PrintfFormatString.cpp revision 26ac2e07b46bfb4d4f00752c96481c0a98c79c69 
1//= PrintfFormatStrings.cpp - Analysis of printf format strings --*- C++ -*-==//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// Handling of format string in printf and friends.  The structure of format
11// strings for fprintf() are described in C99 7.19.6.1.
12//
13//===----------------------------------------------------------------------===//
14
15#include "clang/Analysis/Analyses/PrintfFormatString.h"
16
17using clang::analyze_printf::FormatSpecifier;
18using clang::analyze_printf::OptionalAmount;
19
20namespace {
21class FormatSpecifierResult {
22  FormatSpecifier FS;
23  const char *Start;
24  bool Stop;
25public:
26  FormatSpecifierResult(bool stop = false)
27    : Start(0), Stop(stop) {}
28  FormatSpecifierResult(const char *start,
29                        const FormatSpecifier &fs)
30    : FS(fs), Start(start), Stop(false) {}
31
32
33  const char *getStart() const { return Start; }
34  bool shouldStop() const { return Stop; }
35  bool hasValue() const { return Start != 0; }
36  const FormatSpecifier &getValue() const {
37    assert(hasValue());
38    return FS;
39  }
40  const FormatSpecifier &getValue() { return FS; }
41};
42} // end anonymous namespace
43
44template <typename T>
45class UpdateOnReturn {
46  T &ValueToUpdate;
47  const T &ValueToCopy;
48public:
49  UpdateOnReturn(T &valueToUpdate, const T &valueToCopy)
50    : ValueToUpdate(valueToUpdate), ValueToCopy(valueToCopy) {}
51
52  ~UpdateOnReturn() {
53    ValueToUpdate = ValueToCopy;
54  }
55};
56
57static OptionalAmount ParseAmount(const char *&Beg, const char *E) {
58  const char *I = Beg;
59  UpdateOnReturn <const char*> UpdateBeg(Beg, I);
60
61  bool foundDigits = false;
62  unsigned accumulator = 0;
63
64  for ( ; I != E; ++I) {
65    char c = *I;
66    if (c >= '0' && c <= '9') {
67      foundDigits = true;
68      accumulator += (accumulator * 10) + (c - '0');
69      continue;
70    }
71
72    if (foundDigits)
73      return OptionalAmount(accumulator, Beg);
74
75    if (c == '*') {
76      ++I;
77      return OptionalAmount(OptionalAmount::Arg, Beg);
78    }
79
80    break;
81  }
82
83  return OptionalAmount();
84}
85
86static FormatSpecifierResult
87ParseFormatSpecifier(clang::analyze_printf::FormatStringHandler &H,
88                     const char *&Beg, const char *E) {
89
90  using namespace clang::analyze_printf;
91
92  const char *I = Beg;
93  const char *Start = 0;
94  UpdateOnReturn <const char*> UpdateBeg(Beg, I);
95
96  // Look for a '%' character that indicates the start of a format specifier.
97  for ( ; I != E ; ++I) {
98    char c = *I;
99    if (c == '\0') {
100      // Detect spurious null characters, which are likely errors.
101      H.HandleNullChar(I);
102      return true;
103    }
104    if (c == '%') {
105      Start = I++;  // Record the start of the format specifier.
106      break;
107    }
108  }
109
110  // No format specifier found?
111  if (!Start)
112    return false;
113
114  if (I == E) {
115    // No more characters left?
116    H.HandleIncompleteFormatSpecifier(Start, E);
117    return true;
118  }
119
120  FormatSpecifier FS;
121
122  // Look for flags (if any).
123  bool hasMore = true;
124  for ( ; I != E; ++I) {
125    switch (*I) {
126      default: hasMore = false; break;
127      case '-': FS.setIsLeftJustified(); break;
128      case '+': FS.setHasPlusPrefix(); break;
129      case ' ': FS.setHasSpacePrefix(); break;
130      case '#': FS.setHasAlternativeForm(); break;
131      case '0': FS.setHasLeadingZeros(); break;
132    }
133    if (!hasMore)
134      break;
135  }
136
137  if (I == E) {
138    // No more characters left?
139    H.HandleIncompleteFormatSpecifier(Start, E);
140    return true;
141  }
142
143  // Look for the field width (if any).
144  FS.setFieldWidth(ParseAmount(I, E));
145
146  if (I == E) {
147    // No more characters left?
