PrintfFormatString.cpp revision 65197b4b0c55bb74af0450230d61ee9461223721 
1//== PrintfFormatString.cpp - Analysis of printf format strings --*- C++ -*-==//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// Handling of format string in printf and friends.  The structure of format
11// strings for fprintf() are described in C99 7.19.6.1.
12//
13//===----------------------------------------------------------------------===//
14
15#include "clang/Analysis/Analyses/FormatString.h"
16#include "FormatStringParsing.h"
17
18using clang::analyze_format_string::ArgTypeResult;
19using clang::analyze_format_string::FormatStringHandler;
20using clang::analyze_format_string::LengthModifier;
21using clang::analyze_format_string::OptionalAmount;
22using clang::analyze_format_string::ConversionSpecifier;
23using clang::analyze_printf::PrintfSpecifier;
24
25using namespace clang;
26
27typedef clang::analyze_format_string::SpecifierResult<PrintfSpecifier>
28        PrintfSpecifierResult;
29
30//===----------------------------------------------------------------------===//
31// Methods for parsing format strings.
32//===----------------------------------------------------------------------===//
33
34using analyze_format_string::ParseNonPositionAmount;
35
36static bool ParsePrecision(FormatStringHandler &H, PrintfSpecifier &FS,
37                           const char *Start, const char *&Beg, const char *E,
38                           unsigned *argIndex) {
39  if (argIndex) {
40    FS.setPrecision(ParseNonPositionAmount(Beg, E, *argIndex));
41  }
42  else {
43    const OptionalAmount Amt = ParsePositionAmount(H, Start, Beg, E,
44                                           analyze_format_string::PrecisionPos);
45    if (Amt.isInvalid())
46      return true;
47    FS.setPrecision(Amt);
48  }
49  return false;
50}
51
52static PrintfSpecifierResult ParsePrintfSpecifier(FormatStringHandler &H,
53                                                  const char *&Beg,
54                                                  const char *E,
55                                                  unsigned &argIndex) {
56
57  using namespace clang::analyze_format_string;
58  using namespace clang::analyze_printf;
59
60  const char *I = Beg;
61  const char *Start = 0;
62  UpdateOnReturn <const char*> UpdateBeg(Beg, I);
63
64  // Look for a '%' character that indicates the start of a format specifier.
65  for ( ; I != E ; ++I) {
66    char c = *I;
67    if (c == '\0') {
68      // Detect spurious null characters, which are likely errors.
69      H.HandleNullChar(I);
70      return true;
71    }
72    if (c == '%') {
73      Start = I++;  // Record the start of the format specifier.
74      break;
75    }
76  }
77
78  // No format specifier found?
79  if (!Start)
80    return false;
81
82  if (I == E) {
83    // No more characters left?
84    H.HandleIncompleteSpecifier(Start, E - Start);
85    return true;
86  }
87
88  PrintfSpecifier FS;
89  if (ParseArgPosition(H, FS, Start, I, E))
90    return true;
91
92  if (I == E) {
93    // No more characters left?
94    H.HandleIncompleteSpecifier(Start, E - Start);
95    return true;
96  }
97
98  // Look for flags (if any).
99  bool hasMore = true;
100  for ( ; I != E; ++I) {
101    switch (*I) {
102      default: hasMore = false; break;
103      case '\'':
104        // FIXME: POSIX specific.  Always accept?
105        FS.setHasThousandsGrouping(I);
106        break;
107      case '-': FS.setIsLeftJustified(I); break;
108      case '+': FS.setHasPlusPrefix(I); break;
109      case ' ': FS.setHasSpacePrefix(I); break;
110      case '#': FS.setHasAlternativeForm(I); break;
111      case '0': FS.setHasLeadingZeros(I); break;
112    }
113    if (!hasMore)
114      break;
115  }
116
117  if (I == E) {
118    // No more characters left?
