Fix memOutOfBounds handling of negative pointer offsets

[karoliineh]

This PR fixes a bug in memOutOfBounds where before-start accesses were classified as safe when the offset was negative and precise enough under ana.int.interval, i.e., the bug only manifested when interval domain was turned on. With ana.int.interval, Goblint can compute offsets precisely enough that negative-offset accesses no longer stay at top. This issue was found using the dashboard comparison between Goblint and Mopsa and was exposed by the SV-COMP task list-ext-properties/960521-1_1-1.i.

• Added regressions for negative-offset memOutOfBounds cases in tests/regression/74-invalid_deref.
• Fixed memOutOfBounds to warn when the computed byte offset is negative, in addition to the existing past-the-end check.
• Made the ptr_size_lt_offs comparison sites handle IntDomain.ArithmeticOnIntegerBot consistently by falling back to the existing conservative “could not compare” behavior.
• Refactored the duplicated offset-bound comparison logic into top-level helpers, while preserving the original distinction between:
  • dereference-offset checks using (size - 1) < offset
  • pointer-offset checks using size < offset

[michael-schwarz]

Other than the suggestion, LGTM!

[michael-schwarz]

Suggested change

	printf("%p", (void *) end); //NOWARN
	printf("%p", (void *) end); //NOWARN
	printf("%c", *end); //WARN

So we also see that we do indeed warn if this pointer is dereferenced.

[karoliineh]

ha! it seems you just uncovered an unrelated unsoundness with this ;) I suggest we merge this as is and I will add this suggestion on another PR with an appropriate fix.

[michael-schwarz]

Yeah, sounds good!