1 // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs %s
2 // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs -fno-signed-char %s
3 
4 #include <stdarg.h>
5 #include <stddef.h>
6 #define __need_wint_t
7 #include <stddef.h> // For wint_t and wchar_t
8 
9 typedef struct _FILE FILE;
10 int fprintf(FILE *, const char *restrict, ...);
11 int printf(const char *restrict, ...); // expected-note{{passing argument to parameter here}}
12 int snprintf(char *restrict, size_t, const char *restrict, ...);
13 int sprintf(char *restrict, const char *restrict, ...);
14 int vasprintf(char **, const char *, va_list);
15 int asprintf(char **, const char *, ...);
16 int vfprintf(FILE *, const char *restrict, va_list);
17 int vprintf(const char *restrict, va_list);
18 int vsnprintf(char *, size_t, const char *, va_list);
19 int vsprintf(char *restrict, const char *restrict, va_list); // expected-note{{passing argument to parameter here}}
20 
21 int vscanf(const char *restrict format, va_list arg);
22 
23 char * global_fmt;
24 
check_string_literal(FILE * fp,const char * s,char * buf,...)25 void check_string_literal( FILE* fp, const char* s, char *buf, ... ) {
26 
27   char * b;
28   va_list ap;
29   va_start(ap,buf);
30 
31   printf(s); // expected-warning {{format string is not a string literal}}
32   // expected-note@-1{{treat the string as an argument to avoid this}}
33   vprintf(s,ap); // expected-warning {{format string is not a string literal}}
34   fprintf(fp,s); // expected-warning {{format string is not a string literal}}
35   // expected-note@-1{{treat the string as an argument to avoid this}}
36   vfprintf(fp,s,ap); // expected-warning {{format string is not a string literal}}
37   asprintf(&b,s); // expected-warning {{format string is not a string lit}}
38   // expected-note@-1{{treat the string as an argument to avoid this}}
39   vasprintf(&b,s,ap); // expected-warning {{format string is not a string literal}}
40   sprintf(buf,s); // expected-warning {{format string is not a string literal}}
41   // expected-note@-1{{treat the string as an argument to avoid this}}
42   snprintf(buf,2,s); // expected-warning {{format string is not a string lit}}
43   // expected-note@-1{{treat the string as an argument to avoid this}}
44   __builtin___sprintf_chk(buf,0,-1,s); // expected-warning {{format string is not a string literal}}
45   // expected-note@-1{{treat the string as an argument to avoid this}}
46   __builtin___snprintf_chk(buf,2,0,-1,s); // expected-warning {{format string is not a string lit}}
47   // expected-note@-1{{treat the string as an argument to avoid this}}
48   vsprintf(buf,s,ap); // expected-warning {{format string is not a string lit}}
49   vsnprintf(buf,2,s,ap); // expected-warning {{format string is not a string lit}}
50   vsnprintf(buf,2,global_fmt,ap); // expected-warning {{format string is not a string literal}}
51   __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // expected-warning {{format string is not a string lit}}
52   __builtin___vsnprintf_chk(buf,2,0,-1,global_fmt,ap); // expected-warning {{format string is not a string literal}}
53 
54   vscanf(s, ap); // expected-warning {{format string is not a string literal}}
55 
56   const char *const fmt = "%d"; // FIXME -- defined here
57   printf(fmt, 1, 2); // expected-warning{{data argument not used}}
58 
59   // rdar://6079877
60   printf("abc"
61          "%*d", 1, 1); // no-warning
62   printf("abc\
63 def"
64          "%*d", 1, 1); // no-warning
65 
66   // <rdar://problem/6079850>, allow 'unsigned' (instead of 'int') to be used for both
67   // the field width and precision.  This deviates from C99, but is reasonably safe
68   // and is also accepted by GCC.
69   printf("%*d", (unsigned) 1, 1); // no-warning
70 }
71 
72 // When calling a non-variadic format function (vprintf, vscanf, NSLogv, ...),
73 // warn only if the format string argument is a parameter that is not itself
74 // declared as a format string with compatible format.
