• Home
  • History
  • Annotate
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1  // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs %s
2  // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs -fno-signed-char %s
3  
4  #include <stdarg.h>
5  #include <stddef.h>
6  #define __need_wint_t
7  #include <stddef.h> // For wint_t and wchar_t
8  
9  typedef struct _FILE FILE;
10  int fprintf(FILE *, const char *restrict, ...);
11  int printf(const char *restrict, ...); // expected-note{{passing argument to parameter here}}
12  int snprintf(char *restrict, size_t, const char *restrict, ...);
13  int sprintf(char *restrict, const char *restrict, ...);
14  int vasprintf(char **, const char *, va_list);
15  int asprintf(char **, const char *, ...);
16  int vfprintf(FILE *, const char *restrict, va_list);
17  int vprintf(const char *restrict, va_list);
18  int vsnprintf(char *, size_t, const char *, va_list);
19  int vsprintf(char *restrict, const char *restrict, va_list); // expected-note{{passing argument to parameter here}}
20  
21  int vscanf(const char *restrict format, va_list arg);
22  
23  char * global_fmt;
24  
check_string_literal(FILE * fp,const char * s,char * buf,...)25  void check_string_literal( FILE* fp, const char* s, char *buf, ... ) {
26  
27    char * b;
28    va_list ap;
29    va_start(ap,buf);
30  
31    printf(s); // expected-warning {{format string is not a string literal}}
32    // expected-note@-1{{treat the string as an argument to avoid this}}
33    vprintf(s,ap); // expected-warning {{format string is not a string literal}}
34    fprintf(fp,s); // expected-warning {{format string is not a string literal}}
35    // expected-note@-1{{treat the string as an argument to avoid this}}
36    vfprintf(fp,s,ap); // expected-warning {{format string is not a string literal}}
37    asprintf(&b,s); // expected-warning {{format string is not a string lit}}
38    // expected-note@-1{{treat the string as an argument to avoid this}}
39    vasprintf(&b,s,ap); // expected-warning {{format string is not a string literal}}
40    sprintf(buf,s); // expected-warning {{format string is not a string literal}}
41    // expected-note@-1{{treat the string as an argument to avoid this}}
42    snprintf(buf,2,s); // expected-warning {{format string is not a string lit}}
43    // expected-note@-1{{treat the string as an argument to avoid this}}
44    __builtin___sprintf_chk(buf,0,-1,s); // expected-warning {{format string is not a string literal}}
45    // expected-note@-1{{treat the string as an argument to avoid this}}
46    __builtin___snprintf_chk(buf,2,0,-1,s); // expected-warning {{format string is not a string lit}}
47    // expected-note@-1{{treat the string as an argument to avoid this}}
48    vsprintf(buf,s,ap); // expected-warning {{format string is not a string lit}}
49    vsnprintf(buf,2,s,ap); // expected-warning {{format string is not a string lit}}
50    vsnprintf(buf,2,global_fmt,ap); // expected-warning {{format string is not a string literal}}
51    __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // expected-warning {{format string is not a string lit}}
52    __builtin___vsnprintf_chk(buf,2,0,-1,global_fmt,ap); // expected-warning {{format string is not a string literal}}
53  
54    vscanf(s, ap); // expected-warning {{format string is not a string literal}}
55  
56    const char *const fmt = "%d"; // FIXME -- defined here
57    printf(fmt, 1, 2); // expected-warning{{data argument not used}}
58  
59    // rdar://6079877
60    printf("abc"
61           "%*d", 1, 1); // no-warning
62    printf("abc\
63  def"
64           "%*d", 1, 1); // no-warning
65  
66    // <rdar://problem/6079850>, allow 'unsigned' (instead of 'int') to be used for both
67    // the field width and precision.  This deviates from C99, but is reasonably safe
68    // and is also accepted by GCC.
69    printf("%*d", (unsigned) 1, 1); // no-warning
70  }
71  
72  // When calling a non-variadic format function (vprintf, vscanf, NSLogv, ...),
73  // warn only if the format string argument is a parameter that is not itself
74  // declared as a format string with compatible format.
