1 // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs %s
2 // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs -fno-signed-char %s
3 
4 #define __need_wint_t
5 #include <stdarg.h>
6 #include <stddef.h> // For wint_t and wchar_t
7 
8 typedef struct _FILE FILE;
9 int fprintf(FILE *, const char *restrict, ...);
10 int printf(const char *restrict, ...); // expected-note{{passing argument to parameter here}}
11 int snprintf(char *restrict, size_t, const char *restrict, ...);
12 int sprintf(char *restrict, const char *restrict, ...);
13 int vasprintf(char **, const char *, va_list);
14 int asprintf(char **, const char *, ...);
15 int vfprintf(FILE *, const char *restrict, va_list);
16 int vprintf(const char *restrict, va_list);
17 int vsnprintf(char *, size_t, const char *, va_list);
18 int vsprintf(char *restrict, const char *restrict, va_list); // expected-note{{passing argument to parameter here}}
19 
20 int vscanf(const char *restrict format, va_list arg);
21 
22 char * global_fmt;
23 
24 void check_string_literal( FILE* fp, const char* s, char *buf, ... ) {
25 
26   char * b;
27   va_list ap;
28   va_start(ap,buf);
29 
30   printf(s); // expected-warning {{format string is not a string literal}}
31   vprintf(s,ap); // expected-warning {{format string is not a string literal}}
32   fprintf(fp,s); // expected-warning {{format string is not a string literal}}
33   vfprintf(fp,s,ap); // expected-warning {{format string is not a string literal}}
34   asprintf(&b,s); // expected-warning {{format string is not a string lit}}
35   vasprintf(&b,s,ap); // expected-warning {{format string is not a string literal}}
36   sprintf(buf,s); // expected-warning {{format string is not a string literal}}
37   snprintf(buf,2,s); // expected-warning {{format string is not a string lit}}
38   __builtin___sprintf_chk(buf,0,-1,s); // expected-warning {{format string is not a string literal}}
39   __builtin___snprintf_chk(buf,2,0,-1,s); // expected-warning {{format string is not a string lit}}
40   vsprintf(buf,s,ap); // expected-warning {{format string is not a string lit}}
41   vsnprintf(buf,2,s,ap); // expected-warning {{format string is not a string lit}}
42   vsnprintf(buf,2,global_fmt,ap); // expected-warning {{format string is not a string literal}}
43   __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // expected-warning {{format string is not a string lit}}
44   __builtin___vsnprintf_chk(buf,2,0,-1,global_fmt,ap); // expected-warning {{format string is not a string literal}}
45 
46   vscanf(s, ap); // expected-warning {{format string is not a string literal}}
47 
48   // rdar://6079877
49   printf("abc"
50          "%*d", 1, 1); // no-warning
51   printf("abc\
52 def"
53          "%*d", 1, 1); // no-warning
54 
55   // <rdar://problem/6079850>, allow 'unsigned' (instead of 'int') to be used for both
56   // the field width and precision.  This deviates from C99, but is reasonably safe
57   // and is also accepted by GCC.
58   printf("%*d", (unsigned) 1, 1); // no-warning
59 }
60 
61 // When calling a non-variadic format function (vprintf, vscanf, NSLogv, ...),
62 // warn only if the format string argument is a parameter that is not itself
63 // declared as a format string with compatible format.
