[PATCH 01/27] backupfile: improve -fanalyzer malloc checking

[PATCH 01/27] backupfile: improve -fanalyzer malloc checking

[Paul Eggert]

* lib/backup-internal.h, lib/backupfile.h:
Add malloc-related attributes and include stdlib.h as needed.
---
 ChangeLog             | 6 ++++++
 lib/backup-internal.h | 4 +++-
 lib/backupfile.h      | 9 +++++++--
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 21fbc52e3..f63846d2b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2021-08-01  Paul Eggert  <eggert@cs.ucla.edu>
+
+	maint: improve -fanalyzer malloc checking
+	* lib/backup-internal.h, lib/backupfile.h:
+	Add malloc-related attributes and include stdlib.h as needed.
+
 2021-08-01  Jim Meyering  <meyering@fb.com>
 
 	regex: pacify GCC 11.2.1's -fanalyzer
diff --git a/lib/backup-internal.h b/lib/backup-internal.h
index 701618220..863cc004e 100644
--- a/lib/backup-internal.h
+++ b/lib/backup-internal.h
@@ -17,5 +17,7 @@
 
 #include "backupfile.h"
 #include <stdbool.h>
+#include <stdlib.h>
 
-extern char *backupfile_internal (int, char const *, enum backup_type, bool);
+extern char *backupfile_internal (int, char const *, enum backup_type, bool)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
diff --git a/lib/backupfile.h b/lib/backupfile.h
index 349477064..fc77329fe 100644
--- a/lib/backupfile.h
+++ b/lib/backupfile.h
@@ -22,6 +22,8 @@
 /* Get AT_FDCWD, as a convenience for users of this file.  */
 #include <fcntl.h>
 
+#include <stdlib.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -50,8 +52,11 @@ enum backup_type
 extern char const *simple_backup_suffix;
 
 void set_simple_backup_suffix (char const *);
-char *backup_file_rename (int, char const *, enum backup_type);
-char *find_backup_file_name (int, char const *, enum backup_type);
+char *backup_file_rename (int, char const *, enum backup_type)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
+char *find_backup_file_name (int, char const *, enum backup_type)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 enum backup_type get_version (char const *context, char const *arg);
 enum backup_type xget_version (char const *context, char const *arg);
 
-- 
2.31.1

[PATCH 02/27] maint: improve -fanalyzer malloc checking

[Paul Eggert]

* lib/canonicalize.h:
---
 ChangeLog          | 1 +
 lib/canonicalize.h | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index f63846d2b..1af0b926a 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,7 @@
 
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
+	* lib/canonicalize.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 
 2021-08-01  Jim Meyering  <meyering@fb.com>
diff --git a/lib/canonicalize.h b/lib/canonicalize.h
index f3054d42f..1f7a5fdff 100644
--- a/lib/canonicalize.h
+++ b/lib/canonicalize.h
@@ -48,7 +48,8 @@ typedef enum canonicalize_mode_t canonicalize_mode_t;
    Whether components must exist or not depends on canonicalize mode.
    The result is malloc'd.
    Upon failure, return NULL with errno set.  */
-char *canonicalize_filename_mode (const char *, canonicalize_mode_t);
+char *canonicalize_filename_mode (const char *, canonicalize_mode_t)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 
 #ifdef __cplusplus
 }
-- 
2.31.1

[PATCH 03/27] dfa: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog |  5 ++++-
 lib/dfa.c | 15 +++++++++++++++
 lib/dfa.h |  9 +++++++--
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 1af0b926a..d7740df52 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,8 +2,11 @@
 
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
-	* lib/canonicalize.h:
+	* lib/canonicalize.h, lib/dfa.h:
 	Add malloc-related attributes and include stdlib.h as needed.
+	* lib/dfa.c: Include verify.h.
+	(assume_nonnull): New macro.
+	(dfamust): Use it to pacify GCC.
 
 2021-08-01  Jim Meyering  <meyering@fb.com>
 
diff --git a/lib/dfa.c b/lib/dfa.c
index 7e05a78da..44c3b65c2 100644
--- a/lib/dfa.c
+++ b/lib/dfa.c
@@ -26,6 +26,7 @@
 
 #include "flexmember.h"
 #include "idx.h"
+#include "verify.h"
 
 #include <assert.h>
 #include <ctype.h>
@@ -35,6 +36,13 @@
 #include <limits.h>
 #include <string.h>
 
+/* Pacify gcc -Wanalyzer-null-dereference in areas where GCC
+   understandably cannot deduce that the input comes from a
+   well-formed regular expression.  There's little point to the
+   runtime overhead of 'assert' instead of 'assume_nonnull' when the
+   MMU will check anyway.  */
+#define assume_nonnull(x) assume ((x) != NULL)
+
 static bool
 streq (char const *a, char const *b)
 {
@@ -4090,6 +4098,7 @@ dfamust (struct dfa const *d)
 
         case STAR:
         case QMARK:
+          assume_nonnull (mp);
           resetmust (mp);
           break;
 
@@ -4097,7 +4106,9 @@ dfamust (struct dfa const *d)
           {
             char **new;
             must *rmp = mp;
+            assume_nonnull (rmp);
             must *lmp = mp = mp->prev;
+            assume_nonnull (lmp);
             idx_t j, ln, rn, n;
 
             /* Guaranteed to be.  Unlikely, but ...  */
@@ -4138,10 +4149,12 @@ dfamust (struct dfa const *d)
           break;
 
         case PLUS:
+          assume_nonnull (mp);
           mp->is[0] = '\0';
           break;
 
         case END:
+          assume_nonnull (mp);
           assert (!mp->prev);
           for (idx_t i = 0; mp->in[i] != NULL; i++)
             if (strlen (mp->in[i]) > strlen (result))
@@ -4159,7 +4172,9 @@ dfamust (struct dfa const *d)
         case CAT:
           {
             must *rmp = mp;
+            assume_nonnull (rmp);
             must *lmp = mp = mp->prev;
+            assume_nonnull (lmp);
 
             /* In.  Everything in left, plus everything in
                right, plus concatenation of
diff --git a/lib/dfa.h b/lib/dfa.h
index 19a4127b6..28f9f6336 100644
--- a/lib/dfa.h
+++ b/lib/dfa.h
@@ -24,6 +24,7 @@
 #include <regex.h>
 #include <stdbool.h>
 #include <stddef.h>
+#include <stdlib.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -46,7 +47,9 @@ struct dfa;
 
