1 // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs %s 2 // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs -fno-signed-char %s 3 4 #define __need_wint_t 5 #include <stdarg.h> 6 #include <stddef.h> // For wint_t and wchar_t 7 8 typedef struct _FILE FILE; 9 int fprintf(FILE *, const char *restrict, ...); 10 int printf(const char *restrict, ...); // expected-note{{passing argument to parameter here}} 11 int snprintf(char *restrict, size_t, const char *restrict, ...); 12 int sprintf(char *restrict, const char *restrict, ...); 13 int vasprintf(char **, const char *, va_list); 14 int asprintf(char **, const char *, ...); 15 int vfprintf(FILE *, const char *restrict, va_list); 16 int vprintf(const char *restrict, va_list); 17 int vsnprintf(char *, size_t, const char *, va_list); 18 int vsprintf(char *restrict, const char *restrict, va_list); // expected-note{{passing argument to parameter here}} 19 20 int vscanf(const char *restrict format, va_list arg); 21 22 char * global_fmt; 23 24 void check_string_literal( FILE* fp, const char* s, char *buf, ... ) { 25 26 char * b; 27 va_list ap; 28 va_start(ap,buf); 29 30 printf(s); // expected-warning {{format string is not a string literal}} 31 vprintf(s,ap); // expected-warning {{format string is not a string literal}} 32 fprintf(fp,s); // expected-warning {{format string is not a string literal}} 33 vfprintf(fp,s,ap); // expected-warning {{format string is not a string literal}} 34 asprintf(&b,s); // expected-warning {{format string is not a string lit}} 35 vasprintf(&b,s,ap); // expected-warning {{format string is not a string literal}} 36 sprintf(buf,s); // expected-warning {{format string is not a string literal}} 37 snprintf(buf,2,s); // expected-warning {{format string is not a string lit}} 38 __builtin___sprintf_chk(buf,0,-1,s); // expected-warning {{format string is not a string literal}} 39 __builtin___snprintf_chk(buf,2,0,-1,s); // expected-warning {{format string is not a string lit}} 40 vsprintf(buf,s,ap); // expected-warning {{format string is not a string lit}} 41 vsnprintf(buf,2,s,ap); // expected-warning {{format string is not a string lit}} 42 vsnprintf(buf,2,global_fmt,ap); // expected-warning {{format string is not a string literal}} 43 __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // expected-warning {{format string is not a string lit}} 44 __builtin___vsnprintf_chk(buf,2,0,-1,global_fmt,ap); // expected-warning {{format string is not a string literal}} 45 46 vscanf(s, ap); // expected-warning {{format string is not a string literal}} 47 48 // rdar://6079877 49 printf("abc" 50 "%*d", 1, 1); // no-warning 51 printf("abc\ 52 def" 53 "%*d", 1, 1); // no-warning 54 55 // <rdar://problem/6079850>, allow 'unsigned' (instead of 'int') to be used for both 56 // the field width and precision. This deviates from C99, but is reasonably safe 57 // and is also accepted by GCC. 58 printf("%*d", (unsigned) 1, 1); // no-warning 59 } 60 61 // When calling a non-variadic format function (vprintf, vscanf, NSLogv, ...), 62 // warn only if the format string argument is a parameter that is not itself 63 // declared as a format string with compatible format. 64 __attribute__((__format__ (__printf__, 2, 4))) 65 void check_string_literal2( FILE* fp, const char* s, char *buf, ... ) { 66 char * b; 67 va_list ap; 68 va_start(ap,buf); 69 70 printf(s); // expected-warning {{format string is not a string literal}} 71 vprintf(s,ap); // no-warning 72 fprintf(fp,s); // expected-warning {{format string is not a string literal}} 73 vfprintf(fp,s,ap); // no-warning 74 asprintf(&b,s); // expected-warning {{format string is not a string lit}} 75 vasprintf(&b,s,ap); // no-warning 76 sprintf(buf,s); // expected-warning {{format string is not a string literal}} 77 snprintf(buf,2,s); // expected-warning {{format string is not a string lit}} 78 __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // no-warning 79 80 vscanf(s, ap); // expected-warning {{format string is not a string literal}} 81 } 82 83 void check_conditional_literal(const char* s, int i) { 84 printf(i == 1 ? "yes" : "no"); // no-warning 85 printf(i == 0 ? (i == 1 ? "yes" : "no") : "dont know"); // no-warning 86 printf(i == 0 ? (i == 1 ? s : "no") : "dont know"); // expected-warning{{format string is not a string literal}} 87 printf("yes" ?: "no %d", 1); // expected-warning{{data argument not used by format string}} 88 } 89 90 void check_writeback_specifier() 91 { 92 int x; 93 char *b; 94 printf("%n", b); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}} 95 printf("%n", &x); // no-warning 96 97 printf("%hhn", (signed char*)0); // no-warning 98 printf("%hhn", (char*)0); // no-warning 99 printf("%hhn", (unsigned char*)0); // no-warning 100 printf("%hhn", (int*)0); // expected-warning{{format specifies type 'signed char *' but the argument has type 'int *'}} 101 102 printf("%hn", (short*)0); // no-warning 103 printf("%hn", (unsigned short*)0); // no-warning 104 printf("%hn", (int*)0); // expected-warning{{format specifies type 'short *' but the argument has type 'int *'}} 105 106 printf("%n", (int*)0); // no-warning 107 printf("%n", (unsigned int*)0); // no-warning 108 printf("%n", (char*)0); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}} 109 110 printf("%ln", (long*)0); // no-warning 111 printf("%ln", (unsigned long*)0); // no-warning 112 printf("%ln", (int*)0); // expected-warning{{format specifies type 'long *' but the argument has type 'int *'}} 113 114 printf("%lln", (long long*)0); // no-warning 115 printf("%lln", (unsigned long long*)0); // no-warning 116 printf("%lln", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}} 117 118 printf("%qn", (long long*)0); // no-warning 119 printf("%qn", (unsigned long long*)0); // no-warning 120 printf("%qn", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}} 121 122 printf("%Ln", 0); // expected-warning{{length modifier 'L' results in undefined behavior or no effect with 'n' conversion specifier}} 123 // expected-note@-1{{did you mean to use 'll'?}} 124 } 125 126 void check_invalid_specifier(FILE* fp, char *buf) 127 { 128 printf("%s%lb%d","unix",10,20); // expected-warning {{invalid conversion specifier 'b'}} 129 fprintf(fp,"%%%l"); // expected-warning {{incomplete format specifier}} 130 sprintf(buf,"%%%%%ld%d%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}} 131 snprintf(buf, 2, "%%%%%ld%;%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}} expected-warning {{invalid conversion specifier ';'}} 132 } 133 134 void check_null_char_string(char* b) 135 { 136 printf("\0this is bogus%d",1); // expected-warning {{string contains '\0'}} 137 snprintf(b,10,"%%%%%d\0%d",1,2); // expected-warning {{string contains '\0'}} 138 printf("%\0d",1); // expected-warning {{string contains '\0'}} 139 } 140 141 void check_empty_format_string(char* buf, ...) 142 { 143 va_list ap; 144 va_start(ap,buf); 145 vprintf("",ap); // expected-warning {{format string is empty}} 146 sprintf(buf, "", 1); // expected-warning {{format string is empty}} 147 148 // Don't warn about empty format strings when there are no data arguments. 149 // This can arise from macro expansions and non-standard format string 150 // functions. 151 sprintf(buf, ""); // no-warning 152 } 153 154 void check_wide_string(char* b, ...) 155 { 156 va_list ap; 157 va_start(ap,b); 158 159 printf(L"foo %d",2); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}} 160 vsprintf(b,L"bar %d",ap); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}} 161 } 162 163 void check_asterisk_precision_width(int x) { 164 printf("%*d"); // expected-warning {{'*' specified field width is missing a matching 'int' argument}} 165 printf("%.*d"); // expected-warning {{'.*' specified field precision is missing a matching 'int' argument}} 166 printf("%*d",12,x); // no-warning 167 printf("%*d","foo",x); // expected-warning {{field width should have type 'int', but argument has type 'char *'}} 168 printf("%.