xref: /netbsd/usr.bin/xlint/lint1/func.c (revision bac1f0ad)
1 /*	$NetBSD: func.c,v 1.172 2023/07/29 07:49:14 rillig Exp $	*/
2 
3 /*
4  * Copyright (c) 1994, 1995 Jochen Pohl
5  * All Rights Reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *	This product includes software developed by Jochen Pohl for
18  *	The NetBSD Project.
19  * 4. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #if HAVE_NBTOOL_CONFIG_H
35 #include "nbtool_config.h"
36 #endif
37 
38 #include <sys/cdefs.h>
39 #if defined(__RCSID)
40 __RCSID("$NetBSD: func.c,v 1.172 2023/07/29 07:49:14 rillig Exp $");
41 #endif
42 
43 #include <stdlib.h>
44 #include <string.h>
45 
46 #include "lint1.h"
47 #include "cgram.h"
48 
49 /*
50  * Contains a pointer to the symbol table entry of the current function
51  * definition.
52  */
53 sym_t	*funcsym;
54 
55 /* Is set as long as a statement can be reached. Must be set at level 0. */
56 bool	reached = true;
57 
58 /*
59  * Is true by default, can be cleared by NOTREACHED.
60  * Is reset to true whenever 'reached' changes.
61  */
62 bool	warn_about_unreachable;
63 
64 /*
65  * In conjunction with 'reached', controls printing of "fallthrough on ..."
66  * warnings.
67  * Reset by each statement and set by FALLTHROUGH, stmt_switch_expr and
68  * case_label.
69  *
70  * The control statements 'if', 'for', 'while' and 'switch' do not reset
71  * suppress_fallthrough because this must be done by the controlled statement.
72  * At least for 'if', this is important because ** FALLTHROUGH ** after "if
73  * (expr) statement" is evaluated before the following token, which causes
74  * reduction of above. This means that ** FALLTHROUGH ** after "if ..." would
75  * always be ignored.
76  */
77 bool	suppress_fallthrough;
78 
79 /* The innermost control statement */
80 static control_statement *cstmt;
81 
82 /*
83  * Number of arguments which will be checked for usage in following
84  * function definition. -1 stands for all arguments.
85  *
86  * The position of the last ARGSUSED comment is stored in argsused_pos.
87  */
88 int	nargusg = -1;
89 pos_t	argsused_pos;
90 
91 /*
92  * Number of arguments of the following function definition whose types
93  * shall be checked by lint2. -1 stands for all arguments.
94  *
95  * The position of the last VARARGS comment is stored in vapos.
96  */
97 int	nvararg = -1;
98 pos_t	vapos;
99 
100 /*
101  * Both printflike_argnum and scanflike_argnum contain the 1-based number
102  * of the string argument which shall be used to check the types of remaining
103  * arguments (for PRINTFLIKE and SCANFLIKE).
104  *
105  * printflike_pos and scanflike_pos are the positions of the last PRINTFLIKE
106  * or SCANFLIKE comment.
107  */
108 int	printflike_argnum = -1;
109 int	scanflike_argnum = -1;
110 pos_t	printflike_pos;
111 pos_t	scanflike_pos;
112 
113 /*
114  * If both plibflg and llibflg are set, prototypes are written as function
115  * definitions to the output file.
116  */
117 bool	plibflg;
118 
119 /* Temporarily suppress warnings about constants in conditional context. */
120 bool	suppress_constcond;
121 
122 /*
123  * Whether a lint library shall be created. The effect of this flag is that
124  * all defined symbols are treated as used.
125  * (The LINTLIBRARY comment also resets vflag.)
126  */
127 bool	llibflg;
128 
129 /*
130  * Determines the warnings that are suppressed by a LINTED directive.  For
131  * globally suppressed warnings, see 'msgset'.
132  *
133  * LWARN_ALL:	all warnings are enabled
134  * LWARN_NONE:	all warnings are suppressed
135  * n >= 0:	warning n is ignored, the others are active
136  */
137 int	lwarn = LWARN_ALL;
138 
139 /* Temporarily suppress warnings about wrong types for bit-fields. */
140 bool	suppress_bitfieldtype;
141 
142 /* Temporarily suppress warnings about use of 'long long'. */
143 bool	suppress_longlong;
144 
145 void
begin_control_statement(control_statement_kind kind)146 begin_control_statement(control_statement_kind kind)
147 {
148 	control_statement *cs;
149 
150 	cs = xcalloc(1, sizeof(*cs));
151 	cs->c_kind = kind;
152 	cs->c_surrounding = cstmt;
153 	cstmt = cs;
154 }
155 
156 void
end_control_statement(control_statement_kind kind)157 end_control_statement(control_statement_kind kind)
158 {
159 	control_statement *cs;
160 	case_label_t *cl, *next;
161 
162 	lint_assert(cstmt != NULL);
163 
164 	while (cstmt->c_kind != kind)
165 		cstmt = cstmt->c_surrounding;
166 
167 	cs = cstmt;
168 	cstmt = cs->c_surrounding;
169 
170 	for (cl = cs->c_case_labels; cl != NULL; cl = next) {
171 		next = cl->cl_next;
172 		free(cl);
173 	}
174 
175 	free(cs->c_switch_type);
176 	free(cs);
177 }
178 
179 static void
set_reached(bool new_reached)180 set_reached(bool new_reached)
181 {
182 	debug_step("%s -> %s",
183 	    reached ? "reachable" : "unreachable",
184 	    new_reached ? "reachable" : "unreachable");
185 	reached = new_reached;
186 	warn_about_unreachable = true;
187 }
188 
189 /*
190  * Prints a warning if a statement cannot be reached.