75  __attribute__((__format__ (__printf__, 2, 4)))
check_string_literal2(FILE * fp,const char * s,char * buf,...)76  void check_string_literal2( FILE* fp, const char* s, char *buf, ... ) {
77    char * b;
78    va_list ap;
79    va_start(ap,buf);
80  
81    printf(s); // expected-warning {{format string is not a string literal}}
82    // expected-note@-1{{treat the string as an argument to avoid this}}
83    vprintf(s,ap); // no-warning
84    fprintf(fp,s); // expected-warning {{format string is not a string literal}}
85    // expected-note@-1{{treat the string as an argument to avoid this}}
86    vfprintf(fp,s,ap); // no-warning
87    asprintf(&b,s); // expected-warning {{format string is not a string lit}}
88    // expected-note@-1{{treat the string as an argument to avoid this}}
89    vasprintf(&b,s,ap); // no-warning
90    sprintf(buf,s); // expected-warning {{format string is not a string literal}}
91    // expected-note@-1{{treat the string as an argument to avoid this}}
92    snprintf(buf,2,s); // expected-warning {{format string is not a string lit}}
93    // expected-note@-1{{treat the string as an argument to avoid this}}
94    __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // no-warning
95  
96    vscanf(s, ap); // expected-warning {{format string is not a string literal}}
97  }
98  
check_conditional_literal(const char * s,int i)99  void check_conditional_literal(const char* s, int i) {
100    printf(i == 1 ? "yes" : "no"); // no-warning
101    printf(i == 0 ? (i == 1 ? "yes" : "no") : "dont know"); // no-warning
102    printf(i == 0 ? (i == 1 ? s : "no") : "dont know"); // expected-warning{{format string is not a string literal}}
103    // expected-note@-1{{treat the string as an argument to avoid this}}
104    printf("yes" ?: "no %d", 1); // expected-warning{{data argument not used by format string}}
105    printf(0 ? "yes %s" : "no %d", 1); // no-warning
106    printf(0 ? "yes %d" : "no %s", 1); // expected-warning{{format specifies type 'char *'}}
107  
108    printf(0 ? "yes" : "no %d", 1); // no-warning
109    printf(0 ? "yes %d" : "no", 1); // expected-warning{{data argument not used by format string}}
110    printf(1 ? "yes" : "no %d", 1); // expected-warning{{data argument not used by format string}}
111    printf(1 ? "yes %d" : "no", 1); // no-warning
112    printf(i ? "yes" : "no %d", 1); // no-warning
113    printf(i ? "yes %s" : "no %d", 1); // expected-warning{{format specifies type 'char *'}}
114    printf(i ? "yes" : "no %d", 1, 2); // expected-warning{{data argument not used by format string}}
115  
116    printf(i ? "%*s" : "-", i, s); // no-warning
117    printf(i ? "yes" : 0 ? "no %*d" : "dont know %d", 1, 2); // expected-warning{{data argument not used by format string}}
118    printf(i ? "%i\n" : "%i %s %s\n", i, s); // expected-warning{{more '%' conversions than data arguments}}
119  }
120  
check_writeback_specifier()121  void check_writeback_specifier()
122  {
123    int x;
124    char *b;
125    printf("%n", b); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
126    printf("%n", &x); // no-warning
127  
128    printf("%hhn", (signed char*)0); // no-warning
129    printf("%hhn", (char*)0); // no-warning
130    printf("%hhn", (unsigned char*)0); // no-warning
131    printf("%hhn", (int*)0); // expected-warning{{format specifies type 'signed char *' but the argument has type 'int *'}}
132  
133    printf("%hn", (short*)0); // no-warning
134    printf("%hn", (unsigned short*)0); // no-warning
135    printf("%hn", (int*)0); // expected-warning{{format specifies type 'short *' but the argument has type 'int *'}}
136  
137    printf("%n", (int*)0); // no-warning
138    printf("%n", (unsigned int*)0); // no-warning
139    printf("%n", (char*)0); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
140  
141    printf("%ln", (long*)0); // no-warning
142    printf("%ln", (unsigned long*)0); // no-warning
143    printf("%ln", (int*)0); // expected-warning{{format specifies type 'long *' but the argument has type 'int *'}}
144  
145    printf("%lln", (long long*)0); // no-warning
146    printf("%lln", (unsigned long long*)0); // no-warning
147    printf("%lln", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
148  
149    printf("%qn", (long long*)0); // no-warning
150    printf("%qn", (unsigned long long*)0); // no-warning
151    printf("%qn", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
152  
153    printf("%Ln", 0); // expected-warning{{length modifier 'L' results in undefined behavior or no effect with 'n' conversion specifier}}
154    // expected-note@-1{{did you mean to use 'll'?}}
155  }
156  
check_invalid_specifier(FILE * fp,char * buf)157  void check_invalid_specifier(FILE* fp, char *buf)
158  {
159    printf("%s%lb%d","unix",10,20); // expected-warning {{invalid conversion specifier 'b'}}
160    fprintf(fp,"%%%l"); // expected-warning {{incomplete format specifier}}
161    sprintf(buf,"%%%%%ld%d%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}}
162    snprintf(buf, 2, "%%%%%ld%;%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}} expected-warning {{invalid conversion specifier ';'}}
163  }
164  
check_null_char_string(char * b)165  void check_null_char_string(char* b)
166  {
167    printf("\0this is bogus%d",1); // expected-warning {{string contains '\0'}}
168    snprintf(b,10,"%%%%%d\0%d",1,2); // expected-warning {{string contains '\0'}}
169    printf("%\0d",1); // expected-warning {{string contains '\0'}}
170  }
171  
check_empty_format_string(char * buf,...)172  void check_empty_format_string(char* buf, ...)
