Commit Graph

98 Commits

Author SHA1 Message Date
Nico Weber 272bcf6768 Let stddef.h respect __need_{wchar_t, size_t, NULL, ptrdiff_t, wint_t}.
glibc expects that stddef.h only defines a single thing if either of these
defines is set.  For example, before this change, a C file containing

  #include <stdlib.h>
  int ptrdiff_t = 0;

would compile with gcc but not with clang. Now it compiles with clang too.

This also fixes PR12997, where older versions of the Linux headers would define
NULL incorrectly, and glibc would define __need_NULL and expect stddef.h to
redefine NULL with the correct definition.

llvm-svn: 207606
2014-04-30 04:35:09 +00:00
Benjamin Kramer 6c6a4f4081 Sema: Emit a warning for non-null terminated format strings and other pathological cases.
PR18905.

llvm-svn: 201795
2014-02-20 17:05:38 +00:00
Alp Toker d473363876 Correct hyphenations in comments and assert messages
This patch tries to avoid unrelated changes other than fixing a few
hyphen-related ambiguities in nearby lines.

llvm-svn: 196466
2013-12-05 04:47:09 +00:00
Eli Friedman 0e5d677fc3 Correctly compute the index of the first string format argument when deciding
whether to emit a -Wformat-security warning.  <rdar://problem/14178260>.

llvm-svn: 184214
2013-06-18 18:10:01 +00:00
Dmitri Gribenko 813985b073 Add a comment to test to clarify the intention here
Comment is taken from the commit message of r151080, by Jean-Daniel Dupas

llvm-svn: 172332
2013-01-12 22:39:30 +00:00
Jordan Rose 2f9cc04251 Format strings: suggest %lld instead of %qd and %Ld with -Wformat-non-iso.
As a corollary to the previous commit, even when an extension is
available, we can still offer a fixit to the standard modifier.

llvm-svn: 163453
2012-09-08 04:00:12 +00:00
Jordan Rose 92303592c3 Format strings: %Ld isn't available on Darwin or Windows.
This seems to be a GNU libc extension; we offer a fixit to %lld on
these platforms.

<rdar://problem/11518237>

llvm-svn: 163452
2012-09-08 04:00:03 +00:00
Hans Wennborg abc1e22d65 Properly check length modfiers for %n in format strings.
llvm-svn: 161408
2012-08-07 09:13:19 +00:00
Hans Wennborg 16250c7c18 -Wformat: better handling of qualifiers on pointer arguments
Warn about using pointers to const-qualified types as arguments to
scanf. Ignore the volatile qualifier when checking if types match.

llvm-svn: 161052
2012-07-31 16:37:47 +00:00
Matt Beaumont-Gay 5c8de784f6 Do not warn on correct use of the '%n' format specifier.
While '%n' can be used for evil in an attacker-controlled format string, there
isn't any acute danger in using it in a literal format string with an argument
of the appropriate type.

llvm-svn: 160984
2012-07-30 20:21:58 +00:00
Hans Wennborg ebcd1c7ca2 Make -Wformat check the argument type for %n.
This makes Clang check that the corresponding argument for "%n" in a
format string is a pointer to int.

llvm-svn: 160966
2012-07-30 17:11:32 +00:00
Matt Beaumont-Gay 32d825a4db Use the argument location instead of the format string location when warning
about argument type mismatch.

This gives a nicer diagnostic in cases like
  printf(fmt,
         i);
where previously the snippet just pointed at 'fmt' (with a note at the
definition of fmt).

It's a wash for cases like
  printf("%f",
         i);
where previously we snippeted the offending portion of the format string,
but didn't indicate which argument was at fault.

llvm-svn: 156968
2012-05-17 00:03:16 +00:00
Matt Beaumont-Gay d873508975 Merge branch 'format-string-braced-init'
llvm-svn: 156653
2012-05-11 22:10:59 +00:00
Rafael Espindola 92d49459ab Fix a recent regression with the merging of format attributes.
llvm-svn: 156597
2012-05-11 00:36:07 +00:00
Hans Wennborg 967b9cec23 Make -Wformat accept printf("%hhx", c); with -funsigned-char
For "%hhx", printf expects an unsigned char. This makes Clang
accept a 'char' argument for that also when using -funsigned-char.

This fixes PR12761.

llvm-svn: 156388
2012-05-08 17:21:31 +00:00
James Molloy 222f27858f Add a predefine __WINT_UNSIGNED__, similar to __WCHAR_UNSIGNED__, and test them both for ARM and X86.
Use this to fully fix Sema/format-strings.c for non-x86 platforms.

Reviewed by Chandler on IRC.

llvm-svn: 156169
2012-05-04 11:23:40 +00:00
James Molloy 3636554b63 Fix handling of wint_t - we can't assume wint_t is purely an integer promotion of wchar_t - they may differ in signedness.
Teach ASTContext about WIntType, and have it taken from TargetInfo like WCharType. Should fix test/Sema/format-strings.c for ARM, with the exception of one subtest which will fail if wint_t and wchar_t are the same size and wint_t is signed, wchar_t is unsigned.