191  */
192 void
check_statement_reachable(void)193 check_statement_reachable(void)
194 {
195 	if (!reached && warn_about_unreachable) {
196 		/* statement not reached */
197 		warning(193);
198 		warn_about_unreachable = false;
199 	}
200 }
201 
202 /*
203  * Called after a function declaration which introduces a function definition
204  * and before an (optional) old-style argument declaration list.
205  *
206  * Puts all symbols declared in the prototype or in an old-style argument
207  * list back to the symbol table.
208  *
209  * Does the usual checking of storage class, type (return value),
210  * redeclaration, etc.
211  */
212 void
begin_function(sym_t * fsym)213 begin_function(sym_t *fsym)
214 {
215 	int n;
216 	bool dowarn;
217 	sym_t *arg, *sym, *rdsym;
218 
219 	funcsym = fsym;
220 
221 	/*
222 	 * Put all symbols declared in the argument list back to the
223 	 * symbol table.
224 	 */
225 	for (sym = dcs->d_func_proto_syms; sym != NULL;
226 	    sym = sym->s_level_next) {
227 		if (sym->s_block_level != -1) {
228 			lint_assert(sym->s_block_level == 1);
229 			inssym(1, sym);
230 		}
231 	}
232 
233 	/*
234 	 * In old_style_function() we did not know whether it is an old
235 	 * style function definition or only an old-style declaration,
236 	 * if there are no arguments inside the argument list ("f()").
237 	 */
238 	if (!fsym->s_type->t_proto && fsym->u.s_old_style_args == NULL)
239 		fsym->s_osdef = true;
240 
241 	check_type(fsym);
242 
243 	/*
244 	 * check_type() checks for almost all possible errors, but not for
245 	 * incomplete return values (these are allowed in declarations)
246 	 */
247 	if (fsym->s_type->t_subt->t_tspec != VOID &&
248 	    is_incomplete(fsym->s_type->t_subt)) {
249 		/* cannot return incomplete type */
250 		error(67);
251 	}
252 
253 	fsym->s_def = DEF;
254 
255 	if (fsym->s_scl == TYPEDEF) {
256 		fsym->s_scl = EXTERN;
257 		/* illegal storage class */
258 		error(8);
259 	}
260 
261 	if (dcs->d_inline)
262 		fsym->s_inline = true;
263 
264 	/*
265 	 * Arguments in new style function declarations need a name.
266 	 * (void is already removed from the list of arguments)
267 	 */
268 	n = 1;
269 	for (arg = fsym->s_type->t_args; arg != NULL; arg = arg->s_next) {
270 		if (arg->s_scl == ABSTRACT) {
271 			lint_assert(arg->s_name == unnamed);
272 			/* formal parameter #%d lacks name */
273 			error(59, n);
274 		} else {
275 			lint_assert(arg->s_name != unnamed);
276 		}
277 		n++;
278 	}
279 
280 	/*
281 	 * We must also remember the position. s_def_pos is overwritten
282 	 * if this is an old-style definition, and we had already a prototype.
283 	 */
284 	dcs->d_func_def_pos = fsym->s_def_pos;
285 
286 	if ((rdsym = dcs->d_redeclared_symbol) != NULL) {
287 
288 		if (!check_redeclaration(fsym, (dowarn = false, &dowarn))) {
289 
290 			/*
291 			 * Print nothing if the newly defined function
292 			 * is defined in old style. A better warning will
293 			 * be printed in check_func_lint_directives().
294 			 */
295 			if (dowarn && !fsym->s_osdef) {
296 				/* TODO: error in C99 mode as well? */
297 				if (!allow_trad && !allow_c99)
298 					/* redeclaration of '%s' */
299 					error(27, fsym->s_name);
300 				else
301 					/* redeclaration of '%s' */
302 					warning(27, fsym->s_name);
303 				print_previous_declaration(rdsym);
304 			}
305 
306 			copy_usage_info(fsym, rdsym);
307 
308 			/*
309 			 * If the old symbol was a prototype and the new
310 			 * one is none, overtake the position of the
311 			 * declaration of the prototype.
312 			 */
313 			if (fsym->s_osdef && rdsym->s_type->t_proto)
314 				fsym->s_def_pos = rdsym->s_def_pos;
315 
316 			complete_type(fsym, rdsym);
317 
318 			if (rdsym->s_inline)
319 				fsym->s_inline = true;
320 
321 		}
322 
323 		/* remove the old symbol from the symbol table */
324 		rmsym(rdsym);
325 
326 	}
327 
328 	if (fsym->s_osdef && !fsym->s_type->t_proto) {
329 		/* TODO: Make this an error in C99 mode as well. */
330 		if ((!allow_trad && !allow_c99) && hflag &&
331 		    strcmp(fsym->s_name, "main") != 0)
332 			/* function definition is not a prototype */
333 			warning(286);
334 	}
335 
336 	if (dcs->d_no_type_specifier)
337 		fsym->s_return_type_implicit_int = true;
338 
339 	set_reached(true);
340 }
341 
342 static void
check_missing_return_value(void)343 check_missing_return_value(void)
344 {
345 	if (funcsym->s_type->t_subt->t_tspec == VOID)
346 		return;
347 	if (funcsym->s_return_type_implicit_int)
348 		return;
349 
350 	/* C99 5.1.2.2.3 "Program termination" p1 */
351 	if (allow_c99 && strcmp(funcsym->s_name, "main") == 0)
352 		return;
353 
354 	/* function '%s' falls off bottom without returning value */
355 	warning(217, funcsym->s_name);
356 }
357 
358 /*
359  * Called at the end of a function definition.
