xref: /netbsd-src/usr.bin/xlint/lint2/chk.c (revision 10ad5ffa714ce1a679dcc9dd8159648df2d67b5a)
1 /* $NetBSD: chk.c,v 1.20 2009/04/14 09:03:45 lukem Exp $ */
2 
3 /*
4  * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
5  * Copyright (c) 1994, 1995 Jochen Pohl
6  * All Rights Reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *      This product includes software developed by Jochen Pohl for
19  *	The NetBSD Project.
20  * 4. The name of the author may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #if HAVE_NBTOOL_CONFIG_H
36 #include "nbtool_config.h"
37 #endif
38 
39 #include <sys/cdefs.h>
40 #if defined(__RCSID) && !defined(lint)
41 __RCSID("$NetBSD: chk.c,v 1.20 2009/04/14 09:03:45 lukem Exp $");
42 #endif
43 
44 #include <ctype.h>
45 #include <limits.h>
46 #include <stdlib.h>
47 
48 #include "lint2.h"
49 
50 static	void	chkund(hte_t *);
51 static	void	chkdnu(hte_t *);
52 static	void	chkdnud(hte_t *);
53 static	void	chkmd(hte_t *);
54 static	void	chkvtui(hte_t *, sym_t *, sym_t *);
55 static	void	chkvtdi(hte_t *, sym_t *, sym_t *);
56 static	void	chkfaui(hte_t *, sym_t *, sym_t *);
57 static	void	chkau(hte_t *, int, sym_t *, sym_t *, pos_t *,
58 			   fcall_t *, fcall_t *, type_t *, type_t *);
59 static	void	chkrvu(hte_t *, sym_t *);
60 static	void	chkadecl(hte_t *, sym_t *, sym_t *);
61 static	void	printflike(hte_t *,fcall_t *, int, const char *, type_t **);
62 static	void	scanflike(hte_t *, fcall_t *, int, const char *, type_t **);
63 static	void	badfmt(hte_t *, fcall_t *);
64 static	void	inconarg(hte_t *, fcall_t *, int);
65 static	void	tofewarg(hte_t *, fcall_t *);
66 static	void	tomanyarg(hte_t *, fcall_t *);
67 static	int	eqtype(type_t *, type_t *, int, int, int, int *);
68 static	int	eqargs(type_t *, type_t *, int *);
69 static	int	mnoarg(type_t *, int *);
70 
71 
72 /*
73  * If there is a symbol named "main", mark it as used.
74  */
75 void
76 mainused(void)
77 {
78 	hte_t	*hte;
79 
80 	if ((hte = hsearch("main", 0)) != NULL)
81 		hte->h_used = 1;
82 }
83 
84 /*
85  * Performs all tests for a single name
86  */
87 void
88 chkname(hte_t *hte)
89 {
90 	sym_t	*sym, *def, *pdecl, *decl;
91 
92 	if (uflag) {
93 		chkund(hte);
94 		chkdnu(hte);
95 		if (xflag)
96 			chkdnud(hte);
97 	}
98 	chkmd(hte);
99 
100 	/* Get definition, prototype declaration and declaration */
101 	def = pdecl = decl = NULL;
102 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
103 		if (def == NULL && (sym->s_def == DEF || sym->s_def == TDEF))
104 			def = sym;
105 		if (pdecl == NULL && sym->s_def == DECL &&
106 		    TP(sym->s_type)->t_tspec == FUNC &&
107 		    TP(sym->s_type)->t_proto) {
108 			pdecl = sym;
109 		}
110 		if (decl == NULL && sym->s_def == DECL)
111 			decl = sym;
112 	}
113 
114 	/* A prototype is better than an old style declaration. */
115 	if (pdecl != NULL)
116 		decl = pdecl;
117 
118 	chkvtui(hte, def, decl);
119 
120 	chkvtdi(hte, def, decl);
121 
122 	chkfaui(hte, def, decl);
123 
124 	chkrvu(hte, def);
125 
126 	chkadecl(hte, def, decl);
127 }
128 
129 /*
130  * Print a warning if the name has been used, but not defined.
131  */
132 static void
133 chkund(hte_t *hte)
134 {
135 	fcall_t	*fcall;
136 	usym_t	*usym;
137 
138 	if (!hte->h_used || hte->h_def)
139 		return;
140 
141 	if ((fcall = hte->h_calls) != NULL) {
142 		/* %s used( %s ), but not defined */
143 		msg(0, hte->h_name, mkpos(&fcall->f_pos));
144 	} else if ((usym = hte->h_usyms) != NULL) {
145 		/* %s used( %s ), but not defined */
146 		msg(0, hte->h_name, mkpos(&usym->u_pos));
147 	}
148 }
149 
150 /*
151  * Print a warning if the name has been defined, but never used.