 /* Needed when Gnulib is not used.  */
 #ifndef _GL_ATTRIBUTE_MALLOC
-# define  _GL_ATTRIBUTE_MALLOC
+# define _GL_ATTRIBUTE_MALLOC
+# define _GL_ATTRIBUTE_DEALLOC_FREE
+# define _GL_ATTRIBUTE_RETURNS_NONNULL
 #endif
 
 /* Entry points. */
@@ -55,7 +58,9 @@ struct dfa;
    It should be initialized via dfasyntax or dfacopysyntax before other use.
    The returned pointer should be passed directly to free() after
    calling dfafree() on it. */
-extern struct dfa *dfaalloc (void) _GL_ATTRIBUTE_MALLOC;
+extern struct dfa *dfaalloc (void)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 /* DFA options that can be ORed together, for dfasyntax's 4th arg.  */
 enum
-- 
2.31.1

[PATCH 04/27] dirname: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog     |  2 +-
 lib/dirname.h | 12 +++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index d7740df52..884443438 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,7 +2,7 @@
 
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
-	* lib/canonicalize.h, lib/dfa.h:
+	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/dirname.h b/lib/dirname.h
index 492a4381f..04f823eca 100644
--- a/lib/dirname.h
+++ b/lib/dirname.h
@@ -21,6 +21,7 @@
 
 # include <stdbool.h>
 # include <stddef.h>
+# include <stdlib.h>
 # include "filename.h"
 # include "basename-lgpl.h"
 
@@ -33,11 +34,16 @@ extern "C" {
 #endif
 
 # if GNULIB_DIRNAME
-char *base_name (char const *file) _GL_ATTRIBUTE_MALLOC;
-char *dir_name (char const *file);
+char *base_name (char const *file)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
+char *dir_name (char const *file)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 # endif
 
-char *mdir_name (char const *file);
+char *mdir_name (char const *file)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 size_t dir_len (char const *file) _GL_ATTRIBUTE_PURE;
 
 bool strip_trailing_slashes (char *file);
-- 
2.31.1

[PATCH 05/27] exclude: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog     | 2 +-
 lib/exclude.h | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 884443438..bac4c5fcc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,7 +2,7 @@
 
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
-	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h:
+	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/exclude.h b/lib/exclude.h
index 9ecfbc985..8d6581afa 100644
--- a/lib/exclude.h
+++ b/lib/exclude.h
@@ -48,8 +48,11 @@ struct exclude;
 
 bool fnmatch_pattern_has_wildcards (const char *, int) _GL_ATTRIBUTE_PURE;
 
-struct exclude *new_exclude (void) _GL_ATTRIBUTE_MALLOC;
-void free_exclude (struct exclude *);
+void free_exclude (struct exclude *)
+  _GL_ATTRIBUTE_NONNULL ((1));
+struct exclude *new_exclude (void)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_RETURNS_NONNULL
+  _GL_ATTRIBUTE_DEALLOC (free_exclude, 1);
 void add_exclude (struct exclude *, char const *, int);
 int add_exclude_file (void (*) (struct exclude *, char const *, int),
                       struct exclude *, char const *, int, char);
-- 
2.31.1

[PATCH 06/27] filenamecat-lgpl: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog         | 1 +
 lib/filenamecat.h | 9 +++++++--
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index bac4c5fcc..6bad8ceb6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,6 +3,7 @@
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
+	* lib/filenamecat.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/filenamecat.h b/lib/filenamecat.h
index e2ff46659..e5acb1588 100644
--- a/lib/filenamecat.h
+++ b/lib/filenamecat.h
@@ -18,10 +18,15 @@
 
 /* Written by Jim Meyering.  */
 
+#include <stdlib.h>
+
 #if GNULIB_FILENAMECAT
 char *file_name_concat (char const *dir, char const *base,
-                        char **base_in_result);
+                        char **base_in_result)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 #endif
 
 char *mfile_name_concat (char const *dir, char const *base,
-                         char **base_in_result);
+                         char **base_in_result)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
-- 
2.31.1

[PATCH 07/27] malloca: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog     |  5 ++++-
 lib/malloca.c | 18 ++++++++++++------
 lib/malloca.h |  5 ++++-
 3 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 6bad8ceb6..166618a42 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,11 +3,14 @@
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
-	* lib/filenamecat.h:
+	* lib/filenamecat.h, lib/malloca.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
 	(dfamust): Use it to pacify GCC.
+	* lib/malloca.c (mmalloca): Redo to pacify GCC, to cut down on the
+	number of casts, and to avoid signed integer overflow on
+	theoretical platforms.
 
 2021-08-01  Jim Meyering  <meyering@fb.com>
 
diff --git a/lib/malloca.c b/lib/malloca.c
index d7ad095b5..b4884234a 100644
--- a/lib/malloca.c
+++ b/lib/malloca.c
@@ -47,7 +47,8 @@ mmalloca (size_t n)
 #if HAVE_ALLOCA
   /* Allocate one more word, used to determine the address to pass to freea(),
      and room for the alignment ≡ sa_alignment_max mod 2*sa_alignment_max.  */
-  int plus = sizeof (small_t) + 2 * sa_alignment_max - 1;
+  uintptr_t alignment2_mask = 2 * sa_alignment_max - 1;
+  int plus = sizeof (small_t) + alignment2_mask;
   idx_t nplus;
   if (!INT_ADD_WRAPV (n, plus, &nplus) && !xalloc_oversized (nplus, 1))
     {
@@ -55,16 +56,21 @@ mmalloca (size_t n)
 
       if (mem != NULL)
         {
-          char *p =
-            (char *)((((uintptr_t)mem + sizeof (small_t) + sa_alignment_max - 1)
-                      & ~(uintptr_t)(2 * sa_alignment_max - 1))
-                     + sa_alignment_max);
+          uintptr_t umem = (uintptr_t)mem, umemplus;
+          /* The INT_ADD_WRAPV avoids signed integer overflow on
+             theoretical platforms where UINTPTR_MAX <= INT_MAX.  */
+          INT_ADD_WRAPV (umem, sizeof (small_t) + sa_alignment_max - 1,
+                         &umemplus);
+          idx_t offset = ((umemplus & ~alignment2_mask)
+                          + sa_alignment_max - umem);
+          void *vp = mem + offset;
+          small_t *p = vp;
           /* Here p >= mem + sizeof (small_t),
              and p <= mem + sizeof (small_t) + 2 * sa_alignment_max - 1
              hence p + n <= mem + nplus.
              So, the memory range [p, p+n) lies in the allocated memory range
              [mem, mem + nplus).  */
-          ((small_t *) p)[-1] = p - mem;
+          p[-1] = offset;
           /* p ≡ sa_alignment_max mod 2*sa_alignment_max.  */
           return p;
         }
diff --git a/lib/malloca.h b/lib/malloca.h
index 6fa1d8b20..dbbec3f06 100644
--- a/lib/malloca.h
+++ b/lib/malloca.h
@@ -65,7 +65,6 @@ extern "C" {
 # define malloca(N) \
   mmalloca (N)
 #endif
-extern void * mmalloca (size_t n);
 
