xref: /netbsd/usr.bin/xlint/lint2/chk.c (revision 6550d01e)
1 /* $NetBSD: chk.c,v 1.21 2010/01/14 16:58:27 christos Exp $ */
2 
3 /*
4  * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
5  * Copyright (c) 1994, 1995 Jochen Pohl
6  * All Rights Reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *      This product includes software developed by Jochen Pohl for
19  *	The NetBSD Project.
20  * 4. The name of the author may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #if HAVE_NBTOOL_CONFIG_H
36 #include "nbtool_config.h"
37 #endif
38 
39 #include <sys/cdefs.h>
40 #if defined(__RCSID) && !defined(lint)
41 __RCSID("$NetBSD: chk.c,v 1.21 2010/01/14 16:58:27 christos Exp $");
42 #endif
43 
44 #include <ctype.h>
45 #include <string.h>
46 #include <limits.h>
47 #include <stdlib.h>
48 
49 #include "lint2.h"
50 
51 static	void	chkund(hte_t *);
52 static	void	chkdnu(hte_t *);
53 static	void	chkdnud(hte_t *);
54 static	void	chkmd(hte_t *);
55 static	void	chkvtui(hte_t *, sym_t *, sym_t *);
56 static	void	chkvtdi(hte_t *, sym_t *, sym_t *);
57 static	void	chkfaui(hte_t *, sym_t *, sym_t *);
58 static	void	chkau(hte_t *, int, sym_t *, sym_t *, pos_t *,
59 			   fcall_t *, fcall_t *, type_t *, type_t *);
60 static	void	chkrvu(hte_t *, sym_t *);
61 static	void	chkadecl(hte_t *, sym_t *, sym_t *);
62 static	void	printflike(hte_t *,fcall_t *, int, const char *, type_t **);
63 static	void	scanflike(hte_t *, fcall_t *, int, const char *, type_t **);
64 static	void	badfmt(hte_t *, fcall_t *);
65 static	void	inconarg(hte_t *, fcall_t *, int);
66 static	void	tofewarg(hte_t *, fcall_t *);
67 static	void	tomanyarg(hte_t *, fcall_t *);
68 static	int	eqtype(type_t *, type_t *, int, int, int, int *);
69 static	int	eqargs(type_t *, type_t *, int *);
70 static	int	mnoarg(type_t *, int *);
71 
72 
73 /*
74  * If there is a symbol named "main", mark it as used.
75  */
76 void
77 mainused(void)
78 {
79 	hte_t	*hte;
80 
81 	if ((hte = hsearch("main", 0)) != NULL)
82 		hte->h_used = 1;
83 }
84 
85 /*
86  * Performs all tests for a single name
87  */
88 void
89 chkname(hte_t *hte)
90 {
91 	sym_t	*sym, *def, *pdecl, *decl;
92 
93 	if (uflag) {
94 		chkund(hte);
95 		chkdnu(hte);
96 		if (xflag)
97 			chkdnud(hte);
98 	}
99 	chkmd(hte);
100 
101 	/* Get definition, prototype declaration and declaration */
102 	def = pdecl = decl = NULL;
103 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
104 		if (def == NULL && (sym->s_def == DEF || sym->s_def == TDEF))
105 			def = sym;
106 		if (pdecl == NULL && sym->s_def == DECL &&
107 		    TP(sym->s_type)->t_tspec == FUNC &&
108 		    TP(sym->s_type)->t_proto) {
109 			pdecl = sym;
110 		}
111 		if (decl == NULL && sym->s_def == DECL)
112 			decl = sym;
113 	}
114 
115 	/* A prototype is better than an old style declaration. */
116 	if (pdecl != NULL)
117 		decl = pdecl;
118 
119 	chkvtui(hte, def, decl);
120 
121 	chkvtdi(hte, def, decl);
122 
123 	chkfaui(hte, def, decl);
124 
125 	chkrvu(hte, def);
126 
127 	chkadecl(hte, def, decl);
128 }
129 
130 /*
131  * Print a warning if the name has been used, but not defined.
132  */
133 static void
134 chkund(hte_t *hte)
135 {
136 	fcall_t	*fcall;
137 	usym_t	*usym;
138 
139 	if (!hte->h_used || hte->h_def)
140 		return;
141 
142 	if ((fcall = hte->h_calls) != NULL) {
143 		/* %s used( %s ), but not defined */
144 		msg(0, hte->h_name, mkpos(&fcall->f_pos));
145 	} else if ((usym = hte->h_usyms) != NULL) {
146 		/* %s used( %s ), but not defined */
147 		msg(0, hte->h_name, mkpos(&usym->u_pos));
148 	}
149 }
150 
151 /*
152  * Print a warning if the name has been defined, but never used.
153  */
154 static void
155 chkdnu(hte_t *hte)
156 {
157 	sym_t	*sym;
158 
159 	if (!hte->h_def || hte->h_used)
160 		return;
161 
162 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
163 		if (sym->s_def == DEF || sym->s_def == TDEF) {
164 			/* %s defined( %s ), but never used */
165 			msg(1, hte->h_name, mkpos(&sym->s_pos));
166 			break;
167 		}
168 	}
169 }
170 
171 /*
172  * Print a warning if the variable has been declared, but is not used
173  * or defined.
174  */
175 static void
176 chkdnud(hte_t *hte)
177 {
178 	sym_t	*sym;
179 
180 	if (hte->h_syms == NULL || hte->h_used || hte->h_def)
181 		return;
182 
183 	sym = hte->h_syms;
184 	if (TP(sym->s_type)->t_tspec == FUNC)
185 		return;
186 
187 	if (sym->s_def != DECL)
188 		errx(1, "internal error: chkdnud() 1");
189 	/* %s declared( %s ), but never used or defined */
190 	msg(2, hte->h_name, mkpos(&sym->s_pos));
191 }
192 
193 /*
194  * Print a warning if there is more than one definition for
195  * this name.