75 __attribute__((__format__ (__printf__, 2, 4)))
check_string_literal2(FILE * fp,const char * s,char * buf,...)76 void check_string_literal2( FILE* fp, const char* s, char *buf, ... ) {
77   char * b;
78   va_list ap;
79   va_start(ap,buf);
80 
81   printf(s); // expected-warning {{format string is not a string literal}}
82   // expected-note@-1{{treat the string as an argument to avoid this}}
83   vprintf(s,ap); // no-warning
84   fprintf(fp,s); // expected-warning {{format string is not a string literal}}
85   // expected-note@-1{{treat the string as an argument to avoid this}}
86   vfprintf(fp,s,ap); // no-warning
87   asprintf(&b,s); // expected-warning {{format string is not a string lit}}
88   // expected-note@-1{{treat the string as an argument to avoid this}}
89   vasprintf(&b,s,ap); // no-warning
90   sprintf(buf,s); // expected-warning {{format string is not a string literal}}
91   // expected-note@-1{{treat the string as an argument to avoid this}}
92   snprintf(buf,2,s); // expected-warning {{format string is not a string lit}}
93   // expected-note@-1{{treat the string as an argument to avoid this}}
94   __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // no-warning
95 
96   vscanf(s, ap); // expected-warning {{format string is not a string literal}}
97 }
98 
check_conditional_literal(const char * s,int i)99 void check_conditional_literal(const char* s, int i) {
100   printf(i == 1 ? "yes" : "no"); // no-warning
101   printf(i == 0 ? (i == 1 ? "yes" : "no") : "dont know"); // no-warning
102   printf(i == 0 ? (i == 1 ? s : "no") : "dont know"); // expected-warning{{format string is not a string literal}}
103   // expected-note@-1{{treat the string as an argument to avoid this}}
104   printf("yes" ?: "no %d", 1); // expected-warning{{data argument not used by format string}}
105   printf(0 ? "yes %s" : "no %d", 1); // no-warning
106   printf(0 ? "yes %d" : "no %s", 1); // expected-warning{{format specifies type 'char *'}}
107 
108   printf(0 ? "yes" : "no %d", 1); // no-warning
109   printf(0 ? "yes %d" : "no", 1); // expected-warning{{data argument not used by format string}}
110   printf(1 ? "yes" : "no %d", 1); // expected-warning{{data argument not used by format string}}
111   printf(1 ? "yes %d" : "no", 1); // no-warning
112   printf(i ? "yes" : "no %d", 1); // no-warning
113   printf(i ? "yes %s" : "no %d", 1); // expected-warning{{format specifies type 'char *'}}
114   printf(i ? "yes" : "no %d", 1, 2); // expected-warning{{data argument not used by format string}}
115 
116   printf(i ? "%*s" : "-", i, s); // no-warning
117   printf(i ? "yes" : 0 ? "no %*d" : "dont know %d", 1, 2); // expected-warning{{data argument not used by format string}}
118   printf(i ? "%i\n" : "%i %s %s\n", i, s); // expected-warning{{more '%' conversions than data arguments}}
119 }
120 
check_writeback_specifier()121 void check_writeback_specifier()
122 {
123   int x;
124   char *b;
125   printf("%n", b); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
126   printf("%n", &x); // no-warning
127 
128   printf("%hhn", (signed char*)0); // no-warning
129   printf("%hhn", (char*)0); // no-warning
130   printf("%hhn", (unsigned char*)0); // no-warning
131   printf("%hhn", (int*)0); // expected-warning{{format specifies type 'signed char *' but the argument has type 'int *'}}
132 
133   printf("%hn", (short*)0); // no-warning
134   printf("%hn", (unsigned short*)0); // no-warning
135   printf("%hn", (int*)0); // expected-warning{{format specifies type 'short *' but the argument has type 'int *'}}
136 
137   printf("%n", (int*)0); // no-warning
138   printf("%n", (unsigned int*)0); // no-warning
139   printf("%n", (char*)0); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
140 
141   printf("%ln", (long*)0); // no-warning
142   printf("%ln", (unsigned long*)0); // no-warning
143   printf("%ln", (int*)0); // expected-warning{{format specifies type 'long *' but the argument has type 'int *'}}
144 
145   printf("%lln", (long long*)0); // no-warning
146   printf("%lln", (unsigned long long*)0); // no-warning
147   printf("%lln", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
148 
149   printf("%qn", (long long*)0); // no-warning
150   printf("%qn", (unsigned long long*)0); // no-warning
151   printf("%qn", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
152 
153   printf("%Ln", 0); // expected-warning{{length modifier 'L' results in undefined behavior or no effect with 'n' conversion specifier}}
154   // expected-note@-1{{did you mean to use 'll'?}}
155 }
156 
check_invalid_specifier(FILE * fp,char * buf)157 void check_invalid_specifier(FILE* fp, char *buf)
158 {
159   printf("%s%lb%d","unix",10,20); // expected-warning {{invalid conversion specifier 'b'}} expected-warning {{data argument not used by format string}}
160   fprintf(fp,"%%%l"); // expected-warning {{incomplete format specifier}}
161   sprintf(buf,"%%%%%ld%d%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}}
162   snprintf(buf, 2, "%%%%%ld%;%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}} expected-warning {{invalid conversion specifier ';'}} expected-warning {{data argument not used by format string}}
163 }
164 
check_null_char_string(char * b)165 void check_null_char_string(char* b)
166 {
167   printf("\0this is bogus%d",1); // expected-warning {{string contains '\0'}}
168   snprintf(b,10,"%%%%%d\0%d",1,2); // expected-warning {{string contains '\0'}}
169   printf("%\0d",1); // expected-warning {{string contains '\0'}}
170 }
171 
check_empty_format_string(char * buf,...)172 void check_empty_format_string(char* buf, ...)