64 __attribute__((__format__ (__printf__, 2, 4)))
65 void check_string_literal2( FILE* fp, const char* s, char *buf, ... ) {
66   char * b;
67   va_list ap;
68   va_start(ap,buf);
69 
70   printf(s); // expected-warning {{format string is not a string literal}}
71   vprintf(s,ap); // no-warning
72   fprintf(fp,s); // expected-warning {{format string is not a string literal}}
73   vfprintf(fp,s,ap); // no-warning
74   asprintf(&b,s); // expected-warning {{format string is not a string lit}}
75   vasprintf(&b,s,ap); // no-warning
76   sprintf(buf,s); // expected-warning {{format string is not a string literal}}
77   snprintf(buf,2,s); // expected-warning {{format string is not a string lit}}
78   __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // no-warning
79 
80   vscanf(s, ap); // expected-warning {{format string is not a string literal}}
81 }
82 
83 void check_conditional_literal(const char* s, int i) {
84   printf(i == 1 ? "yes" : "no"); // no-warning
85   printf(i == 0 ? (i == 1 ? "yes" : "no") : "dont know"); // no-warning
86   printf(i == 0 ? (i == 1 ? s : "no") : "dont know"); // expected-warning{{format string is not a string literal}}
87   printf("yes" ?: "no %d", 1); // expected-warning{{data argument not used by format string}}
88 }
89 
90 void check_writeback_specifier()
91 {
92   int x;
93   char *b;
94   printf("%n", b); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
95   printf("%n", &x); // no-warning
96 
97   printf("%hhn", (signed char*)0); // no-warning
98   printf("%hhn", (char*)0); // no-warning
99   printf("%hhn", (unsigned char*)0); // no-warning
100   printf("%hhn", (int*)0); // expected-warning{{format specifies type 'signed char *' but the argument has type 'int *'}}
101 
102   printf("%hn", (short*)0); // no-warning
103   printf("%hn", (unsigned short*)0); // no-warning
104   printf("%hn", (int*)0); // expected-warning{{format specifies type 'short *' but the argument has type 'int *'}}
105 
106   printf("%n", (int*)0); // no-warning
107   printf("%n", (unsigned int*)0); // no-warning
108   printf("%n", (char*)0); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
109 
110   printf("%ln", (long*)0); // no-warning
111   printf("%ln", (unsigned long*)0); // no-warning
112   printf("%ln", (int*)0); // expected-warning{{format specifies type 'long *' but the argument has type 'int *'}}
113 
114   printf("%lln", (long long*)0); // no-warning
115   printf("%lln", (unsigned long long*)0); // no-warning
116   printf("%lln", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
117 
118   printf("%qn", (long long*)0); // no-warning
119   printf("%qn", (unsigned long long*)0); // no-warning
120   printf("%qn", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
121 
122   printf("%Ln", 0); // expected-warning{{length modifier 'L' results in undefined behavior or no effect with 'n' conversion specifier}}
123   // expected-note@-1{{did you mean to use 'll'?}}
124 }
125 
126 void check_invalid_specifier(FILE* fp, char *buf)
127 {
128   printf("%s%lb%d","unix",10,20); // expected-warning {{invalid conversion specifier 'b'}}
129   fprintf(fp,"%%%l"); // expected-warning {{incomplete format specifier}}
130   sprintf(buf,"%%%%%ld%d%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}}
131   snprintf(buf, 2, "%%%%%ld%;%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}} expected-warning {{invalid conversion specifier ';'}}
132 }
133 
134 void check_null_char_string(char* b)
135 {
136   printf("\0this is bogus%d",1); // expected-warning {{string contains '\0'}}
137   snprintf(b,10,"%%%%%d\0%d",1,2); // expected-warning {{string contains '\0'}}
138   printf("%\0d",1); // expected-warning {{string contains '\0'}}
139 }
140 
141 void check_empty_format_string(char* buf, ...)
142 {
143   va_list ap;
144   va_start(ap,buf);
145   vprintf("",ap); // expected-warning {{format string is empty}}
146   sprintf(buf, "", 1); // expected-warning {{format string is empty}}
147 
148   // Don't warn about empty format strings when there are no data arguments.
149   // This can arise from macro expansions and non-standard format string
150   // functions.
151   sprintf(buf, ""); // no-warning
152 }
153 
154 void check_wide_string(char* b, ...)
155 {
156   va_list ap;
157   va_start(ap,b);
158 
159   printf(L"foo %d",2); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}}
160   vsprintf(b,L"bar %d",ap); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}}
161 }
162 
163 void check_asterisk_precision_width(int x) {
164   printf("%*d"); // expected-warning {{'*' specified field width is missing a matching 'int' argument}}
165   printf("%.*d"); // expected-warning {{'.*' specified field precision is missing a matching 'int' argument}}
166   printf("%*d",12,x); // no-warning
167   printf("%*d","foo",x); // expected-warning {{field width should have type 'int', but argument has type 'char *'}}
168   printf("%.*d","foo",x); // expected-warning {{field precision should have type 'int', but argument has type 'char *'}}
169 }
170 
171 void __attribute__((format(printf,1,3))) myprintf(const char*, int blah, ...);
172 
173 void test_myprintf() {
174   myprintf("%d", 17, 18); // okay
175 }
176 
177 void test_constant_bindings(void) {
178   const char * const s1 = "hello";
179   const char s2[] = "hello";
180   const char *s3 = "hello";
181   char * const s4 = "hello";
182   extern const char s5[];
183 
184   printf(s1); // no-warning
185   printf(s2); // no-warning
186   printf(s3); // expected-warning{{not a string literal}}
187   printf(s4); // expected-warning{{not a string literal}}
188   printf(s5); // expected-warning{{not a string literal}}
189 }
190 
191 
192 // Test what happens when -Wformat-security only.