148    H.HandleIncompleteFormatSpecifier(Start, E);
149    return true;
150  }
151
152  // Look for the precision (if any).
153  if (*I == '.') {
154    const char *startPrecision = I++;
155    if (I == E) {
156      H.HandleIncompletePrecision(I - 1);
157      return true;
158    }
159
160    FS.setPrecision(ParseAmount(I, E));
161
162    if (I == E) {
163      // No more characters left?
164      H.HandleIncompletePrecision(startPrecision);
165      return true;
166    }
167  }
168
169  // Look for the length modifier.
170  LengthModifier lm = None;
171  switch (*I) {
172    default:
173      break;
174    case 'h':
175      ++I;
176      lm = (I != E && *I == 'h') ? ++I, AsChar : AsShort;
177      break;
178    case 'l':
179      ++I;
180      lm = (I != E && *I == 'l') ? ++I, AsLongLong : AsLong;
181      break;
182    case 'j': lm = AsIntMax;     ++I; break;
183    case 'z': lm = AsSizeT;      ++I; break;
184    case 't': lm = AsPtrDiff;    ++I; break;
185    case 'L': lm = AsLongDouble; ++I; break;
186  }
187  FS.setLengthModifier(lm);
188
189  if (I == E) {
190    // No more characters left?
191    H.HandleIncompleteFormatSpecifier(Start, E);
192    return true;
193  }
194
195  // Finally, look for the conversion specifier.
196  const char *conversionPosition = I++;
197  ConversionSpecifier::Kind k = ConversionSpecifier::InvalidSpecifier;
198  switch (*conversionPosition) {
199    default:
200      break;
201    // C99: 7.19.6.1 (section 8).
202    case 'd': k = ConversionSpecifier::dArg; break;
203    case 'i': k = ConversionSpecifier::iArg; break;
204    case 'o': k = ConversionSpecifier::oArg; break;
205    case 'u': k = ConversionSpecifier::uArg; break;
206    case 'x': k = ConversionSpecifier::xArg; break;
207    case 'X': k = ConversionSpecifier::XArg; break;
208    case 'f': k = ConversionSpecifier::fArg; break;
209    case 'F': k = ConversionSpecifier::FArg; break;
210    case 'e': k = ConversionSpecifier::eArg; break;
211    case 'E': k = ConversionSpecifier::EArg; break;
212    case 'g': k = ConversionSpecifier::gArg; break;
213    case 'G': k = ConversionSpecifier::GArg; break;
214    case 'a': k = ConversionSpecifier::aArg; break;
215    case 'A': k = ConversionSpecifier::AArg; break;
216    case 'c': k = ConversionSpecifier::IntAsCharArg; break;
217    case 's': k = ConversionSpecifier::CStrArg;      break;
218    case 'p': k = ConversionSpecifier::VoidPtrArg;   break;
219    case 'n': k = ConversionSpecifier::OutIntPtrArg; break;
220    case '%': k = ConversionSpecifier::PercentArg;   break;
221    // Objective-C.
222    case '@': k = ConversionSpecifier::ObjCObjArg; break;
223  }
224  FS.setConversionSpecifier(ConversionSpecifier(conversionPosition, k));
225
226  if (k == ConversionSpecifier::InvalidSpecifier) {
227    H.HandleInvalidConversionSpecifier(FS, Beg, I - Beg);
228    return false; // Keep processing format specifiers.
229  }
230  return FormatSpecifierResult(Start, FS);
231}
232
233namespace clang { namespace analyze_printf {
234bool ParseFormatString(FormatStringHandler &H,
235                       const char *I, const char *E) {
236  // Keep looking for a format specifier until we have exhausted the string.
237  while (I != E) {
238    const FormatSpecifierResult &FSR = ParseFormatSpecifier(H, I, E);
239    // Did a fail-stop error of any kind occur when parsing the specifier?
240    // If so, don't do any more processing.
241    if (FSR.shouldStop())
242      return true;;
243    // Did we exhaust the string or encounter an error that
244    // we can recover from?
245    if (!FSR.hasValue())
246      continue;
247    // We have a format specifier.  Pass it to the callback.
248    if (!H.HandleFormatSpecifier(FSR.getValue(), FSR.getStart(),
249                                 I - FSR.getStart()))
250      return false;
251  }
252  assert(I == E && "Format string not exhausted");
253  return false;
254}
255
256FormatStringHandler::~FormatStringHandler() {}
257}} // end namespace clang::analyze_printf
258