Use dummy allocator to make accesses defined as per standard

[siddhesh]

systemd uses malloc_usable_size() everywhere to use memory blocks obtained through malloc, but that is abuse since the malloc_usable_size() interface isn't meant for this kind of use, it is for diagnostics only. This is also why systemd behaviour is flaky when built with _FORTIFY_SOURCE.

One way to make this more standard (and hence safer) is to, at every malloc_usable_size() call, also 'reallocate' the block so that the compiler can see the larger size. This is done through a dummy reallocator whose only purpose is to tell the compiler about the larger usable size, it doesn't do any actual reallocation.

Florian Weimer pointed out that this doesn't solve the problem of an allocator potentially growing usable size at will, which will break the implicit assumption in systemd use that the value returned remains constant as long as the object is valid. The safest way to fix that is for systemd to step away from using malloc_usable_size() like this.

Resolves #22801.

[siddhesh]

In file included from /usr/include/string.h:535,
                 from /usr/include/x86_64-linux-gnu/sys/un.h:37,
                 from ../../../../src/shared/ask-password-api.c:17:
In function ‘explicit_bzero’,
    inlined from ‘explicit_bzero_safe’ at ../../../../src/basic/memory-util.h:97:17,
    inlined from ‘explicit_bzero_safe’ at ../../../../src/basic/memory-util.h:95:21,
    inlined from ‘erase_and_free’ at ../../../../src/basic/memory-util.h:112:9,
    inlined from ‘erase_and_freep’ at ../../../../src/basic/memory-util.h:117:9,
    inlined from ‘ask_password_credential’ at ../../../../src/shared/ask-password-api.c:966:42,
    inlined from ‘ask_password_auto’ at ../../../../src/shared/ask-password-api.c:1001:21:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:72:3: error: argument 1 is null but the corresponding size argument 2 value is [1, 18446744073709551615] [-Werror=nonnull]
   72 |   __explicit_bzero_chk (__dest, __len, __glibc_objsize0 (__dest));
      |   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/usr/include/x86_64-linux-gnu/bits/string_fortified.h: In function ‘ask_password_auto’:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:66:6: note: in a call to function ‘__explicit_bzero_chk’ declared with attribute ‘access (write_only, 1, 2)’
   66 | void __explicit_bzero_chk (void *__dest, size_t __len, size_t __destlen)
      |      ^~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors

This looks like a spurious gcc warning, I'll take a closer look and see how to fix up.

[siddhesh]

Changes from v1:

• Broke out most of malloc_sizeof_safe into an inline function
• Updated comment
• Added _returns_nonnull_ to fix the failure with ubsan
• Fixed coding style issues

Tested with clang, gcc and the sanitizer fuzzer test that had failed, so hopefully this one should run fully clean.

[poettering]

lgtm