193 #pragma GCC diagnostic ignored "-Wformat-nonliteral"
194 #pragma GCC diagnostic warning "-Wformat-security"
195 
196 void test9(char *P) {
197   int x;
198   printf(P);   // expected-warning {{format string is not a string literal (potentially insecure)}}
199   printf(P, 42);
200 }
201 
202 void torture(va_list v8) {
203   vprintf ("%*.*d", v8);  // no-warning
204 
205 }
206 
207 void test10(int x, float f, int i, long long lli) {
208   printf("%s"); // expected-warning{{more '%' conversions than data arguments}}
209   printf("%@", 12); // expected-warning{{invalid conversion specifier '@'}}
210   printf("\0"); // expected-warning{{format string contains '\0' within the string body}}
211   printf("xs\0"); // expected-warning{{format string contains '\0' within the string body}}
212   printf("%*d\n"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
213   printf("%*.*d\n", x); // expected-warning{{'.*' specified field precision is missing a matching 'int' argument}}
214   printf("%*d\n", f, x); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
215   printf("%*.*d\n", x, f, x); // expected-warning{{field precision should have type 'int', but argument has type 'double'}}
216   printf("%**\n"); // expected-warning{{invalid conversion specifier '*'}}
217   printf("%d%d\n", x); // expected-warning{{more '%' conversions than data arguments}}
218   printf("%d\n", x, x); // expected-warning{{data argument not used by format string}}
219   printf("%W%d%Z\n", x, x, x); // expected-warning{{invalid conversion specifier 'W'}} expected-warning{{invalid conversion specifier 'Z'}}
220   printf("%"); // expected-warning{{incomplete format specifier}}
221   printf("%.d", x); // no-warning
222   printf("%.", x);  // expected-warning{{incomplete format specifier}}
223   printf("%f", 4); // expected-warning{{format specifies type 'double' but the argument has type 'int'}}
224   printf("%qd", lli); // no-warning
225   printf("%qd", x); // expected-warning{{format specifies type 'long long' but the argument has type 'int'}}
226   printf("%qp", (void *)0); // expected-warning{{length modifier 'q' results in undefined behavior or no effect with 'p' conversion specifier}}
227   printf("hhX %hhX", (unsigned char)10); // no-warning
228   printf("llX %llX", (long long) 10); // no-warning
229   // This is fine, because there is an implicit conversion to an int.
230   printf("%d", (unsigned char) 10); // no-warning
231   printf("%d", (long long) 10); // expected-warning{{format specifies type 'int' but the argument has type 'long long'}}
232   printf("%Lf\n", (long double) 1.0); // no-warning
233   printf("%f\n", (long double) 1.0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}}
234   // The man page says that a zero precision is okay.