152  */
153 static void
154 chkdnu(hte_t *hte)
155 {
156 	sym_t	*sym;
157 
158 	if (!hte->h_def || hte->h_used)
159 		return;
160 
161 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
162 		if (sym->s_def == DEF || sym->s_def == TDEF) {
163 			/* %s defined( %s ), but never used */
164 			msg(1, hte->h_name, mkpos(&sym->s_pos));
165 			break;
166 		}
167 	}
168 }
169 
170 /*
171  * Print a warning if the variable has been declared, but is not used
172  * or defined.
173  */
174 static void
175 chkdnud(hte_t *hte)
176 {
177 	sym_t	*sym;
178 
179 	if (hte->h_syms == NULL || hte->h_used || hte->h_def)
180 		return;
181 
182 	sym = hte->h_syms;
183 	if (TP(sym->s_type)->t_tspec == FUNC)
184 		return;
185 
186 	if (sym->s_def != DECL)
187 		errx(1, "internal error: chkdnud() 1");
188 	/* %s declared( %s ), but never used or defined */
189 	msg(2, hte->h_name, mkpos(&sym->s_pos));
190 }
191 
192 /*
193  * Print a warning if there is more than one definition for
194  * this name.
195  */
196 static void
197 chkmd(hte_t *hte)
198 {
199 	sym_t	*sym, *def1;
200 	char	*pos1;
201 
202 	if (!hte->h_def)
203 		return;
204 
205 	def1 = NULL;
206 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
207 		/*
208 		 * ANSI C allows tentative definitions of the same name in
209 		 * only one compilation unit.
210 		 */
211 		if (sym->s_def != DEF && (!sflag || sym->s_def != TDEF))
212 			continue;
213 		if (def1 == NULL) {
214 			def1 = sym;
215 			continue;
216 		}
217 		pos1 = xstrdup(mkpos(&def1->s_pos));
218 		/* %s multiply defined\t%s  ::  %s */
219 		msg(3, hte->h_name, pos1, mkpos(&sym->s_pos));
220 		free(pos1);
221 	}
222 }
223 
224 /*
225  * Print a warning if the return value assumed for a function call
226  * differs from the return value of the function definition or
227  * function declaration.
228  *
229  * If no definition/declaration can be found, the assumed return values
230  * are always int. So there is no need to compare with another function
231  * call as it's done for function arguments.
232  */
233 static void
234 chkvtui(hte_t *hte, sym_t *def, sym_t *decl)
235 {
236 	fcall_t	*call;
237 	char	*pos1;
238 	type_t	*tp1, *tp2;
239 	int	dowarn, eq;
240 	tspec_t	t1;
241 
242 	if (hte->h_calls == NULL)
243 		return;
244 
245 	if (def == NULL)
246 		def = decl;
247 	if (def == NULL)
248 		return;
249 
250 	t1 = (tp1 = TP(def->s_type)->t_subt)->t_tspec;
251 	for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
252 		tp2 = TP(call->f_type)->t_subt;
253 		eq = eqtype(tp1, tp2, 1, 0, 0, (dowarn = 0, &dowarn));
254 		if (!call->f_rused) {
255 			/* no return value used */
256 			if ((t1 == STRUCT || t1 == UNION) && !eq) {
257 				/*
258 				 * If a function returns a struct or union it
259 				 * must be declared to return a struct or
260 				 * union, also if the return value is ignored.
261 				 * This is necessary because the caller must
262 				 * allocate stack space for the return value.
263 				 * If it does not, the return value would over-
264 				 * write other data.
265 				 * XXX Following massage may be confusing
266 				 * because it appears also if the return value
267 				 * was declared inconsistently. But this
268 				 * behaviour matches pcc based lint, so it is
269 				 * accepted for now.
270 				 */
271 				pos1 = xstrdup(mkpos(&def->s_pos));
272 				/* %s value must be decl. before use %s :: %s */
273 				msg(17, hte->h_name,
274 				    pos1, mkpos(&call->f_pos));
275 				free(pos1);
276 			}
277 			continue;
278 		}
279 		if (!eq || (sflag && dowarn)) {
280 			pos1 = xstrdup(mkpos(&def->s_pos));
281 			/* %s value used inconsistenty\t%s  ::  %s */
282 			msg(4, hte->h_name, pos1, mkpos(&call->f_pos));
283 			free(pos1);
284 		}
285 	}
286 }
287 
288 /*
289  * Print a warning if a definition/declaration does not match another
290  * definition/declaration of the same name. For functions, only the
291  * types of return values are tested.
