[clang] Remove rdar links; NFC

We have a new policy in place making links to private resources
something we try to avoid in source and test files. Normally, we'd
organically switch to the new policy

[clang] Remove rdar links; NFC

We have a new policy in place making links to private resources
something we try to avoid in source and test files. Normally, we'd
organically switch to the new policy rather than make a sweeping change
across a project. However, Clang is in a somewhat special circumstance
currently: recently, I've had several new contributors run into rdar
links around test code which their patch was changing the behavior of.
This turns out to be a surprisingly bad experience, especially for
newer folks, for a handful of reasons: not understanding what the link
is and feeling intimidated by it, wondering whether their changes are
actually breaking something important to a downstream in some way,
having to hunt down strangers not involved with the patch to impose on
them for help, accidental pressure from asking for potentially private
IP to be made public, etc. Because folks run into these links entirely
by chance (through fixing bugs or working on new features), there's not
really a set of problematic links to focus on -- all of the links have
basically the same potential for causing these problems. As a result,
this is an omnibus patch to remove all such links.

This was not a mechanical change; it was done by manually searching for
rdar, radar, radr, and other variants to find all the various
problematic links. From there, I tried to retain or reword the
surrounding comments so that we would lose as little context as
possible. However, because most links were just a plain link with no
supporting context, the majority of the changes are simple removals.

Differential Review: https://reviews.llvm.org/D158071

show more ...

[clang][Sema] Add truncation warning on fortified snprintf

This patch warns on snprintf calls whose n argument is known to be smaller than the size of the formatted string like

```
char buf[5];
snp

[clang][Sema] Add truncation warning on fortified snprintf

This patch warns on snprintf calls whose n argument is known to be smaller than the size of the formatted string like