360  */
361 void
end_function(void)362 end_function(void)
363 {
364 
365 	if (reached) {
366 		cstmt->c_had_return_noval = true;
367 		check_missing_return_value();
368 	}
369 
370 	/*
371 	 * This warning is printed only if the return value was implicitly
372 	 * declared to be int. Otherwise, the wrong return statement
373 	 * has already printed a warning.
374 	 */
375 	if (cstmt->c_had_return_noval && cstmt->c_had_return_value &&
376 	    funcsym->s_return_type_implicit_int)
377 		/* function '%s' has 'return expr' and 'return' */
378 		warning(216, funcsym->s_name);
379 
380 	/* Warn about unused parameters. */
381 	int n = nargusg;
382 	nargusg = -1;
383 	for (sym_t *arg = dcs->d_func_args;
384 	     arg != NULL && n != 0; arg = arg->s_next, n--)
385 		check_usage_sym(dcs->d_asm, arg);
386 
387 	/*
388 	 * write the information about the function definition to the
389 	 * output file
390 	 * inline functions explicitly declared extern are written as
391 	 * declarations only.
392 	 */
393 	if (dcs->d_scl == EXTERN && funcsym->s_inline) {
394 		outsym(funcsym, funcsym->s_scl, DECL);
395 	} else {
396 		outfdef(funcsym, &dcs->d_func_def_pos,
397 		    cstmt->c_had_return_value, funcsym->s_osdef,
398 		    dcs->d_func_args);
399 	}
400 
401 	/* clean up after syntax errors, see test stmt_for.c. */
402 	while (dcs->d_enclosing != NULL)
403 		dcs = dcs->d_enclosing;
404 
405 	/*
406 	 * remove all symbols declared during argument declaration from
407 	 * the symbol table
408 	 */
409 	lint_assert(dcs->d_enclosing == NULL);
410 	lint_assert(dcs->d_kind == DLK_EXTERN);
411 	symtab_remove_level(dcs->d_func_proto_syms);
412 
413 	/* must be set on level 0 */
414 	set_reached(true);
415 
416 	funcsym = NULL;
417 }
418 
419 void
named_label(sym_t * sym)420 named_label(sym_t *sym)
421 {
422 
423 	if (sym->s_set) {
424 		/* label '%s' redefined */
425 		error(194, sym->s_name);
426 	} else {
427 		mark_as_set(sym);
428 	}
429 
430 	/* XXX: Assuming that each label is reachable is wrong. */
431 	set_reached(true);
432 }
433 
434 static void
check_case_label_bitand(const tnode_t * case_expr,const tnode_t * switch_expr)435 check_case_label_bitand(const tnode_t *case_expr, const tnode_t *switch_expr)
436 {
437 
438 	if (switch_expr->tn_op != BITAND ||
439 	    switch_expr->tn_right->tn_op != CON)
440 		return;
441 
442 	lint_assert(case_expr->tn_op == CON);
443 	uint64_t case_value = (uint64_t)case_expr->tn_val.u.integer;
444 	uint64_t mask = (uint64_t)switch_expr->tn_right->tn_val.u.integer;
445 
446 	if ((case_value & ~mask) != 0) {
447 		/* statement not reached */
448 		warning(193);
449 	}
450 }
451 
452 static void
check_case_label_enum(const tnode_t * tn,const control_statement * cs)453 check_case_label_enum(const tnode_t *tn, const control_statement *cs)
454 {
455 	/* similar to typeok_enum in tree.c */
456 
457 	if (!(tn->tn_type->t_is_enum || cs->c_switch_type->t_is_enum))
458 		return;
459 	if (tn->tn_type->t_is_enum && cs->c_switch_type->t_is_enum &&
460 	    tn->tn_type->t_enum == cs->c_switch_type->t_enum)
461 		return;
462 
463 #if 0 /* not yet ready, see msg_130.c */
464 	/* enum type mismatch: '%s' '%s' '%s' */
465 	warning(130, type_name(cs->c_switch_type), op_name(EQ),
466 	    type_name(tn->tn_type));
467 #endif
468 }
469 
470 static void
check_case_label(tnode_t * tn,control_statement * cs)471 check_case_label(tnode_t *tn, control_statement *cs)
472 {
473 	case_label_t *cl;
474 	val_t *v;
475 	val_t nv;
476 	tspec_t t;
477 
478 	if (cs == NULL) {
479 		/* case not in switch */
480 		error(195);
481 		return;
482 	}
483 
484 	if (tn == NULL)
485 		return;
486 
487 	if (tn->tn_op != CON) {
488 		/* non-constant case expression */
489 		error(197);
490 		return;
491 	}
492 
493 	if (!is_integer(tn->tn_type->t_tspec)) {
494 		/* non-integral case expression */
495 		error(198);
496 		return;
497 	}
498 
499 	check_case_label_bitand(tn, cs->c_switch_expr);
500 	check_case_label_enum(tn, cs);
501 
502 	lint_assert(cs->c_switch_type != NULL);
503 
504 	if (reached && !suppress_fallthrough) {
505 		if (hflag)
506 			/* fallthrough on case statement */
507 			warning(220);
508 	}
509 
510 	t = tn->tn_type->t_tspec;
511 	if (t == LONG || t == ULONG ||
512 	    t == LLONG || t == ULLONG) {
513 		if (!allow_c90)
514 			/* case label must be of type 'int' in traditional C */
515 			warning(203);
516 	}
517 
518 	/*
519 	 * get the value of the expression and convert it
520 	 * to the type of the switch expression