292  */
293 static void
294 chkvtdi(hte_t *hte, sym_t *def, sym_t *decl)
295 {
296 	sym_t	*sym;
297 	type_t	*tp1, *tp2;
298 	int	eq, dowarn;
299 	char	*pos1;
300 
301 	if (def == NULL)
302 		def = decl;
303 	if (def == NULL)
304 		return;
305 
306 	tp1 = TP(def->s_type);
307 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
308 		type_t *xt1, *xt2;
309 		if (sym == def)
310 			continue;
311 		tp2 = TP(sym->s_type);
312 		dowarn = 0;
313 		if (tp1->t_tspec == FUNC && tp2->t_tspec == FUNC) {
314 			eq = eqtype(xt1 = tp1->t_subt, xt2 = tp2->t_subt,
315 			    1, 0, 0, &dowarn);
316 		} else {
317 			eq = eqtype(xt1 = tp1, xt2 = tp2, 0, 0, 0, &dowarn);
318 		}
319 		if (!eq || (sflag && dowarn)) {
320 			char b1[64], b2[64];
321 			pos1 = xstrdup(mkpos(&def->s_pos));
322 			/* %s value declared inconsistently\t%s  ::  %s */
323 			msg(5, hte->h_name, tyname(b1, sizeof(b1), xt1),
324 			    tyname(b2, sizeof(b2), xt2), pos1,
325 			    mkpos(&sym->s_pos));
326 			free(pos1);
327 		}
328 	}
329 }
330 
331 /*
332  * Print a warning if a function is called with arguments which does
333  * not match the function definition, declaration or another call
334  * of the same function.
335  */
336 static void
337 chkfaui(hte_t *hte, sym_t *def, sym_t *decl)
338 {
339 	type_t	*tp1, *tp2, **ap1, **ap2;
340 	pos_t	*pos1p = NULL;
341 	fcall_t	*calls, *call, *call1;
342 	int	n, as;
343 	char	*pos1;
344 	arginf_t *ai;
345 
346 	if ((calls = hte->h_calls) == NULL)
347 		return;
348 
349 	/*
350 	 * If we find a function definition, we use this for comparison,
351 	 * otherwise the first prototype we can find. If there is no
352 	 * definition or prototype declaration, the first function call
353 	 * is used.
354 	 */
355 	tp1 = NULL;
356 	call1 = NULL;
357 	if (def != NULL) {
358 		if ((tp1 = TP(def->s_type))->t_tspec != FUNC)
359 			return;
360 		pos1p = &def->s_pos;
361 	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
362 		if ((tp1 = TP(decl->s_type))->t_tspec != FUNC)
363 			return;
364 		pos1p = &decl->s_pos;
365 	}
366 	if (tp1 == NULL) {
367 		call1 = calls;
368 		calls = calls->f_nxt;
369 		if ((tp1 = TP(call1->f_type))->t_tspec != FUNC)
370 			return;
371 		pos1p = &call1->f_pos;
372 	}
373 
374 	n = 1;
375 	for (call = calls; call != NULL; call = call->f_nxt) {
376 		if ((tp2 = TP(call->f_type))->t_tspec != FUNC)
377 			continue;
378 		ap1 = tp1->t_args;
379 		ap2 = tp2->t_args;
380 		n = 0;
381 		while (*ap1 != NULL && *ap2 != NULL) {
382 			if (def != NULL && def->s_va && n >= def->s_nva)
383 				break;
384 			n++;
385 			chkau(hte, n, def, decl, pos1p, call1, call,
386 			      *ap1, *ap2);
387 			ap1++;
388 			ap2++;
389 		}
390 		if (*ap1 == *ap2) {
391 			/* equal # of arguments */
392 		} else if (def != NULL && def->s_va && n >= def->s_nva) {
393 			/*
394 			 * function definition with VARARGS; The # of
395 			 * arguments of the call must be at least as large
396 			 * as the parameter of VARARGS.
397 			 */
398 		} else if (*ap2 != NULL && tp1->t_proto && tp1->t_vararg) {
399 			/*
400 			 * prototype with ... and function call with
401 			 * at least the same # of arguments as declared
402 			 * in the prototype.
