1 // RUN: %clang_cc1 -fsyntax-only -verify -Wformat-nonliteral %s 2 3 #include <stdarg.h> 4 typedef __typeof(sizeof(int)) size_t; 5 typedef struct _FILE FILE; 6 int fprintf(FILE *, const char *restrict, ...); 7 int printf(const char *restrict, ...); 8 int snprintf(char *restrict, size_t, const char *restrict, ...); 9 int sprintf(char *restrict, const char *restrict, ...); 10 int vasprintf(char **, const char *, va_list); 11 int asprintf(char **, const char *, ...); 12 int vfprintf(FILE *, const char *restrict, va_list); 13 int vprintf(const char *restrict, va_list); 14 int vsnprintf(char *, size_t, const char *, va_list); 15 int vsprintf(char *restrict, const char *restrict, va_list); 16 17 char * global_fmt; 18 19 void check_string_literal( FILE* fp, const char* s, char *buf, ... ) { 20 21 char * b; 22 va_list ap; 23 va_start(ap,buf); 24 25 printf(s); // expected-warning {{format string is not a string literal}} 26 vprintf(s,ap); // // no-warning 27 fprintf(fp,s); // expected-warning {{format string is not a string literal}} 28 vfprintf(fp,s,ap); // no-warning 29 asprintf(&b,s); // expected-warning {{format string is not a string lit}} 30 vasprintf(&b,s,ap); // no-warning 31 sprintf(buf,s); // expected-warning {{format string is not a string literal}} 32 snprintf(buf,2,s); // expected-warning {{format string is not a string lit}} 33 __builtin___sprintf_chk(buf,0,-1,s); // expected-warning {{format string is not a string literal}} 34 __builtin___snprintf_chk(buf,2,0,-1,s); // expected-warning {{format string is not a string lit}} 35 vsprintf(buf,s,ap); // no-warning 36 vsnprintf(buf,2,s,ap); // no-warning 37 vsnprintf(buf,2,global_fmt,ap); // expected-warning {{format string is not a string literal}} 38 __builtin___vsnprintf_chk(buf,2,0,-1,s,ap); // no-warning 39 __builtin___vsnprintf_chk(buf,2,0,-1,global_fmt,ap); // expected-warning {{format string is not a string literal}} 40 41 // rdar://6079877 42 printf("abc" 43 "%*d", 1, 1); // no-warning 44 printf("abc\ 45 def" 46 "%*d", 1, 1); // no-warning 47 48 // <rdar://problem/6079850>, allow 'unsigned' (instead of 'int') to be used for both 49 // the field width and precision. This deviates from C99, but is reasonably safe 50 // and is also accepted by GCC. 51 printf("%*d", (unsigned) 1, 1); // no-warning 52 } 53 54 void check_conditional_literal(const char* s, int i) { 55 printf(i == 1 ? "yes" : "no"); // no-warning 56 printf(i == 0 ? (i == 1 ? "yes" : "no") : "dont know"); // no-warning 57 printf(i == 0 ? (i == 1 ? s : "no") : "dont know"); // expected-warning{{format string is not a string literal}} 58 printf("yes" ?: "no %d", 1); // expected-warning{{more data arguments than format specifiers}} 59 } 60 61 void check_writeback_specifier() 62 { 63 int x; 64 char *b; 65 66 printf("%n",&x); // expected-warning {{'%n' in format string discouraged}} 67 sprintf(b,"%d%%%n",1, &x); // expected-warning {{'%n' in format string dis}} 68 } 69 70 void check_invalid_specifier(FILE* fp, char *buf) 71 { 72 printf("%s%lb%d","unix",10,20); // expected-warning {{invalid conversion specifier 'b'}} 73 fprintf(fp,"%%%l"); // expected-warning {{incomplete format specifier}} 74 sprintf(buf,"%%%%%ld%d%d", 1, 2, 3); // expected-warning{{conversion specifies type 'long' but the argument has type 'int'}} 75 snprintf(buf, 2, "%%%%%ld%;%d", 1, 2, 3); // expected-warning{{conversion specifies type 'long' but the argument has type 'int'}} expected-warning {{invalid conversion specifier ';'}} 76 } 77 78 void check_null_char_string(char* b) 79 { 80 printf("\0this is bogus%d",1); // expected-warning {{string contains '\0'}} 81 snprintf(b,10,"%%%%%d\0%d",1,2); // expected-warning {{string contains '\0'}} 82 printf("%\0d",1); // expected-warning {{string contains '\0'}} 83 } 84 85 void check_empty_format_string(char* buf, ...) 86 { 87 va_list ap; 88 va_start(ap,buf); 89 vprintf("",ap); // expected-warning {{format string is empty}} 90 sprintf(buf,""); // expected-warning {{format string is empty}} 91 } 92 93 void check_wide_string(char* b, ...) 