196  */
197 static void
198 chkmd(hte_t *hte)
199 {
200 	sym_t	*sym, *def1;
201 	char	*pos1;
202 
203 	if (!hte->h_def)
204 		return;
205 
206 	def1 = NULL;
207 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
208 		/*
209 		 * ANSI C allows tentative definitions of the same name in
210 		 * only one compilation unit.
211 		 */
212 		if (sym->s_def != DEF && (!sflag || sym->s_def != TDEF))
213 			continue;
214 		if (def1 == NULL) {
215 			def1 = sym;
216 			continue;
217 		}
218 		pos1 = xstrdup(mkpos(&def1->s_pos));
219 		/* %s multiply defined\t%s  ::  %s */
220 		msg(3, hte->h_name, pos1, mkpos(&sym->s_pos));
221 		free(pos1);
222 	}
223 }
224 
225 /*
226  * Print a warning if the return value assumed for a function call
227  * differs from the return value of the function definition or
228  * function declaration.
229  *
230  * If no definition/declaration can be found, the assumed return values
231  * are always int. So there is no need to compare with another function
232  * call as it's done for function arguments.
233  */
234 static void
235 chkvtui(hte_t *hte, sym_t *def, sym_t *decl)
236 {
237 	fcall_t	*call;
238 	char	*pos1;
239 	type_t	*tp1, *tp2;
240 	int	dowarn, eq;
241 	tspec_t	t1;
242 
243 	if (hte->h_calls == NULL)
244 		return;
245 
246 	if (def == NULL)
247 		def = decl;
248 	if (def == NULL)
249 		return;
250 
251 	t1 = (tp1 = TP(def->s_type)->t_subt)->t_tspec;
252 	for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
253 		tp2 = TP(call->f_type)->t_subt;
254 		eq = eqtype(tp1, tp2, 1, 0, 0, (dowarn = 0, &dowarn));
255 		if (!call->f_rused) {
256 			/* no return value used */
257 			if ((t1 == STRUCT || t1 == UNION) && !eq) {
258 				/*
259 				 * If a function returns a struct or union it
260 				 * must be declared to return a struct or
261 				 * union, also if the return value is ignored.
262 				 * This is necessary because the caller must
263 				 * allocate stack space for the return value.
264 				 * If it does not, the return value would over-
265 				 * write other data.
266 				 * XXX Following massage may be confusing
267 				 * because it appears also if the return value
268 				 * was declared inconsistently. But this
269 				 * behaviour matches pcc based lint, so it is
270 				 * accepted for now.
271 				 */
272 				pos1 = xstrdup(mkpos(&def->s_pos));
273 				/* %s value must be decl. before use %s :: %s */
274 				msg(17, hte->h_name,
275 				    pos1, mkpos(&call->f_pos));
276 				free(pos1);
277 			}
278 			continue;
279 		}
280 		if (!eq || (sflag && dowarn)) {
281 			pos1 = xstrdup(mkpos(&def->s_pos));
282 			/* %s value used inconsistenty\t%s  ::  %s */
283 			msg(4, hte->h_name, pos1, mkpos(&call->f_pos));
284 			free(pos1);
285 		}
286 	}
287 }
288 
289 /*
290  * Print a warning if a definition/declaration does not match another
291  * definition/declaration of the same name. For functions, only the
292  * types of return values are tested.
293  */
294 static void
295 chkvtdi(hte_t *hte, sym_t *def, sym_t *decl)
296 {
297 	sym_t	*sym;
298 	type_t	*tp1, *tp2;
299 	int	eq, dowarn;
300 	char	*pos1;
301 
302 	if (def == NULL)
303 		def = decl;
304 	if (def == NULL)
305 		return;
306 
307 	tp1 = TP(def->s_type);
308 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
309 		type_t *xt1, *xt2;
310 		if (sym == def)
311 			continue;
312 		tp2 = TP(sym->s_type);
313 		dowarn = 0;
314 		if (tp1->t_tspec == FUNC && tp2->t_tspec == FUNC) {
315 			eq = eqtype(xt1 = tp1->t_subt, xt2 = tp2->t_subt,
316 			    1, 0, 0, &dowarn);
317 		} else {
318 			eq = eqtype(xt1 = tp1, xt2 = tp2, 0, 0, 0, &dowarn);
319 		}
320 		if (!eq || (sflag && dowarn)) {
321 			char b1[64], b2[64];
322 			pos1 = xstrdup(mkpos(&def->s_pos));
323 			/* %s value declared inconsistently\t%s  ::  %s */
324 			msg(5, hte->h_name, tyname(b1, sizeof(b1), xt1),
325 			    tyname(b2, sizeof(b2), xt2), pos1,
326 			    mkpos(&sym->s_pos));
327 			free(pos1);
328 		}
329 	}
330 }
331 
332 /*
333  * Print a warning if a function is called with arguments which does
334  * not match the function definition, declaration or another call
335  * of the same function.
336  */
337 static void
338 chkfaui(hte_t *hte, sym_t *def, sym_t *decl)
339 {
340 	type_t	*tp1, *tp2, **ap1, **ap2;
341 	pos_t	*pos1p = NULL;
342 	fcall_t	*calls, *call, *call1;
343 	int	n, as;
344 	char	*pos1;
345 	arginf_t *ai;
346 
347 	if ((calls = hte->h_calls) == NULL)
348 		return;
349 
350 	/*
351 	 * If we find a function definition, we use this for comparison,
352 	 * otherwise the first prototype we can find. If there is no
353 	 * definition or prototype declaration, the first function call
354 	 * is used.