403 			 */
404 		} else {
405 			pos1 = xstrdup(mkpos(pos1p));
406 			/* %s: variable # of args\t%s  ::  %s */
407 			msg(7, hte->h_name, pos1, mkpos(&call->f_pos));
408 			free(pos1);
409 			continue;
410 		}
411 
412 		/* perform SCANFLIKE/PRINTFLIKE tests */
413 		if (def == NULL || (!def->s_prfl && !def->s_scfl))
414 			continue;
415 		as = def->s_prfl ? def->s_nprfl : def->s_nscfl;
416 		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
417 			if (ai->a_num == as)
418 				break;
419 		}
420 		if (ai == NULL || !ai->a_fmt)
421 			continue;
422 		if (def->s_prfl) {
423 			printflike(hte, call, n, ai->a_fstrg, ap2);
424 		} else {
425 			scanflike(hte, call, n, ai->a_fstrg, ap2);
426 		}
427 	}
428 }
429 
430 /*
431  * Check a single argument in a function call.
432  *
433  *  hte		a pointer to the hash table entry of the function
434  *  n		the number of the argument (1..)
435  *  def		the function definition or NULL
436  *  decl	prototype declaration, old style declaration or NULL
437  *  pos1p	position of definition, declaration of first call
438  *  call1	first call, if both def and decl are old style def/decl
439  *  call	checked call
440  *  arg1	currently checked argument of def/decl/call1
441  *  arg2	currently checked argument of call
442  *
443  */
444 static void
445 chkau(hte_t *hte, int n, sym_t *def, sym_t *decl, pos_t *pos1p,
446 	fcall_t *call1, fcall_t *call, type_t *arg1, type_t *arg2)
447 {
448 	int	promote, asgn, dowarn;
449 	tspec_t	t1, t2;
450 	arginf_t *ai, *ai1;
451 	char	*pos1;
452 	char	tyname1[64], tyname2[64];
453 
454 	/*
455 	 * If a function definition is available (def != NULL), we compair the
456 	 * function call (call) with the definition. Otherwise, if a function
457 	 * definition is available and it is not an old style definition
458 	 * (decl != NULL && TP(decl->s_type)->t_proto), we compair the call
459 	 * with this declaration. Otherwise we compair it with the first
460 	 * call we have found (call1).
461 	 */
462 
463 	/* arg1 must be promoted if it stems from an old style definition */
464 	promote = def != NULL && def->s_osdef;
465 
466 	/*
467 	 * If we compair with a definition or declaration, we must perform
468 	 * the same checks for qualifiers in indirected types as in
469 	 * assignments.
470 	 */
471 	asgn = def != NULL || (decl != NULL && TP(decl->s_type)->t_proto);
472 
473 	dowarn = 0;
474 	if (eqtype(arg1, arg2, 1, promote, asgn, &dowarn) && (!sflag || !dowarn))
475 		return;
476 
477 	/*
478 	 * Other lint implementations print warnings as soon as the type
479 	 * of an argument does not match exactly the expected type. The
480 	 * result are lots of warnings which are really not necessary.
481 	 * We print a warning only if
482 	 *   (0) at least one type is not an interger type and types differ
483 	 *   (1) hflag is set and types differ
484 	 *   (2) types differ, except in signedness
485 	 * If the argument is an integer constant whose msb is not set,
486 	 * signedness is ignored (e.g. 0 matches both signed and unsigned
487 	 * int). This is with and without hflag.
488 	 * If the argument is an integer constant with value 0 and the
489 	 * expected argument is of type pointer and the width of the
490 	 * interger constant is the same as the width of the pointer,
491 	 * no warning is printed.
492 	 */
493 	t1 = arg1->t_tspec;
494 	t2 = arg2->t_tspec;
495 	if (isityp(t1) && isityp(t2) && !arg1->t_isenum && !arg2->t_isenum) {
496 		if (promote) {
497 			/*
498 			 * XXX Here is a problem: Althrough it is possible to
499 			 * pass an int where a char/short it expected, there
500 			 * may be loss in significant digits. We should first
501 			 * check for const arguments if they can be converted
502 			 * into the original parameter type.
