format-strings.c revision 95355bb53ef3145e463b98c6fd26f8f95e26e26c
1// RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral %s 2 3#include <stdarg.h> 4typedef __typeof(sizeof(int)) size_t; 5typedef struct _FILE FILE; 6int fprintf(FILE *, const char *restrict, ...); 7int printf(const char *restrict, ...); // expected-note{{passing argument to parameter here}} 8int snprintf(char *restrict, size_t, const char *restrict, ...); 9int sprintf(char *restrict, const char *restrict, ...); 10int vasprintf(char **, const char *, va_list); 11int asprintf(char **, const char *, ...); 12int vfprintf(FILE *, const char *restrict, va_list); 13int vprintf(const char *restrict, va_list); 14int vsnprintf(char *, size_t, const char *, va_list); 15int vsprintf(char *restrict, const char *restrict, va_list); // expected-note{{passing argument to parameter here}} 16 17char * global_fmt; 18 19void check_string_literal( FILE* fp, const char* s, char *buf, ... ) { 20 21 char * b; 22 va_list ap; 23 va_start(ap,buf); 24 25 printf(s); // expected-warning {{format string is not a string literal}} 26 vprintf(s,ap); // // no-warning 27 fprintf(fp,s); // expected-warning {{format string is not a string literal}} 28 vfprintf(fp,s,ap); // no-warning 29 asprintf(&b,s); // expected-warning {{format string is not a string lit}} 30 vasprintf(&b,s,ap); // no-warning 31 sprintf(buf,s); // expected-warning {{format string is not a string literal}} 32 snprintf(buf,2,s); // expected-warning {{format string is not a string lit}} 33 __builtin___sprintf_chk(buf,0,-1,s); // expected-warning {{format string is not a string literal}} 34 __builtin___snprintf_chk(buf,2,0,-1,s); // expected-warning {{format string is not a string lit}} 35 vsprintf(buf,s,ap); // no-warning 36 vsnprintf(buf,2,s,ap); // no-warning 37 vsnprintf(buf,2,global_fmt,ap); // expected-warning {{format string is not a string literal}} 38 __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // no-warning 39 __builtin___vsnprintf_chk(buf,2,0,-1,global_fmt,ap); // expected-warning {{format string is not a string literal}} 40 41 // rdar://6079877 42 printf("abc" 43 "%*d", 1, 1); // no-warning 44 printf("abc\ 45def" 46 "%*d", 1, 1); // no-warning 47 48 // <rdar://problem/6079850>, allow 'unsigned' (instead of 'int') to be used for both 49 // the field width and precision. This deviates from C99, but is reasonably safe 50 // and is also accepted by GCC. 51 printf("%*d", (unsigned) 1, 1); // no-warning 52} 53 54void check_conditional_literal(const char* s, int i) { 55 printf(i == 1 ? "yes" : "no"); // no-warning 56 printf(i == 0 ? (i == 1 ? "yes" : "no") : "dont know"); // no-warning 57 printf(i == 0 ? (i == 1 ? s : "no") : "dont know"); // expected-warning{{format string is not a string literal}} 58 printf("yes" ?: "no %d", 1); // expected-warning{{data argument not used by format string}} 59} 60 61void check_writeback_specifier() 62{ 63 int x; 64 char *b; 65 66 printf("%n",&x); // expected-warning {{'%n' in format string discouraged}} 67 sprintf(b,"%d%%%n",1, &x); // expected-warning {{'%n' in format string dis}} 68} 69 70void check_invalid_specifier(FILE* fp, char *buf) 71{ 72 printf("%s%lb%d","unix",10,20); // expected-warning {{invalid conversion specifier 'b'}} 73 fprintf(fp,"%%%l"); // expected-warning {{incomplete format specifier}} 74 sprintf(buf,"%%%%%ld%d%d", 1, 2, 3); // expected-warning{{conversion specifies type 'long' but the argument has type 'int'}} 75 snprintf(buf, 2, "%%%%%ld%;%d", 1, 2, 3); // expected-warning{{conversion specifies type 'long' but the argument has type 'int'}} expected-warning {{invalid conversion specifier ';'}} 76} 77 78void check_null_char_string(char* b) 79{ 80 printf("\0this is bogus%d",1); // expected-warning {{string contains '\0'}} 81 snprintf(b,10,"%%%%%d\0%d",1,2); // expected-warning {{string contains '\0'}} 82 printf("%\0d",1); // expected-warning {{string contains '\0'}} 83} 84 85void check_empty_format_string(char* buf, ...) 