1 /* Verify that all sprintf built-ins detect overflow involving directives
2 with non-constant arguments known to be constrained by some range of
3 values, and even when writing into dynamically allocated buffers.
4 -O2 (-ftree-vrp) is necessary for the tests involving ranges to pass,
5 otherwise -O1 is sufficient.
6 { dg-do compile }
7 { dg-require-effective-target alloca }
8 { dg-options "-O2 -Wformat -Wformat-overflow=1 -ftrack-macro-expansion=0" } */
9
10 typedef __SIZE_TYPE__ size_t;
11
12 #ifndef LINE
13 # define LINE 0
14 #endif
15
16 #define bos(x) __builtin_object_size (x, 0)
17
18 /* Defined (and redefined) to the allocation function to use, either
19 malloc, or alloca, or a VLA. */
20 #define ALLOC(p, n) (p) = __builtin_malloc (n)
21
22 /* Defined (and redefined) to the sprintf function to exercise. */
23 #define TEST_SPRINTF(d, maxsize, objsize, fmt, ...) \
24 __builtin___sprintf_chk (d, 0, objsize, fmt, __VA_ARGS__)
25
26 #define T(bufsize, fmt, ...) \
27 do { \
28 if (!LINE || __LINE__ == LINE) \
29 { \
30 char *d; \
31 ALLOC (d, bufsize); \
32 TEST_SPRINTF (d, 0, bos (d), fmt, __VA_ARGS__); \
33 sink (d); \
34 } \
35 } while (0)
36
37 void sink (void*);
38
39 /* Identity function to verify that the checker figures out the value
40 of the operand even when it's not constant (i.e., makes use of
41 inlining and constant propagation information). */
42
i(int x)43 static int i (int x) { return x; }
s(const char * str)44 static const char* s (const char *str) { return str; }
45
46 /* Function to "generate" a unique unknown number (as far as GCC can
47 tell) each time it's called. It prevents the optimizer from being
48 able to narrow down the ranges of possible values in test functions
49 with repeated references to the same variable. */
50 extern int x (void);
51
52 /* Verify that the checker can detect buffer overflow when the "%s"
53 argument is in a known range of lengths and one or both of which
54 exceed the size of the destination. */
55
test_sprintf_chk_string(const char * s,const char * t)56 void test_sprintf_chk_string (const char *s, const char *t)
57 {
58 #define x x ()
59
60 T (1, "%-s", x ? "" : "1"); /* { dg-warning "nul past the end" } */
61 T (1, "%-s", x ? "1" : ""); /* { dg-warning "nul past the end" } */
62 T (1, "%-s", x ? s : "1"); /* { dg-warning "nul past the end" } */
63 T (1, "%-s", x ? "1" : s); /* { dg-warning "nul past the end" } */
64
65 /* When neither string is known no warning should be issued at level 1
66 since their lenghts are assumed to be zero. */
67 T (1, "%s", x ? s : t);
68
69 T (2, "%s", x ? "" : "1");
70 T (2, "%s", x ? "" : s);
71 T (2, "%s", x ? "1" : "");
72 T (2, "%s", x ? s : "");
73 T (2, "%s", x ? "1" : "2");
74 T (2, "%s", x ? "" : "12"); /* { dg-warning "nul past the end" } */
75 T (2, "%s", x ? "12" : ""); /* { dg-warning "nul past the end" } */
76
77 T (2, "%s", x ? "" : "123"); /* { dg-warning "into a region" } */
78 T (2, "%s", x ? "123" : ""); /* { dg-warning "into a region" } */
79
80 #undef x
81 }
82
83
84 /* Verify that the checker makes use of integer constant propagation
85 to detect buffer overflow in non-constant cases. */
86
test_sprintf_chk_integer_value(void)87 void test_sprintf_chk_integer_value (void)
88 {
89 T ( 1, "%i", i ( 0)); /* { dg-warning "nul past the end" } */
90 T ( 1, "%i", i ( 1)); /* { dg-warning "nul past the end" } */
91 T ( 1, "%i", i ( -1)); /* { dg-warning "into a region" } */
92 T ( 1, "%i_", i ( 1)); /* { dg-warning " 1 byte into a region of size 0" } */
93 T ( 1, "_%i", i ( 1)); /* { dg-warning "into a region" } */