503 			 */
504 			if (t1 == FLOAT) {
505 				t1 = DOUBLE;
506 			} else if (t1 == CHAR || t1 == SCHAR) {
507 				t1 = INT;
508 			} else if (t1 == UCHAR) {
509 				t1 = tflag ? UINT : INT;
510 			} else if (t1 == SHORT) {
511 				t1 = INT;
512 			} else if (t1 == USHORT) {
513 				/* CONSTCOND */
514 				t1 = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
515 			}
516 		}
517 
518 		if (styp(t1) == styp(t2)) {
519 
520 			/*
521 			 * types differ only in signedness; get information
522 			 * about arguments
523 			 */
524 
525 			/*
526 			 * treat a definition like a call with variable
527 			 * arguments
528 			 */
529 			ai1 = call1 != NULL ? call1->f_args : NULL;
530 
531 			/*
532 			 * if two calls are compared, ai1 is set to the
533 			 * information for the n-th argument, if this was
534 			 * a constant, otherwise to NULL
535 			 */
536 			for ( ; ai1 != NULL; ai1 = ai1->a_nxt) {
537 				if (ai1->a_num == n)
538 					break;
539 			}
540 			/*
541 			 * ai is set to the information of the n-th arg
542 			 * of the (second) call, if this was a constant,
543 			 * otherwise to NULL
544 			 */
545 			for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
546 				if (ai->a_num == n)
547 					break;
548 			}
549 
550 			if (ai1 == NULL && ai == NULL) {
551 				/* no constant at all */
552 				if (!hflag)
553 					return;
554 			} else if (ai1 == NULL || ai == NULL) {
555 				/* one constant */
556 				if (ai == NULL)
557 					ai = ai1;
558 				if (ai->a_zero || ai->a_pcon)
559 					/* same value in signed and unsigned */
560 					return;
561 				/* value (not representation) differently */
562 			} else {
563 				/*
564 				 * two constants, one signed, one unsigned;
565 				 * if the msb of one of the constants is set,
566 				 * the argument is used inconsistently.
567 				 */
568 				if (!ai1->a_ncon && !ai->a_ncon)
569 					return;
570 			}
571 		}
572 
573 	} else if (t1 == PTR && isityp(t2)) {
574 		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
575 			if (ai->a_num == n)
576 				break;
577 		}
578 		/*
579 		 * Vendor implementations of lint (e.g. HP-UX, Digital UNIX)
580 		 * don't care about the size of the integer argument,
581 		 * only whether or not it is zero.  We do the same.
582 		 */
583 		if (ai != NULL && ai->a_zero)
584 			return;
585 	}
586 
587 	pos1 = xstrdup(mkpos(pos1p));
588 	/* %s, arg %d used inconsistently\t%s[%s]  ::  %s[%s] */
589 	msg(6, hte->h_name, n, pos1,
590 	    tyname(tyname1, sizeof(tyname1), arg1),
591 	    mkpos(&call->f_pos),
592 	    tyname(tyname2, sizeof(tyname2), arg2));
593 	free(pos1);
594 }
595 
596 /*
597  * Compare the types in the NULL-terminated array ap with the format
598  * string fmt.
599  */
600 static void
601 printflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
602 {
603 	const	char *fp;
604 	int	fc;
605 	int	fwidth, prec, left, sign, space, alt, zero;
606 	tspec_t	sz, t1, t2 = NOTSPEC;
607 	type_t	*tp;
608 
609 	fp = fmt;
610 	fc = *fp++;
611 
612 	for ( ; ; ) {
613 		if (fc == '\0') {
614 			if (*ap != NULL)
615 				tomanyarg(hte, call);
616 			break;
617 		}
618 		if (fc != '%') {
619 			badfmt(hte, call);
620 			break;
621 		}
622 		fc = *fp++;
623 		fwidth = prec = left = sign = space = alt = zero = 0;
624 		sz = NOTSPEC;
625 
626 		/* Flags */
627 		for ( ; ; ) {
628 			if (fc == '-') {
629 				if (left)
630 					break;
631 				left = 1;
632 			} else if (fc == '+') {
633 				if (sign)
634 					break;
635 				sign = 1;
636 			} else if (fc == ' ') {
637 				if (space)
638 					break;
639 				space = 1;
640 			} else if (fc == '#') {
641 				if (alt)
642 					break;
643 				alt = 1;
644 			} else if (fc == '0') {
645 				if (zero)
646 					break;
647 				zero = 1;
648 			} else {
649 				break;
650 			}
651 			fc = *fp++;
652 		}
653 
654 		/* field width */
655 		if (isdigit(fc)) {
656 			fwidth = 1;
657 			do { fc = *fp++; } while (isdigit(fc)) ;
658 		} else if (fc == '*') {
659 			fwidth = 1;
660 			fc = *fp++;
661 			if ((tp = *ap++) == NULL) {
662 				tofewarg(hte, call);
663 				break;
664 			}
665 			n++;
666 			if ((t1 = tp->t_tspec) != INT && (hflag || t1 != UINT))