*d","foo",x); // expected-warning {{field precision should have type 'int', but argument has type 'char *'}} 169 } 170 171 void __attribute__((format(printf,1,3))) myprintf(const char*, int blah, ...); 172 173 void test_myprintf() { 174 myprintf("%d", 17, 18); // okay 175 } 176 177 void test_constant_bindings(void) { 178 const char * const s1 = "hello"; 179 const char s2[] = "hello"; 180 const char *s3 = "hello"; 181 char * const s4 = "hello"; 182 extern const char s5[]; 183 184 printf(s1); // no-warning 185 printf(s2); // no-warning 186 printf(s3); // expected-warning{{not a string literal}} 187 printf(s4); // expected-warning{{not a string literal}} 188 printf(s5); // expected-warning{{not a string literal}} 189 } 190 191 192 // Test what happens when -Wformat-security only. 193 #pragma GCC diagnostic ignored "-Wformat-nonliteral" 194 #pragma GCC diagnostic warning "-Wformat-security" 195 196 void test9(char *P) { 197 int x; 198 printf(P); // expected-warning {{format string is not a string literal (potentially insecure)}} 199 printf(P, 42); 200 } 201 202 void torture(va_list v8) { 203 vprintf ("%*.*d", v8); // no-warning 204 205 } 206 207 void test10(int x, float f, int i, long long lli) { 208 printf("%s"); // expected-warning{{more '%' conversions than data arguments}} 209 printf("%@", 12); // expected-warning{{invalid conversion specifier '@'}} 210 printf("\0"); // expected-warning{{format string contains '\0' within the string body}} 211 printf("xs\0"); // expected-warning{{format string contains '\0' within the string body}} 212 printf("%*d\n"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}} 213 printf("%*.*d\n", x); // expected-warning{{'.*' specified field precision is missing a matching 'int' argument}} 214 printf("%*d\n", f, x); // expected-warning{{field width should have type 'int', but argument has type 'double'}} 215 printf("%*.*d\n", x, f, x); // expected-warning{{field precision should have type 'int', but argument has type 'double'}} 216 printf("%**\n"); // expected-warning{{invalid conversion specifier '*'}} 217 printf("%d%d\n", x); // expected-warning{{more '%' conversions than data arguments}} 218 printf("%d\n", x, x); // expected-warning{{data argument not used by format string}} 219 printf("%W%d%Z\n", x, x, x); // expected-warning{{invalid conversion specifier 'W'}} expected-warning{{invalid conversion specifier 'Z'}} 220 printf("%"); // expected-warning{{incomplete format specifier}} 221 printf("%.d", x); // no-warning 222 printf("%.", x); // expected-warning{{incomplete format specifier}} 223 printf("%f", 4); // expected-warning{{format specifies type 'double' but the argument has type 'int'}} 224 printf("%qd", lli); // no-warning 225 printf("%qd", x); // expected-warning{{format specifies type 'long long' but the argument has type 'int'}} 226 printf("%qp", (void *)0); // expected-warning{{length modifier 'q' results in undefined behavior or no effect with 'p' conversion specifier}} 227 printf("hhX %hhX", (unsigned char)10); // no-warning 228 printf("llX %llX", (long long) 10); // no-warning 229 // This is fine, because there is an implicit conversion to an int. 230 printf("%d", (unsigned char) 10); // no-warning 231 printf("%d", (long long) 10); // expected-warning{{format specifies type 'int' but the argument has type 'long long'}} 232 printf("%Lf\n", (long double) 1.0); // no-warning 233 printf("%f\n", (long double) 1.0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}} 234 // The man page says that a zero precision is okay. 235 printf("%.0Lf", (long double) 1.0); // no-warning 236 printf("%c\n", "x"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}} 237 printf("%c\n", 1.23); // expected-warning{{format specifies type 'int' but the argument has type 'double'}} 238 printf("Format %d, is %! %f", 1, 2, 4.4); // expected-warning{{invalid conversion specifier '!'}} 239 } 240 241 typedef unsigned char uint8_t; 242 243 void should_understand_small_integers() { 244 printf("%hhu", (short) 10); // expected-warning{{format specifies type 'unsigned char' but the argument has type 'short'}} 245 printf("%hu\n", (unsigned char) 1); // expected-warning{{format specifies type 'unsigned short' but the argument has type 'unsigned char'}} 246 printf("%hu\n", (uint8_t)1); // expected-warning{{format specifies type 'unsigned short' but the argument has type 'uint8_t'}} 247 } 248 249 void test11(void *p, char *s) { 250 printf("%p", p); // no-warning 251 printf("%p", 123); // expected-warning{{format specifies type 'void *' but the argument has type 'int'}} 252 printf("%.4p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}} 253 printf("%+p", p); // expected-warning{{flag '+' results in undefined behavior with 'p' conversion