[clang] [analyzer] Don't invalidate pointee of pointer-to-const on callback arguments (PR #225489)

[Balázs Benics via cfe-commits]

================
@@ -3831,17 +3757,19 @@ bool MallocChecker::mayFreeAnyEscapedMemoryOrIsModeledExplicitly(
   // 'closefn' is specified (and if that function does free memory),
   // but it will not if closefn is not specified.
   // Currently, we do not inspect the 'closefn' function (PR12101).
-  if (FName == "funopen")
-    if (Call->getNumArgs() >= 4 && Call->getArgSVal(4).isConstant(0))
+  if (FName == "funopen") {
+    if (Call.getNumArgs() >= 4 && Call.getArgSVal(4).isConstant(0))
----------------
steakhal wrote:

Claude told me that this looks suspiciously like an off-by-one bug - for a followup  PR.
```suggestion
  if (FName == "funopen") {
    if (Call.getNumArgs() >= 5 && Call.getArgSVal(4).isConstant(0))
```

man page:
```
FILE *funopen(const void *cookie,
              int (*readfn)(void *, char *, int),
              int (*writefn)(void *, const char *, int),
              fpos_t (*seekfn)(void *, fpos_t, int),
              int (*closefn)(void *));
```

https://github.com/llvm/llvm-project/pull/225489