235   printf("%.0Lf", (long double) 1.0); // no-warning
236   printf("%c\n", "x"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}}
237   printf("%c\n", 1.23); // expected-warning{{format specifies type 'int' but the argument has type 'double'}}
238   printf("Format %d, is %! %f", 1, 2, 4.4); // expected-warning{{invalid conversion specifier '!'}}
239 }
240 
241 typedef unsigned char uint8_t;
242 
243 void should_understand_small_integers() {
244   printf("%hhu", (short) 10); // expected-warning{{format specifies type 'unsigned char' but the argument has type 'short'}}
245   printf("%hu\n", (unsigned char) 1); // expected-warning{{format specifies type 'unsigned short' but the argument has type 'unsigned char'}}
246   printf("%hu\n", (uint8_t)1); // expected-warning{{format specifies type 'unsigned short' but the argument has type 'uint8_t'}}
247 }
248 
249 void test11(void *p, char *s) {
250   printf("%p", p); // no-warning
251   printf("%p", 123); // expected-warning{{format specifies type 'void *' but the argument has type 'int'}}
252   printf("%.4p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
253   printf("%+p", p); // expected-warning{{flag '+' results in undefined behavior with 'p' conversion specifier}}
254   printf("% p", p); // expected-warning{{flag ' ' results in undefined behavior with 'p' conversion specifier}}
255   printf("%0p", p); // expected-warning{{flag '0' results in undefined behavior with 'p' conversion specifier}}
256   printf("%s", s); // no-warning
257   printf("%+s", p); // expected-warning{{flag '+' results in undefined behavior with 's' conversion specifier}}
258   printf("% s", p); // expected-warning{{flag ' ' results in undefined behavior with 's' conversion specifier}}
259   printf("%0s", p); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
260 }
261 
262 void test12(char *b) {
263   unsigned char buf[4];
264   printf ("%.4s\n", buf); // no-warning
265   printf ("%.4s\n", &buf); // expected-warning{{format specifies type 'char *' but the argument has type 'unsigned char (*)[4]'}}
266 
267   // Verify that we are checking asprintf
268   asprintf(&b, "%d", "asprintf"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}}
269 }
270 
271 void test13(short x) {
272   char bel = 007;
273   printf("bel: '0%hhd'\n", bel); // no-warning
274   printf("x: '0%hhd'\n", x); // expected-warning {{format specifies type 'char' but the argument has type 'short'}}
275 }
276 
277 typedef struct __aslclient *aslclient;
278 typedef struct __aslmsg *aslmsg;
279 int asl_log(aslclient asl, aslmsg msg, int level, const char *format, ...) __attribute__((__format__ (__printf__, 4, 5)));
280 void test_asl(aslclient asl) {
281   // Test case from <rdar://problem/7341605>.
282   asl_log(asl, 0, 3, "Error: %m"); // no-warning
283   asl_log(asl, 0, 3, "Error: %W"); // expected-warning{{invalid conversion specifier 'W'}}
284 }
285 
286 // <rdar://problem/7595366>
287 typedef enum { A } int_t;
288 void f0(int_t x) { printf("%d\n", x); }
289 
290 // Unicode test cases.  These are possibly specific to Mac OS X.  If so, they should
291 // eventually be moved into a separate test.
292 
293 void test_unicode_conversions(wchar_t *s) {
294   printf("%S", s); // no-warning
295   printf("%s", s); // expected-warning{{format specifies type 'char *' but the argument has type 'wchar_t *'}}
296   printf("%C", s[0]); // no-warning
297   printf("%c", s[0]);
298   // FIXME: This test reports inconsistent results. On Windows, '%C' expects
299   // 'unsigned short'.
300   // printf("%C", 10);
301   printf("%S", "hello"); // expected-warning{{but the argument has type 'char *'}}
302 }
303 
304 // Mac OS X supports positional arguments in format strings.
305 // This is an IEEE extension (IEEE Std 1003.1).
306 // FIXME: This is probably not portable everywhere.
307 void test_positional_arguments() {
308   printf("%0$", (int)2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
309   printf("%1$*0$d", (int) 2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
310   printf("%1$d", (int) 2); // no-warning
311   printf("%1$d", (int) 2, 2); // expected-warning{{data argument not used by format string}}
312   printf("%1$d%1$f", (int) 2); // expected-warning{{format specifies type 'double' but the argument has type 'int'}}
313   printf("%1$2.2d", (int) 2); // no-warning
314   printf("%2$*1$.2d", (int) 2, (int) 3); // no-warning
315   printf("%2$*8$d", (int) 2, (int) 3); // expected-warning{{specified field width is missing a matching 'int' argument}}
316   printf("%%%1$d", (int) 2); // no-warning
317   printf("%1$d%%", (int) 2); // no-warning
318 }
319 
320 // PR 6697 - Handle format strings where the data argument is not adjacent to the format string
321 void myprintf_PR_6697(const char *format, int x, ...) __attribute__((__format__(printf,1, 3)));
322 void test_pr_6697() {
323   myprintf_PR_6697("%s\n", 1, "foo"); // no-warning
324   myprintf_PR_6697("%s\n", 1, (int)0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
325   // FIXME: Not everything should clearly support positional arguments,
326   // but we need a way to identify those cases.