 /* Free a block of memory allocated through malloca().  */
 #if HAVE_ALLOCA
@@ -74,6 +73,10 @@ extern void freea (void *p);
 # define freea free
 #endif
 
+extern void *mmalloca (size_t n)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC (freea, 1)
+  _GL_ATTRIBUTE_ALLOC_SIZE ((1));
+
 /* nmalloca(N,S) is an overflow-safe variant of malloca (N * S).
    It allocates an array of N objects, each with S bytes of memory,
    on the stack.  N and S should be nonnegative and free of side effects.
-- 
2.31.1

[PATCH 08/27] modechange: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog        | 2 +-
 lib/modechange.h | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 166618a42..dded7f275 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -3,7 +3,7 @@
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
-	* lib/filenamecat.h, lib/malloca.h:
+	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/modechange.h b/lib/modechange.h
index 9029fbc61..e32b3c916 100644
--- a/lib/modechange.h
+++ b/lib/modechange.h
@@ -20,10 +20,13 @@
 # define MODECHANGE_H_
 
 # include <stdbool.h>
+# include <stdlib.h>
 # include <sys/types.h>
 
-struct mode_change *mode_compile (const char *);
-struct mode_change *mode_create_from_ref (const char *);
+struct mode_change *mode_compile (const char *)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
+struct mode_change *mode_create_from_ref (const char *)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 mode_t mode_adjust (mode_t, bool, mode_t, struct mode_change const *,
                     mode_t *);
 
-- 
2.31.1

[PATCH 09/27] mountlist: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog       | 1 +
 lib/mountlist.h | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index dded7f275..f130f9317 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,6 +4,7 @@
 	* lib/backup-internal.h, lib/backupfile.h:
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
+	* lib/mountlist.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/mountlist.h b/lib/mountlist.h
index 66dbb1aba..fbad12461 100644
--- a/lib/mountlist.h
+++ b/lib/mountlist.h
@@ -37,7 +37,8 @@ struct mount_entry
   struct mount_entry *me_next;
 };
 
-struct mount_entry *read_file_system_list (bool need_fs_type);
+struct mount_entry *read_file_system_list (bool need_fs_type)
+  _GL_ATTRIBUTE_MALLOC;
 void free_mount_entry (struct mount_entry *entry);
 
 #endif
-- 
2.31.1

[PATCH 10/27] pagalign_alloc: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog             |  2 +-
 lib/pagealign_alloc.h | 17 ++++++++++-------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f130f9317..e3573cee2 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,7 +4,7 @@
 	* lib/backup-internal.h, lib/backupfile.h:
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
-	* lib/mountlist.h:
+	* lib/mountlist.h, lib/pagealign_alloc.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/pagealign_alloc.h b/lib/pagealign_alloc.h
index 387d5aa04..eb2d4e0df 100644
--- a/lib/pagealign_alloc.h
+++ b/lib/pagealign_alloc.h
@@ -20,6 +20,12 @@
 
 # include <stddef.h>
 
+/* Free a memory block.
+   PTR must be a non-NULL pointer returned by pagealign_alloc or
+   pagealign_xalloc.  */
+extern void pagealign_free (void *ptr)
+  _GL_ATTRIBUTE_NONNULL ((1));
+
 /* Allocate a block of memory of SIZE bytes, aligned on a system page
    boundary.
    If SIZE is not a multiple of the system page size, it will be rounded up
@@ -27,16 +33,13 @@
    Return a pointer to the start of the memory block. Upon allocation failure,
    return NULL and set errno.  */
 extern void *pagealign_alloc (size_t size)
-     _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_ALLOC_SIZE ((1));
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC (pagealign_free, 1)
+  _GL_ATTRIBUTE_ALLOC_SIZE ((1));
 
 /* Like pagealign_alloc, except it exits the program if the allocation
    fails.  */
 extern void *pagealign_xalloc (size_t size)
-     _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_ALLOC_SIZE ((1));
-
-/* Free a memory block.
-   PTR must be a non-NULL pointer returned by pagealign_alloc or
-   pagealign_xalloc.  */
-extern void pagealign_free (void *ptr);
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC (pagealign_free, 1)
+  _GL_ATTRIBUTE_ALLOC_SIZE ((1)) _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 #endif /* _PAGEALIGN_ALLOC_H */
-- 
2.31.1

[PATCH 11/27] quotearg: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog      | 2 +-
 lib/quotearg.h | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index e3573cee2..8a3dcb388 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -4,7 +4,7 @@
 	* lib/backup-internal.h, lib/backupfile.h:
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
-	* lib/mountlist.h, lib/pagealign_alloc.h:
+	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/quotearg.h b/lib/quotearg.h
index ecef74f74..22c09bcea 100644
--- a/lib/quotearg.h
+++ b/lib/quotearg.h
@@ -333,7 +333,9 @@ size_t quotearg_buffer (char *restrict buffer, size_t buffersize,
    buffer.  It is the caller's responsibility to free the result.  The
    result will not contain embedded null bytes.  */
 char *quotearg_alloc (char const *arg, size_t argsize,
-                      struct quoting_options const *o);
+                      struct quoting_options const *o)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 /* Like quotearg_alloc, except that the length of the result,
    excluding the terminating null byte, is stored into SIZE if it is
@@ -342,7 +344,10 @@ char *quotearg_alloc (char const *arg, size_t argsize,
    backslash escapes, and the flags of O do not request elision of
    null bytes.*/
 char *quotearg_alloc_mem (char const *arg, size_t argsize,
-                          size_t *size, struct quoting_options const *o);
+                          size_t *size, struct quoting_options const *o)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
+;
 
 /* Use storage slot N to return a quoted version of the string ARG.
    Use the default quoting options.
-- 
2.31.1

