Buffer overruns: Use ValueFlow to detect negative index