327   myprintf_PR_6697("%1$s\n", 1, "foo"); // no-warning
328   myprintf_PR_6697("%2$s\n", 1, "foo"); // expected-warning{{data argument position '2' exceeds the number of data arguments (1)}}
329   myprintf_PR_6697("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (1)}}
330   myprintf_PR_6697("%1$s\n", 1, (int) 0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
331 }
332 
333 void rdar8026030(FILE *fp) {
334   fprintf(fp, "\%"); // expected-warning{{incomplete format specifier}}
335 }
336 
337 void bug7377_bad_length_mod_usage() {
338   // Bad length modifiers
339   printf("%hhs", "foo"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
340   printf("%1$zp", (void *)0); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}}
341   printf("%ls", L"foo"); // no-warning
342   printf("%#.2Lf", (long double)1.234); // no-warning
343 
344   // Bad flag usage
345   printf("%#p", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'p' conversion specifier}}
346   printf("%0d", -1); // no-warning
347   printf("%#n", (int *) 0); // expected-warning{{flag '#' results in undefined behavior with 'n' conversion specifier}}
348   printf("%-n", (int *) 0); // expected-warning{{flag '-' results in undefined behavior with 'n' conversion specifier}}
349   printf("%-p", (void *) 0); // no-warning
350 
351   // Bad optional amount use
352   printf("%.2c", 'a'); // expected-warning{{precision used with 'c' conversion specifier, resulting in undefined behavior}}
353   printf("%1n", (int *) 0); // expected-warning{{field width used with 'n' conversion specifier, resulting in undefined behavior}}
354   printf("%.9n", (int *) 0); // expected-warning{{precision used with 'n' conversion specifier, resulting in undefined behavior}}
355 
356   // Ignored flags
357   printf("% +f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
358   printf("%+ f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
359   printf("%0-f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
360   printf("%-0f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
361   printf("%-+f", 1.23); // no-warning
362 }
363 
364 // PR 7981 - handle '%lc' (wint_t)
365 
366 void pr7981(wint_t c, wchar_t c2) {
367   printf("%lc", c); // no-warning
368   printf("%lc", 1.0); // expected-warning{{the argument has type 'double'}}
369   printf("%lc", (char) 1); // no-warning
370   printf("%lc", &c); // expected-warning{{the argument has type 'wint_t *'}}
371   // If wint_t and wchar_t are the same width and wint_t is signed where
372   // wchar_t is unsigned, an implicit conversion isn't possible.
373 #if defined(__WINT_UNSIGNED__) || !defined(__WCHAR_UNSIGNED__) ||   \
374   __WINT_WIDTH__ > __WCHAR_WIDTH__
375   printf("%lc", c2); // no-warning
376 #endif
377 }
378 
379 // <rdar://problem/8269537> -Wformat-security says NULL is not a string literal
380 void rdar8269537() {
381   // This is likely to crash in most cases, but -Wformat-nonliteral technically
382   // doesn't warn in this case.
383   printf(0); // no-warning
384 }
385 
386 // Handle functions with multiple format attributes.
387 extern void rdar8332221_vprintf_scanf(const char *, va_list, const char *, ...)
388      __attribute__((__format__(__printf__, 1, 0)))
389      __attribute__((__format__(__scanf__, 3, 4)));
390 
391 void rdar8332221(va_list ap, int *x, long *y) {
392   rdar8332221_vprintf_scanf("%", ap, "%d", x); // expected-warning{{incomplete format specifier}}
393 }
394 
395 // PR8641
396 void pr8641() {
397   printf("%#x\n", 10);
398   printf("%#X\n", 10);
399 }
400 
401 void posix_extensions() {
402   // Test %'d, "thousands grouping".
403   // <rdar://problem/8816343>
404   printf("%'d\n", 123456789); // no-warning
405   printf("%'i\n", 123456789); // no-warning
406   printf("%'f\n", (float) 1.0); // no-warning
407   printf("%'p\n", (void*) 0); // expected-warning{{results in undefined behavior with 'p' conversion specifier}}
408 }
409 
410 // PR8486
411 //
412 // Test what happens when -Wformat is on, but -Wformat-security is off.