521 	 */
522 	v = integer_constant(tn, true);
523 	(void)memset(&nv, 0, sizeof(nv));
524 	convert_constant(CASE, 0, cs->c_switch_type, &nv, v);
525 	free(v);
526 
527 	/* look if we had this value already */
528 	for (cl = cs->c_case_labels; cl != NULL; cl = cl->cl_next) {
529 		if (cl->cl_val.u.integer == nv.u.integer)
530 			break;
531 	}
532 	if (cl != NULL && is_uinteger(nv.v_tspec)) {
533 		/* duplicate case '%lu' in switch */
534 		error(200, (unsigned long)nv.u.integer);
535 	} else if (cl != NULL) {
536 		/* duplicate case '%ld' in switch */
537 		error(199, (long)nv.u.integer);
538 	} else {
539 		check_getopt_case_label(nv.u.integer);
540 
541 		/* append the value to the list of case values */
542 		cl = xcalloc(1, sizeof(*cl));
543 		cl->cl_val = nv;
544 		cl->cl_next = cs->c_case_labels;
545 		cs->c_case_labels = cl;
546 	}
547 }
548 
549 void
case_label(tnode_t * tn)550 case_label(tnode_t *tn)
551 {
552 	control_statement *cs;
553 
554 	/* find the innermost switch statement */
555 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
556 		continue;
557 
558 	check_case_label(tn, cs);
559 
560 	expr_free_all();
561 
562 	set_reached(true);
563 }
564 
565 void
default_label(void)566 default_label(void)
567 {
568 	control_statement *cs;
569 
570 	/* find the innermost switch statement */
571 	for (cs = cstmt; cs != NULL && !cs->c_switch; cs = cs->c_surrounding)
572 		continue;
573 
574 	if (cs == NULL) {
575 		/* default outside switch */
576 		error(201);
577 	} else if (cs->c_default) {
578 		/* duplicate default in switch */
579 		error(202);
580 	} else {
581 		if (reached && !suppress_fallthrough) {
582 			if (hflag)
583 				/* fallthrough on default statement */
584 				warning(284);
585 		}
586 		cs->c_default = true;
587 	}
588 
589 	set_reached(true);
590 }
591 
592 static tnode_t *
check_controlling_expression(tnode_t * tn)593 check_controlling_expression(tnode_t *tn)
594 {
595 
596 	tn = cconv(tn);
597 	if (tn != NULL)
598 		tn = promote(NOOP, false, tn);
599 
600 	if (tn != NULL && !is_scalar(tn->tn_type->t_tspec)) {
601 		/* C99 6.5.15p4 for the ?: operator; see typeok:QUEST */
602 		/* C99 6.8.4.1p1 for if statements */
603 		/* C99 6.8.5p2 for while, do and for loops */
604 		/* controlling expressions must have scalar type */
605 		error(204);
606 		return NULL;
607 	}
608 
609 	if (tn != NULL && Tflag && !is_typeok_bool_compares_with_zero(tn)) {
610 		/* controlling expression must be bool, not '%s' */
611 		error(333, tn->tn_type->t_is_enum ? type_name(tn->tn_type)
612 		    : tspec_name(tn->tn_type->t_tspec));
613 	}
614 
615 	return tn;
616 }
617 
618 void
stmt_if_expr(tnode_t * tn)619 stmt_if_expr(tnode_t *tn)
620 {
621 
622 	if (tn != NULL)
623 		tn = check_controlling_expression(tn);
624 	if (tn != NULL)
625 		expr(tn, false, true, false, false);
626 	begin_control_statement(CS_IF);
627 
628 	if (tn != NULL && tn->tn_op == CON && !tn->tn_system_dependent) {
629 		/* XXX: what if inside 'if (0)'? */
630 		set_reached(constant_is_nonzero(tn));
631 		/* XXX: what about always_else? */
632 		cstmt->c_always_then = reached;
633 	}
634 }
635 
636 void
stmt_if_then_stmt(void)637 stmt_if_then_stmt(void)
638 {
639 
640 	cstmt->c_reached_end_of_then = reached;
641 	/* XXX: what if inside 'if (0)'? */
642 	set_reached(!cstmt->c_always_then);
643 }
644 
645 void
stmt_if_else_stmt(bool els)646 stmt_if_else_stmt(bool els)
647 {
648 	if (cstmt->c_reached_end_of_then)
649 		set_reached(true);
650 	else if (cstmt->c_always_then)
651 		set_reached(false);
652 	else if (!els)
653 		set_reached(true);
654 
655 	end_control_statement(CS_IF);
656 }
657 
658 void
stmt_switch_expr(tnode_t * tn)659 stmt_switch_expr(tnode_t *tn)
660 {
661 	tspec_t t;
662 	type_t *tp;
663 
664 	if (tn != NULL)
665 		tn = cconv(tn);
666 	if (tn != NULL)
667 		tn = promote(NOOP, false, tn);
668 	if (tn != NULL && !is_integer(tn->tn_type->t_tspec)) {
669 		/* switch expression must have integral type */
670 		error(205);
671 		tn = NULL;
672 	}
673 	if (tn != NULL && !allow_c90) {
674 		t = tn->tn_type->t_tspec;
675 		if (t == LONG || t == ULONG || t == LLONG || t == ULLONG) {
676 			/* switch expression must be of type 'int' in ... */
677 			warning(271);
678 		}
679 	}
680 
681 	/*
682 	 * Remember the type of the expression. Because it's possible
683 	 * that (*tp) is allocated on tree memory, the type must be
684 	 * duplicated. This is not too complicated because it is
685 	 * only an integer type.