173  {
174    va_list ap;
175    va_start(ap,buf);
176    vprintf("",ap); // expected-warning {{format string is empty}}
177    sprintf(buf, "", 1); // expected-warning {{format string is empty}}
178  
179    // Don't warn about empty format strings when there are no data arguments.
180    // This can arise from macro expansions and non-standard format string
181    // functions.
182    sprintf(buf, ""); // no-warning
183  }
184  
check_wide_string(char * b,...)185  void check_wide_string(char* b, ...)
186  {
187    va_list ap;
188    va_start(ap,b);
189  
190    printf(L"foo %d",2); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}}
191    vsprintf(b,L"bar %d",ap); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}}
192  }
193  
check_asterisk_precision_width(int x)194  void check_asterisk_precision_width(int x) {
195    printf("%*d"); // expected-warning {{'*' specified field width is missing a matching 'int' argument}}
196    printf("%.*d"); // expected-warning {{'.*' specified field precision is missing a matching 'int' argument}}
197    printf("%*d",12,x); // no-warning
198    printf("%*d","foo",x); // expected-warning {{field width should have type 'int', but argument has type 'char *'}}
199    printf("%.*d","foo",x); // expected-warning {{field precision should have type 'int', but argument has type 'char *'}}
200  }
201  
202  void __attribute__((format(printf,1,3))) myprintf(const char*, int blah, ...);
203  
test_myprintf()204  void test_myprintf() {
205    myprintf("%d", 17, 18); // okay
206  }
207  
test_constant_bindings(void)208  void test_constant_bindings(void) {
209    const char * const s1 = "hello";
210    const char s2[] = "hello";
211    const char *s3 = "hello";
212    char * const s4 = "hello";
213    extern const char s5[];
214  
215    printf(s1); // no-warning
216    printf(s2); // no-warning
217    printf(s3); // expected-warning{{not a string literal}}
218    // expected-note@-1{{treat the string as an argument to avoid this}}
219    printf(s4); // expected-warning{{not a string literal}}
220    // expected-note@-1{{treat the string as an argument to avoid this}}
221    printf(s5); // expected-warning{{not a string literal}}
222    // expected-note@-1{{treat the string as an argument to avoid this}}
223  }
224  
225  
226  // Test what happens when -Wformat-security only.