specifier}} 254 printf("% p", p); // expected-warning{{flag ' ' results in undefined behavior with 'p' conversion specifier}} 255 printf("%0p", p); // expected-warning{{flag '0' results in undefined behavior with 'p' conversion specifier}} 256 printf("%s", s); // no-warning 257 printf("%+s", p); // expected-warning{{flag '+' results in undefined behavior with 's' conversion specifier}} 258 printf("% s", p); // expected-warning{{flag ' ' results in undefined behavior with 's' conversion specifier}} 259 printf("%0s", p); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}} 260 } 261 262 void test12(char *b) { 263 unsigned char buf[4]; 264 printf ("%.4s\n", buf); // no-warning 265 printf ("%.4s\n", &buf); // expected-warning{{format specifies type 'char *' but the argument has type 'unsigned char (*)[4]'}} 266 267 // Verify that we are checking asprintf 268 asprintf(&b, "%d", "asprintf"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}} 269 } 270 271 void test13(short x) { 272 char bel = 007; 273 printf("bel: '0%hhd'\n", bel); // no-warning 274 printf("x: '0%hhd'\n", x); // expected-warning {{format specifies type 'char' but the argument has type 'short'}} 275 } 276 277 typedef struct __aslclient *aslclient; 278 typedef struct __aslmsg *aslmsg; 279 int asl_log(aslclient asl, aslmsg msg, int level, const char *format, ...) __attribute__((__format__ (__printf__, 4, 5))); 280 void test_asl(aslclient asl) { 281 // Test case from <rdar://problem/7341605>. 282 asl_log(asl, 0, 3, "Error: %m"); // no-warning 283 asl_log(asl, 0, 3, "Error: %W"); // expected-warning{{invalid conversion specifier 'W'}} 284 } 285 286 // <rdar://problem/7595366> 287 typedef enum { A } int_t; 288 void f0(int_t x) { printf("%d\n", x); } 289 290 // Unicode test cases. These are possibly specific to Mac OS X. If so, they should 291 // eventually be moved into a separate test. 292 293 void test_unicode_conversions(wchar_t *s) { 294 printf("%S", s); // no-warning 295 printf("%s", s); // expected-warning{{format specifies type 'char *' but the argument has type 'wchar_t *'}} 296 printf("%C", s[0]); // no-warning 297 printf("%c", s[0]); 298 // FIXME: This test reports inconsistent results. On Windows, '%C' expects 299 // 'unsigned short'. 300 // printf("%C", 10); 301 printf("%S", "hello"); // expected-warning{{but the argument has type 'char *'}} 302 } 303 304 // Mac OS X supports positional arguments in format strings. 305 // This is an IEEE extension (IEEE Std 1003.1). 306 // FIXME: This is probably not portable everywhere. 307 void test_positional_arguments() { 308 printf("%0$", (int)2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}} 309 printf("%1$*0$d", (int) 2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}} 310 printf("%1$d", (int) 2); // no-warning 311 printf("%1$d", (int) 2, 2); // expected-warning{{data argument not used by format string}} 312 printf("%1$d%1$f", (int) 2); // expected-warning{{format specifies type 'double' but the argument has type 'int'}} 313 printf("%1$2.2d", (int) 2); // no-warning 314 printf("%2$*1$.2d", (int) 2, (int) 3); // no-warning 315 printf("%2$*8$d", (int) 2, (int) 3); // expected-warning{{specified field width is missing a matching 'int' argument}} 316 printf("%%%1$d", (int) 2); // no-warning 317 printf("%1$d%%", (int) 2); // no-warning 318 } 319 320 // PR 6697 - Handle format strings where the data argument is not adjacent to the format string 321 void myprintf_PR_6697(const char *format, int x, ...) __attribute__((__format__(printf,1, 3))); 322 void test_pr_6697() { 323 myprintf_PR_6697("%s\n", 1, "foo"); // no-warning 324 myprintf_PR_6697("%s\n", 1, (int)0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}} 325 // FIXME: Not everything should clearly support positional arguments, 326 // but we need a way to identify those cases. 