```
char buf[5];
snprintf(buf, 5, "Hello");
```
This is a counterpart of gcc's Wformat-truncation
Fixes https://github.com/llvm/llvm-project/issues/64871

Reviewed By: aaron.ballman, nickdesaulniers
Differential Revision: https://reviews.llvm.org/D158562

show more ...

Revert "Remove rdar links; NFC"

This reverts commit d618f1c3b12effd0c2bdb7d02108d3551f389d3d.
This commit wasn't reviewed ahead of time and significant concerns were
raised immediately after it land

Revert "Remove rdar links; NFC"

This reverts commit d618f1c3b12effd0c2bdb7d02108d3551f389d3d.
This commit wasn't reviewed ahead of time and significant concerns were
raised immediately after it landed. According to our developer policy
this warrants immediate revert of the commit.

https://llvm.org/docs/DeveloperPolicy.html#patch-reversion-policy

Differential Revision: https://reviews.llvm.org/D155509

show more ...

Remove rdar links; NFC

This removes links to rdar, which is an internal bug tracker that the
community doesn't have visibility into.

See further discussion at:
https://discourse.llvm.org/t/code-rev

Remove rdar links; NFC

This removes links to rdar, which is an internal bug tracker that the
community doesn't have visibility into.

See further discussion at:
https://discourse.llvm.org/t/code-review-reminder-about-links-in-code-commit-messages/71847

show more ...

[Sema] -Wformat: recognize %lb for the printf/scanf family of functions

Fix https://github.com/llvm/llvm-project/issues/62247

D131057 added `bArg` and `BArg` in the `AsLongLong` label in
`FormatSpe

[Sema] -Wformat: recognize %lb for the printf/scanf family of functions

Fix https://github.com/llvm/llvm-project/issues/62247

D131057 added `bArg` and `BArg` in the `AsLongLong` label in
`FormatSpecifier::hasValidLengthModifier`, but missed the `AsLong` label,
therefore `%llb` is allowed while `%lb` (e.g. `printf("%lb", (long)10)`) has a
spurious warning. Add the missing case labels.

Reviewed By: aaron.ballman, enh

Differential Revision: https://reviews.llvm.org/D148779

show more ...

[clang][Sema] check default argument promotions for printf

The main focus of this patch is to make ArgType::matchesType check for
possible default parameter promotions when the argType is not a poin

[clang][Sema] check default argument promotions for printf

The main focus of this patch is to make ArgType::matchesType check for
possible default parameter promotions when the argType is not a pointer.
If so, no warning will be given for `int`, `unsigned int` types as
corresponding arguments to %hhd and %hd. However, the usage of %hhd
corresponding to short is relatively rare, and it is more likely to be a
misuse. This patch keeps the original behavior of clang like this as
much as possible, while making it more convenient to consider the
default arguments promotion.

Fixes https://github.com/llvm/llvm-project/issues/57102

Reviewed By: aaron.ballman, nickdesaulniers, #clang-language-wg

Differential Revision: https://reviews.llvm.org/D132568

show more ...

[Sema] -Wformat: support C23 format specifier %b %B

Close #56885: WG14 N2630 added %b to fprintf/fscanf and recommended %B for
fprintf. This patch teaches -Wformat %b for the printf/scanf family of

[Sema] -Wformat: support C23 format specifier %b %B

Close #56885: WG14 N2630 added %b to fprintf/fscanf and recommended %B for
fprintf. This patch teaches -Wformat %b for the printf/scanf family of functions
and %B for the printf family of functions.

glibc 2.35 and latest Android bionic added %b/%B printf support. From
https://www.openwall.com/lists/libc-coord/2022/07/ no scanf support is available
yet.

Like GCC, we don't test library support.

GCC 12 -Wformat -pedantic emits a warning:

> warning: ISO C17 does not support the ‘%b’ gnu_printf format [-Wformat=]

The behavior is not ported.

Note: `freebsd_kernel_printf` uses %b differently.

Reviewed By: aaron.ballman, dim, enh

Differential Revision: https://reviews.llvm.org/D131057

show more ...

Strengthen -Wint-conversion to default to an error

Clang has traditionally allowed C programs to implicitly convert
integers to pointers and pointers to integers, despite it not being
valid to do so

Strengthen -Wint-conversion to default to an error

Clang has traditionally allowed C programs to implicitly convert
integers to pointers and pointers to integers, despite it not being
valid to do so except under special circumstances (like converting the
integer 0, which is the null pointer constant, to a pointer). In C89,
this would result in undefined behavior per 3.3.4, and in C99 this rule
was strengthened to be a constraint violation instead. Constraint
violations are most often handled as an error.

This patch changes the warning to default to an error in all C modes
(it is already an error in C++). This gives us better security posture
by calling out potential programmer mistakes in code but still allows
users who need this behavior to use -Wno-error=int-conversion to retain
the warning behavior, or -Wno-int-conversion to silence the diagnostic
entirely.

Differential Revision: https://reviews.llvm.org/D129881

show more ...

Allow non-variadic functions to be attributed with `__attribute__((format))`

Clang only allows you to use __attribute__((format)) on variadic functions. There are legit use cases for __attribute__((

Allow non-variadic functions to be attributed with `__attribute__((format))`

Clang only allows you to use __attribute__((format)) on variadic functions. There are legit use cases for __attribute__((format)) on non-variadic functions, such as:

(1) variadic templates

```c++
template<typename… Args>
void print(const char *fmt, Args… &&args) __attribute__((format(1, 2))); // error: format attribute requires variadic function
```

(2) functions which take fixed arguments and a custom format:

```c++
void print_number_string(const char *fmt, unsigned number, const char *string) __attribute__((format(1, 2)));
// ^error: format attribute requires variadic function