227  #pragma GCC diagnostic ignored "-Wformat-nonliteral"
228  #pragma GCC diagnostic warning "-Wformat-security"
229  
test9(char * P)230  void test9(char *P) {
231    int x;
232    printf(P);   // expected-warning {{format string is not a string literal (potentially insecure)}}
233    // expected-note@-1{{treat the string as an argument to avoid this}}
234    printf(P, 42);
235  }
236  
torture(va_list v8)237  void torture(va_list v8) {
238    vprintf ("%*.*d", v8);  // no-warning
239  
240  }
241  
test10(int x,float f,int i,long long lli)242  void test10(int x, float f, int i, long long lli) {
243    printf("%s"); // expected-warning{{more '%' conversions than data arguments}}
244    printf("%@", 12); // expected-warning{{invalid conversion specifier '@'}}
245    printf("\0"); // expected-warning{{format string contains '\0' within the string body}}
246    printf("xs\0"); // expected-warning{{format string contains '\0' within the string body}}
247    printf("%*d\n"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
248    printf("%*.*d\n", x); // expected-warning{{'.*' specified field precision is missing a matching 'int' argument}}
249    printf("%*d\n", f, x); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
250    printf("%*.*d\n", x, f, x); // expected-warning{{field precision should have type 'int', but argument has type 'double'}}
251    printf("%**\n"); // expected-warning{{invalid conversion specifier '*'}}
252    printf("%d%d\n", x); // expected-warning{{more '%' conversions than data arguments}}
253    printf("%d\n", x, x); // expected-warning{{data argument not used by format string}}
254    printf("%W%d\n", x, x); // expected-warning{{invalid conversion specifier 'W'}}
255    printf("%"); // expected-warning{{incomplete format specifier}}
256    printf("%.d", x); // no-warning
257    printf("%.", x);  // expected-warning{{incomplete format specifier}}
258    printf("%f", 4); // expected-warning{{format specifies type 'double' but the argument has type 'int'}}
259    printf("%qd", lli); // no-warning
260    printf("%qd", x); // expected-warning{{format specifies type 'long long' but the argument has type 'int'}}
261    printf("%qp", (void *)0); // expected-warning{{length modifier 'q' results in undefined behavior or no effect with 'p' conversion specifier}}
262    printf("hhX %hhX", (unsigned char)10); // no-warning
263    printf("llX %llX", (long long) 10); // no-warning
264    // This is fine, because there is an implicit conversion to an int.
265    printf("%d", (unsigned char) 10); // no-warning
266    printf("%d", (long long) 10); // expected-warning{{format specifies type 'int' but the argument has type 'long long'}}
267    printf("%Lf\n", (long double) 1.0); // no-warning
268    printf("%f\n", (long double) 1.0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}}
269    // The man page says that a zero precision is okay.
270    printf("%.0Lf", (long double) 1.0); // no-warning
271    printf("%c\n", "x"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}}
272    printf("%c\n", 1.23); // expected-warning{{format specifies type 'int' but the argument has type 'double'}}
273    printf("Format %d, is %! %f", 1, 2, 4.4); // expected-warning{{invalid conversion specifier '!'}}
274  }
275  
276  typedef unsigned char uint8_t;
277  
should_understand_small_integers()278  void should_understand_small_integers() {
279    printf("%hhu", (short) 10); // expected-warning{{format specifies type 'unsigned char' but the argument has type 'short'}}
280    printf("%hu\n", (unsigned char) 1); // expected-warning{{format specifies type 'unsigned short' but the argument has type 'unsigned char'}}
281    printf("%hu\n", (uint8_t)1); // expected-warning{{format specifies type 'unsigned short' but the argument has type 'uint8_t'}}
282  }
283  
test11(void * p,char * s)284  void test11(void *p, char *s) {
285    printf("%p", p); // no-warning
286    printf("%p", 123); // expected-warning{{format specifies type 'void *' but the argument has type 'int'}}
287    printf("%.4p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
288    printf("%+p", p); // expected-warning{{flag '+' results in undefined behavior with 'p' conversion specifier}}
289    printf("% p", p); // expected-warning{{flag ' ' results in undefined behavior with 'p' conversion specifier}}
290    printf("%0p", p); // expected-warning{{flag '0' results in undefined behavior with 'p' conversion specifier}}
291    printf("%s", s); // no-warning
292    printf("%+s", p); // expected-warning{{flag '+' results in undefined behavior with 's' conversion specifier}}
293    printf("% s", p); // expected-warning{{flag ' ' results in undefined behavior with 's' conversion specifier}}
294    printf("%0s", p); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
295  }
296  
test12(char * b)297  void test12(char *b) {
298    unsigned char buf[4];
299    printf ("%.4s\n", buf); // no-warning
300    printf ("%.4s\n", &buf); // expected-warning{{format specifies type 'char *' but the argument has type 'unsigned char (*)[4]'}}
301  
302    // Verify that we are checking asprintf
303    asprintf(&b, "%d", "asprintf"); // expected-warning{{format specifies type 'int' but the argument has type 'char *'}}
304  }
305  
test13(short x)306  void test13(short x) {
307    char bel = 007;
308    printf("bel: '0%hhd'\n", bel); // no-warning
309    printf("x: '0%hhd'\n", x); // expected-warning {{format specifies type 'char' but the argument has type 'short'}}
310  }
311  
312  typedef struct __aslclient *aslclient;
313  typedef struct __aslmsg *aslmsg;
314  int asl_log(aslclient asl, aslmsg msg, int level, const char *format, ...) __attribute__((__format__ (__printf__, 4, 5)));
test_asl(aslclient asl)315  void test_asl(aslclient asl) {
316    // Test case from <rdar://problem/7341605>.