94 { 95 va_list ap; 96 va_start(ap,b); 97 98 printf(L"foo %d",2); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}} 99 vsprintf(b,L"bar %d",ap); // expected-warning {{incompatible pointer types}}, expected-warning {{should not be a wide string}} 100 } 101 102 void check_asterisk_precision_width(int x) { 103 printf("%*d"); // expected-warning {{'*' specified field width is missing a matching 'int' argument}} 104 printf("%.*d"); // expected-warning {{'.*' specified field precision is missing a matching 'int' argument}} 105 printf("%*d",12,x); // no-warning 106 printf("%*d","foo",x); // expected-warning {{field width should have type 'int', but argument has type 'char *'}} 107 printf("%.*d","foo",x); // expected-warning {{field precision should have type 'int', but argument has type 'char *'}} 108 } 109 110 void __attribute__((format(printf,1,3))) myprintf(const char*, int blah, ...); 111 112 void test_myprintf() { 113 myprintf("%d", 17, 18); // okay 114 } 115 116 void test_constant_bindings(void) { 117 const char * const s1 = "hello"; 118 const char s2[] = "hello"; 119 const char *s3 = "hello"; 120 char * const s4 = "hello"; 121 extern const char s5[]; 122 123 printf(s1); // no-warning 124 printf(s2); // no-warning 125 printf(s3); // expected-warning{{not a string literal}} 126 printf(s4); // expected-warning{{not a string literal}} 127 printf(s5); // expected-warning{{not a string literal}} 128 } 129 130 131 // Test what happens when -Wformat-security only. 132 #pragma GCC diagnostic ignored "-Wformat-nonliteral" 133 #pragma GCC diagnostic warning "-Wformat-security" 134 135 void test9(char *P) { 136 int x; 137 printf(P); // expected-warning {{format string is not a string literal (potentially insecure)}} 138 printf(P, 42); 139 printf("%n", &x); // expected-warning {{use of '%n' in format string discouraged }} 140 } 141 142 void torture(va_list v8) { 143 vprintf ("%*.*d", v8); // no-warning 144 145 } 146 147 void test10(int x, float f, int i) { 148 printf("%@", 12); // expected-warning{{invalid conversion specifier '@'}} 149 printf("\0"); // expected-warning{{format string contains '\0' within the string body}} 150 printf("xs\0"); // expected-warning{{format string contains '\0' within the string body}} 151 printf("%*d\n"); // expected-warning{{'*' specified field width is missing a matching 'int' argument}} 152 printf("%*.*d\n", x); // expected-warning{{'.*' specified field precision is missing a matching 'int' argument}} 153 printf("%*d\n", f, x); // expected-warning{{field width should have type 'int', but argument has type 'double'}} 154 printf("%*.*d\n", x, f, x); // expected-warning{{field precision should have type 'int', but argument has type 'double'}} 155 printf("%**\n"); // expected-warning{{invalid conversion specifier '*'}} 156 printf("%n", &i); // expected-warning{{use of '%n' in format string discouraged (potentially insecure)}} 157 printf("%d%d\n", x); // expected-warning{{more '%' conversions than data arguments}} 158 printf("%d\n", x, x); // expected-warning{{more data arguments than format specifiers}} 159 printf("%W%d%Z\n", x, x, x); // expected-warning{{invalid conversion specifier 'W'}} expected-warning{{invalid conversion specifier 'Z'}} 160 printf("%"); // expected-warning{{incomplete format specifier}} 161 printf("%.d", x); // no-warning 162 printf("%.", x); // expected-warning{{incomplete format specifier}} 163 } 164 165 typedef struct __aslclient *aslclient; 166 typedef struct __aslmsg *aslmsg; 167 int asl_log(aslclient asl, aslmsg msg, int level, const char *format, ...) __attribute__((__format__ (__printf__, 4, 5))); 168 void test_asl(aslclient asl) { 169 // Test case from <rdar://problem/7341605>. 170 asl_log(asl, 0, 3, "Error: %m"); // no-warning 171 asl_log(asl, 0, 3, "Error: %W"); // expected-warning{{invalid conversion specifier 'W'}} 172 } 173