119    H.HandleIncompleteSpecifier(Start, E - Start);
120    return true;
121  }
122
123  // Look for the field width (if any).
124  if (ParseFieldWidth(H, FS, Start, I, E,
125                      FS.usesPositionalArg() ? 0 : &argIndex))
126    return true;
127
128  if (I == E) {
129    // No more characters left?
130    H.HandleIncompleteSpecifier(Start, E - Start);
131    return true;
132  }
133
134  // Look for the precision (if any).
135  if (*I == '.') {
136    ++I;
137    if (I == E) {
138      H.HandleIncompleteSpecifier(Start, E - Start);
139      return true;
140    }
141
142    if (ParsePrecision(H, FS, Start, I, E,
143                       FS.usesPositionalArg() ? 0 : &argIndex))
144      return true;
145
146    if (I == E) {
147      // No more characters left?
148      H.HandleIncompleteSpecifier(Start, E - Start);
149      return true;
150    }
151  }
152
153  // Look for the length modifier.
154  if (ParseLengthModifier(FS, I, E) && I == E) {
155    // No more characters left?
156    H.HandleIncompleteSpecifier(Start, E - Start);
157    return true;
158  }
159
160  if (*I == '\0') {
161    // Detect spurious null characters, which are likely errors.
162    H.HandleNullChar(I);
163    return true;
164  }
165
166  // Finally, look for the conversion specifier.
167  const char *conversionPosition = I++;
168  ConversionSpecifier::Kind k = ConversionSpecifier::InvalidSpecifier;
169  switch (*conversionPosition) {
170    default:
171      break;
172    // C99: 7.19.6.1 (section 8).
173    case '%': k = ConversionSpecifier::PercentArg;   break;
174    case 'A': k = ConversionSpecifier::AArg; break;
175    case 'E': k = ConversionSpecifier::EArg; break;
176    case 'F': k = ConversionSpecifier::FArg; break;
177    case 'G': k = ConversionSpecifier::GArg; break;
178    case 'X': k = ConversionSpecifier::XArg; break;
179    case 'a': k = ConversionSpecifier::aArg; break;
180    case 'c': k = ConversionSpecifier::cArg; break;
181    case 'd': k = ConversionSpecifier::dArg; break;
182    case 'e': k = ConversionSpecifier::eArg; break;
183    case 'f': k = ConversionSpecifier::fArg; break;
184    case 'g': k = ConversionSpecifier::gArg; break;
185    case 'i': k = ConversionSpecifier::iArg; break;
186    case 'n': k = ConversionSpecifier::nArg; break;
187    case 'o': k = ConversionSpecifier::oArg; break;
188    case 'p': k = ConversionSpecifier::pArg;   break;
189    case 's': k = ConversionSpecifier::sArg;      break;
190    case 'u': k = ConversionSpecifier::uArg; break;
191    case 'x': k = ConversionSpecifier::xArg; break;
192    // POSIX specific.
193    case 'C': k = ConversionSpecifier::CArg; break;
194    case 'S': k = ConversionSpecifier::SArg; break;
195    // Objective-C.
196    case '@': k = ConversionSpecifier::ObjCObjArg; break;
197    // Glibc specific.
198    case 'm': k = ConversionSpecifier::PrintErrno; break;
199  }
200  PrintfConversionSpecifier CS(conversionPosition, k);
201  FS.setConversionSpecifier(CS);
202  if (CS.consumesDataArgument() && !FS.usesPositionalArg())
203    FS.setArgIndex(argIndex++);
204
205  if (k == ConversionSpecifier::InvalidSpecifier) {
206    // Assume the conversion takes one argument.
207    return !H.HandleInvalidPrintfConversionSpecifier(FS, Start, I - Start);
208  }
209  return PrintfSpecifierResult(Start, FS);
210}
211
212bool clang::analyze_format_string::ParsePrintfString(FormatStringHandler &H,
213                                                     const char *I,
214                                                     const char *E) {
215
216  unsigned argIndex = 0;
217
218  // Keep looking for a format specifier until we have exhausted the string.
