1 /* { dg-do compile } */
2 /* { dg-options "-Wformat -Wformat-overflow=1 -fdiagnostics-show-caret" } */
3 
4 extern int sprintf (char*, const char*, ...);
5 
6 char dst [3];
7 
test(void)8 void test (void)
9 {
10   /* Verify thet the caret points to the (invisible) nul character
11      at the end of the format string (i.e., its closing quote).
12      The redundant argument is there to get around GCC bug 77799.  */
13   sprintf (dst + 2, "1", 0);
14   /* { dg-warning "writing a terminating nul past the end of the destination" "nul warning" { target *-*-* } .-1 }
15      { dg-message ".sprintf. output 2 bytes into a destination of size 1" "note" { target *-*-* } .-2 }
16      { dg-begin-multiline-output "-Wformat output: redundant argument" }
17    sprintf (dst + 2, "1", 0);
18                      ^~~
19      { dg-end-multiline-output "" }
20      { dg-begin-multiline-output "-Wformat-overflow output" }
21    sprintf (dst + 2, "1", 0);
22                        ^
23      { dg-end-multiline-output "" }
24      { dg-begin-multiline-output "note" }
25    sprintf (dst + 2, "1", 0);
26    ^~~~~~~~~~~~~~~~~~~~~~~~~
27      { dg-end-multiline-output "" } */
28 
29   /* Verify thet the caret points at the first format character written
30      past the end of the destination.  */
31   sprintf (dst, "1234", 0);
32   /* { dg-warning "writing 4 bytes into a region of size 3" "overlong format string" { target *-*-* } .-1 }
33      { dg-message ".sprintf. output 5 bytes into a destination of size 3" "note" { target *-*-* } .-2 }
34      { dg-begin-multiline-output "-Wformat output: redundant argument" }
35    sprintf (dst, "1234", 0);
36                  ^~~~~~
37      { dg-end-multiline-output "" }
38      { dg-begin-multiline-output "-Wformat-overflow output" }
39    sprintf (dst, "1234", 0);
40                   ~~~^
41      { dg-end-multiline-output "" }
42      { dg-begin-multiline-output "note" }
43    sprintf (dst, "1234", 0);
44    ^~~~~~~~~~~~~~~~~~~~~~~~
45      { dg-end-multiline-output "" } */
46 
47   /* Verify thet the caret points at the first format character written
48      past the end of the destination and the rest of the format string
49      is underlined.  */
50   sprintf (dst, "12345", 0);
51   /* { dg-warning "writing 5 bytes into a region of size 3" "nul warning" { target *-*-* } .-1 }
52      { dg-message ".sprintf. output 6 bytes into a destination of size 3" "note" { target *-*-* } .-2 }
53      { dg-begin-multiline-output "-Wformat output: redundant argument" }
54    sprintf (dst, "12345", 0);
55                  ^~~~~~~
56      { dg-end-multiline-output "" }
57      { dg-begin-multiline-output "-Wformat-overflow output" }
58    sprintf (dst, "12345", 0);
59                   ~~~^~
60      { dg-end-multiline-output "" }
61      { dg-begin-multiline-output "note" }
62    sprintf (dst, "12345", 0);
63    ^~~~~~~~~~~~~~~~~~~~~~~~~
64      { dg-end-multiline-output "" } */
65 
66   /* Same as above but with a directive.  The minus flag is used to
67      get around GCC bug 77671.  */
68   sprintf (dst + 2, "%-s", "1");
69   /* { dg-warning "writing a terminating nul past the end of the destination" "warning" { target *-*-* } .-1 }
70      { dg-message ".sprintf. output 2 bytes into a destination of size 1" "note" { target *-*-* } .-2 }
71      { dg-begin-multiline-output "-Wformat-overflow output" }
72    sprintf (dst + 2, "%-s", "1");
73                          ^
74      { dg-end-multiline-output "" }
75      { dg-begin-multiline-output "note" }
76    sprintf (dst + 2, "%-s", "1");
77    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
78    { dg-end-multiline-output "" } */
79 
80   sprintf (dst + 2, "%-s", "abcd");
81   /* { dg-warning ".%-s. directive writing 4 bytes into a region of size 1" "warning" { target *-*-* } .-1 }
82      { dg-message ".sprintf. output 5 bytes into a destination of size 1" "note" { target *-*-* } .-2 }
83      { dg-begin-multiline-output "-Wformat-overflow output" }
84    sprintf (dst + 2, "%-s", "abcd");
85                       ^~~   ~~~~~~
86      { dg-end-multiline-output "" }