317    asl_log(asl, 0, 3, "Error: %m"); // no-warning
318    asl_log(asl, 0, 3, "Error: %W"); // expected-warning{{invalid conversion specifier 'W'}}
319  }
320  
321  // <rdar://problem/7595366>
322  typedef enum { A } int_t;
f0(int_t x)323  void f0(int_t x) { printf("%d\n", x); }
324  
325  // Unicode test cases.  These are possibly specific to Mac OS X.  If so, they should
326  // eventually be moved into a separate test.
327  
test_unicode_conversions(wchar_t * s)328  void test_unicode_conversions(wchar_t *s) {
329    printf("%S", s); // no-warning
330    printf("%s", s); // expected-warning{{format specifies type 'char *' but the argument has type 'wchar_t *'}}
331    printf("%C", s[0]); // no-warning
332    printf("%c", s[0]);
333    // FIXME: This test reports inconsistent results. On Windows, '%C' expects
334    // 'unsigned short'.
335    // printf("%C", 10);
336    printf("%S", "hello"); // expected-warning{{but the argument has type 'char *'}}
337  }
338  
339  // Mac OS X supports positional arguments in format strings.
340  // This is an IEEE extension (IEEE Std 1003.1).
341  // FIXME: This is probably not portable everywhere.
test_positional_arguments()342  void test_positional_arguments() {
343    printf("%0$", (int)2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
344    printf("%1$*0$d", (int) 2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
345    printf("%1$d", (int) 2); // no-warning
346    printf("%1$d", (int) 2, 2); // expected-warning{{data argument not used by format string}}
347    printf("%1$d%1$f", (int) 2); // expected-warning{{format specifies type 'double' but the argument has type 'int'}}
348    printf("%1$2.2d", (int) 2); // no-warning
349    printf("%2$*1$.2d", (int) 2, (int) 3); // no-warning
350    printf("%2$*8$d", (int) 2, (int) 3); // expected-warning{{specified field width is missing a matching 'int' argument}}
351    printf("%%%1$d", (int) 2); // no-warning
352    printf("%1$d%%", (int) 2); // no-warning
353  }
354  
355  // PR 6697 - Handle format strings where the data argument is not adjacent to the format string
356  void myprintf_PR_6697(const char *format, int x, ...) __attribute__((__format__(printf,1, 3)));
test_pr_6697()357  void test_pr_6697() {
358    myprintf_PR_6697("%s\n", 1, "foo"); // no-warning
359    myprintf_PR_6697("%s\n", 1, (int)0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
360    // FIXME: Not everything should clearly support positional arguments,
361    // but we need a way to identify those cases.
362    myprintf_PR_6697("%1$s\n", 1, "foo"); // no-warning
363    myprintf_PR_6697("%2$s\n", 1, "foo"); // expected-warning{{data argument position '2' exceeds the number of data arguments (1)}}
364    myprintf_PR_6697("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (1)}}
365    myprintf_PR_6697("%1$s\n", 1, (int) 0); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
366  }
367  
rdar8026030(FILE * fp)368  void rdar8026030(FILE *fp) {
369    fprintf(fp, "\%"); // expected-warning{{incomplete format specifier}}
370  }
371  
bug7377_bad_length_mod_usage()372  void bug7377_bad_length_mod_usage() {
373    // Bad length modifiers
374    printf("%hhs", "foo"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
375    printf("%1$zp", (void *)0); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}}
376    printf("%ls", L"foo"); // no-warning
377    printf("%#.2Lf", (long double)1.234); // no-warning
378  
379    // Bad flag usage
380    printf("%#p", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'p' conversion specifier}}
381    printf("%0d", -1); // no-warning
382    printf("%#n", (int *) 0); // expected-warning{{flag '#' results in undefined behavior with 'n' conversion specifier}}
383    printf("%-n", (int *) 0); // expected-warning{{flag '-' results in undefined behavior with 'n' conversion specifier}}
384    printf("%-p", (void *) 0); // no-warning
385  
386    // Bad optional amount use
387    printf("%.2c", 'a'); // expected-warning{{precision used with 'c' conversion specifier, resulting in undefined behavior}}
388    printf("%1n", (int *) 0); // expected-warning{{field width used with 'n' conversion specifier, resulting in undefined behavior}}
389    printf("%.9n", (int *) 0); // expected-warning{{precision used with 'n' conversion specifier, resulting in undefined behavior}}
390  
391    // Ignored flags
392    printf("% +f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
393    printf("%+ f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
394    printf("%0-f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
395    printf("%-0f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
396    printf("%-+f", 1.23); // no-warning
397  }
398  
399  // PR 7981 - handle '%lc' (wint_t)
400  
pr7981(wint_t c,wchar_t c2)401  void pr7981(wint_t c, wchar_t c2) {
402    printf("%lc", c); // no-warning
403    printf("%lc", 1.0); // expected-warning{{the argument has type 'double'}}
404    printf("%lc", (char) 1); // no-warning
405    printf("%lc", &c); // expected-warning{{the argument has type 'wint_t *'}}
406    // If wint_t and wchar_t are the same width and wint_t is signed where
407    // wchar_t is unsigned, an implicit conversion isn't possible.