219  while (I != E) {
220    const PrintfSpecifierResult &FSR = ParsePrintfSpecifier(H, I, E, argIndex);
221    // Did a fail-stop error of any kind occur when parsing the specifier?
222    // If so, don't do any more processing.
223    if (FSR.shouldStop())
224      return true;;
225    // Did we exhaust the string or encounter an error that
226    // we can recover from?
227    if (!FSR.hasValue())
228      continue;
229    // We have a format specifier.  Pass it to the callback.
230    if (!H.HandlePrintfSpecifier(FSR.getValue(), FSR.getStart(),
231                                 I - FSR.getStart()))
232      return true;
233  }
234  assert(I == E && "Format string not exhausted");
235  return false;
236}
237
238//===----------------------------------------------------------------------===//
239// Methods on ConversionSpecifier.
240//===----------------------------------------------------------------------===//
241const char *ConversionSpecifier::toString() const {
242  switch (kind) {
243  case dArg: return "d";
244  case iArg: return "i";
245  case oArg: return "o";
246  case uArg: return "u";
247  case xArg: return "x";
248  case XArg: return "X";
249  case fArg: return "f";
250  case FArg: return "F";
251  case eArg: return "e";
252  case EArg: return "E";
253  case gArg: return "g";
254  case GArg: return "G";
255  case aArg: return "a";
256  case AArg: return "A";
257  case cArg: return "c";
258  case sArg: return "s";
259  case pArg: return "p";
260  case nArg: return "n";
261  case PercentArg:  return "%";
262  case ScanListArg: return "[";
263  case InvalidSpecifier: return NULL;
264
265  // MacOS X unicode extensions.
266  case CArg: return "C";
267  case SArg: return "S";
268
269  // Objective-C specific specifiers.
270  case ObjCObjArg: return "@";
271
272  // GlibC specific specifiers.
273  case PrintErrno: return "m";
274  }
275  return NULL;
276}
277
278//===----------------------------------------------------------------------===//
279// Methods on PrintfSpecifier.
280//===----------------------------------------------------------------------===//
281
282ArgTypeResult PrintfSpecifier::getArgType(ASTContext &Ctx) const {
283  const PrintfConversionSpecifier &CS = getConversionSpecifier();
284
285  if (!CS.consumesDataArgument())
286    return ArgTypeResult::Invalid();
287
288  if (CS.getKind() == ConversionSpecifier::cArg)
289    switch (LM.getKind()) {
290      case LengthModifier::None: return Ctx.IntTy;
291      case LengthModifier::AsLong: return ArgTypeResult::WIntTy;
292      default:
293        return ArgTypeResult::Invalid();
294    }
295
296  if (CS.isIntArg())
297    switch (LM.getKind()) {
298      case LengthModifier::AsLongDouble:
299        return ArgTypeResult::Invalid();
300      case LengthModifier::None: return Ctx.IntTy;
301      case LengthModifier::AsChar: return Ctx.SignedCharTy;
302      case LengthModifier::AsShort: return Ctx.ShortTy;
303      case LengthModifier::AsLong: return Ctx.LongTy;
304      case LengthModifier::AsLongLong: return Ctx.LongLongTy;
305      case LengthModifier::AsIntMax:
306        // FIXME: Return unknown for now.
307        return ArgTypeResult();
308      case LengthModifier::AsSizeT: return Ctx.getSizeType();
309      case LengthModifier::AsPtrDiff: return Ctx.getPointerDiffType();
310    }
311
312  if (CS.isUIntArg())
313    switch (LM.getKind()) {
314      case LengthModifier::AsLongDouble:
315        return ArgTypeResult::Invalid();
316      case LengthModifier::None: return Ctx.UnsignedIntTy;
317      case LengthModifier::AsChar: return Ctx.UnsignedCharTy;
318      case LengthModifier::AsShort: return Ctx.UnsignedShortTy;
319      case LengthModifier::AsLong: return Ctx.UnsignedLongTy;
320      case LengthModifier::AsLongLong: return Ctx.UnsignedLongLongTy;
321      case LengthModifier::AsIntMax:
322        // FIXME: Return unknown for now.
