1*f4a2713aSLionel Sambuc // RUN: %clang_cc1 -Wstrncat-size -verify -fsyntax-only %s
2*f4a2713aSLionel Sambuc // RUN: %clang_cc1 -DUSE_BUILTINS -Wstrncat-size -verify -fsyntax-only %s
3*f4a2713aSLionel Sambuc // RUN: %clang_cc1 -fsyntax-only -Wstrncat-size -fixit -x c %s
4*f4a2713aSLionel Sambuc // RUN: %clang_cc1 -DUSE_BUILTINS -fsyntax-only -Wstrncat-size -fixit -x c %s
5*f4a2713aSLionel Sambuc
6*f4a2713aSLionel Sambuc typedef __SIZE_TYPE__ size_t;
7*f4a2713aSLionel Sambuc size_t strlen (const char *s);
8*f4a2713aSLionel Sambuc
9*f4a2713aSLionel Sambuc #ifdef USE_BUILTINS
10*f4a2713aSLionel Sambuc # define BUILTIN(f) __builtin_ ## f
11*f4a2713aSLionel Sambuc #else
12*f4a2713aSLionel Sambuc # define BUILTIN(f) f
13*f4a2713aSLionel Sambuc #endif
14*f4a2713aSLionel Sambuc
15*f4a2713aSLionel Sambuc #define strncat BUILTIN(strncat)
16*f4a2713aSLionel Sambuc char *strncat(char *restrict s1, const char *restrict s2, size_t n);
17*f4a2713aSLionel Sambuc
18*f4a2713aSLionel Sambuc struct {
19*f4a2713aSLionel Sambuc char f1[100];
20*f4a2713aSLionel Sambuc char f2[100][3];
21*f4a2713aSLionel Sambuc } s4, **s5;
22*f4a2713aSLionel Sambuc
23*f4a2713aSLionel Sambuc char s1[100];
24*f4a2713aSLionel Sambuc char s2[200];
25*f4a2713aSLionel Sambuc int x;
26*f4a2713aSLionel Sambuc
test(char * src)27*f4a2713aSLionel Sambuc void test(char *src) {
28*f4a2713aSLionel Sambuc char dest[10];
29*f4a2713aSLionel Sambuc
30*f4a2713aSLionel Sambuc strncat(dest, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAA", sizeof(dest) - strlen(dest) - 1); // no-warning
31*f4a2713aSLionel Sambuc strncat(dest, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAA", sizeof(dest) - 1); // no-warning - the code might assume that dest is empty
32*f4a2713aSLionel Sambuc
33*f4a2713aSLionel Sambuc strncat(dest, src, sizeof(src)); // expected-warning {{size argument in 'strncat' call appears to be size of the source}} expected-note {{change the argument to be the free space in the destination buffer minus the terminating null byte}}
34*f4a2713aSLionel Sambuc
35*f4a2713aSLionel Sambuc strncat(dest, src, sizeof(src) - 1); // expected-warning {{size argument in 'strncat' call appears to be size of the source}} expected-note {{change the argument to be the free space in the destination buffer minus the terminating null byte}}
36*f4a2713aSLionel Sambuc
37*f4a2713aSLionel Sambuc strncat(dest, "AAAAAAAAAAAAAAAAAAAAAAAAAAA", sizeof(dest)); // expected-warning{{the value of the size argument in 'strncat' is too large, might lead to a buffer overflow}} expected-note {{change the argument to be the free space in the destination buffer minus the terminating null byte}}
38*f4a2713aSLionel Sambuc
39*f4a2713aSLionel Sambuc strncat(dest, "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", sizeof(dest) - strlen(dest)); // expected-warning{{the value of the size argument in 'strncat' is too large, might lead to a buffer overflow}} expected-note {{change the argument to be the free space in the destination buffer minus the terminating null byte}}
40*f4a2713aSLionel Sambuc
41*f4a2713aSLionel Sambuc strncat((*s5)->f2[x], s2, sizeof(s2)); // expected-warning {{size argument in 'strncat' call appears to be size of the source}} expected-note {{change the argument to be the free space in the destination buffer minus the terminating null byte}}
42*f4a2713aSLionel Sambuc strncat(s1+3, s2, sizeof(s2)); // expected-warning {{size argument in 'strncat' call appears to be size of the source}}
43*f4a2713aSLionel Sambuc strncat(s4.f1, s2, sizeof(s2)); // expected-warning {{size argument in 'strncat' call appears to be size of the source}} expected-note {{change the argument to be the free space in the destination buffer minus the terminating null byte}}
44*f4a2713aSLionel Sambuc }
45*f4a2713aSLionel Sambuc
46*f4a2713aSLionel Sambuc // Don't issue FIXIT for flexible arrays.
47*f4a2713aSLionel Sambuc struct S {
48*f4a2713aSLionel Sambuc int y;
49*f4a2713aSLionel Sambuc char x[];
50*f4a2713aSLionel Sambuc };
51*f4a2713aSLionel Sambuc
flexible_arrays(struct S * s)52*f4a2713aSLionel Sambuc void flexible_arrays(struct S *s) {
53*f4a2713aSLionel Sambuc char str[] = "hi";
54*f4a2713aSLionel Sambuc strncat(s->x, str, sizeof(str)); // expected-warning {{size argument in 'strncat' call appears to be size of the source}}
55*f4a2713aSLionel Sambuc }
56*f4a2713aSLionel Sambuc
57*f4a2713aSLionel Sambuc // Don't issue FIXIT for destinations of size 1.
size_1()58*f4a2713aSLionel Sambuc void size_1() {
59*f4a2713aSLionel Sambuc char z[1];
60*f4a2713aSLionel Sambuc char str[] = "hi";
61*f4a2713aSLionel Sambuc
62*f4a2713aSLionel Sambuc strncat(z, str, sizeof(z)); // expected-warning{{the value of the size argument to 'strncat' is wrong}}
63*f4a2713aSLionel Sambuc }
64*f4a2713aSLionel Sambuc
65*f4a2713aSLionel Sambuc // Support VLAs.
vlas(int size)66*f4a2713aSLionel Sambuc void vlas(int size) {
67*f4a2713aSLionel Sambuc char z[size];
68*f4a2713aSLionel Sambuc char str[] = "hi";
69*f4a2713aSLionel Sambuc
70*f4a2713aSLionel Sambuc strncat(z, str, sizeof(str)); // expected-warning {{size argument in 'strncat' call appears to be size of the source}} expected-note {{change the argument to be the free space in the destination buffer minus the terminating null byte}}
71*f4a2713aSLionel Sambuc }
72*f4a2713aSLionel Sambuc
73*f4a2713aSLionel Sambuc // Non-array type gets a different error message.
f(char * s,char * d)74*f4a2713aSLionel Sambuc void f(char* s, char* d) {
75*f4a2713aSLionel Sambuc strncat(d, s, sizeof(d)); // expected-warning {{the value of the size argument to 'strncat' is wrong}}
76*f4a2713aSLionel Sambuc }
77