355 	 */
356 	tp1 = NULL;
357 	call1 = NULL;
358 	if (def != NULL) {
359 		if ((tp1 = TP(def->s_type))->t_tspec != FUNC)
360 			return;
361 		pos1p = &def->s_pos;
362 	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
363 		if ((tp1 = TP(decl->s_type))->t_tspec != FUNC)
364 			return;
365 		pos1p = &decl->s_pos;
366 	}
367 	if (tp1 == NULL) {
368 		call1 = calls;
369 		calls = calls->f_nxt;
370 		if ((tp1 = TP(call1->f_type))->t_tspec != FUNC)
371 			return;
372 		pos1p = &call1->f_pos;
373 	}
374 
375 	n = 1;
376 	for (call = calls; call != NULL; call = call->f_nxt) {
377 		if ((tp2 = TP(call->f_type))->t_tspec != FUNC)
378 			continue;
379 		ap1 = tp1->t_args;
380 		ap2 = tp2->t_args;
381 		n = 0;
382 		while (*ap1 != NULL && *ap2 != NULL) {
383 			if (def != NULL && def->s_va && n >= def->s_nva)
384 				break;
385 			n++;
386 			chkau(hte, n, def, decl, pos1p, call1, call,
387 			      *ap1, *ap2);
388 			ap1++;
389 			ap2++;
390 		}
391 		if (*ap1 == *ap2) {
392 			/* equal # of arguments */
393 		} else if (def != NULL && def->s_va && n >= def->s_nva) {
394 			/*
395 			 * function definition with VARARGS; The # of
396 			 * arguments of the call must be at least as large
397 			 * as the parameter of VARARGS.
398 			 */
399 		} else if (*ap2 != NULL && tp1->t_proto && tp1->t_vararg) {
400 			/*
401 			 * prototype with ... and function call with
402 			 * at least the same # of arguments as declared
403 			 * in the prototype.
404 			 */
405 		} else {
406 			pos1 = xstrdup(mkpos(pos1p));
407 			/* %s: variable # of args\t%s  ::  %s */
408 			msg(7, hte->h_name, pos1, mkpos(&call->f_pos));
409 			free(pos1);
410 			continue;
411 		}
412 
413 		/* perform SCANFLIKE/PRINTFLIKE tests */
414 		if (def == NULL || (!def->s_prfl && !def->s_scfl))
415 			continue;
416 		as = def->s_prfl ? def->s_nprfl : def->s_nscfl;
417 		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
418 			if (ai->a_num == as)
419 				break;
420 		}
421 		if (ai == NULL || !ai->a_fmt)
422 			continue;
423 		if (def->s_prfl) {
424 			printflike(hte, call, n, ai->a_fstrg, ap2);
425 		} else {
426 			scanflike(hte, call, n, ai->a_fstrg, ap2);
427 		}
428 	}
429 }
430 
431 /*
432  * Check a single argument in a function call.
433  *
434  *  hte		a pointer to the hash table entry of the function
435  *  n		the number of the argument (1..)
436  *  def		the function definition or NULL
437  *  decl	prototype declaration, old style declaration or NULL
438  *  pos1p	position of definition, declaration of first call
439  *  call1	first call, if both def and decl are old style def/decl
440  *  call	checked call
441  *  arg1	currently checked argument of def/decl/call1
442  *  arg2	currently checked argument of call
443  *
444  */
445 static void
446 chkau(hte_t *hte, int n, sym_t *def, sym_t *decl, pos_t *pos1p,
447 	fcall_t *call1, fcall_t *call, type_t *arg1, type_t *arg2)
448 {
449 	int	promote, asgn, dowarn;
450 	tspec_t	t1, t2;
451 	arginf_t *ai, *ai1;
452 	char	*pos1;
453 	char	tyname1[64], tyname2[64];
454 
455 	/*
456 	 * If a function definition is available (def != NULL), we compair the
457 	 * function call (call) with the definition. Otherwise, if a function
458 	 * definition is available and it is not an old style definition
459 	 * (decl != NULL && TP(decl->s_type)->t_proto), we compair the call
460 	 * with this declaration. Otherwise we compair it with the first
461 	 * call we have found (call1).
462 	 */
463 
464 	/* arg1 must be promoted if it stems from an old style definition */
465 	promote = def != NULL && def->s_osdef;
466 
467 	/*
468 	 * If we compair with a definition or declaration, we must perform
469 	 * the same checks for qualifiers in indirected types as in
470 	 * assignments.
471 	 */
472 	asgn = def != NULL || (decl != NULL && TP(decl->s_type)->t_proto);
473 
474 	dowarn = 0;
475 	if (eqtype(arg1, arg2, 1, promote, asgn, &dowarn) && (!sflag || !dowarn))
476 		return;
477 
478 	/*
479 	 * Other lint implementations print warnings as soon as the type
480 	 * of an argument does not match exactly the expected type. The
481 	 * result are lots of warnings which are really not necessary.
482 	 * We print a warning only if
483 	 *   (0) at least one type is not an interger type and types differ
484 	 *   (1) hflag is set and types differ
485 	 *   (2) types differ, except in signedness
486 	 * If the argument is an integer constant whose msb is not set,
487 	 * signedness is ignored (e.g. 0 matches both signed and unsigned
488 	 * int). This is with and without hflag.
489 	 * If the argument is an integer constant with value 0 and the
490 	 * expected argument is of type pointer and the width of the
491 	 * interger constant is the same as the width of the pointer,
492 	 * no warning is printed.
493 	 */
494 	t1 = arg1->t_tspec;
495 	t2 = arg2->t_tspec;
496 	if (isityp(t1) && isityp(t2) && !arg1->t_isenum && !arg2->t_isenum) {
497 		if (promote) {
498 			/*
499 			 * XXX Here is a problem: Althrough it is possible to
500 			 * pass an int where a char/short it expected, there
501 			 * may be loss in significant digits. We should first
502 			 * check for const arguments if they can be converted
503 			 * into the original parameter type.
