[clang] [llvm] [NFC][analyzer] Extract bounds checking library (PR #202372)

[Donát Nagy via cfe-commits]

================
@@ -0,0 +1,449 @@
+//===- BoundsChecking.cpp - Bounds checking related APIs --------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+//  This file defines APIs for performing a bounds check (i.e. comparing a
+//  symbolic Offset value to zero and a symbolic Extent value) and composing
+//  descriptions that explain its results.
+//
+//  This is intended as a replacement for `ProgramState::assumeInBound` to
+//  avoid its incorrect logic and compensate for deficiencies of other parts of
+//  the analyzer.
----------------
NagyDonat wrote:

This library is not yet ready as a drop-in replacement for `ProgramState::assumeInBound` (currently it serves the needs of `security.ArrayBound`, but isn't flexible enough for other uses).

I was planning to place deprecation markers and "use the new bounds checking library" comments on `assumeInBound` in follow-up commits when this library is ready to use.

I will tweak this comment to "In the future, this will become a replacement for" to clarify this situation.

https://github.com/llvm/llvm-project/pull/202372