[BoundsSafety] warn when assigning uninitialized memory to a `single` pointer with a flexible array member

[hnrklssn]

For the program below the assignment to p will incur a bounds check, including checking that p->fam + p->len is not greater than the upper bound of the implicit bidi we're assigning from. This involves reading p->len, which LLVM will trivially detect as uninitialized, invoking UB and ruining your day.

We should warn on all assignments from malloc() to foo * __single, for any foo containing a flexible array member. Bonus points if we can detect this for uninitialized stack memory as well without too much extra hassle, but stack memory really shouldn't be used for FAM structs, so that's not as high priority. The diagnostic should include a suggestion to use __bidi_indexable instead, and a fix-it to do the transformation.

#include <ptrcheck.h>
#include <stdlib.h>
struct A {
    int len;
    char fam[__counted_by(len)];
};

void foo(int len) {
    struct A * __single p = malloc(sizeof(struct A) + len);
}