323        return ArgTypeResult();
324      case LengthModifier::AsSizeT:
325        // FIXME: How to get the corresponding unsigned
326        // version of size_t?
327        return ArgTypeResult();
328      case LengthModifier::AsPtrDiff:
329        // FIXME: How to get the corresponding unsigned
330        // version of ptrdiff_t?
331        return ArgTypeResult();
332    }
333
334  if (CS.isDoubleArg()) {
335    if (LM.getKind() == LengthModifier::AsLongDouble)
336      return Ctx.LongDoubleTy;
337    return Ctx.DoubleTy;
338  }
339
340  switch (CS.getKind()) {
341    case ConversionSpecifier::sArg:
342      return ArgTypeResult(LM.getKind() == LengthModifier::AsWideChar ?
343          ArgTypeResult::WCStrTy : ArgTypeResult::CStrTy);
344    case ConversionSpecifier::SArg:
345      // FIXME: This appears to be Mac OS X specific.
346      return ArgTypeResult::WCStrTy;
347    case ConversionSpecifier::CArg:
348      return Ctx.WCharTy;
349    case ConversionSpecifier::pArg:
350      return ArgTypeResult::CPointerTy;
351    default:
352      break;
353  }
354
355  // FIXME: Handle other cases.
356  return ArgTypeResult();
357}
358
359bool PrintfSpecifier::fixType(QualType QT) {
360  // Handle strings first (char *, wchar_t *)
361  if (QT->isPointerType() && (QT->getPointeeType()->isAnyCharacterType())) {
362    CS.setKind(ConversionSpecifier::sArg);
363
364    // Disable irrelevant flags
365    HasAlternativeForm = 0;
366    HasLeadingZeroes = 0;
367
368    // Set the long length modifier for wide characters
369    if (QT->getPointeeType()->isWideCharType())
370      LM.setKind(LengthModifier::AsWideChar);
371
372    return true;
373  }
374
375  // We can only work with builtin types.
376  if (!QT->isBuiltinType())
377    return false;
378
379  // Everything else should be a base type
380  const BuiltinType *BT = QT->getAs<BuiltinType>();
381
382  // Set length modifier
383  switch (BT->getKind()) {
384  default:
385    // The rest of the conversions are either optional or for non-builtin types
386    LM.setKind(LengthModifier::None);
387    break;
388
389  case BuiltinType::Char_U:
390  case BuiltinType::UChar:
391  case BuiltinType::Char_S:
392  case BuiltinType::SChar:
393    LM.setKind(LengthModifier::AsChar);
394    break;
395
396  case BuiltinType::Short:
397  case BuiltinType::UShort:
398    LM.setKind(LengthModifier::AsShort);
399    break;
400
401  case BuiltinType::WChar_S:
402  case BuiltinType::WChar_U:
403  case BuiltinType::Long:
404  case BuiltinType::ULong:
405    LM.setKind(LengthModifier::AsLong);
406    break;
407
408  case BuiltinType::LongLong:
409  case BuiltinType::ULongLong:
410    LM.setKind(LengthModifier::AsLongLong);
411    break;
412
413  case BuiltinType::LongDouble:
414    LM.setKind(LengthModifier::AsLongDouble);
415    break;
416  }
417
418  // Set conversion specifier and disable any flags which do not apply to it.
419  // Let typedefs to char fall through to int, as %c is silly for uint8_t.