173 {
174   va_list ap;
175   va_start(ap,buf);
176   vprintf("",ap); // expected-warning {{format string is empty}}
177   sprintf(buf, "", 1); // expected-warning {{format string is empty}}
178 
179   // Don't warn about empty format strings when there are no data arguments.
180   // This can arise from macro expansions and non-standard format string
181   // functions.
182   sprintf(buf, ""); // no-warning
183 }
184 
check_wide_string(char * b,...)185 void check_wide_string(char* b, ...)
186 {
187   va_list ap;
188   va_start(ap,b);
189 
190   printf(L"foo %d",2); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}}
191   vsprintf(b,L"bar %d",ap); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}}
192 }
193 
check_asterisk_precision_width(int x)194 void check_asterisk_precision_width(int x) {
195   printf("%*d"); // expected-warning {{'*' specified field width is missing a matching 'int' argument}}
196   printf("%.*d"); // expected-warning {{'.*' specified field precision is missing a matching 'int' argument}}
197   printf("%*d",12,x); // no-warning
198   printf("%*d","foo",x); // expected-warning {{field width should have type 'int', but argument has type 'char *'}}
199   printf("%.*d","foo",x); // expected-warning {{field precision should have type 'int', but argument has type 'char *'}}
200 }
201 
202 void __attribute__((format(printf,1,3))) myprintf(const char*, int blah, ...);
203 
test_myprintf()204 void test_myprintf() {
205   myprintf("%d", 17, 18); // okay
206 }
207 
test_constant_bindings(void)208 void test_constant_bindings(void) {
209   const char * const s1 = "hello";
210   const char s2[] = "hello";
211   const char *s3 = "hello";
212   char * const s4 = "hello";
213   extern const char s5[];
214 
215   printf(s1); // no-warning
216   printf(s2); // no-warning
217   printf(s3); // expected-warning{{not a string literal}}
218   // expected-note@-1{{treat the string as an argument to avoid this}}
219   printf(s4); // expected-warning{{not a string literal}}
220   // expected-note@-1{{treat the string as an argument to avoid this}}
221   printf(s5); // expected-warning{{not a string literal}}
222   // expected-note@-1{{treat the string as an argument to avoid this}}
223 }
224 
225 
226 // Test what happens when -Wformat-security only.
227 #pragma GCC diagnostic ignored "-Wformat-nonliteral"
228 #pragma GCC diagnostic warning "-Wformat-security"
229 
test9(char * P)230 void test9(char *P) {
231   int x;
232   printf(P);   // expected-warning {{format string is not a string literal (potentially insecure)}}
233   // expected-note@-1{{treat the string as an argument to avoid this}}
234   printf(P, 42);
235 }
236 
torture(va_list v8)237 void torture(va_list v8) {
238   vprintf ("%*.*d", v8);  // no-warning
239 
240 }
241 
test10(int x,float f,int i,long long lli)242 void test10(int x, float f, int i, long long lli) {
243   printf("%s"); // expected-warning{{more '%' conversions than data arguments}}
244   printf("%@", 12); // expected-warning{{invalid conversion specifier '@'}}
245   printf("\0"); // expected-warning{{format string contains '\0' within the string body}}
246   printf("xs\0"); // expected-warning{{format string contains '\0' within the string body}}
247   printf("%*d\n"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
248   printf("%*.*d\n", x); // expected-warning{{'.*' specified field precision is missing a matching 'int' argument}}
249   printf("%*d\n", f, x); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
250   printf("%*.*d\n", x, f, x); // expected-warning{{field precision should have type 'int', but argument has type 'double'}}
251   printf("%**\n"); // expected-warning{{invalid conversion specifier '*'}}
252   printf("%d%d\n", x); // expected-warning{{more '%' conversions than data arguments}}
253   printf("%d\n", x, x); // expected-warning{{data argument not used by format string}}
254   printf("%W%d\n", x, x); // expected-warning{{invalid conversion specifier 'W'}}  expected-warning {{data argument not used by format string}}
255   printf("%"); // expected-warning{{incomplete format specifier}}
256   printf("%.d", x); // no-warning
257   printf("%.", x);  // expected-warning{{incomplete format specifier}}
258   printf("%f", 4); // expected-warning{{format specifies type 'double' but the argument has type 'int'}}
259   printf("%qd", lli); // no-warning
260   printf("%qd", x); // expected-warning{{format specifies type 'long long' but the argument has type 'int'}}
261   printf("%qp", (void *)0); // expected-warning{{length modifier 'q' results in undefined behavior or no effect with 'p' conversion specifier}}
262   printf("hhX %hhX", (unsigned char)10); // no-warning
263   printf("llX %llX", (long long) 10); // no-warning
264   // This is fine, because there is an implicit conversion to an int.