667 				inconarg(hte, call, n);
668 		}
669 
670 		/* precision */
671 		if (fc == '.') {
672 			fc = *fp++;
673 			prec = 1;
674 			if (isdigit(fc)) {
675 				do { fc = *fp++; } while (isdigit(fc));
676 			} else if (fc == '*') {
677 				fc = *fp++;
678 				if ((tp = *ap++) == NULL) {
679 					tofewarg(hte, call);
680 					break;
681 				}
682 				n++;
683 				if (tp->t_tspec != INT)
684 					inconarg(hte, call, n);
685 			} else {
686 				badfmt(hte, call);
687 				break;
688 			}
689 		}
690 
691 		if (fc == 'h') {
692 			sz = SHORT;
693 		} else if (fc == 'l') {
694 			sz = LONG;
695 		} else if (fc == 'q') {
696 			sz = QUAD;
697 		} else if (fc == 'L') {
698 			sz = LDOUBLE;
699 		}
700 		if (sz != NOTSPEC)
701 			fc = *fp++;
702 
703 		if (fc == '%') {
704 			if (sz != NOTSPEC || left || sign || space ||
705 			    alt || zero || prec || fwidth) {
706 				badfmt(hte, call);
707 			}
708 			fc = *fp++;
709 			continue;
710 		}
711 
712 		if (fc == '\0') {
713 			badfmt(hte, call);
714 			break;
715 		}
716 
717 		if ((tp = *ap++) == NULL) {
718 			tofewarg(hte, call);
719 			break;
720 		}
721 		n++;
722 		if ((t1 = tp->t_tspec) == PTR)
723 			t2 = tp->t_subt->t_tspec;
724 
725 		if (fc == 'd' || fc == 'i') {
726 			if (alt || sz == LDOUBLE) {
727 				badfmt(hte, call);
728 				break;
729 			}
730 		int_conv:
731 			if (sz == LONG) {
732 				if (t1 != LONG && (hflag || t1 != ULONG))
733 					inconarg(hte, call, n);
734 			} else if (sz == QUAD) {
735 				if (t1 != QUAD && (hflag || t1 != UQUAD))
736 					inconarg(hte, call, n);
737 			} else {
738 				/*
739 				 * SHORT is always promoted to INT, USHORT
740 				 * to INT or UINT.
741 				 */
742 				if (t1 != INT && (hflag || t1 != UINT))
743 					inconarg(hte, call, n);
744 			}
745 		} else if (fc == 'o' || fc == 'u' || fc == 'x' || fc == 'X') {
746 			if ((alt && fc == 'u') || sz == LDOUBLE)
747 				badfmt(hte, call);
748 		uint_conv:
749 			if (sz == LONG) {
750 				if (t1 != ULONG && (hflag || t1 != LONG))
751 					inconarg(hte, call, n);
752 			} else if (sz == QUAD) {
753 				if (t1 != UQUAD && (hflag || t1 != QUAD))
754 					inconarg(hte, call, n);
755 			} else if (sz == SHORT) {
756 				/* USHORT was promoted to INT or UINT */
757 				if (t1 != UINT && t1 != INT)
758 					inconarg(hte, call, n);
759 			} else {
760 				if (t1 != UINT && (hflag || t1 != INT))
761 					inconarg(hte, call, n);
762 			}
763 		} else if (fc == 'D' || fc == 'O' || fc == 'U') {
764 			if ((alt && fc != 'O') || sz != NOTSPEC || !tflag)
765 				badfmt(hte, call);
766 			sz = LONG;
767 			if (fc == 'D') {
768 				goto int_conv;
769 			} else {
770 				goto uint_conv;
771 			}
772 		} else if (fc == 'f' || fc == 'e' || fc == 'E' ||
773 			   fc == 'g' || fc == 'G') {
774 			if (sz == NOTSPEC)
775 				sz = DOUBLE;
776 			if (sz != DOUBLE && sz != LDOUBLE)
777 				badfmt(hte, call);
778 			if (t1 != sz)
779 				inconarg(hte, call, n);
780 		} else if (fc == 'c') {
781 			if (sz != NOTSPEC || alt || zero)
782 				badfmt(hte, call);
783 			if (t1 != INT)
784 				inconarg(hte, call, n);
785 		} else if (fc == 's') {
786 			if (sz != NOTSPEC || alt || zero)
787 				badfmt(hte, call);
788 			if (t1 != PTR ||
789 			    (t2 != CHAR && t2 != UCHAR && t2 != SCHAR)) {
790 				inconarg(hte, call, n);
791 			}
792 		} else if (fc == 'p') {
793 			if (fwidth || prec || sz != NOTSPEC || alt || zero)
794 				badfmt(hte, call);
795 			if (t1 != PTR || (hflag && t2 != VOID))
796 				inconarg(hte, call, n);
797 		} else if (fc == 'n') {
798 			if (fwidth || prec || alt || zero || sz == LDOUBLE)
799 				badfmt(hte, call);
800 			if (t1 != PTR) {
801 				inconarg(hte, call, n);
802 			} else if (sz == LONG) {
803 				if (t2 != LONG && t2 != ULONG)
804 					inconarg(hte, call, n);
805 			} else if (sz == SHORT) {
806 				if (t2 != SHORT && t2 != USHORT)
807 					inconarg(hte, call, n);
808 			} else {
809 				if (t2 != INT && t2 != UINT)
810 					inconarg(hte, call, n);
811 			}
812 		} else {
813 			badfmt(hte, call);
814 			break;
815 		}
816 
817 		fc = *fp++;
818 	}
819 }
820 
821 /*
822  * Compare the types in the NULL-terminated array ap with the format
823  * string fmt.