420  if (isa<TypedefType>(QT) && QT->isAnyCharacterType()) {
421    CS.setKind(ConversionSpecifier::cArg);
422    LM.setKind(LengthModifier::None);
423    Precision.setHowSpecified(OptionalAmount::NotSpecified);
424    HasAlternativeForm = 0;
425    HasLeadingZeroes = 0;
426    HasPlusPrefix = 0;
427  }
428  // Test for Floating type first as LongDouble can pass isUnsignedIntegerType
429  else if (QT->isRealFloatingType()) {
430    CS.setKind(ConversionSpecifier::fArg);
431  }
432  else if (QT->isPointerType()) {
433    CS.setKind(ConversionSpecifier::pArg);
434    Precision.setHowSpecified(OptionalAmount::NotSpecified);
435    HasAlternativeForm = 0;
436    HasLeadingZeroes = 0;
437    HasPlusPrefix = 0;
438  }
439  else if (QT->isSignedIntegerType()) {
440    CS.setKind(ConversionSpecifier::dArg);
441    HasAlternativeForm = 0;
442  }
443  else if (QT->isUnsignedIntegerType()) {
444    CS.setKind(ConversionSpecifier::uArg);
445    HasAlternativeForm = 0;
446    HasPlusPrefix = 0;
447  }
448  else {
449    return false;
450  }
451
452  return true;
453}
454
455void PrintfSpecifier::toString(llvm::raw_ostream &os) const {
456  // Whilst some features have no defined order, we are using the order
457  // appearing in the C99 standard (ISO/IEC 9899:1999 (E) ¤7.19.6.1)
458  os << "%";
459
460  // Positional args
461  if (usesPositionalArg()) {
462    os << getPositionalArgIndex() << "$";
463  }
464
465  // Conversion flags
466  if (IsLeftJustified)    os << "-";
467  if (HasPlusPrefix)      os << "+";
468  if (HasSpacePrefix)     os << " ";
469  if (HasAlternativeForm) os << "#";
470  if (HasLeadingZeroes)   os << "0";
471
472  // Minimum field width
473  FieldWidth.toString(os);
474  // Precision
475  Precision.toString(os);
476  // Length modifier
477  os << LM.toString();
478  // Conversion specifier
479  os << CS.toString();
480}
481
482bool PrintfSpecifier::hasValidPlusPrefix() const {
483  if (!HasPlusPrefix)
484    return true;
485
486  // The plus prefix only makes sense for signed conversions
487  switch (CS.getKind()) {
488  case ConversionSpecifier::dArg:
489  case ConversionSpecifier::iArg:
490  case ConversionSpecifier::fArg:
491  case ConversionSpecifier::FArg:
492  case ConversionSpecifier::eArg:
493  case ConversionSpecifier::EArg:
494  case ConversionSpecifier::gArg:
495  case ConversionSpecifier::GArg:
496  case ConversionSpecifier::aArg:
497  case ConversionSpecifier::AArg:
498    return true;
499
500  default:
501    return false;
502  }
503}
504
505bool PrintfSpecifier::hasValidAlternativeForm() const {
506  if (!HasAlternativeForm)
507    return true;
508
509  // Alternate form flag only valid with the oxXaAeEfFgG conversions
510  switch (CS.getKind()) {
511  case ConversionSpecifier::oArg:
512  case ConversionSpecifier::xArg:
513  case ConversionSpecifier::XArg:
514  case ConversionSpecifier::aArg:
515  case ConversionSpecifier::AArg:
516  case ConversionSpecifier::eArg:
517  case ConversionSpecifier::EArg:
518  case ConversionSpecifier::fArg:
519  case ConversionSpecifier::FArg:
520  case ConversionSpecifier::gArg:
521  case ConversionSpecifier::GArg:
522    return true;
523
524  default:
525    return false;
526  }
527}
528
529bool PrintfSpecifier::hasValidLeadingZeros() const {
530  if (!HasLeadingZeroes)
531    return true;
532