408  #if defined(__WINT_UNSIGNED__) || !defined(__WCHAR_UNSIGNED__) ||   \
409    __WINT_WIDTH__ > __WCHAR_WIDTH__
410    printf("%lc", c2); // no-warning
411  #endif
412  }
413  
414  // <rdar://problem/8269537> -Wformat-security says NULL is not a string literal
rdar8269537()415  void rdar8269537() {
416    // This is likely to crash in most cases, but -Wformat-nonliteral technically
417    // doesn't warn in this case.
418    printf(0); // no-warning
419  }
420  
421  // Handle functions with multiple format attributes.
422  extern void rdar8332221_vprintf_scanf(const char *, va_list, const char *, ...)
423       __attribute__((__format__(__printf__, 1, 0)))
424       __attribute__((__format__(__scanf__, 3, 4)));
425  
rdar8332221(va_list ap,int * x,long * y)426  void rdar8332221(va_list ap, int *x, long *y) {
427    rdar8332221_vprintf_scanf("%", ap, "%d", x); // expected-warning{{incomplete format specifier}}
428  }
429  
430  // PR8641
pr8641()431  void pr8641() {
432    printf("%#x\n", 10);
433    printf("%#X\n", 10);
434  }
435  
posix_extensions()436  void posix_extensions() {
437    // Test %'d, "thousands grouping".
438    // <rdar://problem/8816343>
439    printf("%'d\n", 123456789); // no-warning
440    printf("%'i\n", 123456789); // no-warning
441    printf("%'f\n", (float) 1.0); // no-warning
442    printf("%'p\n", (void*) 0); // expected-warning{{results in undefined behavior with 'p' conversion specifier}}
443  }
444  
445  // PR8486
446  //
447  // Test what happens when -Wformat is on, but -Wformat-security is off.
448  #pragma GCC diagnostic warning "-Wformat"
449  #pragma GCC diagnostic ignored "-Wformat-security"
450  
pr8486()451  void pr8486() {
452    printf("%s", 1); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
453  }
454  
455  // PR9314
456  // Don't warn about string literals that are PreDefinedExprs, e.g. __func__.
pr9314()457  void pr9314() {
458    printf(__PRETTY_FUNCTION__); // no-warning
459    printf(__func__); // no-warning
460  }
461  
462  int printf(const char * restrict, ...) __attribute__((__format__ (__printf__, 1, 2)));
463  
rdar9612060(void)464  void rdar9612060(void) {
465    printf("%s", 2); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
466  }
467  
check_char(unsigned char x,signed char y)468  void check_char(unsigned char x, signed char y) {
469    printf("%c", y); // no-warning
470    printf("%hhu", x); // no-warning
471    printf("%hhi", y); // no-warning
472    printf("%hhi", x); // no-warning
473    printf("%c", x); // no-warning
474    printf("%hhu", y); // no-warning
475  }
476  
477  // Test suppression of individual warnings.
478  
test_suppress_invalid_specifier()479  void test_suppress_invalid_specifier() {
480  #pragma clang diagnostic push
481  #pragma clang diagnostic ignored "-Wformat-invalid-specifier"
482    printf("%@", 12); // no-warning
483  #pragma clang diagnostic pop
484  }
485  
486  // Make sure warnings are on for next test.