504 			 */
505 			if (t1 == FLOAT) {
506 				t1 = DOUBLE;
507 			} else if (t1 == CHAR || t1 == SCHAR) {
508 				t1 = INT;
509 			} else if (t1 == UCHAR) {
510 				t1 = tflag ? UINT : INT;
511 			} else if (t1 == SHORT) {
512 				t1 = INT;
513 			} else if (t1 == USHORT) {
514 				/* CONSTCOND */
515 				t1 = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
516 			}
517 		}
518 
519 		if (styp(t1) == styp(t2)) {
520 
521 			/*
522 			 * types differ only in signedness; get information
523 			 * about arguments
524 			 */
525 
526 			/*
527 			 * treat a definition like a call with variable
528 			 * arguments
529 			 */
530 			ai1 = call1 != NULL ? call1->f_args : NULL;
531 
532 			/*
533 			 * if two calls are compared, ai1 is set to the
534 			 * information for the n-th argument, if this was
535 			 * a constant, otherwise to NULL
536 			 */
537 			for ( ; ai1 != NULL; ai1 = ai1->a_nxt) {
538 				if (ai1->a_num == n)
539 					break;
540 			}
541 			/*
542 			 * ai is set to the information of the n-th arg
543 			 * of the (second) call, if this was a constant,
544 			 * otherwise to NULL
545 			 */
546 			for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
547 				if (ai->a_num == n)
548 					break;
549 			}
550 
551 			if (ai1 == NULL && ai == NULL) {
552 				/* no constant at all */
553 				if (!hflag)
554 					return;
555 			} else if (ai1 == NULL || ai == NULL) {
556 				/* one constant */
557 				if (ai == NULL)
558 					ai = ai1;
559 				if (ai->a_zero || ai->a_pcon)
560 					/* same value in signed and unsigned */
561 					return;
562 				/* value (not representation) differently */
563 			} else {
564 				/*
565 				 * two constants, one signed, one unsigned;
566 				 * if the msb of one of the constants is set,
567 				 * the argument is used inconsistently.
568 				 */
569 				if (!ai1->a_ncon && !ai->a_ncon)
570 					return;
571 			}
572 		}
573 
574 	} else if (t1 == PTR && isityp(t2)) {
575 		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
576 			if (ai->a_num == n)
577 				break;
578 		}
579 		/*
580 		 * Vendor implementations of lint (e.g. HP-UX, Digital UNIX)
581 		 * don't care about the size of the integer argument,
582 		 * only whether or not it is zero.  We do the same.
583 		 */
584 		if (ai != NULL && ai->a_zero)
585 			return;
586 	}
587 
588 	pos1 = xstrdup(mkpos(pos1p));
589 	/* %s, arg %d used inconsistently\t%s[%s]  ::  %s[%s] */
590 	msg(6, hte->h_name, n, pos1,
591 	    tyname(tyname1, sizeof(tyname1), arg1),
592 	    mkpos(&call->f_pos),
593 	    tyname(tyname2, sizeof(tyname2), arg2));
594 	free(pos1);
595 }
596 
597 /*
598  * Compare the types in the NULL-terminated array ap with the format
599  * string fmt.
600  */
601 static void
602 printflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
603 {
604 	const	char *fp;
605 	int	fc;
606 	int	fwidth, prec, left, sign, space, alt, zero;
607 	tspec_t	sz, t1, t2 = NOTSPEC;
608 	type_t	*tp;
609 
610 	fp = fmt;
611 	fc = *fp++;
612 
613 	for ( ; ; ) {
614 		if (fc == '\0') {
615 			if (*ap != NULL)
616 				tomanyarg(hte, call);
617 			break;
618 		}
619 		if (fc != '%') {
620 			badfmt(hte, call);
621 			break;
622 		}
623 		fc = *fp++;
624 		fwidth = prec = left = sign = space = alt = zero = 0;
625 		sz = NOTSPEC;
626 
627 		/* Flags */
628 		for ( ; ; ) {
629 			if (fc == '-') {
630 				if (left)
631 					break;
632 				left = 1;
633 			} else if (fc == '+') {
634 				if (sign)
635 					break;
636 				sign = 1;
637 			} else if (fc == ' ') {
638 				if (space)
639 					break;
640 				space = 1;
641 			} else if (fc == '#') {
642 				if (alt)
643 					break;
644 				alt = 1;
645 			} else if (fc == '0') {
646 				if (zero)
647 					break;
648 				zero = 1;
649 			} else {
650 				break;
651 			}
652 			fc = *fp++;
653 		}
654 
655 		/* field width */
656 		if (isdigit(fc)) {
657 			fwidth = 1;
658 			do { fc = *fp++; } while (isdigit(fc)) ;
659 		} else if (fc == '*') {
660 			fwidth = 1;
661 			fc = *fp++;
662 			if ((tp = *ap++) == NULL) {
663 				tofewarg(hte, call);
664 				break;
665 			}
666 			n++;
667 			if ((t1 = tp->t_tspec) != INT && (hflag || t1 != UINT))
668 				inconarg(hte, call, n);
669 		}
670 
671 		/* precision */
672 		if (fc == '.') {
673 			fc = *fp++;
674 			prec = 1;
675 			if (isdigit(fc)) {
676 				do { fc = *fp++; } while (isdigit(fc));
677 			} else if (fc == '*') {
678 				fc = *fp++;
679 				if ((tp = *ap++) == NULL) {
680 					tofewarg(hte, call);
681 					break;
682 				}
683 				n++;
684 				if (tp->t_tspec != INT)
685 					inconarg(hte, call, n);
686 			} else {
687 				badfmt(hte, call);
688 				break;
689 			}
690 		}
691 
692 		if (fc == 'h') {
693 			sz = SHORT;
694 		} else if (fc == 'l') {
695 			sz = LONG;
696 		} else if (fc == 'q') {
697 			sz = QUAD;
698 		} else if (fc == 'L') {
699 			sz = LDOUBLE;
700 		}
701 		if (sz != NOTSPEC)
702 			fc = *fp++;
703 
704 		if (fc == '%') {
705 			if (sz != NOTSPEC || left || sign || space ||
706 			    alt || zero || prec || fwidth) {
707 				badfmt(hte, call);
708 			}
709 			fc = *fp++;
710 			continue;
711 		}
712 
713 		if (fc == '\0') {
714 			badfmt(hte, call);
715 			break;
716 		}
717 
718 		if ((tp = *ap++) == NULL) {
719 			tofewarg(hte, call);
720 			break;
721 		}
722 		n++;
723 		if ((t1 = tp->t_tspec) == PTR)
724 			t2 = tp->t_subt->t_tspec;
725 
726 		if (fc == 'd' || fc == 'i') {
727 			if (alt || sz == LDOUBLE) {
728 				badfmt(hte, call);
729 				break;
730 			}
731 		int_conv:
732 			if (sz == LONG) {
733 				if (t1 != LONG && (hflag || t1 != ULONG))
734 					inconarg(hte, call, n);
735 			} else if (sz == QUAD) {
736 				if (t1 != QUAD && (hflag || t1 != UQUAD))
737 					inconarg(hte, call, n);
738 			} else {
739 				/*
740 				 * SHORT is always promoted to INT, USHORT
741 				 * to INT or UINT.