327 myprintf_PR_6697("%1$s\n", 1, "foo"); // no-warning 328 myprintf_PR_6697("%2$s\n", 1, "foo"); // expected-warning{{data argument position '2' exceeds the number of data arguments (1)}} 329 myprintf_PR_6697("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (1)}} 330 myprintf_PR_6697("%1$s\n", 1, (int) 0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}} 331 } 332 333 void rdar8026030(FILE *fp) { 334 fprintf(fp, "\%"); // expected-warning{{incomplete format specifier}} 335 } 336 337 void bug7377_bad_length_mod_usage() { 338 // Bad length modifiers 339 printf("%hhs", "foo"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}} 340 printf("%1$zp", (void *)0); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}} 341 printf("%ls", L"foo"); // no-warning 342 printf("%#.2Lf", (long double)1.234); // no-warning 343 344 // Bad flag usage 345 printf("%#p", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'p' conversion specifier}} 346 printf("%0d", -1); // no-warning 347 printf("%#n", (int *) 0); // expected-warning{{flag '#' results in undefined behavior with 'n' conversion specifier}} 348 printf("%-n", (int *) 0); // expected-warning{{flag '-' results in undefined behavior with 'n' conversion specifier}} 349 printf("%-p", (void *) 0); // no-warning 350 351 // Bad optional amount use 352 printf("%.2c", 'a'); // expected-warning{{precision used with 'c' conversion specifier, resulting in undefined behavior}} 353 printf("%1n", (int *) 0); // expected-warning{{field width used with 'n' conversion specifier, resulting in undefined behavior}} 354 printf("%.9n", (int *) 0); // expected-warning{{precision used with 'n' conversion specifier, resulting in undefined behavior}} 355 356 // Ignored flags 357 printf("% +f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}} 358 printf("%+ f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}} 359 printf("%0-f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}} 360 printf("%-0f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}} 361 printf("%-+f", 1.23); // no-warning 362 } 363 364 // PR 7981 - handle '%lc' (wint_t) 365 366 void pr7981(wint_t c, wchar_t c2) { 367 printf("%lc", c); // no-warning 368 printf("%lc", 1.0); // expected-warning{{the argument has type 'double'}} 369 printf("%lc", (char) 1); // no-warning 370 printf("%lc", &c); // expected-warning{{the argument has type 'wint_t *'}} 371 // If wint_t and wchar_t are the same width and wint_t is signed where 372 // wchar_t is unsigned, an implicit conversion isn't possible. 373 #if defined(__WINT_UNSIGNED__) || !defined(__WCHAR_UNSIGNED__) || \ 374 __WINT_WIDTH__ > __WCHAR_WIDTH__ 375 printf("%lc", c2); // no-warning 376 #endif 377 } 378 379 // <rdar://problem/8269537> -Wformat-security says NULL is not a string literal 380 void rdar8269537() { 381 // This is likely to crash in most cases, but -Wformat-nonliteral technically 382 // doesn't warn in this case. 383 printf(0); // no-warning 384 } 385 386 // Handle functions with multiple format attributes. 387 extern void rdar8332221_vprintf_scanf(const char *, va_list, const char *, ...) 388 __attribute__((__format__(__printf__, 1, 0))) 389 __attribute__((__format__(__scanf__, 3, 4))); 390 391 void rdar8332221(va_list ap, int *x, long *y) { 392 rdar8332221_vprintf_scanf("%", ap, "%d", x); // expected-warning{{incomplete format specifier}} 393 } 394 395 // PR8641 396 void pr8641() { 397 printf("%#x\n", 10); 398 printf("%#X\n", 10); 399 } 400 401 void posix_extensions() { 402 // Test %'d, "thousands grouping". 403 // <rdar://problem/8816343> 404 printf("%'d\n", 123456789); // no-warning 405 printf("%'i\n", 123456789); // no-warning 406 printf("%'f\n", (float) 1.0); // no-warning 407 printf("%'p\n", (void*) 0); // expected-warning{{results in undefined behavior with 'p' conversion specifier}} 408 } 409 410 // PR8486 411 // 412 // Test what happens when -Wformat is on, but -Wformat-security is off. 413 #pragma GCC diagnostic warning "-Wformat" 414 #pragma GCC diagnostic ignored "-Wformat-security" 415 416 void pr8486() { 417 printf("%s", 1); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}} 418 } 419 420 // PR9314 421 // Don't warn about string literals that are PreDefinedExprs, e.g. __func__. 422 void pr9314() { 423 printf(__PRETTY_FUNCTION__); // no-warning 424 printf(__func__); // no-warning 425 } 426 427 int printf(const char * restrict, ...) __attribute__((__format__ (__printf__, 1, 2))); 428 429 void rdar9612060(void) { 430 printf("%s", 2); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}} 431 } 432 433 void check_char(unsigned char x, signed char y) { 434 printf("%c", y); // no-warning 435 printf("%hhu", x); // no-warning 436 printf("%hhi", y); // no-warning 437 printf("%hhi", x); // no-warning 438 printf("%c", x); // no-warning 439 printf("%hhu", y); // no-warning 440 } 441 442 // Test suppression of individual warnings. 