86{ 87 va_list ap; 88 va_start(ap,buf); 89 vprintf("",ap); // expected-warning {{format string is empty}} 90 sprintf(buf,""); // expected-warning {{format string is empty}} 91} 92 93void check_wide_string(char* b, ...) 94{ 95 va_list ap; 96 va_start(ap,b); 97 98 printf(L"foo %d",2); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}} 99 vsprintf(b,L"bar %d",ap); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}} 100} 101 102void check_asterisk_precision_width(int x) { 103 printf("%*d"); // expected-warning {{'*' specified field width is missing a matching 'int' argument}} 104 printf("%.*d"); // expected-warning {{'.*' specified field precision is missing a matching 'int' argument}} 105 printf("%*d",12,x); // no-warning 106 printf("%*d","foo",x); // expected-warning {{field width should have type 'int', but argument has type 'char *'}} 107 printf("%.*d","foo",x); // expected-warning {{field precision should have type 'int', but argument has type 'char *'}} 108} 109 110void __attribute__((format(printf,1,3))) myprintf(const char*, int blah, ...); 111 112void test_myprintf() { 113 myprintf("%d", 17, 18); // okay 114} 115 116void test_constant_bindings(void) { 117 const char * const s1 = "hello"; 118 const char s2[] = "hello"; 119 const char *s3 = "hello"; 120 char * const s4 = "hello"; 121 extern const char s5[]; 122 123 printf(s1); // no-warning 124 printf(s2); // no-warning 125 printf(s3); // expected-warning{{not a string literal}} 126 printf(s4); // expected-warning{{not a string literal}} 127 printf(s5); // expected-warning{{not a string literal}} 128} 129 130 131// Test what happens when -Wformat-security only. 132#pragma GCC diagnostic ignored "-Wformat-nonliteral" 133#pragma GCC diagnostic warning "-Wformat-security" 134 135void test9(char *P) { 136 int x; 137 printf(P); // expected-warning {{format string is not a string literal (potentially insecure)}} 138 printf(P, 42); 139 printf("%n", &x); // expected-warning {{use of '%n' in format string discouraged }} 140} 141 142void torture(va_list v8) { 143 vprintf ("%*.*d", v8); // no-warning 144 145} 146 147void test10(int x, float f, int i, long long lli) { 148 printf("%s"); // expected-warning{{more '%' conversions than data arguments}} 149 printf("%@", 12); // expected-warning{{invalid conversion specifier '@'}} 150 printf("\0"); // expected-warning{{format string contains '\0' within the string body}} 151 printf("xs\0"); // expected-warning{{format string contains '\0' within the string body}} 152 printf("%*d\n"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}} 153 printf("%*.*d\n", x); // expected-warning{{'.*' specified field precision is missing a matching 'int' argument}} 154 printf("%*d\n", f, x); // expected-warning{{field width should have type 'int', but argument has type 'double'}} 155 printf("%*.*d\n", x, f, x); // expected-warning{{field precision should have type 'int', but argument has type 'double'}} 156 printf("%**\n"); // expected-warning{{invalid conversion specifier '*'}} 157 printf("%n", &i); // expected-warning{{use of '%n' in format string discouraged (potentially insecure)}} 158 printf("%d%d\n", x); // expected-warning{{more '%' conversions than data arguments}} 159 printf("%d\n", x, x); // expected-warning{{data argument not used by format string}} 160 printf("%W%d%Z\n", x, x, x); // expected-warning{{invalid conversion specifier 'W'}} expected-warning{{invalid conversion specifier 'Z'}} 161 printf("%"); // expected-warning{{incomplete format specifier}} 162 printf("%.d", x); // no-warning 163 printf("%.", x); // expected-warning{{incomplete format specifier}} 164 printf("%f", 4); // expected-warning{{conversion specifies type 'double' but the argument has type 'int'}} 165 printf("%qd", lli); 166 printf("hhX %hhX", (unsigned char)10); // no-warning 167 printf("llX %llX", (long long) 10); // no-warning 168 // This is fine, because there is an implicit conversion to an int. 169 printf("%d", (unsigned char) 10); // no-warning 170 printf("%d", (long long) 10); // expected-warning{{conversion specifies type 