742 				 */
743 				if (t1 != INT && (hflag || t1 != UINT))
744 					inconarg(hte, call, n);
745 			}
746 		} else if (fc == 'o' || fc == 'u' || fc == 'x' || fc == 'X') {
747 			if ((alt && fc == 'u') || sz == LDOUBLE)
748 				badfmt(hte, call);
749 		uint_conv:
750 			if (sz == LONG) {
751 				if (t1 != ULONG && (hflag || t1 != LONG))
752 					inconarg(hte, call, n);
753 			} else if (sz == QUAD) {
754 				if (t1 != UQUAD && (hflag || t1 != QUAD))
755 					inconarg(hte, call, n);
756 			} else if (sz == SHORT) {
757 				/* USHORT was promoted to INT or UINT */
758 				if (t1 != UINT && t1 != INT)
759 					inconarg(hte, call, n);
760 			} else {
761 				if (t1 != UINT && (hflag || t1 != INT))
762 					inconarg(hte, call, n);
763 			}
764 		} else if (fc == 'D' || fc == 'O' || fc == 'U') {
765 			if ((alt && fc != 'O') || sz != NOTSPEC || !tflag)
766 				badfmt(hte, call);
767 			sz = LONG;
768 			if (fc == 'D') {
769 				goto int_conv;
770 			} else {
771 				goto uint_conv;
772 			}
773 		} else if (fc == 'f' || fc == 'e' || fc == 'E' ||
774 			   fc == 'g' || fc == 'G') {
775 			if (sz == NOTSPEC)
776 				sz = DOUBLE;
777 			if (sz != DOUBLE && sz != LDOUBLE)
778 				badfmt(hte, call);
779 			if (t1 != sz)
780 				inconarg(hte, call, n);
781 		} else if (fc == 'c') {
782 			if (sz != NOTSPEC || alt || zero)
783 				badfmt(hte, call);
784 			if (t1 != INT)
785 				inconarg(hte, call, n);
786 		} else if (fc == 's') {
787 			if (sz != NOTSPEC || alt || zero)
788 				badfmt(hte, call);
789 			if (t1 != PTR ||
790 			    (t2 != CHAR && t2 != UCHAR && t2 != SCHAR)) {
791 				inconarg(hte, call, n);
792 			}
793 		} else if (fc == 'p') {
794 			if (fwidth || prec || sz != NOTSPEC || alt || zero)
795 				badfmt(hte, call);
796 			if (t1 != PTR || (hflag && t2 != VOID))
797 				inconarg(hte, call, n);
798 		} else if (fc == 'n') {
799 			if (fwidth || prec || alt || zero || sz == LDOUBLE)
800 				badfmt(hte, call);
801 			if (t1 != PTR) {
802 				inconarg(hte, call, n);
803 			} else if (sz == LONG) {
804 				if (t2 != LONG && t2 != ULONG)
805 					inconarg(hte, call, n);
806 			} else if (sz == SHORT) {
807 				if (t2 != SHORT && t2 != USHORT)
808 					inconarg(hte, call, n);
809 			} else {
810 				if (t2 != INT && t2 != UINT)
811 					inconarg(hte, call, n);
812 			}
813 		} else {
814 			badfmt(hte, call);
815 			break;
816 		}
817 
818 		fc = *fp++;
819 	}
820 }
821 
822 /*
823  * Compare the types in the NULL-terminated array ap with the format
824  * string fmt.