94 T ( 1, "_%i_",i ( 1)); /* { dg-warning "into a region" } */
95 T ( 1, "%o", i ( 0)); /* { dg-warning "nul past the end" } */
96 T ( 1, "%u", i ( 0)); /* { dg-warning "nul past the end" } */
97 T ( 1, "%x", i ( 0)); /* { dg-warning "nul past the end" } */
98 T ( 1, "%#x", i ( 0)); /* { dg-warning "nul past the end" } */
99 T ( 1, "%x", i ( 1)); /* { dg-warning "nul past the end" } */
100 T ( 1, "%#x", i ( 1)); /* { dg-warning "into a region" } */
101
102 T ( 2, "%i", i ( 0));
103 T ( 2, "%i", i ( 1));
104 T ( 2, "%i", i ( 9));
105 T ( 2, "%i", i ( -1)); /* { dg-warning "nul past the end" } */
106 T ( 2, "%i", i ( 10)); /* { dg-warning "nul past the end" } */
107 T ( 2, "%i_", i ( 0)); /* { dg-warning "nul past the end" } */
108 T ( 2, "_%i", i ( 0)); /* { dg-warning "nul past the end" } */
109 T ( 2, "_%i_",i ( 0)); /* { dg-warning " 1 byte into a region of size 0" } */
110 T ( 2, "%o", i ( 1));
111 T ( 2, "%o", i ( 7));
112 T ( 2, "%o", i ( 010)); /* { dg-warning "nul past the end" } */
113 T ( 2, "%o", i ( 0100)); /* { dg-warning "into a region" } */
114 T ( 2, "%x", i ( 1));
115 T ( 2, "%#x", i ( 1)); /* { dg-warning "into a region" } */
116 T ( 2, "%x", i ( 0xa));
117 T ( 2, "%x", i ( 0xf));
118 T ( 2, "%x", i ( 0x10)); /* { dg-warning "nul past the end" } */
119 T ( 2, "%x", i ( 0xff)); /* { dg-warning "nul past the end" } */
120 T ( 2, "%x", i (0x1ff)); /* { dg-warning "into a region" } */
121
122 T ( 3, "%i", i ( 0));
123 T ( 3, "%i", i ( 1));
124 T ( 3, "%i", i ( 9));
125 T ( 3, "%i", i ( -9));
126 T ( 3, "%i", i ( 10));
127 T ( 3, "%i", i ( 99));
128 T ( 3, "%i", i ( -99)); /* { dg-warning "nul past the end" } */
129
130 T ( 3, "%i", i (99) + i (1)); /* { dg-warning "nul past the end" } */
131
132 T ( 8, "%8u", i ( 1)); /* { dg-warning "nul past the end" } */
133 T ( 9, "%8u", i ( 1));
134 }
135
136 extern int rand (void);
137
138 /* Functions to require optimization to figure out the range of the operand.
139 Used to verify that the checker makes use of the range information to
140 avoid diagnosing the output of sufficiently constrained arguments to
141 integer directives. */
142
143 static signed char
range_schar(signed char min,signed char max)144 range_schar (signed char min, signed char max)
145 {
146 signed char val = rand ();
147 return val < min || max < val ? min : val;
148 }
149
150 static unsigned char
range_uchar(unsigned char min,unsigned char max)151 range_uchar (unsigned char min, unsigned char max)
152 {
153 unsigned char val = rand ();
154 return val < min || max < val ? min : val;
155 }
156
157 static signed short
range_sshrt(signed short min,signed short max)158 range_sshrt (signed short min, signed short max)
159 {
160 signed short val = rand ();
161 return val < min || max < val ? min : val;
162 }
163
164 static unsigned short
range_ushrt(unsigned short min,unsigned short max)165 range_ushrt (unsigned short min, unsigned short max)
166 {
167 unsigned short val = rand ();
168 return val < min || max < val ? min : val;
169 }
170
171 static signed int
range_sint(signed int min,signed int max)172 range_sint (signed int min, signed int max)
173 {
174 signed int val = rand ();
175 return val < min || max < val ? min : val;
176 }
177
178 static unsigned int
range_uint(unsigned int min,unsigned int max)179 range_uint (unsigned int min, unsigned int max)
180 {
181 unsigned int val = rand ();
182 return val < min || max < val ? min : val;
183 }
184
test_sprintf_chk_range_schar(void)185 void test_sprintf_chk_range_schar (void)
186 {
187 #define R(min, max) range_sint (min, max)
