1 // RUN: %clang_cc1 -triple x86_64-apple-macosx10.14.0 %s -verify
2 // RUN: %clang_cc1 -triple x86_64-apple-macosx10.14.0 %s -verify -DUSE_BUILTINS
3 // RUN: %clang_cc1 -xc++ -triple x86_64-apple-macosx10.14.0 %s -verify
4 // RUN: %clang_cc1 -xc++ -triple x86_64-apple-macosx10.14.0 %s -verify -DUSE_BUILTINS
5 
6 typedef unsigned long size_t;
7 
8 #ifdef __cplusplus
9 extern "C" {
10 #endif
11 
12 extern int sprintf(char *str, const char *format, ...);
13 
14 #if defined(USE_BUILTINS)
15 #define memcpy(x,y,z) __builtin_memcpy(x,y,z)
16 #else
17 void *memcpy(void *dst, const void *src, size_t c);
18 #endif
19 
20 #ifdef __cplusplus
21 }
22 #endif
23 
call_memcpy()24 void call_memcpy() {
25   char dst[10];
26   char src[20];
27   memcpy(dst, src, 20); // expected-warning {{memcpy' will always overflow; destination buffer has size 10, but size argument is 20}}
28 
29   if (sizeof(dst) == sizeof(src))
30     memcpy(dst, src, 20); // no warning, unreachable
31 }
32 
call_memcpy_type()33 void call_memcpy_type() {
34   struct pair {
35     int first;
36     int second;
37   };
38   struct pair p;
39   char buf[20];
40   memcpy(&p.first, buf, 20); // expected-warning {{memcpy' will always overflow; destination buffer has size 8, but size argument is 20}}
41 }
42 
call_strncat()43 void call_strncat() {
44   char s1[10], s2[20];
45   __builtin_strncat(s2, s1, 20);
46   __builtin_strncat(s1, s2, 20); // expected-warning {{'strncat' size argument is too large; destination buffer has size 10, but size argument is 20}}
47 }
48 
call_strncpy()49 void call_strncpy() {
50   char s1[10], s2[20];
51   __builtin_strncpy(s2, s1, 20);
52   __builtin_strncpy(s1, s2, 20); // expected-warning {{'strncpy' size argument is too large; destination buffer has size 10, but size argument is 20}}
53 }
54 
call_stpncpy()55 void call_stpncpy() {
56   char s1[10], s2[20];
57   __builtin_stpncpy(s2, s1, 20);
58   __builtin_stpncpy(s1, s2, 20); // expected-warning {{'stpncpy' size argument is too large; destination buffer has size 10, but size argument is 20}}
59 }
60 
call_memmove()61 void call_memmove() {
62   char s1[10], s2[20];
63   __builtin_memmove(s2, s1, 20);
64   __builtin_memmove(s1, s2, 20); // expected-warning {{'memmove' will always overflow; destination buffer has size 10, but size argument is 20}}
65 }
66 
call_memset()67 void call_memset() {
68   char buf[10];
69   __builtin_memset(buf, 0xff, 10);
70   __builtin_memset(buf, 0xff, 11); // expected-warning {{'memset' will always overflow; destination buffer has size 10, but size argument is 11}}
71 }
72 
call_snprintf()73 void call_snprintf() {
74   char buf[10];
75   __builtin_snprintf(buf, 10, "merp");
76   __builtin_snprintf(buf, 11, "merp"); // expected-warning {{'snprintf' size argument is too large; destination buffer has size 10, but size argument is 11}}
77 }
78 
call_vsnprintf()79 void call_vsnprintf() {
80   char buf[10];
81   __builtin_va_list list;
82   __builtin_vsnprintf(buf, 10, "merp", list);
83   __builtin_vsnprintf(buf, 11, "merp", list); // expected-warning {{'vsnprintf' size argument is too large; destination buffer has size 10, but size argument is 11}}
84 }
85 
call_sprintf_chk(char * buf)86 void call_sprintf_chk(char *buf) {
87   __builtin___sprintf_chk(buf, 1, 6, "hell\n");
88   __builtin___sprintf_chk(buf, 1, 5, "hell\n");     // expected-warning {{'sprintf' will always overflow; destination buffer has size 5, but format string expands to at least 6}}
89   __builtin___sprintf_chk(buf, 1, 6, "hell\0 boy"); // expected-warning {{format string contains '\0' within the string body}}
