[inferbo] Add a pointer arithmetic test

Reviewed By: mbouaziz

Differential Revision: D7484490

fbshipit-source-id: 8d64016

infer/tests/codetoanalyze/c/bufferoverrun/issues.exp

@@ -58,6 +58,7 @@ codetoanalyze/c/bufferoverrun/models.c, fgetc_256_bad, 3, BUFFER_OVERRUN_L2, ERR
 codetoanalyze/c/bufferoverrun/models.c, fgetc_m1_bad, 3, BUFFER_OVERRUN_L3, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [-1, 255] Size: [10000, 10000]]
 codetoanalyze/c/bufferoverrun/nested_loop.c, nested_loop, 7, BUFFER_OVERRUN_L2, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, 10] Size: [10, 10]]
 codetoanalyze/c/bufferoverrun/nested_loop_with_label.c, nested_loop_with_label, 6, BUFFER_OVERRUN_L4, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [0, +oo] Size: [10, 10]]
+codetoanalyze/c/bufferoverrun/pointer_arith.c, FP_pointer_arith5_Ok, 5, BUFFER_OVERRUN_L2, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [3, 2043] Size: [1024, 1024]]
 codetoanalyze/c/bufferoverrun/pointer_arith.c, array_pointer_arith_Bad, 3, BUFFER_OVERRUN_L1, ERROR, [ArrayDeclaration,Assignment,ArrayAccess: Offset: [10, 10] Size: [10, 10]]
 codetoanalyze/c/bufferoverrun/pointer_arith.c, call_pointer_arith3_Bad, 2, BUFFER_OVERRUN_L1, ERROR, [ArrayDeclaration,Call,Parameter: p,Parameter: x,ArrayAccess: Offset: [10, 10] Size: [5, 5] @ codetoanalyze/c/bufferoverrun/pointer_arith.c:33:3 by call to `pointer_arith3()` ]
 codetoanalyze/c/bufferoverrun/pointer_arith.c, call_pointer_arith4_Bad, 0, BUFFER_OVERRUN_L1, ERROR, [Call,ArrayDeclaration,Parameter: x,ArrayAccess: Offset: [10, 10] Size: [5, 5] @ codetoanalyze/c/bufferoverrun/pointer_arith.c:48:3 by call to `FN_pointer_arith4_Bad()` ]

infer/tests/codetoanalyze/c/bufferoverrun/pointer_arith.c

@@ -49,3 +49,15 @@ void FN_pointer_arith4_Bad(int x) {
 }
 
 void call_pointer_arith4_Bad() { FN_pointer_arith4_Bad(100); }
+
+#include <stdio.h>
+#include <stdlib.h>
+
+void FP_pointer_arith5_Ok() {
+  char buf[1024];
+  fgets(buf, 1024, stdin);
+  size_t len = strlen(buf);
+  if (len < sizeof(buf) - 3) {
+    (buf + len)[sizeof(buf) - len - 1] = '\0';
+  }
+}