265   printf("%d", (unsigned char) 10); // no-warning
266   printf("%d", (long long) 10); // expected-warning{{format specifies type 'int' but the argument has type 'long long'}}
267   printf("%Lf\n", (long double) 1.0); // no-warning
268   printf("%f\n", (long double) 1.0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}}
269   // The man page says that a zero precision is okay.
270   printf("%.0Lf", (long double) 1.0); // no-warning
271   printf("%c\n", "x"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}}
272   printf("%c\n", 1.23); // expected-warning{{format specifies type 'int' but the argument has type 'double'}}
273   printf("Format %d, is %! %f", 1, 4.4); // expected-warning{{invalid conversion specifier '!'}}
274 }
275 
276 typedef unsigned char uint8_t;
277 
should_understand_small_integers()278 void should_understand_small_integers() {
279   printf("%hhu", (short) 10); // expected-warning{{format specifies type 'unsigned char' but the argument has type 'short'}}
280   printf("%hu\n", (unsigned char)1); // warning with -Wformat-pedantic only
281   printf("%hu\n", (uint8_t)1);       // warning with -Wformat-pedantic only
282 }
283 
test11(void * p,char * s)284 void test11(void *p, char *s) {
285   printf("%p", p); // no-warning
286   printf("%p", 123); // expected-warning{{format specifies type 'void *' but the argument has type 'int'}}
287   printf("%.4p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
288   printf("%+p", p); // expected-warning{{flag '+' results in undefined behavior with 'p' conversion specifier}}
289   printf("% p", p); // expected-warning{{flag ' ' results in undefined behavior with 'p' conversion specifier}}
290   printf("%0p", p); // expected-warning{{flag '0' results in undefined behavior with 'p' conversion specifier}}
291   printf("%s", s); // no-warning
292   printf("%+s", p); // expected-warning{{flag '+' results in undefined behavior with 's' conversion specifier}}
293                     // expected-warning@-1 {{format specifies type 'char *' but the argument has type 'void *'}}
294   printf("% s", p); // expected-warning{{flag ' ' results in undefined behavior with 's' conversion specifier}}
295                     // expected-warning@-1 {{format specifies type 'char *' but the argument has type 'void *'}}
296   printf("%0s", p); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
297                     // expected-warning@-1 {{format specifies type 'char *' but the argument has type 'void *'}}
298 }
299 
test12(char * b)300 void test12(char *b) {
301   unsigned char buf[4];
302   printf ("%.4s\n", buf); // no-warning
303   printf ("%.4s\n", &buf); // expected-warning{{format specifies type 'char *' but the argument has type 'unsigned char (*)[4]'}}
304 
305   // Verify that we are checking asprintf
306   asprintf(&b, "%d", "asprintf"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}}
307 }
308 
test13(short x)309 void test13(short x) {
310   char bel = 007;
311   printf("bel: '0%hhd'\n", bel); // no-warning
312   printf("x: '0%hhd'\n", x); // expected-warning {{format specifies type 'char' but the argument has type 'short'}}
313 }
314 
315 typedef struct __aslclient *aslclient;
316 typedef struct __aslmsg *aslmsg;
317 int asl_log(aslclient asl, aslmsg msg, int level, const char *format, ...) __attribute__((__format__ (__printf__, 4, 5)));
test_asl(aslclient asl)318 void test_asl(aslclient asl) {
319   // Test case from <rdar://problem/7341605>.
320   asl_log(asl, 0, 3, "Error: %m"); // no-warning
321   asl_log(asl, 0, 3, "Error: %W"); // expected-warning{{invalid conversion specifier 'W'}}
322 }
323 
324 // <rdar://problem/7595366>
325 typedef enum { A } int_t;
f0(int_t x)326 void f0(int_t x) { printf("%d\n", x); }
327 
328 // Unicode test cases.  These are possibly specific to Mac OS X.  If so, they should
329 // eventually be moved into a separate test.
330 
test_unicode_conversions(wchar_t * s)331 void test_unicode_conversions(wchar_t *s) {
332   printf("%S", s); // no-warning
333   printf("%s", s); // expected-warning{{format specifies type 'char *' but the argument has type 'wchar_t *'}}
334   printf("%C", s[0]); // no-warning
335 #if defined(__sun) && !defined(__LP64__)
336   printf("%c", s[0]); // expected-warning{{format specifies type 'int' but the argument has type 'wchar_t' (aka 'long')}}
337 #else
338   printf("%c", s[0]);
339 #endif
340   // FIXME: This test reports inconsistent results. On Windows, '%C' expects
341   // 'unsigned short'.
