-Warray-bounds does not work when indexing outside of bounds via pointer arithmetic instead of subscript operator

[inicula]

This code shows no errors when compiled with -Wall -Wextra -Wpedantic -Werror:

#include <cstdio>

int main()
{
    int arr[10] = {1,2,3};
    printf("%d\n", *(arr + 10));
}

But the indexing operation is optimized away nonetheless (-O3 -Wall -Wextra -Wpedantic -Werror):

main:
        push    rax
        lea     rdi, [rip + .L.str]
        xor     eax, eax
        call    printf@PLT
        xor     eax, eax
        pop     rcx
        ret

.L.str:
        .asciz  "%d\n"

[firewave]

It is detected by CSA:

<source>:6:20: warning: Out of bound access to memory after the end of 'arr' [clang-analyzer-security.ArrayBound]
    6 |     printf("%d\n", *(arr + 10));
      |                    ^~~~~~~~~~~
<source>:6:20: note: Access of 'arr' at index 10, while it holds only 10 'int' elements
    6 |     printf("%d\n", *(arr + 10));
      |                    ^~~~~~~~~~~

https://godbolt.org/z/o1GGzd861

[AaronBallman]

Yeah, this isn't necessarily a bug; it requires data flow analysis which is why the static analyzer checks it rather than the compiler proper. That said, I think we could look for *(ptr + constant offset) as longhand for ptr[index] to catch a few more cases like this without requiring dataflow analysis (it would only work when ptr is declared as a constant size array and the offset is a constant expression, though).