533  // Leading zeroes flag only valid with the diouxXaAeEfFgG conversions
534  switch (CS.getKind()) {
535  case ConversionSpecifier::dArg:
536  case ConversionSpecifier::iArg:
537  case ConversionSpecifier::oArg:
538  case ConversionSpecifier::uArg:
539  case ConversionSpecifier::xArg:
540  case ConversionSpecifier::XArg:
541  case ConversionSpecifier::aArg:
542  case ConversionSpecifier::AArg:
543  case ConversionSpecifier::eArg:
544  case ConversionSpecifier::EArg:
545  case ConversionSpecifier::fArg:
546  case ConversionSpecifier::FArg:
547  case ConversionSpecifier::gArg:
548  case ConversionSpecifier::GArg:
549    return true;
550
551  default:
552    return false;
553  }
554}
555
556bool PrintfSpecifier::hasValidSpacePrefix() const {
557  if (!HasSpacePrefix)
558    return true;
559
560  // The space prefix only makes sense for signed conversions
561  switch (CS.getKind()) {
562  case ConversionSpecifier::dArg:
563  case ConversionSpecifier::iArg:
564  case ConversionSpecifier::fArg:
565  case ConversionSpecifier::FArg:
566  case ConversionSpecifier::eArg:
567  case ConversionSpecifier::EArg:
568  case ConversionSpecifier::gArg:
569  case ConversionSpecifier::GArg:
570  case ConversionSpecifier::aArg:
571  case ConversionSpecifier::AArg:
572    return true;
573
574  default:
575    return false;
576  }
577}
578
579bool PrintfSpecifier::hasValidLeftJustified() const {
580  if (!IsLeftJustified)
581    return true;
582
583  // The left justified flag is valid for all conversions except n
584  switch (CS.getKind()) {
585  case ConversionSpecifier::nArg:
586    return false;
587
588  default:
589    return true;
590  }
591}
592
593bool PrintfSpecifier::hasValidThousandsGroupingPrefix() const {
594  if (!HasThousandsGrouping)
595    return true;
596
597  switch (CS.getKind()) {
598    case ConversionSpecifier::dArg:
599    case ConversionSpecifier::iArg:
600    case ConversionSpecifier::uArg:
601    case ConversionSpecifier::fArg:
602    case ConversionSpecifier::FArg:
603    case ConversionSpecifier::gArg:
604    case ConversionSpecifier::GArg:
605      return true;
606    default:
607      return false;
608  }
609}
610
611bool PrintfSpecifier::hasValidPrecision() const {
612  if (Precision.getHowSpecified() == OptionalAmount::NotSpecified)
613    return true;
614
615  // Precision is only valid with the diouxXaAeEfFgGs conversions
616  switch (CS.getKind()) {
617  case ConversionSpecifier::dArg:
618  case ConversionSpecifier::iArg:
619  case ConversionSpecifier::oArg:
620  case ConversionSpecifier::uArg:
621  case ConversionSpecifier::xArg:
622  case ConversionSpecifier::XArg:
623  case ConversionSpecifier::aArg:
624  case ConversionSpecifier::AArg:
625  case ConversionSpecifier::eArg:
626  case ConversionSpecifier::EArg:
627  case ConversionSpecifier::fArg:
628  case ConversionSpecifier::FArg:
629  case ConversionSpecifier::gArg:
630  case ConversionSpecifier::GArg:
631  case ConversionSpecifier::sArg:
632    return true;
633
634  default:
635    return false;
636  }
637}
638bool PrintfSpecifier::hasValidFieldWidth() const {
639  if (FieldWidth.getHowSpecified() == OptionalAmount::NotSpecified)
640      return true;
641
642  // The field width is valid for all conversions except n
643  switch (CS.getKind()) {
644  case ConversionSpecifier::nArg:
645    return false;
646
647  default:
648    return true;
649  }
650}
651