There'll be a followup commit to fix that.

Reviewed by Chandler and Hans at http://llvm.org/reviews/r/8

llvm-svn: 156165
2012-05-04 10:55:22 +00:00
Bob Wilson e31772fc44 Add a test for r156092.
llvm-svn: 156132
2012-05-03 23:38:51 +00:00
Hans Wennborg c9dd946852 Warn about non-standard format strings (pr12017)
This adds the -Wformat-non-standard flag (off by default,
enabled by -pedantic), which warns about non-standard
things in format strings (such as the 'q' length modifier,
the 'S' conversion specifier, etc.)

llvm-svn: 151154
2012-02-22 10:17:01 +00:00
Jean-Daniel Dupas 58dab6829a When calling a non variadic format function(vprintf, vscanf, NSLogv, …), warn if the format string argument is a parameter that is not itself declared as a format string with compatible format.
llvm-svn: 151080
2012-02-21 20:00:53 +00:00
Hans Wennborg 9bc9bcc247 Format string analysis: give 'q' its own enumerator.
This is in preparation for being able to warn about 'q' and other
non-standard format string features.

It also allows us to print its name correctly.

llvm-svn: 150697
2012-02-16 16:34:54 +00:00
Hans Wennborg f81b9d172a Fix typo in PrintfConversionSpecifier::isDoubleArg()
This makes the printf diagnostics issue warnigns for %a, %A, %e, etc.
when used with the wrong argument.

llvm-svn: 150370
2012-02-13 10:32:27 +00:00
Jean-Daniel Dupas 6567f48fd9 non-literal strftime format string is not unsafe.
llvm-svn: 150009
2012-02-07 23:10:53 +00:00
Jean-Daniel Dupas cb197b0e42 FormatCheckers should emit all diagnostics using EmitFormatDiagnostic().
llvm-svn: 149394
2012-01-31 18:12:08 +00:00
Jean-Daniel Dupas 028573e794 Update on format attribute handling.
- Remove the printf0 special handling as we treat it as printf anyway.
- Perform basic checks (non-literal, empty) for all formats and not only printf/scanf.

llvm-svn: 149236
2012-01-30 08:46:47 +00:00
Ted Kremenek 6fa5727939 Teach scanf/printf checking about '%Ld' and friends (a GNU extension). Fixes PR 9466.
llvm-svn: 148859
2012-01-24 21:29:54 +00:00
Ted Kremenek e7b9d4342b Tighten format string diagnostic and make it a bit clearer (and a bit closer to GCC's).
llvm-svn: 148579
2012-01-20 21:52:58 +00:00
Richard Trieu 03cf7b70e0 Fix for PR9751 to change the behavior of -Wformat warnings. If the format
string is part of the function call, then there is no difference.  If the
format string is not, the warning will point to the call site and a note
will point to where the format string is.

Fix-it hints for strings are moved to the note if a note is emitted.  This will
prevent changes to format strings that may be used in multiple places.

llvm-svn: 143168
2011-10-28 00:41:25 +00:00
Ted Kremenek 74e82bd190 Tweak printf format string parsing to accept 'hh' conversion specifier to accept any char, not just signed char. Fixes <rdar://problem/10303638>.
llvm-svn: 142908
2011-10-25 04:20:41 +00:00
Ted Kremenek 6e302b2e6e Do not warn about empty format strings when there are no data arguments. Fixes <rdar://problem/9473155>.
llvm-svn: 140777
2011-09-29 05:52:16 +00:00
Ted Kremenek 183875f671 Control 'invalid conversion specifier' warnings under a subflag (-Wformat-invalid-specifier) of -Wformat. Fixes <rdar://problem/10031930>.
llvm-svn: 138686
2011-08-27 00:16:45 +00:00
Ted Kremenek d0c2afd2c3 Revert r135147 and r135075. The consensus was that this wasn't the right thing to do.
llvm-svn: 135152
2011-07-14 17:05:32 +00:00
Ted Kremenek ba84cf53bc Reapply r135075, but modify format-strings.c and format-strings-fixit.c test cases to be more portable with an explicit target triple.
llvm-svn: 135134
2011-07-14 06:49:52 +00:00
Ted Kremenek cc47e0fad1 Re-relax conversion specifier checking for printf format strings and conversion specifiers. My recent change was a mistake.
llvm-svn: 135048
2011-07-13 17:35:14 +00:00
Ted Kremenek 1d3fb8af68 Fix inversion in argument type checking for format strings with conversion specifiers for character types.
llvm-svn: 135046
2011-07-13 17:25:47 +00:00
Douglas Gregor 88336839b9 Don't add redundant FormatAttr, ConstAttr, or NoThrowAttr attributes,
either imlicitly (for builtins) or explicitly (due to multiple
specification of the same attributes). Fixes <rdar://problem/9612060>.

llvm-svn: 133045
2011-06-15 05:45:11 +00:00
Ted Kremenek a8890833f2 Don't warn about using PredefinedExprs as format string literals. These never can be a real security issue.
Fixes PR 9314.

llvm-svn: 126447
2011-02-24 23:03:04 +00:00
Chandler Carruth 468b5cbd40 Allow -Wformat to be enabled without -Wformat-security. GCC gates
-Wformat-security on -Wformat, not vice-versa.