487  #pragma GCC diagnostic warning "-Wformat"
488  #pragma GCC diagnostic warning "-Wformat-security"
489  
490  // Test that the printf call site is where the warning is attached.  If the
491  // format string is somewhere else, point to it in a note.
pr9751()492  void pr9751() {
493    const char kFormat1[] = "%d %d \n"; // expected-note{{format string is defined here}}}
494    printf(kFormat1, 0); // expected-warning{{more '%' conversions than data arguments}}
495    printf("%d %s\n", 0); // expected-warning{{more '%' conversions than data arguments}}
496  
497    const char kFormat2[] = "%18$s\n"; // expected-note{{format string is defined here}}
498    printf(kFormat2, 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}}
499    printf("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (2)}}
500  
501    const char kFormat4[] = "%y"; // expected-note{{format string is defined here}}
502    printf(kFormat4, 5); // expected-warning{{invalid conversion specifier 'y'}}
503    printf("%y", 5); // expected-warning{{invalid conversion specifier 'y'}}
504  
505    const char kFormat5[] = "%."; // expected-note{{format string is defined here}}
506    printf(kFormat5, 5); // expected-warning{{incomplete format specifier}}
507    printf("%.", 5); // expected-warning{{incomplete format specifier}}
508  
509    const char kFormat6[] = "%s"; // expected-note{{format string is defined here}}
510    printf(kFormat6, 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
511    printf("%s", 5); // expected-warning{{format specifies type 'char *' but the argument has type 'int'}}
512  
513    const char kFormat7[] = "%0$"; // expected-note{{format string is defined here}}
514    printf(kFormat7, 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
515    printf("%0$", 5); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}}
516  
517    const char kFormat8[] = "%1$d %d"; // expected-note{{format string is defined here}}
518    printf(kFormat8, 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}}
519    printf("%1$d %d", 4, 4); // expected-warning{{cannot mix positional and non-positional arguments in format string}}
520  
521    const char kFormat9[] = ""; // expected-note{{format string is defined here}}
522    printf(kFormat9, 4, 4); // expected-warning{{format string is empty}}
523    printf("", 4, 4); // expected-warning{{format string is empty}}
524  
525    const char kFormat10[] = "\0%d"; // expected-note{{format string is defined here}}
526    printf(kFormat10, 4); // expected-warning{{format string contains '\0' within the string body}}
527    printf("\0%d", 4); // expected-warning{{format string contains '\0' within the string body}}
528  
529    const char kFormat11[] = "%*d"; // expected-note{{format string is defined here}}
530    printf(kFormat11); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
531    printf("%*d"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}}
532  
533    const char kFormat12[] = "%*d"; // expected-note{{format string is defined here}}
534    printf(kFormat12, 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
535    printf("%*d", 4.4); // expected-warning{{field width should have type 'int', but argument has type 'double'}}
536  
537    const char kFormat13[] = "%.3p"; // expected-note{{format string is defined here}}
538    void *p;
539    printf(kFormat13, p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
540    printf("%.3p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}}
541  
542    const char kFormat14[] = "%0s"; // expected-note{{format string is defined here}}
543    printf(kFormat14, "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
544    printf("%0s", "a"); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}}
545  
546    const char kFormat15[] = "%hhs"; // expected-note{{format string is defined here}}
547    printf(kFormat15, "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
548    printf("%hhs", "a"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
549  
550    const char kFormat16[] = "%-0d"; // expected-note{{format string is defined here}}
551    printf(kFormat16, 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
552    printf("%-0d", 5); // expected-warning{{flag '0' is ignored when flag '-' is present}}
553  
554    // Make sure that the "format string is defined here" note is not emitted
555    // when the original string is within the argument expression.
556    printf(1 ? "yes %d" : "no %d"); // expected-warning{{more '%' conversions than data arguments}}
557  
558    const char kFormat17[] = "%hu"; // expected-note{{format string is defined here}}}
559    printf(kFormat17, (int[]){0}); // expected-warning{{format specifies type 'unsigned short' but the argument}}
560  
561    printf("%a", (long double)0); // expected-warning{{format specifies type 'double' but the argument has type 'long double'}}
562  
563    // Test braced char[] initializers.
564    const char kFormat18[] = { "%lld" }; // expected-note{{format string is defined here}}
565    printf(kFormat18, 0); // expected-warning{{format specifies type}}
566  
567    // Make sure we point at the offending argument rather than the format string.
