title: What function annotation flags are available for Coverity Scan?
body: <p>The Coverity Scan <a href="https://scan.coverity.com/tune" rel="nofollow noreferrer">tuning documentation</a> talks about adding function annotations to source files. There are three options listed:</p>
  
  <ul>
  <li><code>+kill</code> </li>
  <li><code>+alloc</code> </li>
  <li><code>+free</code> </li>
  </ul>
  
  <p>However, from that same page there is a link to an example file that uses as-of-yet unseen flags:</p>
  
  <ul>
  <li><a href="https://github.com/ukyg9e5r6k7gubiekd6/gpsd/blob/master/gpsdctl.c#L70" rel="nofollow noreferrer"><code>toctou</code></a></li>
  <li><a href="https://github.com/ukyg9e5r6k7gubiekd6/gpsd/blob/master/gpsdctl.c#L103" rel="nofollow noreferrer"><code>string_size</code></a></li>
  </ul>
  
  <p>What do these flags mean? What other flags are available for function annotation, and where are they documented?</p>