413 #pragma GCC diagnostic warning "-Wformat"
414 #pragma GCC diagnostic ignored "-Wformat-security"
415 
416 void pr8486() {
417   printf("%s", 1); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
418 }
419 
420 // PR9314
421 // Don't warn about string literals that are PreDefinedExprs, e.g. __func__.
422 void pr9314() {
423   printf(__PRETTY_FUNCTION__); // no-warning
424   printf(__func__); // no-warning
425 }
426 
427 int printf(const char * restrict, ...) __attribute__((__format__ (__printf__, 1, 2)));
428 
429 void rdar9612060(void) {
430   printf("%s", 2); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
431 }
432 
433 void check_char(unsigned char x, signed char y) {
434   printf("%c", y); // no-warning
435   printf("%hhu", x); // no-warning
436   printf("%hhi", y); // no-warning
437   printf("%hhi", x); // no-warning
438   printf("%c", x); // no-warning
439   printf("%hhu", y); // no-warning
440 }
441 
442 // Test suppression of individual warnings.
443 
444 void test_suppress_invalid_specifier() {
445 #pragma clang diagnostic push
446 #pragma clang diagnostic ignored "-Wformat-invalid-specifier"
447   printf("%@", 12); // no-warning
448 #pragma clang diagnostic pop
449 }
450 
451 // Make sure warnings are on for next test.
452 #pragma GCC diagnostic warning "-Wformat"
453 #pragma GCC diagnostic warning "-Wformat-security"
454 
455 // Test that the printf call site is where the warning is attached.  If the
456 // format string is somewhere else, point to it in a note.
457 void pr9751() {
458   const char kFormat1[] = "%d %d \n"; // expected-note{{format string is defined here}}}
459   printf(kFormat1, 0); // expected-warning{{more '%' conversions than data arguments}}
460   printf("%d %s\n", 0); // expected-warning{{more '%' conversions than data arguments}}
461 
462   const char kFormat2[] = "%18$s\n"; // expected-note{{format string is defined here}}
463   printf(kFormat2, 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}}
464   printf("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}}
465 
466   const char kFormat4[] = "%y"; // expected-note{{format string is defined here}}
467   printf(kFormat4, 5); // expected-warning{{invalid conversion specifier 'y'}}
468   printf("%y", 5); // expected-warning{{invalid conversion specifier 'y'}}
469 
470   const char kFormat5[] = "%."; // expected-note{{format string is defined here}}
471   printf(kFormat5, 5); // expected-warning{{incomplete format specifier}}
472   printf("%.", 5); // expected-warning{{incomplete format specifier}}
473 
474   const char kFormat6[] = "%s"; // expected-note{{format string is defined here}}
475   printf(kFormat6, 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
476   printf("%s", 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
477 
478   const char kFormat7[] = "%0$"; // expected-note{{format string is defined here}}
479   printf(kFormat7, 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
480   printf("%0$", 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
481 
482   const char kFormat8[] = "%1$d %d"; // expected-note{{format string is defined here}}
483   printf(kFormat8, 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}}
484   printf("%1$d %d", 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}}
485 
486   const char kFormat9[] = ""; // expected-note{{format string is defined here}}
487   printf(kFormat9, 4, 4); // expected-warning{{format string is empty}}
488   printf("", 4, 4); // expected-warning{{format string is empty}}
489 
490   const char kFormat10[] = "\0%d"; // expected-note{{format string is defined here}}
491   printf(kFormat10, 4); // expected-warning{{format string contains '\0' within the string body}}
492   printf("\0%d", 4); // expected-warning{{format string contains '\0' within the string body}}
493 
494   const char kFormat11[] = "%*d"; // expected-note{{format string is defined here}}
495   printf(kFormat11); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
496   printf("%*d"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
497 
498   const char kFormat12[] = "%*d"; // expected-note{{format string is defined here}}
499   printf(kFormat12, 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
500   printf("%*d", 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
501 
502   const char kFormat13[] = "%.3p"; // expected-note{{format string is defined here}}
503   void *p;
504   printf(kFormat13, p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
505   printf("%.3p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
506 
507   const char kFormat14[] = "%0s"; // expected-note{{format string is defined here}}
508   printf(kFormat14, "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
509   printf("%0s", "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
510 
511   const char kFormat15[] = "%hhs"; // expected-note{{format string is defined here}}
512   printf(kFormat15, "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
513   printf("%hhs", "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
514 
515   const char kFormat16[] = "%-0d"; // expected-note{{format string is defined here}}
516   printf(kFormat16, 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
517   printf("%-0d", 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
518 
519   // Make sure that the "format string is defined here" note is not emitted
520   // when the original string is within the argument expression.