686 	 */
687 	tp = xcalloc(1, sizeof(*tp));
688 	if (tn != NULL) {
689 		tp->t_tspec = tn->tn_type->t_tspec;
690 		if ((tp->t_is_enum = tn->tn_type->t_is_enum) != false)
691 			tp->t_enum = tn->tn_type->t_enum;
692 	} else {
693 		tp->t_tspec = INT;
694 	}
695 
696 	/* leak the memory, for check_case_label_bitand */
697 	(void)expr_save_memory();
698 
699 	check_getopt_begin_switch();
700 	expr(tn, true, false, false, false);
701 
702 	begin_control_statement(CS_SWITCH);
703 	cstmt->c_switch = true;
704 	cstmt->c_switch_type = tp;
705 	cstmt->c_switch_expr = tn;
706 
707 	set_reached(false);
708 	suppress_fallthrough = true;
709 }
710 
711 void
stmt_switch_expr_stmt(void)712 stmt_switch_expr_stmt(void)
713 {
714 	int nenum = 0, nclab = 0;
715 	sym_t *esym;
716 	case_label_t *cl;
717 
718 	lint_assert(cstmt->c_switch_type != NULL);
719 
720 	if (cstmt->c_switch_type->t_is_enum) {
721 		/*
722 		 * Warn if the number of case labels is different from the
723 		 * number of enumerators.
724 		 */
725 		nenum = nclab = 0;
726 		lint_assert(cstmt->c_switch_type->t_enum != NULL);
727 		for (esym = cstmt->c_switch_type->t_enum->en_first_enumerator;
728 		     esym != NULL; esym = esym->s_next) {
729 			nenum++;
730 		}
731 		for (cl = cstmt->c_case_labels; cl != NULL; cl = cl->cl_next)
732 			nclab++;
733 		if (hflag && eflag && nclab < nenum && !cstmt->c_default) {
734 			/* enumeration value(s) not handled in switch */
735 			warning(206);
736 		}
737 	}
738 
739 	check_getopt_end_switch();
740 
741 	if (cstmt->c_break) {
742 		/*
743 		 * The end of the switch statement is always reached since
744 		 * c_break is only set if a break statement can actually
745 		 * be reached.
746 		 */
747 		set_reached(true);
748 	} else if (cstmt->c_default ||
749 		   (hflag && cstmt->c_switch_type->t_is_enum &&
750 		    nenum == nclab)) {
751 		/*
752 		 * The end of the switch statement is reached if the end
753 		 * of the last statement inside it is reached.
754 		 */
755 	} else {
756 		/*
757 		 * There are possible values that are not handled in the
758 		 * switch statement.
759 		 */
760 		set_reached(true);
761 	}
762 
763 	end_control_statement(CS_SWITCH);
764 }
765 
766 void
stmt_while_expr(tnode_t * tn)767 stmt_while_expr(tnode_t *tn)
768 {
769 	bool body_reached;
770 
771 	if (!reached) {
772 		/* loop not entered at top */
773 		warning(207);
774 		/* FIXME: that's plain wrong. */
775 		set_reached(true);
776 	}
777 
778 	if (tn != NULL)
779 		tn = check_controlling_expression(tn);
780 
781 	begin_control_statement(CS_WHILE);
782 	cstmt->c_loop = true;
783 	cstmt->c_maybe_endless = is_nonzero(tn);
784 	body_reached = !is_zero(tn);
785 
786 	check_getopt_begin_while(tn);
787 	expr(tn, false, true, true, false);
788 
789 	set_reached(body_reached);
790 }
791 
792 void
stmt_while_expr_stmt(void)793 stmt_while_expr_stmt(void)
794 {
795 
796 	/*
797 	 * The end of the loop can be reached if it is no endless loop
798 	 * or there was a break statement which was reached.