825  */
826 static void
827 scanflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
828 {
829 	const	char *fp;
830 	int	fc;
831 	int	noasgn, fwidth;
832 	tspec_t	sz, t1 = NOTSPEC, t2 = NOTSPEC;
833 	type_t	*tp = NULL;
834 
835 	fp = fmt;
836 	fc = *fp++;
837 
838 	for ( ; ; ) {
839 		if (fc == '\0') {
840 			if (*ap != NULL)
841 				tomanyarg(hte, call);
842 			break;
843 		}
844 		if (fc != '%') {
845 			badfmt(hte, call);
846 			break;
847 		}
848 		fc = *fp++;
849 
850 		noasgn = fwidth = 0;
851 		sz = NOTSPEC;
852 
853 		if (fc == '*') {
854 			noasgn = 1;
855 			fc = *fp++;
856 		}
857 
858 		if (isdigit(fc)) {
859 			fwidth = 1;
860 			do { fc = *fp++; } while (isdigit(fc));
861 		}
862 
863 		if (fc == 'h') {
864 			sz = SHORT;
865 		} else if (fc == 'l') {
866 			sz = LONG;
867 		} else if (fc == 'q') {
868 			sz = QUAD;
869 		} else if (fc == 'L') {
870 			sz = LDOUBLE;
871 		}
872 		if (sz != NOTSPEC)
873 			fc = *fp++;
874 
875 		if (fc == '%') {
876 			if (sz != NOTSPEC || noasgn || fwidth)
877 				badfmt(hte, call);
878 			fc = *fp++;
879 			continue;
880 		}
881 
882 		if (!noasgn) {
883 			if ((tp = *ap++) == NULL) {
884 				tofewarg(hte, call);
885 				break;
886 			}
887 			n++;
888 			if ((t1 = tp->t_tspec) == PTR)
889 				t2 = tp->t_subt->t_tspec;
890 		}
891 
892 		if (fc == 'd' || fc == 'i' || fc == 'n') {
893 			if (sz == LDOUBLE)
894 				badfmt(hte, call);
895 			if (sz != SHORT && sz != LONG && sz != QUAD)
896 				sz = INT;
897 		conv:
898 			if (!noasgn) {
899 				if (t1 != PTR) {
900 					inconarg(hte, call, n);
901 				} else if (t2 != styp(sz)) {
902 					inconarg(hte, call, n);
903 				} else if (hflag && t2 != sz) {
904 					inconarg(hte, call, n);
905 				} else if (tp->t_subt->t_const) {
906 					inconarg(hte, call, n);
907 				}
908 			}
909 		} else if (fc == 'o' || fc == 'u' || fc == 'x') {
910 			if (sz == LDOUBLE)
911 				badfmt(hte, call);
912 			if (sz == SHORT) {
913 				sz = USHORT;
914 			} else if (sz == LONG) {
915 				sz = ULONG;
916 			} else if (sz == QUAD) {
917 				sz = UQUAD;
918 			} else {
919 				sz = UINT;
920 			}
921 			goto conv;
922 		} else if (fc == 'D') {
923 			if (sz != NOTSPEC || !tflag)
924 				badfmt(hte, call);
925 			sz = LONG;
926 			goto conv;
927 		} else if (fc == 'O') {
928 			if (sz != NOTSPEC || !tflag)
929 				badfmt(hte, call);
930 			sz = ULONG;
931 			goto conv;
932 		} else if (fc == 'X') {
933 			/*
934 			 * XXX valid in ANSI C, but in NetBSD's libc imple-
935 			 * mented as "lx". Thats why it should be avoided.
936 			 */
937 			if (sz != NOTSPEC || !tflag)
938 				badfmt(hte, call);
939 			sz = ULONG;
940 			goto conv;
941 		} else if (fc == 'E') {
942 			/*
943 			 * XXX valid in ANSI C, but in NetBSD's libc imple-
944 			 * mented as "lf". Thats why it should be avoided.
945 			 */
946 			if (sz != NOTSPEC || !tflag)
947 				badfmt(hte, call);
948 			sz = DOUBLE;
949 			goto conv;
950 		} else if (fc == 'F') {
951 			/* XXX only for backward compatibility */
952 			if (sz != NOTSPEC || !tflag)
953 				badfmt(hte, call);
954 			sz = DOUBLE;
955 			goto conv;
956 		} else if (fc == 'G') {
957 			/*
958 			 * XXX valid in ANSI C, but in NetBSD's libc not
959 			 * implemented
960 			 */
961 			if (sz != NOTSPEC && sz != LONG && sz != LDOUBLE)
962 				badfmt(hte, call);
963 			goto fconv;
964 		} else if (fc == 'e' || fc == 'f' || fc == 'g') {
965 		fconv:
966 			if (sz == NOTSPEC) {
967 				sz = FLOAT;
968 			} else if (sz == LONG) {
969 				sz = DOUBLE;
970 			} else if (sz != LDOUBLE) {
971 				badfmt(hte, call);
972 				sz = FLOAT;
973 			}
974 			goto conv;
975 		} else if (fc == 's' || fc == '[' || fc == 'c') {
976 			if (sz != NOTSPEC)
977 				badfmt(hte, call);
978 			if (fc == '[') {
979 				if ((fc = *fp++) == '-') {
980 					badfmt(hte, call);
981 					fc = *fp++;
982 				}
983 				if (fc != ']') {
984 					badfmt(hte, call);
985 					if (fc == '\0')
986 						break;
987 				}
988 			}
989 			if (!noasgn) {
990 				if (t1 != PTR) {
991 					inconarg(hte, call, n);
992 				} else if (t2 != CHAR && t2 != UCHAR &&
993 					   t2 != SCHAR) {
994 					inconarg(hte, call, n);
995 				}
996 			}
997 		} else if (fc == 'p') {
998 			if (sz != NOTSPEC)
999 				badfmt(hte, call);
1000 			if (!noasgn) {
1001 				if (t1 != PTR || t2 != PTR) {
1002 					inconarg(hte, call, n);
1003 				} else if (tp->t_subt->t_subt->t_tspec!=VOID) {
1004 					if (hflag)
1005 						inconarg(hte, call, n);
1006 				}
1007 			}
1008 		} else {
1009 			badfmt(hte, call);
1010 			break;
1011 		}
1012 
1013 		fc = *fp++;
1014 	}
1015 }
1016 
1017 static void
1018 badfmt(hte_t *hte, fcall_t *call)
1019 {
1020 
1021 	/* %s: malformed format string\t%s */
1022 	msg(13, hte->h_name, mkpos(&call->f_pos));
1023 }
1024 
1025 static void
1026 inconarg(hte_t *hte, fcall_t *call, int n)
1027 {
1028 
1029 	/* %s, arg %d inconsistent with format\t%s(%d) */
1030 	msg(14, hte->h_name, n, mkpos(&call->f_pos));
1031 }
1032 
1033 static void
1034 tofewarg(hte_t *hte, fcall_t *call)
1035 {
1036 
1037 	/* %s: too few args for format  \t%s */
1038 	msg(15, hte->h_name, mkpos(&call->f_pos));
1039 }
1040 
1041 static void
1042 tomanyarg(hte_t *hte, fcall_t *call)
1043 {
1044 
1045 	/* %s: too many args for format  \t%s */
1046 	msg(16, hte->h_name, mkpos(&call->f_pos));
1047 }
1048 
1049 /*
1050  * List of functions where we usually don't care about their result.
1051  * NB: Must be sorted.