342   // printf("%C", 10);
343   printf("%S", "hello"); // expected-warning{{but the argument has type 'char *'}}
344 }
345 
346 // Mac OS X supports positional arguments in format strings.
347 // This is an IEEE extension (IEEE Std 1003.1).
348 // FIXME: This is probably not portable everywhere.
test_positional_arguments()349 void test_positional_arguments() {
350   printf("%0$", (int)2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
351   printf("%1$*0$d", (int) 2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
352   printf("%1$d", (int) 2); // no-warning
353   printf("%1$d", (int) 2, 2); // expected-warning{{data argument not used by format string}}
354   printf("%1$d%1$f", (int) 2); // expected-warning{{format specifies type 'double' but the argument has type 'int'}}
355   printf("%1$2.2d", (int) 2); // no-warning
356   printf("%2$*1$.2d", (int) 2, (int) 3); // no-warning
357   printf("%2$*8$d", (int) 2, (int) 3); // expected-warning{{specified field width is missing a matching 'int' argument}}
358   printf("%%%1$d", (int) 2); // no-warning
359   printf("%1$d%%", (int) 2); // no-warning
360 }
361 
362 // PR 6697 - Handle format strings where the data argument is not adjacent to the format string
363 void myprintf_PR_6697(const char *format, int x, ...) __attribute__((__format__(printf,1, 3)));
test_pr_6697()364 void test_pr_6697() {
365   myprintf_PR_6697("%s\n", 1, "foo"); // no-warning
366   myprintf_PR_6697("%s\n", 1, (int)0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
367   // FIXME: Not everything should clearly support positional arguments,
368   // but we need a way to identify those cases.
369   myprintf_PR_6697("%1$s\n", 1, "foo"); // no-warning
370   myprintf_PR_6697("%2$s\n", 1, "foo"); // expected-warning{{data argument position '2' exceeds the number of data arguments (1)}}
371   myprintf_PR_6697("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (1)}}
372   myprintf_PR_6697("%1$s\n", 1, (int) 0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
373 }
374 
rdar8026030(FILE * fp)375 void rdar8026030(FILE *fp) {
376   fprintf(fp, "\%"); // expected-warning{{incomplete format specifier}}
377 }
378 
bug7377_bad_length_mod_usage()379 void bug7377_bad_length_mod_usage() {
380   // Bad length modifiers
381   printf("%hhs", "foo"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
382   printf("%1$zp", (void *)0); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}}
383   printf("%ls", L"foo"); // no-warning
384   printf("%#.2Lf", (long double)1.234); // no-warning
385 
386   // Bad flag usage
387   printf("%#p", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'p' conversion specifier}}
388   printf("%0d", -1); // no-warning
389   printf("%#n", (int *) 0); // expected-warning{{flag '#' results in undefined behavior with 'n' conversion specifier}}
390   printf("%-n", (int *) 0); // expected-warning{{flag '-' results in undefined behavior with 'n' conversion specifier}}
391   printf("%-p", (void *) 0); // no-warning
392 
393   // Bad optional amount use
394   printf("%.2c", 'a'); // expected-warning{{precision used with 'c' conversion specifier, resulting in undefined behavior}}
395   printf("%1n", (int *) 0); // expected-warning{{field width used with 'n' conversion specifier, resulting in undefined behavior}}
396   printf("%.9n", (int *) 0); // expected-warning{{precision used with 'n' conversion specifier, resulting in undefined behavior}}
397 
398   // Ignored flags
399   printf("% +f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
400   printf("%+ f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
401   printf("%0-f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
402   printf("%-0f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
403   printf("%-+f", 1.23); // no-warning
404 }
405 
406 // PR 7981 - handle '%lc' (wint_t)
407 
pr7981(wint_t c,wchar_t c2)408 void pr7981(wint_t c, wchar_t c2) {
409   printf("%lc", c); // no-warning
410   printf("%lc", 1.0); // expected-warning{{the argument has type 'double'}}
411 #if __WINT_WIDTH__ == 32 && !(defined(__sun) && !defined(__LP64__))
412   printf("%lc", (char) 1); // no-warning
413 #else
414   printf("%lc", (char) 1); // expected-warning{{the argument has type 'char'}}
415 #endif
416   printf("%lc", &c); // expected-warning{{the argument has type 'wint_t *'}}
417   // If wint_t and wchar_t are the same width and wint_t is signed where
418   // wchar_t is unsigned, an implicit conversion isn't possible.