521   printf(1 ? "yes %d" : "no %d"); // expected-warning 2{{more '%' conversions than data arguments}}
522 
523   const char kFormat17[] = "%hu"; // expected-note{{format string is defined here}}}
524   printf(kFormat17, (int[]){0}); // expected-warning{{format specifies type 'unsigned short' but the argument}}
525 
526   printf("%a", (long double)0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}}
527 
528   // Test braced char[] initializers.
529   const char kFormat18[] = { "%lld" }; // expected-note{{format string is defined here}}
530   printf(kFormat18, 0); // expected-warning{{format specifies type}}
531 
532   // Make sure we point at the offending argument rather than the format string.
533   const char kFormat19[] = "%d";  // expected-note{{format string is defined here}}
534   printf(kFormat19,
535          0.0); // expected-warning{{format specifies}}
536 }
537 
538 void __attribute__((format(strfmon,1,2))) monformat(const char *fmt, ...);
539 void __attribute__((format(strftime,1,0))) dateformat(const char *fmt);
540 
541 // Other formats
542 void test_other_formats() {
543   char *str = "";
544   monformat("", 1); // expected-warning{{format string is empty}}
545   monformat(str); // expected-warning{{format string is not a string literal (potentially insecure)}}
546   dateformat(""); // expected-warning{{format string is empty}}
547   dateformat(str); // no-warning (using strftime non literal is not unsafe)
548 }
549 
550 // Do not warn about unused arguments coming from system headers.
551 // <rdar://problem/11317765>
552 #include <format-unused-system-args.h>
553 void test_unused_system_args(int x) {
554   PRINT1("%d\n", x); // no-warning{{extra argument is system header is OK}}
555 }
556 
557 void pr12761(char c) {
558   // This should not warn even with -fno-signed-char.
559   printf("%hhx", c);
560 }
561 
562 
563 // Test that we correctly merge the format in both orders.
564 extern void test14_foo(const char *, const char *, ...)
565      __attribute__((__format__(__printf__, 1, 3)));
566 extern void test14_foo(const char *, const char *, ...)
567      __attribute__((__format__(__scanf__, 2, 3)));
568 
569 extern void test14_bar(const char *, const char *, ...)
570      __attribute__((__format__(__scanf__, 2, 3)));
571 extern void test14_bar(const char *, const char *, ...)
572      __attribute__((__format__(__printf__, 1, 3)));
573 
574 void test14_zed(int *p) {
575   test14_foo("%", "%d", p); // expected-warning{{incomplete format specifier}}
576   test14_bar("%", "%d", p); // expected-warning{{incomplete format specifier}}
577 }
578 
579 void test_qualifiers(volatile int *vip, const int *cip,
580                      const volatile int *cvip) {
581   printf("%n", cip); // expected-warning{{format specifies type 'int *' but the argument has type 'const int *'}}
582   printf("%n", cvip); // expected-warning{{format specifies type 'int *' but the argument has type 'const volatile int *'}}
583 
584   printf("%n", vip); // No warning.
585   printf("%p", cip); // No warning.
586   printf("%p", cvip); // No warning.
587 
588 
589   typedef int* ip_t;
590   typedef const int* cip_t;
591   printf("%n", (ip_t)0); // No warning.
592   printf("%n", (cip_t)0); // expected-warning{{format specifies type 'int *' but the argument has type 'cip_t' (aka 'const int *')}}
593 }
594 
595 #pragma GCC diagnostic ignored "-Wformat-nonliteral"
596 #pragma GCC diagnostic warning "-Wformat-security"
597 // <rdar://problem/14178260>
598 extern void test_format_security_extra_args(const char*, int, ...)
599     __attribute__((__format__(__printf__, 1, 3)));
600 void test_format_security_pos(char* string) {
601   test_format_security_extra_args(string, 5); // expected-warning {{format string is not a string literal (potentially insecure)}}
602 }
603 #pragma GCC diagnostic warning "-Wformat-nonliteral"
604