'int' but the argument has type 'long long'}} 171 printf("%Lf\n", (long double) 1.0); // no-warning 172 printf("%f\n", (long double) 1.0); // expected-warning{{conversion specifies type 'double' but the argument has type 'long double'}} 173 // The man page says that a zero precision is okay. 174 printf("%.0Lf", (long double) 1.0); // no-warning 175 printf("%c\n", "x"); // expected-warning{{conversion specifies type 'int' but the argument has type 'char *'}} 176 printf("%c\n", 1.23); // expected-warning{{conversion specifies type 'int' but the argument has type 'double'}} 177} 178 179void test11(void *p, char *s) { 180 printf("%p", p); // no-warning 181 printf("%p", 123); // expected-warning{{conversion specifies type 'void *' but the argument has type 'int'}} 182 printf("%.4p", p); // expected-warning{{precision used with 'p' conversion specifier, resulting in undefined behavior}} 183 printf("%+p", p); // expected-warning{{flag '+' results in undefined behavior with 'p' conversion specifier}} 184 printf("% p", p); // expected-warning{{flag ' ' results in undefined behavior with 'p' conversion specifier}} 185 printf("%0p", p); // expected-warning{{flag '0' results in undefined behavior with 'p' conversion specifier}} 186 printf("%s", s); // no-warning 187 printf("%+s", p); // expected-warning{{flag '+' results in undefined behavior with 's' conversion specifier}} 188 printf("% s", p); // expected-warning{{flag ' ' results in undefined behavior with 's' conversion specifier}} 189 printf("%0s", p); // expected-warning{{flag '0' results in undefined behavior with 's' conversion specifier}} 190} 191 192void test12(char *b) { 193 unsigned char buf[4]; 194 printf ("%.4s\n", buf); // no-warning 195 printf ("%.4s\n", &buf); // expected-warning{{conversion specifies type 'char *' but the argument has type 'unsigned char (*)[4]'}} 196 197 // Verify that we are checking asprintf 198 asprintf(&b, "%d", "asprintf"); // expected-warning{{conversion specifies type 'int' but the argument has type 'char *'}} 199} 200 201typedef struct __aslclient *aslclient; 202typedef struct __aslmsg *aslmsg; 203int asl_log(aslclient asl, aslmsg msg, int level, const char *format, ...) __attribute__((__format__ (__printf__, 4, 5))); 204void test_asl(aslclient asl) { 205 // Test case from <rdar://problem/7341605>. 206 asl_log(asl, 0, 3, "Error: %m"); // no-warning 207 asl_log(asl, 0, 3, "Error: %W"); // expected-warning{{invalid conversion specifier 'W'}} 208} 209 210// <rdar://problem/7595366> 211typedef enum { A } int_t; 212void f0(int_t x) { printf("%d\n", x); } 213 214// Unicode test cases. These are possibly specific to Mac OS X. If so, they should 215// eventually be moved into a separate test. 216typedef __WCHAR_TYPE__ wchar_t; 217 218void test_unicode_conversions(wchar_t *s) { 219 printf("%S", s); // no-warning 220 printf("%s", s); // expected-warning{{conversion specifies type 'char *' but the argument has type 'wchar_t *'}} 221 printf("%C", s[0]); // no-warning 222 printf("%c", s[0]); 223 // FIXME: This test reports inconsistent results. On Windows, '%C' expects 224 // 'unsigned short'. 225 // printf("%C", 10); 226 // FIXME: we report the expected type as 'int*' instead of 'wchar_t*' 227 printf("%S", "hello"); // expected-warning{{but the argument has type 'char *'}} 228} 229 230// Mac OS X supports positional arguments in format strings. 231// This is an IEEE extension (IEEE Std 1003.1). 232// FIXME: This is probably not portable everywhere. 