[PATCH 12/27] readutmp: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog      | 1 +
 lib/readutmp.h | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 8a3dcb388..11c4395b9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,6 +5,7 @@
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
+	* lib/readutmp.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/readutmp.h b/lib/readutmp.h
index a3a7eda01..5be981802 100644
--- a/lib/readutmp.h
+++ b/lib/readutmp.h
@@ -20,6 +20,7 @@
 #ifndef __READUTMP_H__
 # define __READUTMP_H__
 
+# include <stdlib.h>
 # include <sys/types.h>
 
 /* AIX 4.3.3 has both utmp.h and utmpx.h, but only struct utmp
@@ -211,7 +212,9 @@ enum
     READ_UTMP_USER_PROCESS = 2
   };
 
-char *extract_trimmed_name (const STRUCT_UTMP *ut);
+char *extract_trimmed_name (const STRUCT_UTMP *ut)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 /* FIXME: This header should use idx_t, not size_t.  */
 int read_utmp (char const *file, size_t *n_entries, STRUCT_UTMP **utmp_buf,
-- 
2.31.1

[PATCH 13/27] savedir: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog     | 2 +-
 lib/savedir.h | 7 +++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 11c4395b9..45fd8cad5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,7 +5,7 @@
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
-	* lib/readutmp.h:
+	* lib/readutmp.h, lib/savedir.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/savedir.h b/lib/savedir.h
index 65cc15af1..12dabdb11 100644
--- a/lib/savedir.h
+++ b/lib/savedir.h
@@ -22,6 +22,7 @@
 #define _GL_SAVEDIR_H
 
 #include <dirent.h>
+#include <stdlib.h>
 
 enum savedir_option
   {
@@ -35,7 +36,9 @@ enum savedir_option
 #endif
   };
 
-char *streamsavedir (DIR *, enum savedir_option);
-char *savedir (char const *, enum savedir_option);
+char *streamsavedir (DIR *, enum savedir_option)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
+char *savedir (char const *, enum savedir_option)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 
 #endif
-- 
2.31.1

[PATCH 14/27] sh-quote: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog      | 2 +-
 lib/sh-quote.h | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 45fd8cad5..6c81691fb 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,7 +5,7 @@
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
-	* lib/readutmp.h, lib/savedir.h:
+	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/sh-quote.h b/lib/sh-quote.h
index e543e4063..0101036e5 100644
--- a/lib/sh-quote.h
+++ b/lib/sh-quote.h
@@ -23,6 +23,7 @@
    "$", '*', '?' etc. in a special way.  */
 
 #include <stddef.h>
+#include <stdlib.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -36,11 +37,15 @@ extern size_t shell_quote_length (const char *string);
 extern char * shell_quote_copy (char *restrict p, const char *string);
 
 /* Returns the freshly allocated quoted string.  */
-extern char * shell_quote (const char *string);
+extern char * shell_quote (const char *string)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 /* Returns a freshly allocated string containing all argument strings, quoted,
    separated through spaces.  */
-extern char * shell_quote_argv (const char * const *argv);
+extern char * shell_quote_argv (const char * const *argv)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 #ifdef __cplusplus
 }
-- 
2.31.1

[PATCH 15/27] system-quote: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog          | 2 +-
 lib/system-quote.h | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 6c81691fb..7ef3676a6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -5,7 +5,7 @@
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
-	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h:
+	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/system-quote.h b/lib/system-quote.h
index f378950e9..b1bbf6521 100644
--- a/lib/system-quote.h
+++ b/lib/system-quote.h
@@ -47,6 +47,7 @@
  */
 
 #include <stddef.h>
+#include <stdlib.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -84,13 +85,17 @@ extern char *
 /* Returns the freshly allocated quoted string.  */
 extern char *
        system_quote (enum system_command_interpreter interpreter,
-                     const char *string);
+                     const char *string)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 /* Returns a freshly allocated string containing all argument strings, quoted,
    separated through spaces.  */
 extern char *
        system_quote_argv (enum system_command_interpreter interpreter,
-                          char * const *argv);
+                          char * const *argv)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
 
 #ifdef __cplusplus
 }
-- 
2.31.1

[PATCH 16/27] trim: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog  | 1 +
 lib/trim.h | 6 +++++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index 7ef3676a6..eef494f38 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,7 @@
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
+	* lib/trim.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/trim.h b/lib/trim.h
index dc886e568..761b8a67d 100644
--- a/lib/trim.h
+++ b/lib/trim.h
@@ -16,6 +16,8 @@
 
 /* Written by Davide Angelocola <davide.angelocola@gmail.com> */
 
+#include <stdlib.h>
+
 /* Trim mode. */
 #define TRIM_TRAILING 0
 #define TRIM_LEADING 1
@@ -30,4 +32,6 @@
 /* Removes leading whitespaces. */
 #define trim_leading(s) trim2(s, TRIM_LEADING)
 
-char *trim2 (const char *, int);
+char *trim2 (const char *, int)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
+  _GL_ATTRIBUTE_RETURNS_NONNULL;
-- 
2.31.1

[PATCH 17/27] xgetcwd: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog     | 2 +-
 lib/xgetcwd.h | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index eef494f38..fa2b09d2d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,7 +6,7 @@
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
-	* lib/trim.h:
+	* lib/trim.h, lib/xgetcwd.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/xgetcwd.h b/lib/xgetcwd.h
index 98d1d1a4f..eca195e8e 100644
--- a/lib/xgetcwd.h
+++ b/lib/xgetcwd.h
@@ -14,4 +14,7 @@
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
 
-extern char *xgetcwd (void);
+#include <stdlib.h>
+
+extern char *xgetcwd (void)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
-- 
2.31.1

[PATCH 18/27] xgethostname: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog          | 2 +-
 lib/xgethostname.h | 5 ++++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index fa2b09d2d..99d546d9f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,7 +6,7 @@
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
-	* lib/trim.h, lib/xgetcwd.h:
+	* lib/trim.h, lib/xgetcwd.h, lib/xgethostname.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/xgethostname.h b/lib/xgethostname.h
index f4be56268..23d2d61eb 100644
--- a/lib/xgethostname.h
+++ b/lib/xgethostname.h
@@ -15,4 +15,7 @@
    You should have received a copy of the GNU General Public License
    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
 
-char *xgethostname (void);
+#include <stdlib.h>
+
+char *xgethostname (void)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
-- 
2.31.1