568    const char kFormat19[] = "%d";  // expected-note{{format string is defined here}}
569    printf(kFormat19,
570           0.0); // expected-warning{{format specifies}}
571  }
572  
pr18905()573  void pr18905() {
574    const char s1[] = "s\0%s"; // expected-note{{format string is defined here}}
575    const char s2[1] = "s"; // expected-note{{format string is defined here}}
576    const char s3[2] = "s\0%s"; // expected-warning{{initializer-string for char array is too long}}
577    const char s4[10] = "s";
578    const char s5[0] = "%s"; // expected-warning{{initializer-string for char array is too long}}
579                             // expected-note@-1{{format string is defined here}}
580  
581    printf(s1); // expected-warning{{format string contains '\0' within the string body}}
582    printf(s2); // expected-warning{{format string is not null-terminated}}
583    printf(s3); // no-warning
584    printf(s4); // no-warning
585    printf(s5); // expected-warning{{format string is not null-terminated}}
586  }
587  
588  void __attribute__((format(strfmon,1,2))) monformat(const char *fmt, ...);
589  void __attribute__((format(strftime,1,0))) dateformat(const char *fmt);
590  
591  // Other formats
test_other_formats()592  void test_other_formats() {
593    char *str = "";
594    monformat("", 1); // expected-warning{{format string is empty}}
595    monformat(str); // expected-warning{{format string is not a string literal (potentially insecure)}}
596    dateformat(""); // expected-warning{{format string is empty}}
597    dateformat(str); // no-warning (using strftime non-literal is not unsafe)
598  }
599  
600  // Do not warn about unused arguments coming from system headers.
601  // <rdar://problem/11317765>
602  #include <format-unused-system-args.h>
test_unused_system_args(int x)603  void test_unused_system_args(int x) {
604    PRINT1("%d\n", x); // no-warning{{extra argument is system header is OK}}
605  }
606  
pr12761(char c)607  void pr12761(char c) {
608    // This should not warn even with -fno-signed-char.
609    printf("%hhx", c);
610  }
611  
612  
613  // Test that we correctly merge the format in both orders.
614  extern void test14_foo(const char *, const char *, ...)
615       __attribute__((__format__(__printf__, 1, 3)));
616  extern void test14_foo(const char *, const char *, ...)
617       __attribute__((__format__(__scanf__, 2, 3)));
618  
619  extern void test14_bar(const char *, const char *, ...)
620       __attribute__((__format__(__scanf__, 2, 3)));
621  extern void test14_bar(const char *, const char *, ...)
622       __attribute__((__format__(__printf__, 1, 3)));
623  
test14_zed(int * p)624  void test14_zed(int *p) {
625    test14_foo("%", "%d", p); // expected-warning{{incomplete format specifier}}
626    test14_bar("%", "%d", p); // expected-warning{{incomplete format specifier}}
627  }
628  
test_qualifiers(volatile int * vip,const int * cip,const volatile int * cvip)629  void test_qualifiers(volatile int *vip, const int *cip,
630                       const volatile int *cvip) {
631    printf("%n", cip); // expected-warning{{format specifies type 'int *' but the argument has type 'const int *'}}
632    printf("%n", cvip); // expected-warning{{format specifies type 'int *' but the argument has type 'const volatile int *'}}
633  
634    printf("%n", vip); // No warning.
635    printf("%p", cip); // No warning.
636    printf("%p", cvip); // No warning.
637  
638  
639    typedef int* ip_t;
640    typedef const int* cip_t;
641    printf("%n", (ip_t)0); // No warning.
642    printf("%n", (cip_t)0); // expected-warning{{format specifies type 'int *' but the argument has type 'cip_t' (aka 'const int *')}}
643  }
644  
645  #pragma GCC diagnostic ignored "-Wformat-nonliteral"
646  #pragma GCC diagnostic warning "-Wformat-security"
647  // <rdar://problem/14178260>
648  extern void test_format_security_extra_args(const char*, int, ...)
649      __attribute__((__format__(__printf__, 1, 3)));
test_format_security_pos(char * string)650  void test_format_security_pos(char* string) {
651    test_format_security_extra_args(string, 5); // expected-warning {{format string is not a string literal (potentially insecure)}}
652    // expected-note@-1{{treat the string as an argument to avoid this}}
653  }
654  #pragma GCC diagnostic warning "-Wformat-nonliteral"
655