443 444 void test_suppress_invalid_specifier() { 445 #pragma clang diagnostic push 446 #pragma clang diagnostic ignored "-Wformat-invalid-specifier" 447 printf("%@", 12); // no-warning 448 #pragma clang diagnostic pop 449 } 450 451 // Make sure warnings are on for next test. 452 #pragma GCC diagnostic warning "-Wformat" 453 #pragma GCC diagnostic warning "-Wformat-security" 454 455 // Test that the printf call site is where the warning is attached. If the 456 // format string is somewhere else, point to it in a note. 457 void pr9751() { 458 const char kFormat1[] = "%d %d \n"; // expected-note{{format string is defined here}}} 459 printf(kFormat1, 0); // expected-warning{{more '%' conversions than data arguments}} 460 printf("%d %s\n", 0); // expected-warning{{more '%' conversions than data arguments}} 461 462 const char kFormat2[] = "%18$s\n"; // expected-note{{format string is defined here}} 463 printf(kFormat2, 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}} 464 printf("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}} 465 466 const char kFormat4[] = "%y"; // expected-note{{format string is defined here}} 467 printf(kFormat4, 5); // expected-warning{{invalid conversion specifier 'y'}} 468 printf("%y", 5); // expected-warning{{invalid conversion specifier 'y'}} 469 470 const char kFormat5[] = "%."; // expected-note{{format string is defined here}} 471 printf(kFormat5, 5); // expected-warning{{incomplete format specifier}} 472 printf("%.", 5); // expected-warning{{incomplete format specifier}} 473 474 const char kFormat6[] = "%s"; // expected-note{{format string is defined here}} 475 printf(kFormat6, 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}} 476 printf("%s", 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}} 477 478 const char kFormat7[] = "%0$"; // expected-note{{format string is defined here}} 479 printf(kFormat7, 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}} 480 printf("%0$", 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}} 481 482 const char kFormat8[] = "%1$d %d"; // expected-note{{format string is defined here}} 483 printf(kFormat8, 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}} 484 printf("%1$d %d", 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}} 485 486 const char kFormat9[] = ""; // expected-note{{format string is defined here}} 487 printf(kFormat9, 4, 4); // expected-warning{{format string is empty}} 488 printf("", 4, 4); // expected-warning{{format string is empty}} 489 490 const char kFormat10[] = "\0%d"; // expected-note{{format string is defined here}} 491 printf(kFormat10, 4); // expected-warning{{format string contains '\0' within the string body}} 492 printf("\0%d", 4); // expected-warning{{format string contains '\0' within the string body}} 493 494 const char kFormat11[] = "%*d"; // expected-note{{format string is defined here}} 495 printf(kFormat11); // expected-warning{{'*' specified field width is missing a matching 'int' argument}} 496 printf("%*d"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}} 497 498 const char kFormat12[] = "%*d"; // expected-note{{format string is defined here}} 499 printf(kFormat12, 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}} 500 printf("%*d", 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}} 501 502 const char kFormat13[] = "%.3p"; // expected-note{{format string is defined here}} 503 void *p; 504 printf(kFormat13, p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}} 505 printf("%.3p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}} 506 507 const char kFormat14[] = "%0s"; // expected-note{{format string is defined here}} 508 printf(kFormat14, "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}} 509 printf("%0s", "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}} 510 511 const char kFormat15[] = "%hhs"; // expected-note{{format string is defined here}} 512 printf(kFormat15, "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}} 513 printf("%hhs", "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}} 514 515 const char kFormat16[] = "%-0d"; // expected-note{{format string is defined here}} 516 printf(kFormat16, 5); // expected-warning{{flag '0' is ignored when flag '-' is present}} 517 printf("%-0d", 5); // expected-warning{{flag '0' is ignored when flag '-' is present}} 518 519 // Make sure that the "format string is defined here" note is not emitted 520 // when the original string is within the argument expression. 