188
189 T ( 0, "%hhi", R (0, 1)); /* { dg-warning ".%hhi. directive writing 1 byte into a region of size 0" } */
190 /* { dg-message "directive argument in the range \\\[0, 1\\\]" "note" { target *-*-* } .-1 } */
191
192 T ( 0, "%hhi", R (0, 127)); /* { dg-warning ".%hhi. directive writing between 1 and 3 bytes into a region of size 0" } */
193 /* { dg-message "directive argument in the range \\\[0, 127\\\]" "note" { target *-*-* } .-1 } */
194
195 T ( 0, "%hhi", R (1024, 1033)); /* { dg-warning ".%hhi. directive writing 1 byte into a region of size 0" } */
196 /* { dg-message "directive argument in the range \\\[1024, 1033\\\]" "note" { target *-*-* } .-1 } */
197
198 T ( 0, "%hhi", R (1024, 1034)); /* { dg-warning ".%hhi. directive writing between 1 and 2 bytes into a region of size 0" } */
199 /* { dg-message "directive argument in the range \\\[1024, 1034\\\]" "note" { target *-*-* } .-1 } */
200
201 T ( 0, "%hhi", R (1024, 2035)); /* { dg-warning ".%hhi. directive writing between 1 and 4 bytes into a region of size 0" } */
202 /* { dg-message "using the range \\\[-128, 127\\\] for directive argument" "note" { target *-*-* } .-1 } */
203
204 T ( 2, "%#hhx", R (1234, 12345)); /* { dg-warning "'%#hhx' directive writing between 1 and 4 bytes into a region of size 2 " } */
205 T ( 3, "%#hhx", R (1234, 12345)); /* { dg-warning "may write a terminating nul" } */
206 T ( 4, "%#hhx", R (1234, 12345));
207
208 #undef R
209 #define R(min, max) range_schar (min, max)
210
211 T ( 0, "%i", R (0, 9)); /* { dg-warning ".%i. directive writing 1 byte into a region of size 0" } */
212 T ( 1, "%i", R (0, 9)); /* { dg-warning "nul past the end" } */
213 T ( 2, "%i", R (0, 9));
214 T ( 2, "%i", R (-1, 0)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
215 T ( 2, "%i", R (9, 10)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
216
217 T ( 3, "%i", R ( -9, 9));
218 T ( 3, "%i", R (-99, 99)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
219 T ( 3, "%i", R ( 0, 99));
220 T ( 3, "%i", R ( 0, 100)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
221
222 /* The following call may write as few as 2 bytes and as many as 4.
223 It's a judgment call how best to diagnose it to make the potential
224 problem clear. */
225 T ( 3, "%i%i", R (1, 10), R (9, 10)); /* { dg-warning "directive writing between 1 and 2 bytes into a region of size between 1 and 2" } */
226
227 T ( 4, "%i%i", R (10, 11), R (12, 13)); /* { dg-warning "nul past the end" } */
228
229 T ( 5, "%i%i", R (-9, 99), R (-9, 99));
230
231 T ( 6, "%i_%i_%i", R (0, 9), R (0, 9), R (0, 9));
232 T ( 6, "%i_%i_%i", R (0, 9), R (0, 9), R (0, 10)); /* { dg-warning "may write a terminating nul past the end" } */
233 T ( 6, "%i_%i_%i", R (0, 9), R (0, 10), R (0, 9)); /* { dg-warning "may write a terminating nul past the end" } */
234 T ( 6, "%i_%i_%i", R (0, 10), R (0, 9), R (0, 9)); /* { dg-warning "may write a terminating nul past the end" } */
235 T ( 6, "%hhi_%hi_%i", R (0, 9), R (0, 10), R (0, 10)); /* { dg-warning ".i. directive writing between 1 and 2 bytes into a region of size between 1 and 2" } */
236 T ( 6, "%3i|%2i/%1i", R (0, 99), R (0, 99), R (0, 99)); /* { dg-warning "./. directive writing 1 byte into a region of size 0" } */
237 T ( 6, "%.3i|%.2i/%i", R (0, 99), R (0, 99), R (0, 99)); /* { dg-warning "./. directive writing 1 byte into a region of size 0" } */
238 T ( 6, "%.3i|%.2i/%i", R (0, 119), R (0, 99), R (0, 99)); /* { dg-warning "./. directive writing 1 byte into a region of size 0" } */