824  */
825 static void
826 scanflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
827 {
828 	const	char *fp;
829 	int	fc;
830 	int	noasgn, fwidth;
831 	tspec_t	sz, t1 = NOTSPEC, t2 = NOTSPEC;
832 	type_t	*tp = NULL;
833 
834 	fp = fmt;
835 	fc = *fp++;
836 
837 	for ( ; ; ) {
838 		if (fc == '\0') {
839 			if (*ap != NULL)
840 				tomanyarg(hte, call);
841 			break;
842 		}
843 		if (fc != '%') {
844 			badfmt(hte, call);
845 			break;
846 		}
847 		fc = *fp++;
848 
849 		noasgn = fwidth = 0;
850 		sz = NOTSPEC;
851 
852 		if (fc == '*') {
853 			noasgn = 1;
854 			fc = *fp++;
855 		}
856 
857 		if (isdigit(fc)) {
858 			fwidth = 1;
859 			do { fc = *fp++; } while (isdigit(fc));
860 		}
861 
862 		if (fc == 'h') {
863 			sz = SHORT;
864 		} else if (fc == 'l') {
865 			sz = LONG;
866 		} else if (fc == 'q') {
867 			sz = QUAD;
868 		} else if (fc == 'L') {
869 			sz = LDOUBLE;
870 		}
871 		if (sz != NOTSPEC)
872 			fc = *fp++;
873 
874 		if (fc == '%') {
875 			if (sz != NOTSPEC || noasgn || fwidth)
876 				badfmt(hte, call);
877 			fc = *fp++;
878 			continue;
879 		}
880 
881 		if (!noasgn) {
882 			if ((tp = *ap++) == NULL) {
883 				tofewarg(hte, call);
884 				break;
885 			}
886 			n++;
887 			if ((t1 = tp->t_tspec) == PTR)
888 				t2 = tp->t_subt->t_tspec;
889 		}
890 
891 		if (fc == 'd' || fc == 'i' || fc == 'n') {
892 			if (sz == LDOUBLE)
893 				badfmt(hte, call);
894 			if (sz != SHORT && sz != LONG && sz != QUAD)
895 				sz = INT;
896 		conv:
897 			if (!noasgn) {
898 				if (t1 != PTR) {
899 					inconarg(hte, call, n);
900 				} else if (t2 != styp(sz)) {
901 					inconarg(hte, call, n);
902 				} else if (hflag && t2 != sz) {
903 					inconarg(hte, call, n);
904 				} else if (tp->t_subt->t_const) {
905 					inconarg(hte, call, n);
906 				}
907 			}
908 		} else if (fc == 'o' || fc == 'u' || fc == 'x') {
909 			if (sz == LDOUBLE)
910 				badfmt(hte, call);
911 			if (sz == SHORT) {
912 				sz = USHORT;
913 			} else if (sz == LONG) {
914 				sz = ULONG;
915 			} else if (sz == QUAD) {
916 				sz = UQUAD;
917 			} else {
918 				sz = UINT;
919 			}
920 			goto conv;
921 		} else if (fc == 'D') {
922 			if (sz != NOTSPEC || !tflag)
923 				badfmt(hte, call);
924 			sz = LONG;
925 			goto conv;
926 		} else if (fc == 'O') {
927 			if (sz != NOTSPEC || !tflag)
928 				badfmt(hte, call);
929 			sz = ULONG;
930 			goto conv;
931 		} else if (fc == 'X') {
932 			/*
933 			 * XXX valid in ANSI C, but in NetBSD's libc imple-
934 			 * mented as "lx". Thats why it should be avoided.