419 #if defined(__WINT_UNSIGNED__) || !defined(__WCHAR_UNSIGNED__) ||   \
420   __WINT_WIDTH__ > __WCHAR_WIDTH__
421   printf("%lc", c2); // no-warning
422 #endif
423 }
424 
425 // <rdar://problem/8269537> -Wformat-security says NULL is not a string literal
rdar8269537()426 void rdar8269537() {
427   // This is likely to crash in most cases, but -Wformat-nonliteral technically
428   // doesn't warn in this case.
429   printf(0); // no-warning
430 }
431 
432 // Handle functions with multiple format attributes.
433 extern void rdar8332221_vprintf_scanf(const char *, va_list, const char *, ...)
434      __attribute__((__format__(__printf__, 1, 0)))
435      __attribute__((__format__(__scanf__, 3, 4)));
436 
rdar8332221(va_list ap,int * x,long * y)437 void rdar8332221(va_list ap, int *x, long *y) {
438   rdar8332221_vprintf_scanf("%", ap, "%d", x); // expected-warning{{incomplete format specifier}}
439 }
440 
441 // PR8641
pr8641()442 void pr8641() {
443   printf("%#x\n", 10);
444   printf("%#X\n", 10);
445 }
446 
posix_extensions()447 void posix_extensions() {
448   // Test %'d, "thousands grouping".
449   // <rdar://problem/8816343>
450   printf("%'d\n", 123456789); // no-warning
451   printf("%'i\n", 123456789); // no-warning
452   printf("%'f\n", (float) 1.0); // no-warning
453   printf("%'p\n", (void*) 0); // expected-warning{{results in undefined behavior with 'p' conversion specifier}}
454 }
455 
456 // PR8486
457 //
458 // Test what happens when -Wformat is on, but -Wformat-security is off.
459 #pragma GCC diagnostic warning "-Wformat"
460 #pragma GCC diagnostic ignored "-Wformat-security"
461 
pr8486()462 void pr8486() {
463   printf("%s", 1); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
464 }
465 
466 // PR9314
467 // Don't warn about string literals that are PreDefinedExprs, e.g. __func__.
pr9314()468 void pr9314() {
469   printf(__PRETTY_FUNCTION__); // no-warning
470   printf(__func__); // no-warning
471 }
472 
473 int printf(const char * restrict, ...) __attribute__((__format__ (__printf__, 1, 2)));
474 
rdar9612060(void)475 void rdar9612060(void) {
476   printf("%s", 2); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
477 }
478 
check_char(unsigned char x,signed char y)479 void check_char(unsigned char x, signed char y) {
480   printf("%c", y); // no-warning
481   printf("%hhu", x); // no-warning
482   printf("%hhi", y); // no-warning
483   printf("%hhi", x); // no-warning
484   printf("%c", x); // no-warning
485   printf("%hhu", y); // no-warning
486 }
487 
488 // Test suppression of individual warnings.
489 
test_suppress_invalid_specifier()490 void test_suppress_invalid_specifier() {
491 #pragma clang diagnostic push
492 #pragma clang diagnostic ignored "-Wformat-invalid-specifier"
493   printf("%@", 12); // no-warning
494 #pragma clang diagnostic pop
495 }
496 
497 // Make sure warnings are on for next test.
498 #pragma GCC diagnostic warning "-Wformat"
499 #pragma GCC diagnostic warning "-Wformat-security"
500 
501 // Test that the printf call site is where the warning is attached.  If the
502 // format string is somewhere else, point to it in a note.
pr9751()503 void pr9751() {
504   const char kFormat1[] = "%d %d \n"; // expected-note{{format string is defined here}}}
505   printf(kFormat1, 0); // expected-warning{{more '%' conversions than data arguments}}
506   printf("%d %s\n", 0); // expected-warning{{more '%' conversions than data arguments}}
507 
508   const char kFormat2[] = "%18$s\n"; // expected-note{{format string is defined here}}
509   printf(kFormat2, 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}}
510   printf("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}}
511 
512   const char kFormat4[] = "%y"; // expected-note{{format string is defined here}}
513   printf(kFormat4, 5); // expected-warning{{invalid conversion specifier 'y'}}
514   printf("%y", 5); // expected-warning{{invalid conversion specifier 'y'}}
515 
516   const char kFormat5[] = "%."; // expected-note{{format string is defined here}}
517   printf(kFormat5, 5); // expected-warning{{incomplete format specifier}}
518   printf("%.", 5); // expected-warning{{incomplete format specifier}}
519 
520   const char kFormat6[] = "%s"; // expected-note{{format string is defined here}}
521   printf(kFormat6, 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
522   printf("%s", 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
523 
524   const char kFormat7[] = "%0$"; // expected-note{{format string is defined here}}
525   printf(kFormat7, 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
526   printf("%0$", 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
527 
528   const char kFormat8[] = "%1$d %d"; // expected-note{{format string is defined here}}
529   printf(kFormat8, 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}}
530   printf("%1$d %d", 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}}
531 
532   const char kFormat9[] = ""; // expected-note{{format string is defined here}}
533   printf(kFormat9, 4, 4); // expected-warning{{format string is empty}}
534   printf("", 4, 4); // expected-warning{{format string is empty}}
535 
536   const char kFormat10[] = "\0%d"; // expected-note{{format string is defined here}}