[PATCH 19/27] xmalloca: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog      | 2 +-
 lib/xmalloca.h | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 99d546d9f..403e7ecb7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,7 +6,7 @@
 	* lib/filenamecat.h, lib/malloca.h, lib/modechange.h:
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
-	* lib/trim.h, lib/xgetcwd.h, lib/xgethostname.h:
+	* lib/trim.h, lib/xgetcwd.h, lib/xgethostname.h, lib/xmalloca.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/xmalloca.h b/lib/xmalloca.h
index dbc648697..6fec3de61 100644
--- a/lib/xmalloca.h
+++ b/lib/xmalloca.h
@@ -39,7 +39,9 @@ extern "C" {
                 + (2 * sa_alignment_max - 1))                                \
                & ~(uintptr_t)(2 * sa_alignment_max - 1))                     \
    : xmmalloca (N))
-extern void * xmmalloca (size_t n);
+extern void * xmmalloca (size_t n)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC (freea, 1)
+  _GL_ATTRIBUTE_ALLOC_SIZE ((1)) _GL_ATTRIBUTE_RETURNS_NONNULL;
 #else
 # define xmalloca(N) \
   xmalloc (N)
-- 
2.31.1

[PATCH 20/27] xreadlink: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog       | 1 +
 lib/xreadlink.h | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 403e7ecb7..19ca548c7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,6 +7,7 @@
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
 	* lib/trim.h, lib/xgetcwd.h, lib/xgethostname.h, lib/xmalloca.h:
+	* lib/xreadlink.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/xreadlink.h b/lib/xreadlink.h
index ef749babe..fb7cea710 100644
--- a/lib/xreadlink.h
+++ b/lib/xreadlink.h
@@ -18,8 +18,12 @@
 
 /* Written by Jim Meyering <jim@meyering.net>  */
 
-extern char *xreadlink (char const *filename);
+#include <stdlib.h>
+
+extern char *xreadlink (char const *filename)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 
 #if GNULIB_XREADLINKAT
-extern char *xreadlinkat (int fd, char const *filename);
+extern char *xreadlinkat (int fd, char const *filename)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 #endif
-- 
2.31.1

[PATCH 21/27] xstriconv: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog       | 2 +-
 lib/xstriconv.h | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 19ca548c7..aba2b150d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,7 +7,7 @@
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
 	* lib/trim.h, lib/xgetcwd.h, lib/xgethostname.h, lib/xmalloca.h:
-	* lib/xreadlink.h:
+	* lib/xreadlink.h, lib/xstriconv.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/xstriconv.h b/lib/xstriconv.h
index 1f69fa3b2..d90aa4c5c 100644
--- a/lib/xstriconv.h
+++ b/lib/xstriconv.h
@@ -19,6 +19,7 @@
 #define _XSTRICONV_H
 
 #include <stddef.h>
+#include <stdlib.h>
 #if HAVE_ICONV
 #include <iconv.h>
 #endif
@@ -54,7 +55,8 @@ extern int xmem_cd_iconv (const char *src, size_t srclen, iconv_t cd,
    Upon memory allocation failure, report the error and exit.
    Return value: the freshly allocated resulting NUL-terminated string if
    successful, otherwise NULL and errno set.  */
-extern char * xstr_cd_iconv (const char *src, iconv_t cd);
+extern char * xstr_cd_iconv (const char *src, iconv_t cd)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 
 #endif
 
@@ -67,8 +69,8 @@ extern char * xstr_cd_iconv (const char *src, iconv_t cd);
    Return value: the freshly allocated resulting NUL-terminated string if
    successful, otherwise NULL and errno set.  */
 extern char * xstr_iconv (const char *src,
-                          const char *from_codeset, const char *to_codeset);
-
+                          const char *from_codeset, const char *to_codeset)
+  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 
 #ifdef __cplusplus
 }
-- 
2.31.1

[PATCH 22/27] xvasprintf: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog        | 2 +-
 lib/xvasprintf.h | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index aba2b150d..b1b6b4296 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -7,7 +7,7 @@
 	* lib/mountlist.h, lib/pagealign_alloc.h, lib/quotearg.h:
 	* lib/readutmp.h, lib/savedir.h, lib/sh-quote.h, lib/system-quote.h:
 	* lib/trim.h, lib/xgetcwd.h, lib/xgethostname.h, lib/xmalloca.h:
-	* lib/xreadlink.h, lib/xstriconv.h:
+	* lib/xreadlink.h, lib/xstriconv.h, lib/xvasprintf.h:
 	Add malloc-related attributes and include stdlib.h as needed.
 	* lib/dfa.c: Include verify.h.
 	(assume_nonnull): New macro.
diff --git a/lib/xvasprintf.h b/lib/xvasprintf.h
index 4da42c655..aaa7ade55 100644
--- a/lib/xvasprintf.h
+++ b/lib/xvasprintf.h
@@ -23,6 +23,9 @@
 /* Get _GL_ATTRIBUTE_SPEC_PRINTF_STANDARD.  */
 #include <stdio.h>
 
+/* Get 'free'.  */
+#include <stdlib.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -35,8 +38,10 @@ extern "C" {
      - [EILSEQ] error during conversion between wide and multibyte characters,
    return NULL.  */
 extern char *xasprintf (const char *format, ...)
+       _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
        _GL_ATTRIBUTE_FORMAT ((_GL_ATTRIBUTE_SPEC_PRINTF_STANDARD, 1, 2));
 extern char *xvasprintf (const char *format, va_list args)
+       _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
        _GL_ATTRIBUTE_FORMAT ((_GL_ATTRIBUTE_SPEC_PRINTF_STANDARD, 1, 0));
 
 #ifdef __cplusplus
-- 
2.31.1

[PATCH 23/27] vasnprintf: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog        | 2 ++
 lib/vasnprintf.c | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/ChangeLog b/ChangeLog
index b1b6b4296..d67787f42 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,8 @@
 	* lib/malloca.c (mmalloca): Redo to pacify GCC, to cut down on the
 	number of casts, and to avoid signed integer overflow on
 	theoretical platforms.
+	* lib/vasnprintf.c:
+	Disable -Wanalyzer-null-argument here.
 
