Improve memOutOfBounds precision for points-to sets which mix allocs with others

[sim642]

This is on top of #2029.

Pointer may point to either allocated blob or static array.
Currently memOutOfBounds only uses BlobSize query for points-to sets which are definitely alloc, but not a mix.

This moves the decision to be made per-pointee basis, not on the basis of the whole points-to set.
The diff probably looks much nicer with whitespace ignored.

TODO

• sv-benchmarks
• Look into TopValue exceptions from sv-benchmarks.

[sim642]

According to an sv-benchmarks run with level01, 60s and 1GB, this doesn't improve any verdicts: https://goblint.cs.ut.ee/results/335-all-level01-pr-2030-after/table-generator-cmp.diff.html#/table.

However, there is a regression on

• ldv-challenges/linux-3.14_linux-kernel-locking-mutex_drivers-net-ethernet-chelsio-cxgb4-cxgb4.cil
• ldv-challenges/linux-3.14_linux-kernel-locking-spinlock_drivers-net-ethernet-chelsio-cxgb4-cxgb4.cil

where TIMEOUT goes to exception Lattice.TopValue. That's with unreach-call not valid-memsafety. This changes base just to keep the function in sync with memOutOfBounds.
For reference, in SV-COMP we output true after >400s for these but get no points because the witness isn't validated.

Somehow it's coming from the Fake lattice used for ZeroInit of blobs.

EDIT: These are fixed by #2035.

[Copilot]

Pull request overview

This PR improves size reasoning for out-of-bounds checks when a pointer may target both allocated memory and non-allocated objects, moving toward per-pointee size handling.

Changes:

• Refactors pointer target size computation in memOutOfBounds and base to inspect individual points-to elements.
• Adds a regression test for a pointer that may refer to either a malloc allocation or a static array.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/analyses/memOutOfBounds.ml	Updates target-size computation for mixed points-to sets.
src/analyses/base.ml	Applies analogous target-size handling for memory-copy modeling.
tests/regression/74-invalid_deref/38-oob-alloc-array-mix.c	Adds regression coverage for alloc/static-array mixed points-to sets.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sim642]

This currently doesn't make a difference because the sizes are joined here anyway. The same issue is with EvalLength in the array case below. I added TODOs about these to handle when improving this check to be properly relational between the address base size and the offset.