1052  */
1053 static const char ignorelist[][8] = {
1054 	"memcpy",
1055 	"memmove",
1056 	"memset",
1057 	"printf",
1058 	"strcat",
1059 	"strcpy",
1060 	"vprintf",
1061 };
1062 
1063 /*
1064  * Print warnings for return values which are used, but not returned,
1065  * or return values which are always or sometimes ignored.
1066  */
1067 static void
1068 chkrvu(hte_t *hte, sym_t *def)
1069 {
1070 	fcall_t	*call;
1071 	int	used, ignored;
1072 
1073 	if (def == NULL)
1074 		/* don't know wheter or not the functions returns a value */
1075 		return;
1076 
1077 	if (hte->h_calls == NULL)
1078 		return;
1079 
1080 	if (def->s_rval) {
1081 		/*
1082 		 * XXX as soon as we are able to disable single warnings
1083 		 * the following dependencies from hflag should be removed.
1084 		 * but for now I do'nt want to be botherd by this warnings
1085 		 * which are almost always useless.
1086 		 */
1087 		if (hflag == 0)
1088 			return;
1089 		if (hflag == 1 && bsearch(hte->h_name, ignorelist,
1090 		    __arraycount(ignorelist), sizeof(ignorelist[0]),
1091 		    (int (*)(const void *, const void *))strcmp) != NULL)
1092 			return;
1093 
1094 		/* function has return value */
1095 		used = ignored = 0;
1096 		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1097 			used |= call->f_rused || call->f_rdisc;
1098 			ignored |= !call->f_rused && !call->f_rdisc;
1099 		}
1100 		if (!used && ignored) {
1101 			/* %s returns value which is always ignored */
1102 			msg(8, hte->h_name);
1103 		} else if (used && ignored) {
1104 			/* %s returns value which is sometimes ign. */
1105 			msg(9, hte->h_name);
1106 		}
1107 	} else {
1108 		/* function has no return value */
1109 		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1110 			if (call->f_rused)
1111 				/* %s value is used( %s ), but none ret. */
1112 				msg(10, hte->h_name, mkpos(&call->f_pos));
1113 		}
1114 	}
1115 }
1116 
1117 /*
1118  * Print warnings for inconsistent argument declarations.
1119  */
1120 static void
1121 chkadecl(hte_t *hte, sym_t *def, sym_t *decl)
1122 {
1123 	int	osdef, eq, dowarn, n;
1124 	sym_t	*sym1, *sym;
1125 	type_t	**ap1, **ap2, *tp1, *tp2;
1126 	char	*pos1;
1127 	const	char *pos2;
1128 
1129 	osdef = 0;
1130 	if (def != NULL) {
1131 		osdef = def->s_osdef;
1132 		sym1 = def;
1133 	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
1134 		sym1 = decl;
1135 	} else {
1136 		return;
1137 	}
1138 	if (TP(sym1->s_type)->t_tspec != FUNC)
1139 		return;
1140 
1141 	/*
1142 	 * XXX Prototypes should also be compared with old style function
1143 	 * declarations.
1144 	 */
1145 
1146 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
1147 		if (sym == sym1 || !TP(sym->s_type)->t_proto)
1148 			continue;
1149 		ap1 = TP(sym1->s_type)->t_args;
1150 		ap2 = TP(sym->s_type)->t_args;
1151 		n = 0;
1152 		while (*ap1 != NULL && *ap2 != NULL) {
1153 			type_t *xt1, *xt2;
1154 			dowarn = 0;
1155 			eq = eqtype(xt1 = *ap1, xt2 = *ap2, 1, osdef, 0, &dowarn);
1156 			if (!eq || dowarn) {
1157 				char b1[64], b2[64];
1158 				pos1 = xstrdup(mkpos(&sym1->s_pos));
1159 				pos2 = mkpos(&sym->s_pos);
1160 				/* %s, arg %d declared inconsistently ... */
1161 				msg(11, hte->h_name, n + 1,
1162 				    tyname(b1, sizeof(b1), xt1),
1163 				    tyname(b2, sizeof(b2), xt2), pos1, pos2);
1164 				free(pos1);
1165 			}
1166 			n++;
1167 			ap1++;
1168 			ap2++;
1169 		}
1170 		if (*ap1 == *ap2) {
1171 			tp1 = TP(sym1->s_type);
1172 			tp2 = TP(sym->s_type);
1173 			if (tp1->t_vararg == tp2->t_vararg)
1174 				continue;
1175 			if (tp2->t_vararg &&
1176 			    sym1->s_va && sym1->s_nva == n && !sflag) {
1177 				continue;
1178 			}
1179 		}
1180 		/* %s: variable # of args declared\t%s  ::  %s */
1181 		pos1 = xstrdup(mkpos(&sym1->s_pos));
1182 		msg(12, hte->h_name, pos1, mkpos(&sym->s_pos));
1183 		free(pos1);
1184 	}
1185 }
1186 
1187 
1188 /*
1189  * Check compatibility of two types. Returns 1 if types are compatible,
1190  * otherwise 0.
1191  *
1192  * ignqual	if set, ignore qualifiers of outhermost type; used for
1193  *		function arguments
1194  * promote	if set, promote left type before comparison; used for
1195  *		comparisons of arguments with parameters of old style
1196  *		definitions
1197  * asgn		left indirected type must have at least the same qualifiers
1198  *		like right indirected type (for assignments and function
1199  *		arguments)
1200  * *dowarn	set to 1 if an old style declaration was compared with
1201  *		an incompatible prototype declaration
1202  */
1203 static int
1204 eqtype(type_t *tp1, type_t *tp2, int ignqual, int promot, int asgn, int *dowarn)
1205 {
1206 	tspec_t	t, to;
1207 	int	indir;
1208 
1209 	to = NOTSPEC;
1210 	indir = 0;
1211 
1212 	while (tp1 != NULL && tp2 != NULL) {
1213 
1214 		t = tp1->t_tspec;
1215 		if (promot) {
1216 			if (t == FLOAT) {
1217 				t = DOUBLE;
1218 			} else if (t == CHAR || t == SCHAR) {
1219 				t = INT;
1220 			} else if (t == UCHAR) {
1221 				t = tflag ? UINT : INT;
1222 			} else if (t == SHORT) {
1223 				t = INT;
1224 			} else if (t == USHORT) {
1225 				/* CONSTCOND */
1226 				t = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
1227 			}
1228 		}
1229 
1230 		if (asgn && to == PTR) {
1231 			if (indir == 1 && (t == VOID || tp2->t_tspec == VOID))
1232 				return (1);
1233 		}
1234 
1235 		if (t != tp2->t_tspec) {
1236 			/*
1237 			 * Give pointer to types which differ only in
1238 			 * signedness a chance if not sflag and not hflag.