799 	 */
800 	set_reached(!cstmt->c_maybe_endless || cstmt->c_break);
801 
802 	check_getopt_end_while();
803 	end_control_statement(CS_WHILE);
804 }
805 
806 void
stmt_do(void)807 stmt_do(void)
808 {
809 
810 	if (!reached) {
811 		/* loop not entered at top */
812 		warning(207);
813 		set_reached(true);
814 	}
815 
816 	begin_control_statement(CS_DO_WHILE);
817 	cstmt->c_loop = true;
818 }
819 
820 void
stmt_do_while_expr(tnode_t * tn)821 stmt_do_while_expr(tnode_t *tn)
822 {
823 
824 	/*
825 	 * If there was a continue statement, the expression controlling the
826 	 * loop is reached.
827 	 */
828 	if (cstmt->c_continue)
829 		set_reached(true);
830 
831 	if (tn != NULL)
832 		tn = check_controlling_expression(tn);
833 
834 	if (tn != NULL && tn->tn_op == CON) {
835 		cstmt->c_maybe_endless = constant_is_nonzero(tn);
836 		if (!cstmt->c_maybe_endless && cstmt->c_continue)
837 			/* continue in 'do ... while (0)' loop */
838 			error(323);
839 	}
840 
841 	expr(tn, false, true, true, true);
842 
843 	if (cstmt->c_maybe_endless)
844 		set_reached(false);
845 	if (cstmt->c_break)
846 		set_reached(true);
847 
848 	end_control_statement(CS_DO_WHILE);
849 }
850 
851 void
stmt_for_exprs(tnode_t * tn1,tnode_t * tn2,tnode_t * tn3)852 stmt_for_exprs(tnode_t *tn1, tnode_t *tn2, tnode_t *tn3)
853 {
854 
855 	/*
856 	 * If there is no initialization expression it is possible that
857 	 * it is intended not to enter the loop at top.
858 	 */
859 	if (tn1 != NULL && !reached) {
860 		/* loop not entered at top */
861 		warning(207);
862 		set_reached(true);
863 	}
864 
865 	begin_control_statement(CS_FOR);
866 	cstmt->c_loop = true;
867 
868 	/*
869 	 * Store the tree memory for the reinitialization expression.
870 	 * Also remember this expression itself. We must check it at
871 	 * the end of the loop to get "used but not set" warnings correct.
872 	 */
873 	cstmt->c_for_expr3_mem = expr_save_memory();
874 	cstmt->c_for_expr3 = tn3;
875 	cstmt->c_for_expr3_pos = curr_pos;
876 	cstmt->c_for_expr3_csrc_pos = csrc_pos;
877 
878 	if (tn1 != NULL)
879 		expr(tn1, false, false, true, false);
880 
881 	if (tn2 != NULL)
882 		tn2 = check_controlling_expression(tn2);
883 	if (tn2 != NULL)
884 		expr(tn2, false, true, true, false);
885 
886 	cstmt->c_maybe_endless = tn2 == NULL || is_nonzero(tn2);
887 
888 	/* The tn3 expression is checked in stmt_for_exprs_stmt. */
889 
890 	set_reached(!is_zero(tn2));
891 }
892 
893 void
stmt_for_exprs_stmt(void)894 stmt_for_exprs_stmt(void)
895 {
896 	pos_t cpos, cspos;
897 	tnode_t *tn3;
898 
899 	if (cstmt->c_continue)
900 		set_reached(true);
901 
902 	cpos = curr_pos;
903 	cspos = csrc_pos;
904 
905 	/* Restore the tree memory for the reinitialization expression */
906 	expr_restore_memory(cstmt->c_for_expr3_mem);
907 	tn3 = cstmt->c_for_expr3;
908 	curr_pos = cstmt->c_for_expr3_pos;
909 	csrc_pos = cstmt->c_for_expr3_csrc_pos;
910 
911 	/* simply "statement not reached" would be confusing */
912 	if (!reached && warn_about_unreachable) {
913 		/* end-of-loop code not reached */
914 		warning(223);
915 		set_reached(true);
916 	}
917 
918 	if (tn3 != NULL) {
919 		expr(tn3, false, false, true, false);
920 	} else {
921 		expr_free_all();
922 	}
923 
924 	curr_pos = cpos;
925 	csrc_pos = cspos;
926 
927 	/* An endless loop without break will never terminate */
928 	/* TODO: What if the loop contains a 'return'? */
929 	set_reached(cstmt->c_break || !cstmt->c_maybe_endless);
930 
931 	end_control_statement(CS_FOR);
932 }
933 
934 void
stmt_goto(sym_t * lab)935 stmt_goto(sym_t *lab)
936 {
937 
938 	mark_as_used(lab, false, false);
939 
940 	check_statement_reachable();
941 
942 	set_reached(false);
943 }
944 
945 void
stmt_break(void)946 stmt_break(void)
947 {
948 	control_statement *cs;
949 
950 	cs = cstmt;
951 	while (cs != NULL && !cs->c_loop && !cs->c_switch)
952 		cs = cs->c_surrounding;
953 
954 	if (cs == NULL) {
955 		/* break outside loop or switch */
956 		error(208);
957 	} else {
958 		if (reached)
959 			cs->c_break = true;
960 	}
961 
962 	if (bflag)
963 		check_statement_reachable();
964 
965 	set_reached(false);
966 }
967 
968 void