239 T ( 6, "%.3i|%.2i/%i", R (0, 1), R (0, 2), R (0, 3)); /* { dg-warning "./. directive writing 1 byte into a region of size 0" } */
240 }
241
test_sprintf_chk_range_uchar(void)242 void test_sprintf_chk_range_uchar (void)
243 {
244 #undef R
245 #define R(min, max) range_uchar (min, max)
246
247 T ( 0, "%i", R (0, 9)); /* { dg-warning ".%i. directive writing 1 byte into a region of size 0" } */
248 T ( 1, "%i", R (0, 9)); /* { dg-warning "nul past the end" } */
249 T ( 2, "%i", R (0, 9));
250 T ( 2, "%i", R (9, 10)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
251
252 T ( 3, "%i", R (0, 99));
253 T ( 3, "%i", R (0, 100)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
254 }
255
test_sprintf_chk_range_sshrt(void)256 void test_sprintf_chk_range_sshrt (void)
257 {
258 #undef R
259 #define R(min, max) range_sshrt (min, max)
260
261 T ( 0, "%i", R ( 0, 9)); /* { dg-warning ".%i. directive writing 1 byte into a region of size 0" } */
262 T ( 1, "%i", R ( 0, 1)); /* { dg-warning "nul past the end" } */
263 T ( 1, "%i", R ( 0, 9)); /* { dg-warning "nul past the end" } */
264 T ( 2, "%i", R ( 0, 1));
265 T ( 2, "%i", R ( 8, 9));
266 T ( 2, "%i", R ( 0, 9));
267 T ( 2, "%i", R (-1, 0)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
268 T ( 2, "%i", R ( 9, 10)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
269
270 T ( 3, "%i", R ( 0, 99));
271 T ( 3, "%i", R (99, 999)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
272
273 T ( 4, "%i", R ( 0, 999));
274 T ( 4, "%i", R ( 99, 999));
275 T ( 4, "%i", R (998, 999));
276 T ( 4, "%i", R (999, 1000)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
277 }
278
test_sprintf_chk_range_ushrt(void)279 void test_sprintf_chk_range_ushrt (void)
280 {
281 #undef R
282 #define R(min, max) range_ushrt (min, max)
283
284 T ( 0, "%i", R ( 0, 9)); /* { dg-warning ".%i. directive writing 1 byte into a region of size 0" } */
285 T ( 1, "%i", R ( 0, 1)); /* { dg-warning "nul past the end" } */
286 T ( 1, "%i", R ( 0, 9)); /* { dg-warning "nul past the end" } */
287 T ( 2, "%i", R ( 0, 1));
288 T ( 2, "%i", R ( 8, 9));
289 T ( 2, "%i", R ( 0, 9));
290 T ( 2, "%i", R ( 9, 10)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
291
292 T ( 3, "%i", R ( 0, 99));
293 T ( 3, "%i", R (99, 999)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
294
295 T ( 4, "%i", R ( 0, 999));
296 T ( 4, "%i", R ( 99, 999));
297 T ( 4, "%i", R (998, 999));
298 T ( 4, "%i", R (999, 1000)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
299 }
300
test_sprintf_chk_range_sint(void)301 void test_sprintf_chk_range_sint (void)
302 {
303 #undef R
304 #define R(min, max) range_sint (min, max)
305
306 T ( 0, "%i", R ( 0, 9)); /* { dg-warning ".%i. directive writing 1 byte into a region of size 0" } */
307 T ( 1, "%i", R ( 0, 1)); /* { dg-warning "nul past the end" } */
308 T ( 1, "%i", R ( 0, 9)); /* { dg-warning "nul past the end" } */
309 T ( 2, "%i", R ( 0, 1));
310 T ( 2, "%i", R ( 8, 9));
311 T ( 2, "%i", R ( 0, 9));
312 T ( 2, "%i", R (-1, 0)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
313 T ( 2, "%i", R ( 9, 10)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
314
315 T ( 3, "%i", R ( 0, 99));
316 T ( 3, "%i", R (99, 999)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
317
318 T ( 4, "%i", R ( 0, 999));
319 T ( 4, "%i", R ( 99, 999));
320 T ( 4, "%i", R (998, 999));
321 T ( 4, "%i", R (999, 1000)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
322 }
323
test_sprintf_chk_range_uint(void)324 void test_sprintf_chk_range_uint (void)
325 {
326 #undef R
327 #define R(min, max) range_uint (min, max)