void foo(void) {
print_number_string(“%08x %s\n”, 0xdeadbeef, “hello”);
print_number_string(“%d %s”, 0xcafebabe, “bar”);
}
```

This change allows Clang users to attach __attribute__((format)) to non-variadic functions, including functions with C++ variadic templates. It replaces the error with a GCC compatibility warning and improves the type checker to ensure that received arrays are treated like pointers (this is a possibility in C++ since references to template types can bind to arrays).

Reviewed By: aaron.ballman
Differential Revision: https://reviews.llvm.org/D112579
rdar://84629099

show more ...

Use functions with prototypes when appropriate; NFC

A significant number of our tests in C accidentally use functions
without prototypes. This patch converts the function signatures to have
a protot

Use functions with prototypes when appropriate; NFC

A significant number of our tests in C accidentally use functions
without prototypes. This patch converts the function signatures to have
a prototype for the situations where the test is not specific to K&R C
declarations. e.g.,

void func();

becomes

void func(void);

This is the second batch of tests being updated (there are a significant
number of other tests left to be updated).

show more ...

[Sema] Warn about printf %n on Android and Fuchsia

The `printf` specifier `%n` is not supported on Android's libc and will soon be removed from Fuchsia's

Reviewed By: enh

Differential Revision: ht

[Sema] Warn about printf %n on Android and Fuchsia

The `printf` specifier `%n` is not supported on Android's libc and will soon be removed from Fuchsia's

Reviewed By: enh

Differential Revision: https://reviews.llvm.org/D117611

show more ...

[Sema] Recognize format argument indicated by format attribute inside blocks

- `[[format(archetype, fmt-idx, ellipsis)]]` specifies that a function accepts a
format string and arguments according

[Sema] Recognize format argument indicated by format attribute inside blocks

- `[[format(archetype, fmt-idx, ellipsis)]]` specifies that a function accepts a
format string and arguments according to `archetype`. This is how Clang
type-checks `printf` arguments based on the format string.
- Clang has a `-Wformat-nonliteral` warning that is triggered when a function
with the `format` attribute is called with a format string that is not
inspectable because it isn't constant. This warning is suppressed if the
caller has the `format` attribute itself and the format argument to the callee
is the caller's own format parameter.
- When using the `format` attribute on a block, Clang wouldn't recognize its
format parameter when calling another function with the format attribute. This
would cause unsuppressed -Wformat-nonliteral warnings for no supported reason.

Reviewed By: ahatanak

Differential Revision: https://reviews.llvm.org/D112569

Radar-Id: rdar://84603673

show more ...

[Sema] Emit a -Wformat warning for printf("%s", (void*)p)

Its dangerous to assume that the opaque pointer points to a null-terminated
string, and this has an easy fix (casting to char*).

rdar://624

[Sema] Emit a -Wformat warning for printf("%s", (void*)p)

Its dangerous to assume that the opaque pointer points to a null-terminated
string, and this has an easy fix (casting to char*).

rdar://62432331

show more ...

[Sema] Don't warn on printf('%hd', [char]) (PR41467)

Summary: Link: https://bugs.llvm.org/show_bug.cgi?id=41467

Reviewers: rsmith, nickdesaulniers, aaron.ballman, lebedev.ri

Reviewed By: nickdesau

[Sema] Don't warn on printf('%hd', [char]) (PR41467)

Summary: Link: https://bugs.llvm.org/show_bug.cgi?id=41467

Reviewers: rsmith, nickdesaulniers, aaron.ballman, lebedev.ri

Reviewed By: nickdesaulniers, aaron.ballman, lebedev.ri

Subscribers: lebedev.ri, nickdesaulniers, cfe-commits

Tags: #clang

Differential Revision: https://reviews.llvm.org/D66186

llvm-svn: 369791

show more ...

Clang :: Sema/wchar.c has long been failing on Solaris:

error: 'error' diagnostics expected but not seen:
File /vol/llvm/src/clang/local/test/Sema/wchar.c Line 22: initializing wide char arra

Clang :: Sema/wchar.c has long been failing on Solaris:

error: 'error' diagnostics expected but not seen:
File /vol/llvm/src/clang/local/test/Sema/wchar.c Line 22: initializing wide char array with non-wide string literal
error: 'error' diagnostics seen but not expected:
File /vol/llvm/src/clang/local/test/Sema/wchar.c Line 20: array initializer must be an initializer list
File /vol/llvm/src/clang/local/test/Sema/wchar.c Line 22: array initializer must be an initializer list

It turns out the definition is wrong, as can be seen in GCC's gcc/config/sol2.h:

/* wchar_t is called differently in <wchar.h> for 32 and 64-bit
compilations. This is called for by SCD 2.4.1, p. 6-83, Figure 6-65
(32-bit) and p. 6P-10, Figure 6.38 (64-bit). */

#undef WCHAR_TYPE
#define WCHAR_TYPE (TARGET_64BIT ? "int" : "long int")

The following patch implements this, and at the same time corrects the wint_t
definition which is the same:

/* Same for wint_t. See SCD 2.4.1, p. 6-83, Figure 6-66 (32-bit). There's
no corresponding 64-bit definition, but this is what Solaris 8
<iso/wchar_iso.h> uses. */

#undef WINT_TYPE
#define WINT_TYPE (TARGET_64BIT ? "int" : "long int")

Clang :: Preprocessor/wchar_t.c and Clang :: Sema/format-strings.c need to