stmt_continue(void)969 stmt_continue(void)
970 {
971 	control_statement *cs;
972 
973 	for (cs = cstmt; cs != NULL && !cs->c_loop; cs = cs->c_surrounding)
974 		continue;
975 
976 	if (cs == NULL) {
977 		/* continue outside loop */
978 		error(209);
979 	} else {
980 		/* TODO: only if reachable, for symmetry with c_break */
981 		cs->c_continue = true;
982 	}
983 
984 	check_statement_reachable();
985 
986 	set_reached(false);
987 }
988 
989 static bool
is_parenthesized(const tnode_t * tn)990 is_parenthesized(const tnode_t *tn)
991 {
992 
993 	while (!tn->tn_parenthesized && tn->tn_op == COMMA)
994 		tn = tn->tn_right;
995 	return tn->tn_parenthesized && !tn->tn_sys;
996 }
997 
998 static void
check_return_value(bool sys,tnode_t * tn)999 check_return_value(bool sys, tnode_t *tn)
1000 {
1001 
1002 	if (any_query_enabled && is_parenthesized(tn)) {
1003 		/* parenthesized return value */
1004 		query_message(9);
1005 	}
1006 
1007 	/* Create a temporary node for the left side */
1008 	tnode_t *ln = expr_zero_alloc(sizeof(*ln), "tnode");
1009 	ln->tn_op = NAME;
1010 	ln->tn_type = expr_unqualified_type(funcsym->s_type->t_subt);
1011 	ln->tn_lvalue = true;
1012 	ln->tn_sym = funcsym;	/* better than nothing */
1013 
1014 	tnode_t *retn = build_binary(ln, RETURN, sys, tn);
1015 
1016 	if (retn != NULL) {
1017 		const tnode_t *rn = retn->tn_right;
1018 		while (rn->tn_op == CVT || rn->tn_op == PLUS)
1019 			rn = rn->tn_left;
1020 		if (rn->tn_op == ADDR && rn->tn_left->tn_op == NAME &&
1021 		    rn->tn_left->tn_sym->s_scl == AUTO) {
1022 			/* '%s' returns pointer to automatic object */
1023 			warning(302, funcsym->s_name);
1024 		}
1025 	}
1026 
1027 	expr(retn, true, false, true, false);
1028 }
1029 
1030 void
stmt_return(bool sys,tnode_t * tn)1031 stmt_return(bool sys, tnode_t *tn)
1032 {
1033 	control_statement *cs = cstmt;
1034 
1035 	if (cs == NULL) {
1036 		/* syntax error '%s' */
1037 		error(249, "return outside function");
1038 		return;
1039 	}
1040 
1041 	for (; cs->c_surrounding != NULL; cs = cs->c_surrounding)
1042 		continue;
1043 
1044 	if (tn != NULL)
1045 		cs->c_had_return_value = true;
1046 	else
1047 		cs->c_had_return_noval = true;
1048 
1049 	if (tn != NULL && funcsym->s_type->t_subt->t_tspec == VOID) {
1050 		/* void function '%s' cannot return value */
1051 		error(213, funcsym->s_name);
1052 		expr_free_all();
1053 		tn = NULL;
1054 	} else if (tn == NULL && funcsym->s_type->t_subt->t_tspec != VOID) {
1055 		/*
1056 		 * Assume that the function has a return value only if it
1057 		 * is explicitly declared.
1058 		 */
1059 		if (!funcsym->s_return_type_implicit_int)
1060 			/* function '%s' expects to return value */
1061 			warning(214, funcsym->s_name);
1062 	}
1063 
1064 	if (tn != NULL)
1065 		check_return_value(sys, tn);
1066 	else
1067 		check_statement_reachable();
1068 
1069 	set_reached(false);
1070 }
1071 
1072 /*
1073  * Do some cleanup after a global declaration or definition.
1074  * Especially remove information about unused lint comments.
1075  */
1076 void
global_clean_up_decl(bool silent)1077 global_clean_up_decl(bool silent)
1078 {
1079 
1080 	if (nargusg != -1) {
1081 		if (!silent) {
1082 			/* comment ** %s ** must precede function definition */
1083 			warning_at(282, &argsused_pos, "ARGSUSED");
1084 		}
1085 		nargusg = -1;
1086 	}
1087 	if (nvararg != -1) {
1088 		if (!silent) {
1089 			/* comment ** %s ** must precede function definition */
1090 			warning_at(282, &vapos, "VARARGS");
1091 		}
1092 		nvararg = -1;
1093 	}
1094 	if (printflike_argnum != -1) {
1095 		if (!silent) {
1096 			/* comment ** %s ** must precede function definition */
1097 			warning_at(282, &printflike_pos, "PRINTFLIKE");
1098 		}
1099 		printflike_argnum = -1;
1100 	}
1101 	if (scanflike_argnum != -1) {
1102 		if (!silent) {
1103 			/* comment ** %s ** must precede function definition */
1104 			warning_at(282, &scanflike_pos, "SCANFLIKE");
1105 		}
1106 		scanflike_argnum = -1;
1107 	}
1108 
1109 	dcs->d_asm = false;
1110 
1111 	/*
1112 	 * Needed for BSD yacc in case of parse errors; GNU Bison 3.0.4 is
1113 	 * fine.  See test gcc_attribute.c, function_with_unknown_attribute.