 2021-08-01  Jim Meyering  <meyering@fb.com>
 
diff --git a/lib/vasnprintf.c b/lib/vasnprintf.c
index 12c532ef4..d9b669d15 100644
--- a/lib/vasnprintf.c
+++ b/lib/vasnprintf.c
@@ -60,6 +60,14 @@
 #ifndef VASNPRINTF
 # include <config.h>
 #endif
+
+/* As of GCC 11.2.1, gcc -Wanalyzer-too-complex reports that main's
+   use of CHECK macros expands to code that is too complicated for gcc
+   -fanalyzer.  Suppress the resulting bogus warnings.  */
+#if 10 <= __GNUC__
+# pragma GCC diagnostic ignored "-Wanalyzer-null-argument"
+#endif
+
 #include <alloca.h>
 
 /* Specification.  */
-- 
2.31.1

[PATCH 24/27] argmatch-tests: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog             | 2 +-
 tests/test-argmatch.c | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/ChangeLog b/ChangeLog
index d67787f42..577d3077e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,7 +15,7 @@
 	* lib/malloca.c (mmalloca): Redo to pacify GCC, to cut down on the
 	number of casts, and to avoid signed integer overflow on
 	theoretical platforms.
-	* lib/vasnprintf.c:
+	* lib/vasnprintf.c, tests/test-argmatch.c:
 	Disable -Wanalyzer-null-argument here.
 
 2021-08-01  Jim Meyering  <meyering@fb.com>
diff --git a/tests/test-argmatch.c b/tests/test-argmatch.c
index a7ea67cef..ef105360b 100644
--- a/tests/test-argmatch.c
+++ b/tests/test-argmatch.c
@@ -19,6 +19,13 @@
 
 #include <config.h>
 
+/* As of GCC 11.2.1, gcc -Wanalyzer-too-complex reports that main's
+   use of CHECK macros expands to code that is too complicated for gcc
+   -fanalyzer.  Suppress the resulting bogus warnings.  */
+#if 10 <= __GNUC__
+# pragma GCC diagnostic ignored "-Wanalyzer-null-argument"
+#endif
+
 #include "argmatch.h"
 
 #include <stdlib.h>
-- 
2.31.1

[PATCH 25/27] manywarnings: improve -fanalyzer malloc checking

[Paul Eggert]

---
 ChangeLog          | 1 +
 m4/manywarnings.m4 | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 577d3077e..f72226809 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -17,6 +17,7 @@
 	theoretical platforms.
 	* lib/vasnprintf.c, tests/test-argmatch.c:
 	Disable -Wanalyzer-null-argument here.
+	* m4/manywarnings.m4: Update GCC bug report number in comment.
 
 2021-08-01  Jim Meyering  <meyering@fb.com>
 
diff --git a/m4/manywarnings.m4 b/m4/manywarnings.m4
index 53ab15340..611484f31 100644
--- a/m4/manywarnings.m4
+++ b/m4/manywarnings.m4
@@ -1,4 +1,4 @@
-# manywarnings.m4 serial 21
+# manywarnings.m4 serial 22
 dnl Copyright (C) 2008-2021 Free Software Foundation, Inc.
 dnl This file is free software; the Free Software Foundation
 dnl gives unlimited permission to copy and/or distribute it,
@@ -198,7 +198,7 @@ AC_DEFUN([gl_MANYWARN_ALL_GCC(C)],
   # Some warnings have too many false alarms in GCC 10.1.
   # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=93695
   gl_AS_VAR_APPEND([$1], [' -Wno-analyzer-double-free'])
-  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94458
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101713  (GCC 11.2.1)
   gl_AS_VAR_APPEND([$1], [' -Wno-analyzer-malloc-leak'])
   # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94851
   gl_AS_VAR_APPEND([$1], [' -Wno-analyzer-null-dereference'])
-- 
2.31.1

[PATCH 26/27] sigsegv-tests: make more things static

[Paul Eggert]

* tests/test-sigsegv-catch-segv1.c:
* tests/test-sigsegv-catch-stackoverflow1.c:
* tests/test-sigsegv-catch-stackoverflow2.c:
Declare some functions and variables static, to pacify GCC when
warning about external functions missing declarations.
---
 ChangeLog                                 |  7 +++++++
 tests/test-sigsegv-catch-segv1.c          |  4 ++--
 tests/test-sigsegv-catch-stackoverflow1.c | 16 ++++++++--------
 tests/test-sigsegv-catch-stackoverflow2.c | 18 +++++++++---------
 4 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index f72226809..f908d4ef5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,12 @@
 2021-08-01  Paul Eggert  <eggert@cs.ucla.edu>
 
+	sigsegv-tests: make more things static
+	* tests/test-sigsegv-catch-segv1.c:
+	* tests/test-sigsegv-catch-stackoverflow1.c:
+	* tests/test-sigsegv-catch-stackoverflow2.c:
+	Declare some functions and variables static, to pacify GCC when
+	warning about external functions missing declarations.
+
 	maint: improve -fanalyzer malloc checking
 	* lib/backup-internal.h, lib/backupfile.h:
 	* lib/canonicalize.h, lib/dfa.h, lib/dirname.h, lib/exclude.h:
diff --git a/tests/test-sigsegv-catch-segv1.c b/tests/test-sigsegv-catch-segv1.c
index 68f65c55c..4f6989efe 100644
--- a/tests/test-sigsegv-catch-segv1.c
+++ b/tests/test-sigsegv-catch-segv1.c
@@ -40,7 +40,7 @@ uintptr_t page;
 
 volatile int handler_called = 0;
 
-int
+static int
 handler (void *fault_address, int serious)
 {
   handler_called++;
@@ -54,7 +54,7 @@ handler (void *fault_address, int serious)
   return 0;
 }
 
-void
+static void
 crasher (uintptr_t p)
 {
   *(volatile int *) (p + 0x678) = 42;
diff --git a/tests/test-sigsegv-catch-stackoverflow1.c b/tests/test-sigsegv-catch-stackoverflow1.c
index 2f1e6f487..3c229975b 100644
--- a/tests/test-sigsegv-catch-stackoverflow1.c
+++ b/tests/test-sigsegv-catch-stackoverflow1.c
@@ -44,13 +44,13 @@
 # endif
 # include "altstack-util.h"
 
-jmp_buf mainloop;
-sigset_t mainsigset;
+static jmp_buf mainloop;
+static sigset_t mainsigset;
 
-volatile int pass = 0;
+static volatile int pass = 0;
 
-volatile char *stack_lower_bound;
-volatile char *stack_upper_bound;
+static volatile char *stack_lower_bound;
+static volatile char *stack_upper_bound;
 
 static void
 stackoverflow_handler_continuation (void *arg1, void *arg2, void *arg3)
@@ -59,7 +59,7 @@ stackoverflow_handler_continuation (void *arg1, void *arg2, void *arg3)
   longjmp (mainloop, arg);
 }
 
