[analyzer] Fix Static Analyzer g_memdup false-positive

[steakhal]

Summary

g_memdup() allocates and copies memory, thus we should not assume that
the returned memory region is uninitialized because it might not be the
case.

PS: It would be even better to copy the bindings to mimic the actual
content of the buffer, but this works too.

Fixes #53617

[martong]

Ok. LGTM.

(Just a note: it looks kind of interesting that we support the GTK related Glib functions explicitly here. I suppose they are far less frequently used than the libc or POSIX functions. This is somewhat similar to the fact that we can check WebKit or Fuchsia related code, but at least those are separated into their own checker.)

clang/lib/StaticAnalyzer/Checkers/MallocChecker.cpp

void MallocChecker::checkGMalloc0(const CallEvent &Call,
   State = MallocMemAux(C, Call, Call.getArgExpr(0), zeroVal, State, AF_Malloc);
   State = ProcessZeroAllocCheck(Call, 0, State);
   C.addTransition(State);
 }
 
 void MallocChecker::checkGMemdup(const CallEvent &Call,
                                  CheckerContext &C) const {
   ProgramStateRef State = C.getState();
-  State = MallocMemAux(C, Call, Call.getArgExpr(1), UndefinedVal(), State,
-                       AF_Malloc);
+  State =
+      MallocMemAux(C, Call, Call.getArgExpr(1), UnknownVal(), State, AF_Malloc);
   State = ProcessZeroAllocCheck(Call, 1, State);
   C.addTransition(State);
 }
 
 void MallocChecker::checkGMallocN(const CallEvent &Call,
                                   CheckerContext &C) const {
   ProgramStateRef State = C.getState();
   SVal Init = UndefinedVal();

clang/test/Analysis/gmalloc.c

 gpointer g_malloc_n(gsize n_blocks, gsize n_block_bytes);
 gpointer g_malloc0_n(gsize n_blocks, gsize n_block_bytes);
 gpointer g_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);
 gpointer g_try_malloc_n(gsize n_blocks, gsize n_block_bytes);
 gpointer g_try_malloc0_n(gsize n_blocks, gsize n_block_bytes);
 gpointer g_try_realloc_n(gpointer mem, gsize n_blocks, gsize n_block_bytes);
 void g_free(gpointer mem);
 gpointer g_memdup(gconstpointer mem, guint byte_size);
+gpointer g_strconcat(gconstpointer string1, ...);
 
 static const gsize n_bytes = 1024;
 
 void f1(void) {
   gpointer g1 = g_malloc(n_bytes);
   gpointer g2 = g_malloc0(n_bytes);
   g1 = g_realloc(g1, n_bytes * 2);
   gpointer g3 = g_try_malloc(n_bytes);
void f7(void) {
   g_free(g1);
   g_free(g2);
   g_free(g3);
   g_free(g4);
   g_free(g5);
   g_free(g6);
   g_free(g7);
 }
+
+void f8(void) {
+  typedef struct {
+    gpointer str;
+  } test_struct;
+
+  test_struct *s1 = (test_struct *)g_malloc0(sizeof(test_struct));
+  test_struct *s2 = (test_struct *)g_memdup(s1, sizeof(test_struct));
+  gpointer str = g_strconcat("text", s1->str, s2->str, NULL); // no-warning
+  g_free(str);
+  g_free(s2);
+  g_free(s1);
+}