1114 	 */
1115 	in_gcc_attribute = false;
1116 	while (dcs->d_enclosing != NULL)
1117 		end_declaration_level();
1118 }
1119 
1120 /*
1121  * Only the first n arguments of the following function are checked for usage.
1122  * A missing argument is taken to be 0.
1123  */
1124 static void
argsused(int n)1125 argsused(int n)
1126 {
1127 
1128 	if (n == -1)
1129 		n = 0;
1130 
1131 	if (dcs->d_kind != DLK_EXTERN) {
1132 		/* comment ** %s ** must be outside function */
1133 		warning(280, "ARGSUSED");
1134 		return;
1135 	}
1136 	if (nargusg != -1) {
1137 		/* duplicate comment ** %s ** */
1138 		warning(281, "ARGSUSED");
1139 	}
1140 	nargusg = n;
1141 	argsused_pos = curr_pos;
1142 }
1143 
1144 static void
varargs(int n)1145 varargs(int n)
1146 {
1147 
1148 	if (n == -1)
1149 		n = 0;
1150 
1151 	if (dcs->d_kind != DLK_EXTERN) {
1152 		/* comment ** %s ** must be outside function */
1153 		warning(280, "VARARGS");
1154 		return;
1155 	}
1156 	if (nvararg != -1) {
1157 		/* duplicate comment ** %s ** */
1158 		warning(281, "VARARGS");
1159 	}
1160 	nvararg = n;
1161 	vapos = curr_pos;
1162 }
1163 
1164 /*
1165  * Check all arguments until the (n-1)-th as usual. The n-th argument is
1166  * used the check the types of remaining arguments.
1167  */
1168 static void
printflike(int n)1169 printflike(int n)
1170 {
1171 
1172 	if (n == -1)
1173 		n = 0;
1174 
1175 	if (dcs->d_kind != DLK_EXTERN) {
1176 		/* comment ** %s ** must be outside function */
1177 		warning(280, "PRINTFLIKE");
1178 		return;
1179 	}
1180 	if (printflike_argnum != -1) {
1181 		/* duplicate comment ** %s ** */
1182 		warning(281, "PRINTFLIKE");
1183 	}
1184 	printflike_argnum = n;
1185 	printflike_pos = curr_pos;
1186 }
1187 
1188 /*
1189  * Check all arguments until the (n-1)-th as usual. The n-th argument is
1190  * used the check the types of remaining arguments.
1191  */
1192 static void
scanflike(int n)1193 scanflike(int n)
1194 {
1195 
1196 	if (n == -1)
1197 		n = 0;
1198 
1199 	if (dcs->d_kind != DLK_EXTERN) {
1200 		/* comment ** %s ** must be outside function */
1201 		warning(280, "SCANFLIKE");
1202 		return;
1203 	}
1204 	if (scanflike_argnum != -1) {
1205 		/* duplicate comment ** %s ** */
1206 		warning(281, "SCANFLIKE");
1207 	}
1208 	scanflike_argnum = n;
1209 	scanflike_pos = curr_pos;
1210 }
1211 
1212 static void
lintlib(void)1213 lintlib(void)
1214 {
1215 
1216 	if (dcs->d_kind != DLK_EXTERN) {
1217 		/* comment ** %s ** must be outside function */
1218 		warning(280, "LINTLIBRARY");
1219 		return;
1220 	}
1221 	llibflg = true;
1222 	vflag = true;
1223 }
1224 
1225 /*
1226  * PROTOLIB in conjunction with LINTLIBRARY can be used to handle
1227  * prototypes like function definitions. This is done if the argument
1228  * to PROTOLIB is nonzero. Otherwise, prototypes are handled normally.
1229  */
1230 static void
protolib(int n)1231 protolib(int n)
1232 {
1233 
1234 	if (dcs->d_kind != DLK_EXTERN) {
1235 		/* comment ** %s ** must be outside function */
1236 		warning(280, "PROTOLIB");
1237 		return;
1238 	}
1239 	plibflg = n != 0;
1240 }
1241 
1242 void
handle_lint_comment(lint_comment comment,int arg)1243 handle_lint_comment(lint_comment comment, int arg)
1244 {
1245 	switch (comment) {
1246 	case LC_ARGSUSED:	argsused(arg);			break;
1247 	case LC_BITFIELDTYPE:	suppress_bitfieldtype = true;	break;
1248 	case LC_CONSTCOND:	suppress_constcond = true;	break;
1249 	case LC_FALLTHROUGH:	suppress_fallthrough = true;	break;
1250 	case LC_LINTLIBRARY:	lintlib();			break;
1251 	case LC_LINTED:		debug_step("set lwarn %d", arg);
1252 				lwarn = arg;			break;
1253 	case LC_LONGLONG:	suppress_longlong = true;	break;
1254 	case LC_NOTREACHED:	set_reached(false);
1255 				warn_about_unreachable = false;	break;
1256 	case LC_PRINTFLIKE:	printflike(arg);		break;
1257 	case LC_PROTOLIB:	protolib(arg);			break;
1258 	case LC_SCANFLIKE:	scanflike(arg);			break;
1259 	case LC_VARARGS:	varargs(arg);			break;
1260 	}
1261 }
1262