-void
+static void
 stackoverflow_handler (int emergency, stackoverflow_context_t scp)
 {
   char dummy;
@@ -73,7 +73,7 @@ stackoverflow_handler (int emergency, stackoverflow_context_t scp)
                          (void *) (long) (emergency ? -1 : pass), NULL, NULL);
 }
 
-volatile int *
+static volatile int *
 recurse_1 (int n, volatile int *p)
 {
   if (n < INT_MAX)
@@ -81,7 +81,7 @@ recurse_1 (int n, volatile int *p)
   return p;
 }
 
-int
+static int
 recurse (volatile int n)
 {
   return *recurse_1 (n, &n);
diff --git a/tests/test-sigsegv-catch-stackoverflow2.c b/tests/test-sigsegv-catch-stackoverflow2.c
index 5914e3250..ea79b96e7 100644
--- a/tests/test-sigsegv-catch-stackoverflow2.c
+++ b/tests/test-sigsegv-catch-stackoverflow2.c
@@ -46,12 +46,12 @@
 # endif
 # include "altstack-util.h"
 
-jmp_buf mainloop;
-sigset_t mainsigset;
+static jmp_buf mainloop;
+static sigset_t mainsigset;
 
-volatile int pass = 0;
-uintptr_t page;
-volatile int *null_pointer_to_volatile_int /* = NULL */;
+static volatile int pass = 0;
+static uintptr_t page;
+static volatile int *null_pointer_to_volatile_int /* = NULL */;
 
 static void
 stackoverflow_handler_continuation (void *arg1, void *arg2, void *arg3)
@@ -60,7 +60,7 @@ stackoverflow_handler_continuation (void *arg1, void *arg2, void *arg3)
   longjmp (mainloop, arg);
 }
 
-void
+static void
 stackoverflow_handler (int emergency, stackoverflow_context_t scp)
 {
   pass++;
@@ -76,7 +76,7 @@ stackoverflow_handler (int emergency, stackoverflow_context_t scp)
                          (void *) (long) (emergency ? -1 : pass), NULL, NULL);
 }
 
-int
+static int
 sigsegv_handler (void *address, int emergency)
 {
   /* This test is necessary to distinguish stack overflow and SIGSEGV.  */
@@ -96,7 +96,7 @@ sigsegv_handler (void *address, int emergency)
                                 (void *) (long) pass, NULL, NULL);
 }
 
-volatile int *
+static volatile int *
 recurse_1 (int n, volatile int *p)
 {
   if (n < INT_MAX)
@@ -104,7 +104,7 @@ recurse_1 (int n, volatile int *p)
   return p;
 }
 
-int
+static int
 recurse (volatile int n)
 {
   return *recurse_1 (n, &n);
-- 
2.31.1

[PATCH 27/27] * lib/quotarg.c: remove wrong, unneeded comment

[Paul Eggert]

---
 lib/quotearg.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/quotearg.c b/lib/quotearg.c
index 570468917..dc4babcb6 100644
--- a/lib/quotearg.c
+++ b/lib/quotearg.c
@@ -787,7 +787,6 @@ quotearg_buffer (char *buffer, size_t buffersize,
   return r;
 }
 
-/* Equivalent to quotearg_alloc (ARG, ARGSIZE, NULL, O).  */
 char *
 quotearg_alloc (char const *arg, size_t argsize,
                 struct quoting_options const *o)
-- 
2.31.1

Re: [PATCH 03/27] dfa: improve -fanalyzer malloc checking

[Bruno Haible]

> +	* lib/canonicalize.h, lib/dfa.h:
>  	Add malloc-related attributes and include stdlib.h as needed.

More can be done in dfa.h:


2021-08-07  Bruno Haible  <bruno@clisp.org>

	dfa: Improve GCC 11 allocation-deallocation checking.
	* lib/dfa.h (dfamust): Declare that deallocation must happen through
	dfamustfree.

diff --git a/lib/dfa.h b/lib/dfa.h
index 28f9f63..edc39dc 100644
--- a/lib/dfa.h
+++ b/lib/dfa.h
@@ -88,13 +88,16 @@ extern void dfacopysyntax (struct dfa *, struct dfa const *);
 /* Parse the given string of given length into the given struct dfa.  */
 extern void dfaparse (char const *, ptrdiff_t, struct dfa *);
 
-/* Allocate and return a struct dfamust from a struct dfa that was
-   initialized by dfaparse and not yet given to dfacomp.  */
-extern struct dfamust *dfamust (struct dfa const *);
+struct dfamust;
 
 /* Free the storage held by the components of a struct dfamust. */
 extern void dfamustfree (struct dfamust *);
 
+/* Allocate and return a struct dfamust from a struct dfa that was
+   initialized by dfaparse and not yet given to dfacomp.  */
+extern struct dfamust *dfamust (struct dfa const *)
+  _GL_ATTRIBUTE_DEALLOC (dfamustfree, 1);
+
 /* Compile the given string of the given length into the given struct dfa.
    The last argument says whether to build a searching or an exact matcher.
    A null first argument means the struct dfa has already been

Re: [PATCH 04/27] dirname: improve -fanalyzer malloc checking

[Bruno Haible]

Paul Eggert wrote:
> diff --git a/lib/dirname.h b/lib/dirname.h
> index 492a4381f..04f823eca 100644
> --- a/lib/dirname.h
> +++ b/lib/dirname.h
> @@ -21,6 +21,7 @@
>  
>  # include <stdbool.h>
>  # include <stddef.h>
> +# include <stdlib.h>
>  # include "filename.h"
>  # include "basename-lgpl.h"
>  

Now that <stdlib.h> is included, the <stddef.h> include is no longer necessary
(since this module does not use 'offsetof' nor 'ptrdiff_t'). Similarly in a
couple of other files.