90   __builtin___sprintf_chk(buf, 1, 2, "hell\0 boy"); // expected-warning {{format string contains '\0' within the string body}}
91   // expected-warning@-1 {{'sprintf' will always overflow; destination buffer has size 2, but format string expands to at least 5}}
92   __builtin___sprintf_chk(buf, 1, 6, "hello");
93   __builtin___sprintf_chk(buf, 1, 5, "hello"); // expected-warning {{'sprintf' will always overflow; destination buffer has size 5, but format string expands to at least 6}}
94   __builtin___sprintf_chk(buf, 1, 2, "%c", '9');
95   __builtin___sprintf_chk(buf, 1, 1, "%c", '9'); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
96   __builtin___sprintf_chk(buf, 1, 2, "%d", 9);
97   __builtin___sprintf_chk(buf, 1, 1, "%d", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
98   __builtin___sprintf_chk(buf, 1, 2, "%i", 9);
99   __builtin___sprintf_chk(buf, 1, 1, "%i", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
100   __builtin___sprintf_chk(buf, 1, 2, "%o", 9);
101   __builtin___sprintf_chk(buf, 1, 1, "%o", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
102   __builtin___sprintf_chk(buf, 1, 2, "%u", 9);
103   __builtin___sprintf_chk(buf, 1, 1, "%u", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
104   __builtin___sprintf_chk(buf, 1, 2, "%x", 9);
105   __builtin___sprintf_chk(buf, 1, 1, "%x", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
106   __builtin___sprintf_chk(buf, 1, 2, "%X", 9);
107   __builtin___sprintf_chk(buf, 1, 1, "%X", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
108   __builtin___sprintf_chk(buf, 1, 2, "%hhd", (char)9);
109   __builtin___sprintf_chk(buf, 1, 1, "%hhd", (char)9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
110   __builtin___sprintf_chk(buf, 1, 2, "%hd", (short)9);
111   __builtin___sprintf_chk(buf, 1, 1, "%hd", (short)9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
112   __builtin___sprintf_chk(buf, 1, 2, "%ld", 9l);
113   __builtin___sprintf_chk(buf, 1, 1, "%ld", 9l); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
114   __builtin___sprintf_chk(buf, 1, 2, "%lld", 9ll);
115   __builtin___sprintf_chk(buf, 1, 1, "%lld", 9ll); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
116   __builtin___sprintf_chk(buf, 1, 2, "%%");
117   __builtin___sprintf_chk(buf, 1, 1, "%%"); // expected-warning {{'sprintf' will always overflow; destination buffer has size 1, but format string expands to at least 2}}
118   __builtin___sprintf_chk(buf, 1, 4, "%#x", 9);
119   __builtin___sprintf_chk(buf, 1, 3, "%#x", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 3, but format string expands to at least 4}}
120   __builtin___sprintf_chk(buf, 1, 4, "%p", (void *)9);
121   __builtin___sprintf_chk(buf, 1, 3, "%p", (void *)9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 3, but format string expands to at least 4}}
122   __builtin___sprintf_chk(buf, 1, 3, "%+d", 9);
123   __builtin___sprintf_chk(buf, 1, 2, "%+d", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 2, but format string expands to at least 3}}
124   __builtin___sprintf_chk(buf, 1, 3, "% i", 9);
125   __builtin___sprintf_chk(buf, 1, 2, "% i", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 2, but format string expands to at least 3}}
126   __builtin___sprintf_chk(buf, 1, 6, "%5d", 9);
127   __builtin___sprintf_chk(buf, 1, 5, "%5d", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 5, but format string expands to at least 6}}
128   __builtin___sprintf_chk(buf, 1, 9, "%f", 9.f);