537   printf(kFormat10, 4); // expected-warning{{format string contains '\0' within the string body}}
538   printf("\0%d", 4); // expected-warning{{format string contains '\0' within the string body}}
539 
540   const char kFormat11[] = "%*d"; // expected-note{{format string is defined here}}
541   printf(kFormat11); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
542   printf("%*d"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
543 
544   const char kFormat12[] = "%*d"; // expected-note{{format string is defined here}}
545   printf(kFormat12, 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
546   printf("%*d", 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
547 
548   const char kFormat13[] = "%.3p"; // expected-note{{format string is defined here}}
549   void *p;
550   printf(kFormat13, p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
551   printf("%.3p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
552 
553   const char kFormat14[] = "%0s"; // expected-note{{format string is defined here}}
554   printf(kFormat14, "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
555   printf("%0s", "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
556 
557   const char kFormat15[] = "%hhs"; // expected-note{{format string is defined here}}
558   printf(kFormat15, "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
559   printf("%hhs", "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
560 
561   const char kFormat16[] = "%-0d"; // expected-note{{format string is defined here}}
562   printf(kFormat16, 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
563   printf("%-0d", 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
564 
565   // Make sure that the "format string is defined here" note is not emitted
566   // when the original string is within the argument expression.
567   printf(1 ? "yes %d" : "no %d"); // expected-warning{{more '%' conversions than data arguments}}
568 
569   const char kFormat17[] = "%hu"; // expected-note{{format string is defined here}}}
570   printf(kFormat17, (int[]){0}); // expected-warning{{format specifies type 'unsigned short' but the argument}}
571 
572   printf("%a", (long double)0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}}
573 
574   // Test braced char[] initializers.
575   const char kFormat18[] = { "%lld" }; // expected-note{{format string is defined here}}
576   printf(kFormat18, 0); // expected-warning{{format specifies type}}
577 
578   // Make sure we point at the offending argument rather than the format string.
579   const char kFormat19[] = "%d";  // expected-note{{format string is defined here}}
580   printf(kFormat19,
581          0.0); // expected-warning{{format specifies}}
582 }
583 
pr18905()584 void pr18905() {
585   const char s1[] = "s\0%s"; // expected-note{{format string is defined here}}
586   const char s2[1] = "s"; // expected-note{{format string is defined here}}
587   const char s3[2] = "s\0%s"; // expected-warning{{initializer-string for char array is too long}}
588   const char s4[10] = "s";
589   const char s5[0] = "%s"; // expected-warning{{initializer-string for char array is too long}}
590                            // expected-note@-1{{format string is defined here}}
591 
592   printf(s1); // expected-warning{{format string contains '\0' within the string body}}
593   printf(s2); // expected-warning{{format string is not null-terminated}}
594   printf(s3); // no-warning
595   printf(s4); // no-warning
596   printf(s5); // expected-warning{{format string is not null-terminated}}
597 }
598 
599 void __attribute__((format(strfmon,1,2))) monformat(const char *fmt, ...);
600 void __attribute__((format(strftime,1,0))) dateformat(const char *fmt);
601 
602 // Other formats
test_other_formats()603 void test_other_formats() {
604   char *str = "";
605   monformat("", 1); // expected-warning{{format string is empty}}
606   monformat(str); // expected-warning{{format string is not a string literal (potentially insecure)}}
607   dateformat(""); // expected-warning{{format string is empty}}
608   dateformat(str); // no-warning (using strftime non-literal is not unsafe)
609 }
610 
611 // Do not warn about unused arguments coming from system headers.
612 // <rdar://problem/11317765>
613 #include <format-unused-system-args.h>
test_unused_system_args(int x)614 void test_unused_system_args(int x) {
615   PRINT1("%d\n", x); // no-warning{{extra argument is system header is OK}}
616 }
617 
pr12761(char c)618 void pr12761(char c) {
619   // This should not warn even with -fno-signed-char.
620   printf("%hhx", c);
621 }
622 
test_opencl_vector_format(int x)623 void test_opencl_vector_format(int x) {
624   printf("%v4d", x); // expected-warning{{invalid conversion specifier 'v'}}
625   printf("%vd", x); // expected-warning{{invalid conversion specifier 'v'}}
626   printf("%0vd", x); // expected-warning{{invalid conversion specifier 'v'}}
627   printf("%hlf", x); // expected-warning{{invalid conversion specifier 'l'}}
628   printf("%hld", x); // expected-warning{{invalid conversion specifier 'l'}}
629 }
630 
631 // Test that we correctly merge the format in both orders.