Fixes PR8486. Patch by Oleg Slezberg.

llvm-svn: 126096
2011-02-21 00:07:51 +00:00
Ted Kremenek bf4832cda8 Add semantic checking that the "thousands grouping"
prefix in a printf format string is matched
with the appropriate conversion specifier.

llvm-svn: 123055
2011-01-08 05:28:46 +00:00
Ted Kremenek a322cae011 Add printf format string parsing support for '
prefix to format conversions (POSIX extension).

llvm-svn: 123054
2011-01-08 05:28:38 +00:00
Ted Kremenek 9e618ed1c9 Fix range in printf warnings for invalid conversion specifiers.
llvm-svn: 120735
2010-12-02 20:57:51 +00:00
Anders Carlsson a369f8dc3a The 'X' printf type has a valid alternative form. Fixes PR8641.
llvm-svn: 119946
2010-11-21 18:34:21 +00:00
Ted Kremenek 12a37de003 Previously, the printf warnings would say your arguments type was 'int' when it was really a 'char'
or a 'short'. This fixes that and allows the hints to suggest 'h' modifiers for small ints.

Patch by Justin Bogner!

llvm-svn: 116996
2010-10-21 04:00:58 +00:00
Ted Kremenek b8176da314 Check format strings when a called function has more than one FormatAttr (one for 'scanf' and one for 'printf'). Fixes <rdar://problem/8409437>.
llvm-svn: 113472
2010-09-09 04:33:05 +00:00
Ted Kremenek 1520dae606 It appears that technically a null format string is not warned under -Wformat-nonliteral, as
the function processing the format string can decided whether or not to accept a null format string (e.g., asl_log).  Fixes <rdar://problem/8269537>.

llvm-svn: 113469
2010-09-09 03:51:42 +00:00
Ted Kremenek 5f0c066062 Fix printf format string checking for '%lc' (which expects a wint_t or compatible argument). Fixes PR 7981.
llvm-svn: 111978
2010-08-24 22:24:51 +00:00
Ted Kremenek 6cd694233d Don't warn when a '%%' or '%*d' (scanf) is used in a format string with positional arguments, since
these don't actually consume an argument.

llvm-svn: 108757
2010-07-19 22:01:06 +00:00
Tom Care 3f272b853f Bug 7377: printf checking fails to flag some undefined behavior
http://llvm.org/bugs/show_bug.cgi?id=7377

Updated format string highlighting and fixits to take advantage of the new CharSourceRange class.
- Change HighlightRange to allow highlighting whitespace only in a CharSourceRange (for warnings about the ' ' (space) flag)
- Change format specifier range helper function to allow for half-open ranges (+1 to end)
- Enabled previously failing tests (FIXMEs/XFAILs removed)
- Small fixes and additions to format string test cases

M       test/Sema/format-strings.c
M       test/Sema/format-strings-fixit.c
M       lib/Frontend/TextDiagnosticPrinter.cpp
M       lib/Sema/SemaChecking.cpp

llvm-svn: 106480
2010-06-21 21:21:01 +00:00
Tom Care b49ec6907b Bug 7377: Fixed several bad printf format string bugs.
- Added warning for undefined behavior when using field specifier
- Added warning for undefined behavior when using length modifier
- Fixed warnings for invalid flags
- Added warning for ignored flags
- Added fixits for the above warnings
- Fixed accuracy of detecting several undefined behavior conditions
- Receive normal warnings in addition to security warnings when using %n
- Fix bug where '+' flag would remain on unsigned conversion suggestions

Summary of changes:
- Added expanded tests
- Added/expanded warnings
- Added position info to OptionalAmounts for fixits
- Extracted optional flags to a wrapper class with position info for fixits
- Added several methods to validate a FormatSpecifier by component, each checking for undefined behavior
- Fixed conversion specifier checking to conform to C99 standard
- Added hooks to detect the invalid states in CheckPrintfHandler::HandleFormatSpecifier

Note: warnings involving the ' ' (space) flag are temporarily disabled until whitespace highlighting no longer triggers assertions. I will make a post about this on cfe-dev shortly.

M    test/Sema/format-strings.c
M    include/clang/Basic/DiagnosticSemaKinds.td
M    include/clang/Analysis/Analyses/PrintfFormatString.h
M    lib/Analysis/PrintfFormatString.cpp
M    lib/Sema/SemaChecking.cpp

llvm-svn: 106233
2010-06-17 19:00:27 +00:00
Ted Kremenek 98008a47a0 Fix format string checking of '%c' by treating it as an integer conversion. Fixes PR 7391.
llvm-svn: 106196
2010-06-17 01:12:20 +00:00