328
329 T ( 0, "%i", R ( 0, 9)); /* { dg-warning ".%i. directive writing 1 byte into a region of size 0" } */
330 T ( 1, "%i", R ( 0, 1)); /* { dg-warning "nul past the end" } */
331 T ( 1, "%i", R ( 0, 9)); /* { dg-warning "nul past the end" } */
332 T ( 2, "%i", R ( 0, 1));
333 T ( 2, "%i", R ( 8, 9));
334 T ( 2, "%i", R ( 0, 9));
335 T ( 2, "%i", R ( 9, 10)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
336
337 T ( 3, "%i", R ( 0, 99));
338 T ( 3, "%i", R (99, 999)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
339
340 T ( 4, "%i", R ( 0, 999));
341 T ( 4, "%i", R ( 99, 999));
342 T ( 4, "%i", R (998, 999));
343 T ( 4, "%i", R (999, 1000)); /* { dg-warning "may write a terminating nul past the end of the destination" } */
344 }
345
346 /* Verify that destination size in excess of INT_MAX (and, separately,
347 in excess of the largest object) is diagnosed. The former because
348 the functions are defined only for output of at most INT_MAX and
349 specifying a large upper bound defeats the bounds checking (and,
350 on some implementations such as Solaris, causes the function to
351 fail. The latter because due to the limit of ptrdiff_t no object
352 can be larger than PTRDIFF_MAX bytes. */
353
test_too_large(char * d,int x,__builtin_va_list va)354 void test_too_large (char *d, int x, __builtin_va_list va)
355 {
356 const size_t imax = __INT_MAX__;
357 const size_t imax_p1 = imax + 1;
358
359 __builtin_snprintf (d, imax, "%c", x);
360 __builtin_snprintf (d, imax_p1, "%c", x); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "INT_MAX + 1" { target lp64 } } */
361 /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size" "INT_MAX + 1" { target { { avr-*-* } || ilp32 } } .-1 } */
362
363 __builtin_vsnprintf (d, imax, "%c", va);
364 __builtin_vsnprintf (d, imax_p1, "%c", va); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "INT_MAX + 1" { target lp64 } } */
365 /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size" "INT_MAX + 1" { target { { avr-*-* } || ilp32 } } .-1 } */
366
367 __builtin___snprintf_chk (d, imax, 0, imax, "%c", x);
368 __builtin___snprintf_chk (d, imax_p1, 0, imax_p1, "%c", x); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "INT_MAX + 1" { target lp64 } } */
369 /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size" "INT_MAX + 1" { target { { avr-*-* } || ilp32 } } .-1 } */
370
371 __builtin___vsnprintf_chk (d, imax, 0, imax, "%c", va);
372 __builtin___vsnprintf_chk (d, imax_p1, 0, imax_p1, "%c", va); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "INT_MAX + 1" { target lp64 } } */
373 /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size" "INT_MAX + 1" { target { { avr-*-* } || ilp32 } } .-1 } */
374
375 const size_t ptrmax = __PTRDIFF_MAX__;
376 const size_t ptrmax_m1 = ptrmax - 1;
377
378 __builtin_snprintf (d, ptrmax_m1, "%c", x); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX - 1" { target lp64 } } */
379 __builtin_snprintf (d, ptrmax, " %c", x); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX" { target lp64 } } */
380
381 __builtin_vsnprintf (d, ptrmax_m1, "%c", va); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX - 1" { target lp64 } } */
382 __builtin_vsnprintf (d, ptrmax, "%c", va); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX" { target lp64 } } */
383
384 __builtin___snprintf_chk (d, ptrmax_m1, 0, ptrmax_m1, "%c", x); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX - 1" { target lp64 } } */
385 __builtin___snprintf_chk (d, ptrmax, 0, ptrmax, "%c", x); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX" { target lp64 } } */