129   __builtin___sprintf_chk(buf, 1, 8, "%f", 9.f); // expected-warning {{'sprintf' will always overflow; destination buffer has size 8, but format string expands to at least 9}}
130   __builtin___sprintf_chk(buf, 1, 9, "%Lf", (long double)9.);
131   __builtin___sprintf_chk(buf, 1, 8, "%Lf", (long double)9.); // expected-warning {{'sprintf' will always overflow; destination buffer has size 8, but format string expands to at least 9}}
132   __builtin___sprintf_chk(buf, 1, 10, "%+f", 9.f);
133   __builtin___sprintf_chk(buf, 1, 9, "%+f", 9.f); // expected-warning {{'sprintf' will always overflow; destination buffer has size 9, but format string expands to at least 10}}
134   __builtin___sprintf_chk(buf, 1, 12, "%e", 9.f);
135   __builtin___sprintf_chk(buf, 1, 11, "%e", 9.f); // expected-warning {{'sprintf' will always overflow; destination buffer has size 11, but format string expands to at least 12}}
136 }
137 
call_sprintf()138 void call_sprintf() {
139   char buf[6];
140   sprintf(buf, "hell\0 boy"); // expected-warning {{format string contains '\0' within the string body}}
141   sprintf(buf, "hello b\0y"); // expected-warning {{format string contains '\0' within the string body}}
142   // expected-warning@-1 {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 8}}
143   sprintf(buf, "hello");
144   sprintf(buf, "hello!"); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
145   sprintf(buf, "1234%%");
146   sprintf(buf, "12345%%"); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
147   sprintf(buf, "1234%c", '9');
148   sprintf(buf, "12345%c", '9'); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
149   sprintf(buf, "1234%d", 9);
150   sprintf(buf, "12345%d", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
151   sprintf(buf, "1234%lld", 9ll);
152   sprintf(buf, "12345%lld", 9ll); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
153   sprintf(buf, "12%#x", 9);
154   sprintf(buf, "123%#x", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
155   sprintf(buf, "12%p", (void *)9);
156   sprintf(buf, "123%p", (void *)9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
157   sprintf(buf, "123%+d", 9);
158   sprintf(buf, "1234%+d", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
159   sprintf(buf, "123% i", 9);
160   sprintf(buf, "1234% i", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
161   sprintf(buf, "%5d", 9);
162   sprintf(buf, "1%5d", 9); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
163   sprintf(buf, "%.3f", 9.f);
164   sprintf(buf, "5%.3f", 9.f); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
165   sprintf(buf, "%+.2f", 9.f);
166   sprintf(buf, "%+.3f", 9.f); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 7}}
167   sprintf(buf, "%.0e", 9.f);
168   sprintf(buf, "5%.1e", 9.f); // expected-warning {{'sprintf' will always overflow; destination buffer has size 6, but format string expands to at least 8}}
169 }
170 
171 #ifdef __cplusplus
172 template <class> struct S {
mfS173   void mf() const {
174     __builtin_memset(const_cast<char *>(mv), 0, 0);
175   }
176 
177   char mv[10];
178 };
179 
180 template <int A, int B>
call_memcpy_dep()181 void call_memcpy_dep() {
182   char bufferA[A];
183   char bufferB[B];
184   memcpy(bufferA, bufferB, 10); // expected-warning{{'memcpy' will always overflow; destination buffer has size 9, but size argument is 10}}
185 }
186 
call_call_memcpy()187 void call_call_memcpy() {
188   call_memcpy_dep<10, 9>();
189   call_memcpy_dep<9, 10>(); // expected-note {{in instantiation of function template specialization 'call_memcpy_dep<9, 10>' requested here}}
190 }
191 #endif
192