be adjusted to account for that.

Tested on i386-pc-solaris2.11, x86_64-pc-solaris2.11, and x86_64-pc-linux-gnu.

Differential Revision: https://reviews.llvm.org/D62944

llvm-svn: 363612

show more ...

OpenCL: Use length modifier for warning on vector printf arguments

Re-enable format string warnings on printf.

The warnings are still incomplete. Apparently it is undefined to use a
vector specifie

OpenCL: Use length modifier for warning on vector printf arguments

Re-enable format string warnings on printf.

The warnings are still incomplete. Apparently it is undefined to use a
vector specifier without a length modifier, which is not currently
warned on. Additionally, type warnings appear to not be working with
the hh modifier, and aren't warning on all of the special restrictions
from c99 printf.

llvm-svn: 352540

show more ...

OpenCL: Don't warn on v printf modifier

This avoids spurious warnings, but could use
a lot of work. For example the number of vector
elements is not verified, and the passed
value type is not checke

OpenCL: Don't warn on v printf modifier

This avoids spurious warnings, but could use
a lot of work. For example the number of vector
elements is not verified, and the passed
value type is not checked.

Fixes bug 39486

llvm-svn: 346806

show more ...

test: actually fix the condition properly

I had locally changed the test to add an explicit triple to figure out the issue
with the SCEI buildbots, and that hid the error. This now works with and
w

test: actually fix the condition properly

I had locally changed the test to add an explicit triple to figure out the issue
with the SCEI buildbots, and that hid the error. This now works with and
without the explicit triple.

llvm-svn: 342581

show more ...

test: improve condition for the check

When the type of `wint_t` is `int`, the promotion will allow this to pass.
Check this explicitly rather than using the size.

llvm-svn: 342569

Sema: handle `wint_t` more carefully for printf checking

In the case that `win_t` is an `unsigned short` (e.g. on Windows), we would
previously incorrectly diagnose the conversion because we would i

Sema: handle `wint_t` more carefully for printf checking

In the case that `win_t` is an `unsigned short` (e.g. on Windows), we would
previously incorrectly diagnose the conversion because we would immediately
promote the argument type from `wint_t` (aka `unsigned short`) to `int` before
checking if the type matched. This should repair the Windows hosted bots.

llvm-svn: 342565

show more ...

Fix printf specifier handling: invalid specifier should not be marked as "consuming data arguments"

Reviewers: rsmith, bruno, dexonsmith

Subscribers: cfe-commits

Differential Revision: https://rev

Fix printf specifier handling: invalid specifier should not be marked as "consuming data arguments"

Reviewers: rsmith, bruno, dexonsmith

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D27796

llvm-svn: 289850

show more ...

[Sema] Fix PR30481: crash on checking printf args.

We were falling through from one case to another in a switch statement.
Oops.

llvm-svn: 282124

Do not warn about format strings that are indexed string literals.

Summary:
The warning for a format string not being a string literal and therefore
being potentially insecure is overly strict for i

Do not warn about format strings that are indexed string literals.

Summary:
The warning for a format string not being a string literal and therefore
being potentially insecure is overly strict for indices into string
literals. This fix checks if the index into the string literal is
precomputable. If that's the case it will check if the suffix of that
string literal is a valid format string string literal. It will still
issue the aforementioned warning for out of range indices into the
string literal.

Patch by Meike Baumgärtner (meikeb)

Reviewers: rsmith

Subscribers: srhines, cfe-commits

Differential Revision: https://reviews.llvm.org/D24584

llvm-svn: 281686

show more ...

Revert "Do not warn about format strings that are indexed string literals."

Summary: This reverts r281527 because I messed up the attribution.

Reviewers: srhines

Subscribers: cfe-commits

Differen

Revert "Do not warn about format strings that are indexed string literals."

Summary: This reverts r281527 because I messed up the attribution.

Reviewers: srhines

Subscribers: cfe-commits

Differential Revision: https://reviews.llvm.org/D24579

llvm-svn: 281530

show more ...

Do not warn about format strings that are indexed string literals.

Summary:
The warning for a format string not being a sting literal and therefore
being potentially insecure is overly strict for in

Do not warn about format strings that are indexed string literals.

Summary:
The warning for a format string not being a sting literal and therefore
being potentially insecure is overly strict for indecies into sting
literals. This fix checks if the index into the string literal is
precomputable. If thats the case it will check if the suffix of that
sting literal is a valid format string string literal. It will still
issue the aforementioned warning for out of range indecies into the
string literal.

Reviewers: rsmith

Subscribers: srhines, cfe-commits

Differential Revision: https://reviews.llvm.org/D23820

llvm-svn: 281527

show more ...