': events 13-19
           |
           |  330 |   switch (drvs->type) {
           |      |   ^~~~~~
           |      |   |
           |      |   (13) ...to here
           |      |   (14) following 'case 1:' branch...
           |......
           |  342 |   case drv_uri:
           |      |   ~~~~
           |      |   |
           |      |   (15) ...to here
           |  343 |     name = strdup (drvs->uri.orig_uri);
           |  344 |     if (name == NULL)
           |      |        ~
           |      |        |
           |      |        (16) following 'false' branch (when 'name' is
non-NULL)...
           |......
           |  349 |     p = strrchr (name, '/');
           |      |     ~
           |      |     |
           |      |     (17) ...to here
           |......
           |  370 |   if (!name)
           |      |      ~
           |      |      |
           |      |      (18) following 'false' branch (when 'name' is
non-NULL)...
           |......
           |  373 |   return name;
           |      |   ~~~~~~
           |      |   |
           |      |   (19) ...to here
           |
    <------+
    |
  'make_display_name': events 20-21
    |
    |  401 |     ret = single_drive_display_name (drvs);
    |      |           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |           |
    |      |           (20) returning to 'make_display_name' from
'single_drive_display_name'
    |......
    |  404 |     ret = realloc (ret, len + pluses + 1);
    |      |           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    |      |           |
    |      |           (21) deallocated with 'realloc' here
    |
cc1: all warnings being treated as errors