632 extern void test14_foo(const char *, const char *, ...)
633      __attribute__((__format__(__printf__, 1, 3)));
634 extern void test14_foo(const char *, const char *, ...)
635      __attribute__((__format__(__scanf__, 2, 3)));
636 
637 extern void test14_bar(const char *, const char *, ...)
638      __attribute__((__format__(__scanf__, 2, 3)));
639 extern void test14_bar(const char *, const char *, ...)
640      __attribute__((__format__(__printf__, 1, 3)));
641 
test14_zed(int * p)642 void test14_zed(int *p) {
643   test14_foo("%", "%d", p); // expected-warning{{incomplete format specifier}}
644   test14_bar("%", "%d", p); // expected-warning{{incomplete format specifier}}
645 }
646 
test_qualifiers(volatile int * vip,const int * cip,const volatile int * cvip)647 void test_qualifiers(volatile int *vip, const int *cip,
648                      const volatile int *cvip) {
649   printf("%n", cip); // expected-warning{{format specifies type 'int *' but the argument has type 'const int *'}}
650   printf("%n", cvip); // expected-warning{{format specifies type 'int *' but the argument has type 'const volatile int *'}}
651 
652   printf("%n", vip); // No warning.
653   printf("%p", cip); // No warning.
654   printf("%p", cvip); // No warning.
655 
656 
657   typedef int* ip_t;
658   typedef const int* cip_t;
659   printf("%n", (ip_t)0); // No warning.
660   printf("%n", (cip_t)0); // expected-warning{{format specifies type 'int *' but the argument has type 'cip_t' (aka 'const int *')}}
661 }
662 
663 #pragma GCC diagnostic ignored "-Wformat-nonliteral"
664 #pragma GCC diagnostic warning "-Wformat-security"
665 // <rdar://problem/14178260>
666 extern void test_format_security_extra_args(const char*, int, ...)
667     __attribute__((__format__(__printf__, 1, 3)));
test_format_security_pos(char * string)668 void test_format_security_pos(char* string) {
669   test_format_security_extra_args(string, 5); // expected-warning {{format string is not a string literal (potentially insecure)}}
670   // expected-note@-1{{treat the string as an argument to avoid this}}
671 }
672 #pragma GCC diagnostic warning "-Wformat-nonliteral"
673 
test_char_pointer_arithmetic(int b)674 void test_char_pointer_arithmetic(int b) {
675   const char s1[] = "string";
676   const char s2[] = "%s string";
677 
678   printf(s1 - 1);  // expected-warning {{format string is not a string literal (potentially insecure)}}
679   // expected-note@-1{{treat the string as an argument to avoid this}}
680 
681   printf(s1 + 2);  // no-warning
682   printf(s2 + 2);  // no-warning
683 
684   const char s3[] = "%s string";
685   printf((s3 + 2) - 2);  // expected-warning{{more '%' conversions than data arguments}}
686   // expected-note@-2{{format string is defined here}}
687   printf(2 + s2);             // no-warning
688   printf(6 + s2 - 2);         // no-warning
689   printf(2 + (b ? s1 : s2));  // no-warning
690 
691   const char s5[] = "string %s";
692   printf(2 + (b ? s2 : s5));  // expected-warning{{more '%' conversions than data arguments}}
693   // expected-note@-2{{format string is defined here}}
694   printf(2 + (b ? s2 : s5), "");      // no-warning
695   printf(2 + (b ? s1 : s2 - 2), "");  // no-warning
696 
697   const char s6[] = "%s string";
698   printf(2 + (b ? s1 : s6 - 2));  // expected-warning{{more '%' conversions than data arguments}}
699   // expected-note@-2{{format string is defined here}}
700   printf(1 ? s2 + 2 : s2);  // no-warning
701   printf(0 ? s2 : s2 + 2);  // no-warning
702   printf(2 + s2 + 5 * 3 - 16, "");  // expected-warning{{data argument not used}}
703 
704   const char s7[] = "%s string %s %s";
705   printf(s7 + 3, "");  // expected-warning{{more '%' conversions than data arguments}}
706   // expected-note@-2{{format string is defined here}}
707 }
708 
PR30481()709 void PR30481() {
710   // This caused crashes due to invalid casts.
711   printf(1 > 0); // expected-warning{{format string is not a string literal}} expected-warning{{incompatible integer to pointer conversion}} expected-note@format-strings.c:*{{passing argument to parameter here}} expected-note{{to avoid this}}
712 }
713 
test_printf_opaque_ptr(void * op)714 void test_printf_opaque_ptr(void *op) {
715   printf("%s", op); // expected-warning{{format specifies type 'char *' but the argument has type 'void *'}}
716 }
717