[Bug analyzer/103546] Analyzer reports null dereference in flex scanners

[cvs-commit at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103546

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalc...@gcc.gnu.org>:

https://gcc.gnu.org/g:78a17f4452db9514da7cc8706c654cb98ba0a8e6

commit r13-4399-g78a17f4452db9514da7cc8706c654cb98ba0a8e6
Author: David Malcolm <dmalc...@redhat.com>
Date:   Tue Nov 29 19:56:27 2022 -0500

    analyzer work on issues with flex-generated lexers [PR103546]

    PR analyzer/103546 tracks various false positives seen on
    flex-generated lexers.

    Whilst investigating them, I noticed an ICE with
    -fanalyzer-call-summaries due to attempting to store sm-state
    for an UNKNOWN svalue, which this patch fixes.

    This patch also provides known_function implementations of all of the
    external functions called by the lexer, reducing the number of false
    positives.

    The patch doesn't eliminate all false positives, but adds integration
    tests to try to establish a baseline from which the remaining false
    positives can be fixed.

    gcc/analyzer/ChangeLog:
            PR analyzer/103546
            * analyzer.h (register_known_file_functions): New decl.
            * program-state.cc (sm_state_map::replay_call_summary): Rejct
            attempts to store sm-state for caller_sval that can't have
            associated state.
            * region-model-impl-calls.cc (register_known_functions): Call
            register_known_file_functions.
            * sm-fd.cc (class kf_isatty): New.
            (register_known_fd_functions): Register it.
            * sm-file.cc (class kf_ferror): New.
            (class kf_fileno): New.
            (class kf_getc): New.
            (register_known_file_functions): New.

    gcc/ChangeLog:
            PR analyzer/103546
            * doc/invoke.texi (Static Analyzer Options): Add isatty, ferror,
            fileno, and getc to the list of functions known to the analyzer.

    gcc/testsuite/ChangeLog:
            PR analyzer/103546
            * gcc.dg/analyzer/ferror-1.c: New test.
            * gcc.dg/analyzer/fileno-1.c: New test.
            * gcc.dg/analyzer/flex-with-call-summaries.c: New test.
            * gcc.dg/analyzer/flex-without-call-summaries.c: New test.
            * gcc.dg/analyzer/getc-1.c: New test.
            * gcc.dg/analyzer/isatty-1.c: New test.

    Signed-off-by: David Malcolm <dmalc...@redhat.com>