87      { dg-begin-multiline-output "note" }
88    sprintf (dst + 2, "%-s", "abcd");
89    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
90     { dg-end-multiline-output "" } */
91 }
92 
93 /* { dg-prune-output "too many arguments for format" } */
94 
95 /* When debugging, define LINE to the line number of the test case to exercise
96    and avoid exercising any of the others.  The buffer macro
97    below makes use of LINE to avoid warnings for other lines.  */
98 #ifndef LINE
99 # define LINE 0
100 #endif
101 
102 char buffer [256];
103 extern char *ptr;
104 
105 /* Evaluate to an array of SIZE characters when non-negative and LINE
106    is not set or set to the line the macro is on, or to a pointer to
107    an unknown object otherwise.  */
108 #define buffer(size)                                                    \
109   (0 <= size && (!LINE || __LINE__ == LINE)                             \
110    ? buffer + sizeof buffer - size : ptr)
111 
112 /* Verify that the note printed along with the diagnostic mentions
113    the correct sizes and refers to the location corresponding to
114    the affected directive.  */
115 
test_sprintf_note(void)116 void test_sprintf_note (void)
117 {
118   /* Diagnostic column numbers are 1-based.  */
119 
120   __builtin_sprintf (buffer (0), "%c%s%i", '1', "2", 3);
121   /* { dg-warning "35: .%c. directive writing 1 byte into a region of size 0" "" { target *-*-* } .-1 }
122      { dg-begin-multiline-output "" }
123    __builtin_sprintf (buffer (0), "%c%s%i", '1', "2", 3);
124                                    ^~
125      { dg-end-multiline-output "" }
126 
127      { dg-message ".__builtin_sprintf. output 4 bytes into a destination of size 0" "" { target *-*-* } .-7 }
128      { dg-begin-multiline-output "" }
129    __builtin_sprintf (buffer (0), "%c%s%i", '1', "2", 3);
130    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
131      { dg-end-multiline-output "" } */
132 
133   __builtin_sprintf (buffer (1), "%c%s%i", '1', "23", 45);
134   /* { dg-warning "37: .%s. directive writing 2 bytes into a region of size 0" "" { target *-*-* } .-1 }
135      { dg-begin-multiline-output "" }
136    __builtin_sprintf (buffer (1), "%c%s%i", '1', "23", 45);
137                                      ^~          ~~~~
138      { dg-end-multiline-output "" }
139 
140      { dg-message ".__builtin_sprintf. output 6 bytes into a destination of size 1" "" { target *-*-* } .-7 }
141      { dg-begin-multiline-output "" }
142    __builtin_sprintf (buffer (1), "%c%s%i", '1', "23", 45);
143    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
144      { dg-end-multiline-output "" } */
145 
146   __builtin_sprintf (buffer (2), "%c%s%i", '1', "2", 345);
147   /* { dg-warning "39: .%i. directive writing 3 bytes into a region of size 0" "" { target *-*-* } .-1 }
148      { dg-begin-multiline-output "" }
149    __builtin_sprintf (buffer (2), "%c%s%i", '1', "2", 345);
150                                        ^~
151      { dg-end-multiline-output "" }
152 
153      { dg-message ".__builtin_sprintf. output 6 bytes into a destination of size 2" "" { target *-*-* } .-7 }
154      { dg-begin-multiline-output "" }
155    __builtin_sprintf (buffer (2), "%c%s%i", '1', "2", 345);
156    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
157      { dg-end-multiline-output "" } */
158 
159   __builtin_sprintf (buffer (6), "%c%s%i", '1', "2", 3456);
160   /* { dg-warning "41: writing a terminating nul past the end of the destination" "" { target *-*-* } .-1 }
161      { dg-begin-multiline-output "" }
162    __builtin_sprintf (buffer (6), "%c%s%i", '1', "2", 3456);
163                                          ^
164      { dg-end-multiline-output "" }
165 
166      { dg-message ".__builtin_sprintf. output 7 bytes into a destination of size 6" "" { target *-*-* } .-7 }
167      { dg-begin-multiline-output "" }
168    __builtin_sprintf (buffer (6), "%c%s%i", '1', "2", 3456);
169    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
170      { dg-end-multiline-output "" } */
171 }
172