> “using only the information available for that function in the translation unit defining it, which includes the annotations possibly provided in function decl

> “using only the information available for that function in the translation unit defining it, which includes the annotations possibly provided in function declarations.” > So, in the examples, when something calls "read", what does the analyzer know about "read", and how much of its "char " buffer it overwrites? As the text says: “the annotations possibly provided in function declarations.”* The PDF also says “the large part of the result is obtained without any annotation at all, thanks to the fact that the C Standard Library and the POSIX Library have been annotated once and for all (and the same can be done with any commonly used library).”