1239 			 */
1240 			if (sflag || hflag || to != PTR)
1241 				return (0);
1242 			if (styp(t) != styp(tp2->t_tspec))
1243 				return (0);
1244 		}
1245 
1246 		if (tp1->t_isenum && tp2->t_isenum) {
1247 			if (tp1->t_istag && tp2->t_istag) {
1248 				return (tp1->t_tag == tp2->t_tag);
1249 			} else if (tp1->t_istynam && tp2->t_istynam) {
1250 				return (tp1->t_tynam == tp2->t_tynam);
1251 			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1252 				return (tp1->t_uniqpos.p_line ==
1253 				      tp2->t_uniqpos.p_line &&
1254 				    tp1->t_uniqpos.p_file ==
1255 				      tp2->t_uniqpos.p_file &&
1256 				    tp1->t_uniqpos.p_uniq ==
1257 				      tp2->t_uniqpos.p_uniq);
1258 			} else {
1259 				return (0);
1260 			}
1261 		}
1262 
1263 		/*
1264 		 * XXX Handle combinations of enum and int if eflag is set.
1265 		 * But note: enum and 0 should be allowed.
1266 		 */
1267 
1268 		if (asgn && indir == 1) {
1269 			if (!tp1->t_const && tp2->t_const)
1270 				return (0);
1271 			if (!tp1->t_volatile && tp2->t_volatile)
1272 				return (0);
1273 		} else if (!ignqual && !tflag) {
1274 			if (tp1->t_const != tp2->t_const)
1275 				return (0);
1276 			if (tp1->t_const != tp2->t_const)
1277 				return (0);
1278 		}
1279 
1280 		if (t == STRUCT || t == UNION) {
1281 			if (tp1->t_istag && tp2->t_istag) {
1282 				return (tp1->t_tag == tp2->t_tag);
1283 			} else if (tp1->t_istynam && tp2->t_istynam) {
1284 				return (tp1->t_tynam == tp2->t_tynam);
1285 			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1286 				return (tp1->t_uniqpos.p_line ==
1287 				      tp2->t_uniqpos.p_line &&
1288 				    tp1->t_uniqpos.p_file ==
1289 				      tp2->t_uniqpos.p_file &&
1290 				    tp1->t_uniqpos.p_uniq ==
1291 				      tp2->t_uniqpos.p_uniq);
1292 			} else {
1293 				return (0);
1294 			}
1295 		}
1296 
1297 		if (t == ARRAY && tp1->t_dim != tp2->t_dim) {
1298 			if (tp1->t_dim != 0 && tp2->t_dim != 0)
1299 				return (0);
1300 		}
1301 
1302 		if (t == FUNC) {
1303 			if (tp1->t_proto && tp2->t_proto) {
1304 				if (!eqargs(tp1, tp2, dowarn))
1305 					return (0);
1306 			} else if (tp1->t_proto) {
1307 				if (!mnoarg(tp1, dowarn))
1308 					return (0);
1309 			} else if (tp2->t_proto) {
1310 				if (!mnoarg(tp2, dowarn))
1311 					return (0);
1312 			}
1313 		}
1314 
1315 		tp1 = tp1->t_subt;
1316 		tp2 = tp2->t_subt;
1317 		ignqual = promot = 0;
1318 		to = t;
1319 		indir++;
1320 
1321 	}
1322 
1323 	return (tp1 == tp2);
1324 }
1325 
1326 /*
1327  * Compares arguments of two prototypes
1328  */
1329 static int
1330 eqargs(type_t *tp1, type_t *tp2, int *dowarn)
1331 {
1332 	type_t	**a1, **a2;
1333 
1334 	if (tp1->t_vararg != tp2->t_vararg)
1335 		return (0);
1336 
1337 	a1 = tp1->t_args;
1338 	a2 = tp2->t_args;
1339 
1340 	while (*a1 != NULL && *a2 != NULL) {
1341 
1342 		if (eqtype(*a1, *a2, 1, 0, 0, dowarn) == 0)
1343 			return (0);
1344 
1345 		a1++;
1346 		a2++;
1347 
1348 	}
1349 
1350 	return (*a1 == *a2);
1351 }
1352 
1353 /*
1354  * mnoarg() (matches functions with no argument type information)
1355  * returns 1 if all parameters of a prototype are compatible with
1356  * and old style function declaration.
1357  * This is the case if following conditions are met:
1358  *	1. the prototype must have a fixed number of parameters
1359  *	2. no parameter is of type float
1360  *	3. no parameter is converted to another type if integer promotion
1361  *	   is applied on it
1362  */
1363 static int
1364 mnoarg(type_t *tp, int *dowarn)
1365 {
1366 	type_t	**arg;
1367 	tspec_t	t;
1368 
1369 	if (tp->t_vararg && dowarn != NULL)
1370 		*dowarn = 1;
1371 	for (arg = tp->t_args; *arg != NULL; arg++) {
1372 		if ((t = (*arg)->t_tspec) == FLOAT)
1373 			return (0);
1374 		if (t == CHAR || t == SCHAR || t == UCHAR)
1375 			return (0);
1376 		if (t == SHORT || t == USHORT)
1377 			return (0);
1378 	}
1379 	return (1);
1380 }
1381