2021-08-07  Bruno Haible  <bruno@clisp.org>

	dirname-lgpl, sh-quote, system-quote, xstriconv: Clean up includes.
	* lib/dirname.h: Don't include <stddef.h>.
	* lib/sh-quote.h: Likewise.
	* lib/system-quote.h: Likewise.
	* lib/xstriconv.h: Likewise.

diff --git a/lib/dirname.h b/lib/dirname.h
index 04f823e..25abc7b 100644
--- a/lib/dirname.h
+++ b/lib/dirname.h
@@ -20,7 +20,6 @@
 # define DIRNAME_H_ 1
 
 # include <stdbool.h>
-# include <stddef.h>
 # include <stdlib.h>
 # include "filename.h"
 # include "basename-lgpl.h"
diff --git a/lib/sh-quote.h b/lib/sh-quote.h
index 0101036..ab440c6 100644
--- a/lib/sh-quote.h
+++ b/lib/sh-quote.h
@@ -22,7 +22,6 @@
    arguments, since Unix shells interpret characters like " ", "'", "<", ">",
    "$", '*', '?' etc. in a special way.  */
 
-#include <stddef.h>
 #include <stdlib.h>
 
 #ifdef __cplusplus
diff --git a/lib/system-quote.h b/lib/system-quote.h
index b1bbf65..6cfddd0 100644
--- a/lib/system-quote.h
+++ b/lib/system-quote.h
@@ -46,7 +46,6 @@
       is to truncate the entire command line.
  */
 
-#include <stddef.h>
 #include <stdlib.h>
 
 #ifdef __cplusplus
diff --git a/lib/xstriconv.h b/lib/xstriconv.h
index d90aa4c..879a772 100644
--- a/lib/xstriconv.h
+++ b/lib/xstriconv.h
@@ -18,7 +18,6 @@
 #ifndef _XSTRICONV_H
 #define _XSTRICONV_H
 
-#include <stddef.h>
 #include <stdlib.h>
 #if HAVE_ICONV
 #include <iconv.h>
@@ -72,6 +71,7 @@ extern char * xstr_iconv (const char *src,
                           const char *from_codeset, const char *to_codeset)
   _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE;
 
+
 #ifdef __cplusplus
 }
 #endif

Re: [PATCH 07/27] malloca: improve -fanalyzer malloc checking

[Bruno Haible]

Paul Eggert wrote:
> diff --git a/lib/malloca.h b/lib/malloca.h
> index 6fa1d8b20..dbbec3f06 100644
> --- a/lib/malloca.h
> +++ b/lib/malloca.h
> @@ -65,7 +65,6 @@ extern "C" {
>  # define malloca(N) \
>    mmalloca (N)
>  #endif
> -extern void * mmalloca (size_t n);
>  
>  /* Free a block of memory allocated through malloca().  */
>  #if HAVE_ALLOCA
> @@ -74,6 +73,10 @@ extern void freea (void *p);
>  # define freea free
>  #endif
>  
> +extern void *mmalloca (size_t n)
> +  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC (freea, 1)
> +  _GL_ATTRIBUTE_ALLOC_SIZE ((1));
> +
>  /* nmalloca(N,S) is an overflow-safe variant of malloca (N * S).
>     It allocates an array of N objects, each with S bytes of memory,
>     on the stack.  N and S should be nonnegative and free of side effects.

malloca and mmalloca belong close together. I prefer to move the 'freea'
declaration, so that malloca and mmalloca are declared together.


2021-08-07  Bruno Haible  <bruno@clisp.org>

	malloca: Tweak last commit.
	* lib/malloca.h: Keep use and declaration of mmalloca close together.

diff --git a/lib/malloca.h b/lib/malloca.h
index dbbec3f..7eb63d2 100644
--- a/lib/malloca.h
+++ b/lib/malloca.h
@@ -51,6 +51,13 @@ extern "C" {
 # define safe_alloca(N) ((void) (N), NULL)
 #endif
 
+/* Free a block of memory allocated through malloca().  */
+#if HAVE_ALLOCA
+extern void freea (void *p);
+#else
+# define freea free
+#endif
+
 /* malloca(N) is a safe variant of alloca(N).  It allocates N bytes of
    memory allocated on the stack, that must be freed using freea() before
    the function returns.  Upon failure, it returns NULL.  */
@@ -65,14 +72,6 @@ extern "C" {
 # define malloca(N) \
   mmalloca (N)
 #endif
-
-/* Free a block of memory allocated through malloca().  */
-#if HAVE_ALLOCA
-extern void freea (void *p);
-#else
-# define freea free
-#endif
-
 extern void *mmalloca (size_t n)
   _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC (freea, 1)
   _GL_ATTRIBUTE_ALLOC_SIZE ((1));

Re: [PATCH 11/27] quotearg: improve -fanalyzer malloc checking

[Bruno Haible]

Paul Eggert wrote:
> @@ -342,7 +344,10 @@ char *quotearg_alloc (char const *arg, size_t argsize,
>     backslash escapes, and the flags of O do not request elision of
>     null bytes.*/
>  char *quotearg_alloc_mem (char const *arg, size_t argsize,
> -                          size_t *size, struct quoting_options const *o);
> +                          size_t *size, struct quoting_options const *o)
> +  _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
> +  _GL_ATTRIBUTE_RETURNS_NONNULL;
> +;
>  
>  /* Use storage slot N to return a quoted version of the string ARG.
>     Use the default quoting options.
> 

This patch introduced a stray semicolon.


2021-08-07  Bruno Haible  <bruno@clisp.org>

	quotearg: Tweak last commit.
	* lib/quotearg.h: Don't include <stddef.h>. Remove stray semicolon.

diff --git a/lib/quotearg.h b/lib/quotearg.h
index 22c09bc..f5644b8 100644
--- a/lib/quotearg.h
+++ b/lib/quotearg.h
@@ -21,7 +21,6 @@
 #ifndef QUOTEARG_H_
 # define QUOTEARG_H_ 1
 
-# include <stddef.h>
 # include <stdlib.h>
 
 /* Basic quoting styles.  For each style, an example is given on the
@@ -279,6 +278,7 @@ struct quoting_options;
 struct quoting_options *clone_quoting_options (struct quoting_options *o)
   _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
   _GL_ATTRIBUTE_RETURNS_NONNULL;
+
 /* Get the value of O's quoting style.  If O is null, use the default.  */
 enum quoting_style get_quoting_style (struct quoting_options const *o);
 
@@ -347,7 +347,6 @@ char *quotearg_alloc_mem (char const *arg, size_t argsize,
                           size_t *size, struct quoting_options const *o)
   _GL_ATTRIBUTE_MALLOC _GL_ATTRIBUTE_DEALLOC_FREE
   _GL_ATTRIBUTE_RETURNS_NONNULL;
-;
 
 /* Use storage slot N to return a quoted version of the string ARG.
    Use the default quoting options.

Re: [PATCH 26/27] sigsegv-tests: make more things static

[Bruno Haible]

Paul Eggert wrote:
> * tests/test-sigsegv-catch-segv1.c:
> * tests/test-sigsegv-catch-stackoverflow1.c:
> * tests/test-sigsegv-catch-stackoverflow2.c:
> Declare some functions and variables static, to pacify GCC when
> warning about external functions missing declarations.

Thanks. I synced this to GNU libsigsegv, now.

Bruno