521 printf(1 ? "yes %d" : "no %d"); // expected-warning 2{{more '%' conversions than data arguments}} 522 523 const char kFormat17[] = "%hu"; // expected-note{{format string is defined here}}} 524 printf(kFormat17, (int[]){0}); // expected-warning{{format specifies type 'unsigned short' but the argument}} 525 526 printf("%a", (long double)0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}} 527 528 // Test braced char[] initializers. 529 const char kFormat18[] = { "%lld" }; // expected-note{{format string is defined here}} 530 printf(kFormat18, 0); // expected-warning{{format specifies type}} 531 532 // Make sure we point at the offending argument rather than the format string. 533 const char kFormat19[] = "%d"; // expected-note{{format string is defined here}} 534 printf(kFormat19, 535 0.0); // expected-warning{{format specifies}} 536 } 537 538 void __attribute__((format(strfmon,1,2))) monformat(const char *fmt, ...); 539 void __attribute__((format(strftime,1,0))) dateformat(const char *fmt); 540 541 // Other formats 542 void test_other_formats() { 543 char *str = ""; 544 monformat("", 1); // expected-warning{{format string is empty}} 545 monformat(str); // expected-warning{{format string is not a string literal (potentially insecure)}} 546 dateformat(""); // expected-warning{{format string is empty}} 547 dateformat(str); // no-warning (using strftime non literal is not unsafe) 548 } 549 550 // Do not warn about unused arguments coming from system headers. 551 // <rdar://problem/11317765> 552 #include <format-unused-system-args.h> 553 void test_unused_system_args(int x) { 554 PRINT1("%d\n", x); // no-warning{{extra argument is system header is OK}} 555 } 556 557 void pr12761(char c) { 558 // This should not warn even with -fno-signed-char. 559 printf("%hhx", c); 560 } 561 562 563 // Test that we correctly merge the format in both orders. 564 extern void test14_foo(const char *, const char *, ...) 565 __attribute__((__format__(__printf__, 1, 3))); 566 extern void test14_foo(const char *, const char *, ...) 567 __attribute__((__format__(__scanf__, 2, 3))); 568 569 extern void test14_bar(const char *, const char *, ...) 570 __attribute__((__format__(__scanf__, 2, 3))); 571 extern void test14_bar(const char *, const char *, ...) 572 __attribute__((__format__(__printf__, 1, 3))); 573 574 void test14_zed(int *p) { 575 test14_foo("%", "%d", p); // expected-warning{{incomplete format specifier}} 576 test14_bar("%", "%d", p); // expected-warning{{incomplete format specifier}} 577 } 578 579 void test_qualifiers(volatile int *vip, const int *cip, 580 const volatile int *cvip) { 581 printf("%n", cip); // expected-warning{{format specifies type 'int *' but the argument has type 'const int *'}} 582 printf("%n", cvip); // expected-warning{{format specifies type 'int *' but the argument has type 'const volatile int *'}} 583 584 printf("%n", vip); // No warning. 585 printf("%p", cip); // No warning. 586 printf("%p", cvip); // No warning. 587 588 589 typedef int* ip_t; 590 typedef const int* cip_t; 591 printf("%n", (ip_t)0); // No warning. 592 printf("%n", (cip_t)0); // expected-warning{{format specifies type 'int *' but the argument has type 'cip_t' (aka 'const int *')}} 593 } 594 595 #pragma GCC diagnostic ignored "-Wformat-nonliteral" 596 #pragma GCC diagnostic warning "-Wformat-security" 597 // <rdar://problem/14178260> 598 extern void test_format_security_extra_args(const char*, int, ...) 599 __attribute__((__format__(__printf__, 1, 3))); 600 void test_format_security_pos(char* string) { 601 test_format_security_extra_args(string, 5); // expected-warning {{format string is not a string literal (potentially insecure)}} 602 } 603 #pragma GCC diagnostic warning "-Wformat-nonliteral" 604