233void test_positional_arguments() { 234 printf("%0$", (int)2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}} 235 printf("%1$*0$d", (int) 2); // expected-warning{{position arguments in format strings start counting at 1 (not 0)}} 236 printf("%1$d", (int) 2); // no-warning 237 printf("%1$d", (int) 2, 2); // expected-warning{{data argument not used by format string}} 238 printf("%1$d%1$f", (int) 2); // expected-warning{{conversion specifies type 'double' but the argument has type 'int'}} 239 printf("%1$2.2d", (int) 2); // no-warning 240 printf("%2$*1$.2d", (int) 2, (int) 3); // no-warning 241 printf("%2$*8$d", (int) 2, (int) 3); // expected-warning{{specified field width is missing a matching 'int' argument}} 242 printf("%%%1$d", (int) 2); // no-warning 243 printf("%1$d%%", (int) 2); // no-warning 244} 245 246// PR 6697 - Handle format strings where the data argument is not adjacent to the format string 247void myprintf_PR_6697(const char *format, int x, ...) __attribute__((__format__(printf,1, 3))); 248void test_pr_6697() { 249 myprintf_PR_6697("%s\n", 1, "foo"); // no-warning 250 myprintf_PR_6697("%s\n", 1, (int)0); // expected-warning{{conversion specifies type 'char *' but the argument has type 'int'}} 251 // FIXME: Not everything should clearly support positional arguments, 252 // but we need a way to identify those cases. 253 myprintf_PR_6697("%1$s\n", 1, "foo"); // no-warning 254 myprintf_PR_6697("%2$s\n", 1, "foo"); // expected-warning{{data argument position '2' exceeds the number of data arguments (1)}} 255 myprintf_PR_6697("%18$s\n", 1, "foo"); // expected-warning{{data argument position '18' exceeds the number of data arguments (1)}} 256 myprintf_PR_6697("%1$s\n", 1, (int) 0); // expected-warning{{conversion specifies type 'char *' but the argument has type 'int'}} 257} 258 259void rdar8026030(FILE *fp) { 260 fprintf(fp, "\%"); // expected-warning{{incomplete format specifier}} 261} 262 263void bug7377_bad_length_mod_usage() { 264 // Bad length modifiers 265 printf("%hhs", "foo"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}} 266 printf("%1$zp", (void *)0); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}} 267 printf("%ls", L"foo"); // no-warning 268 printf("%#.2Lf", (long double)1.234); // no-warning 269 270 // Bad flag usage 271 printf("%#p", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'p' conversion specifier}} 272 printf("%0d", -1); // no-warning 273 printf("%#n", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'n' conversion specifier}} expected-warning{{use of '%n' in format string discouraged (potentially insecure)}} 274 printf("%-n", (void *) 0); // expected-warning{{flag '-' results in undefined behavior with 'n' conversion specifier}} expected-warning{{use of '%n' in format string discouraged (potentially insecure)}} 275 printf("%-p", (void *) 0); // no-warning 276 277 // Bad optional amount use 278 printf("%.2c", 'a'); // expected-warning{{precision used with 'c' conversion specifier, resulting in undefined behavior}} 279 printf("%1n", (void *) 0); // expected-warning{{field width used with 'n' conversion specifier, resulting in undefined behavior}} expected-warning{{use of '%n' in format string discouraged (potentially insecure)}} 280 printf("%.9n", (void *) 0); // expected-warning{{precision used with 'n' conversion specifier, resulting in undefined behavior}} expected-warning{{use of '%n' in format string discouraged (potentially insecure)}} 281 282 // Ignored flags 283 printf("% +f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}} 284 printf("%+ f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}} 285 printf("%0-f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}} 286 printf("%-0f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}} 287 printf("%-+f", 1.23); // no-warning 288} 289 290// PR 7981 - handle '%lc' (wint_t) 291#ifndef wint_t 292typedef int __darwin_wint_t; 293typedef __darwin_wint_t wint_t; 294#endif 295 296void pr7981(wint_t c, wchar_t c2) { 297 printf("%lc", c); // no-warning 298 printf("%lc", 1.0); // expected-warning{{the argument has type 'double'}} 299 printf("%lc", (char) 1); // no-warning 300 printf("%lc", &c); // expected-warning{{the argument has type 'wint_t *' (aka 'int *')}} 301 printf("%lc", c2); // no-warning 302} 303 304// <rdar://problem/8269537> -Wformat-security says NULL is not a string literal 305void r8269537() { 306 // This is likely to crash in most cases, but -Wformat-nonliteral technically 307 // doesn't warn in this case. 308 printf(0); // no-warning 309} 310 311