386
387 __builtin___vsnprintf_chk (d, ptrmax_m1, 0, ptrmax_m1, "%c", va); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX - 1" { target lp64 } } */
388 __builtin___vsnprintf_chk (d, ptrmax, 0, ptrmax, "%c", va); /* { dg-warning "specified bound \[0-9\]+ exceeds .INT_MAX." "PTRDIFF_MAX" { target lp64 } } */
389 }
390
391 /* Exercise ordinary sprintf with malloc. */
392 #undef TEST_SPRINTF
393 #define TEST_SPRINTF(d, maxsize, objsize, fmt, ...) \
394 __builtin_sprintf (d, fmt, __VA_ARGS__)
395
test_sprintf_malloc(const char * s,const char * t)396 void test_sprintf_malloc (const char *s, const char *t)
397 {
398 #define x x ()
399
400 T (1, "%-s", x ? "" : "1"); /* { dg-warning "nul past the end" } */
401 T (1, "%-s", x ? "1" : ""); /* { dg-warning "nul past the end" } */
402 T (1, "%-s", x ? s : "1"); /* { dg-warning "nul past the end" } */
403 T (1, "%-s", x ? "1" : s); /* { dg-warning "nul past the end" } */
404 T (1, "%-s", x ? s : t);
405
406 T (2, "%-s", x ? "" : "1");
407 T (2, "%-s", x ? "" : s);
408 T (2, "%-s", x ? "1" : "");
409 T (2, "%-s", x ? s : "");
410 T (2, "%-s", x ? "1" : "2");
411 T (2, "%-s", x ? "" : "12"); /* { dg-warning "nul past the end" } */
412 T (2, "%-s", x ? "12" : ""); /* { dg-warning "nul past the end" } */
413
414 T (2, "%-s", x ? "" : "123"); /* { dg-warning "into a region" } */
415 T (2, "%-s", x ? "123" : ""); /* { dg-warning "into a region" } */
416
417 #undef x
418 }
419
420 /* Exercise ordinary sprintf with alloca. */
421 #undef ALLOC
422 #define ALLOC(p, n) (p) = __builtin_alloca (n)
423
test_sprintf_alloca(const char * s,const char * t)424 void test_sprintf_alloca (const char *s, const char *t)
425 {
426 #define x x ()
427
428 T (1, "%-s", x ? "" : "1"); /* { dg-warning "nul past the end" } */
429 T (1, "%-s", x ? "1" : ""); /* { dg-warning "nul past the end" } */
430 T (1, "%-s", x ? s : "1"); /* { dg-warning "nul past the end" } */
431 T (1, "%-s", x ? "1" : s); /* { dg-warning "nul past the end" } */
432 T (1, "%-s", x ? s : t);
433
434 T (2, "%-s", x ? "" : "1");
435 T (2, "%-s", x ? "" : s);
436 T (2, "%-s", x ? "1" : "");
437 T (2, "%-s", x ? s : "");
438 T (2, "%-s", x ? "1" : "2");
439 T (2, "%-s", x ? "" : "12"); /* { dg-warning "nul past the end" } */
440 T (2, "%-s", x ? "12" : ""); /* { dg-warning "nul past the end" } */
441
442 T (2, "%-s", x ? "" : "123"); /* { dg-warning "into a region" } */
443 T (2, "%-s", x ? "123" : ""); /* { dg-warning "into a region" } */
444
445 #undef x
446 }
447
448 /* Exercise ordinary sprintf with a VLA. */
449 #undef ALLOC
450 #define ALLOC(p, n) char vla [i (n)]; (p) = vla
451
test_sprintf_vla(const char * s,const char * t)452 void test_sprintf_vla (const char *s, const char *t)
453 {
454 #define x x ()
455
456 T (1, "%-s", x ? "" : "1"); /* { dg-warning "nul past the end" } */
457 T (1, "%-s", x ? "1" : ""); /* { dg-warning "nul past the end" } */
458 T (1, "%-s", x ? s : "1"); /* { dg-warning "nul past the end" } */
459 T (1, "%-s", x ? "1" : s); /* { dg-warning "nul past the end" } */
460 T (1, "%-s", x ? s : t);
461
462 T (2, "%-s", x ? "" : "1");
463 T (2, "%-s", x ? "" : s);
464 T (2, "%-s", x ? "1" : "");
465 T (2, "%-s", x ? s : "");
466 T (2, "%-s", x ? "1" : "2");
467 T (2, "%-s", x ? "" : "12"); /* { dg-warning "nul past the end" } */
468 T (2, "%-s", x ? "12" : ""); /* { dg-warning "nul past the end" } */
469
470 T (2, "%-s", x ? "" : "123"); /* { dg-warning "into a region" } */
471 T (2, "%-s", x ? "123" : ""); /* { dg-warning "into a region" } */
472
473 #undef x
474 }
475