935 			 */
936 			if (sz != NOTSPEC || !tflag)
937 				badfmt(hte, call);
938 			sz = ULONG;
939 			goto conv;
940 		} else if (fc == 'E') {
941 			/*
942 			 * XXX valid in ANSI C, but in NetBSD's libc imple-
943 			 * mented as "lf". Thats why it should be avoided.
944 			 */
945 			if (sz != NOTSPEC || !tflag)
946 				badfmt(hte, call);
947 			sz = DOUBLE;
948 			goto conv;
949 		} else if (fc == 'F') {
950 			/* XXX only for backward compatibility */
951 			if (sz != NOTSPEC || !tflag)
952 				badfmt(hte, call);
953 			sz = DOUBLE;
954 			goto conv;
955 		} else if (fc == 'G') {
956 			/*
957 			 * XXX valid in ANSI C, but in NetBSD's libc not
958 			 * implemented
959 			 */
960 			if (sz != NOTSPEC && sz != LONG && sz != LDOUBLE)
961 				badfmt(hte, call);
962 			goto fconv;
963 		} else if (fc == 'e' || fc == 'f' || fc == 'g') {
964 		fconv:
965 			if (sz == NOTSPEC) {
966 				sz = FLOAT;
967 			} else if (sz == LONG) {
968 				sz = DOUBLE;
969 			} else if (sz != LDOUBLE) {
970 				badfmt(hte, call);
971 				sz = FLOAT;
972 			}
973 			goto conv;
974 		} else if (fc == 's' || fc == '[' || fc == 'c') {
975 			if (sz != NOTSPEC)
976 				badfmt(hte, call);
977 			if (fc == '[') {
978 				if ((fc = *fp++) == '-') {
979 					badfmt(hte, call);
980 					fc = *fp++;
981 				}
982 				if (fc != ']') {
983 					badfmt(hte, call);
984 					if (fc == '\0')
985 						break;
986 				}
987 			}
988 			if (!noasgn) {
989 				if (t1 != PTR) {
990 					inconarg(hte, call, n);
991 				} else if (t2 != CHAR && t2 != UCHAR &&
992 					   t2 != SCHAR) {
993 					inconarg(hte, call, n);
994 				}
995 			}
996 		} else if (fc == 'p') {
997 			if (sz != NOTSPEC)
998 				badfmt(hte, call);
999 			if (!noasgn) {
1000 				if (t1 != PTR || t2 != PTR) {
1001 					inconarg(hte, call, n);
1002 				} else if (tp->t_subt->t_subt->t_tspec!=VOID) {
1003 					if (hflag)
1004 						inconarg(hte, call, n);
1005 				}
1006 			}
1007 		} else {
1008 			badfmt(hte, call);
1009 			break;
1010 		}
1011 
1012 		fc = *fp++;
1013 	}
1014 }
1015 
1016 static void
1017 badfmt(hte_t *hte, fcall_t *call)
1018 {
1019 
1020 	/* %s: malformed format string\t%s */
1021 	msg(13, hte->h_name, mkpos(&call->f_pos));
1022 }
1023 
1024 static void
1025 inconarg(hte_t *hte, fcall_t *call, int n)
1026 {
1027 
1028 	/* %s, arg %d inconsistent with format\t%s(%d) */
1029 	msg(14, hte->h_name, n, mkpos(&call->f_pos));
1030 }
1031 
1032 static void
1033 tofewarg(hte_t *hte, fcall_t *call)
1034 {
1035 
1036 	/* %s: too few args for format  \t%s */
1037 	msg(15, hte->h_name, mkpos(&call->f_pos));
1038 }
1039 
1040 static void
1041 tomanyarg(hte_t *hte, fcall_t *call)
1042 {
1043 
1044 	/* %s: too many args for format  \t%s */
1045 	msg(16, hte->h_name, mkpos(&call->f_pos));
1046 }
1047 
1048 
1049 /*
1050  * Print warnings for return values which are used, but not returned,
1051  * or return values which are always or sometimes ignored.
1052  */
1053 static void
1054 chkrvu(hte_t *hte, sym_t *def)
1055 {
1056 	fcall_t	*call;
1057 	int	used, ignored;
1058 
1059 	if (def == NULL)
1060 		/* don't know wheter or not the functions returns a value */
1061 		return;
1062 
1063 	if (hte->h_calls == NULL)
1064 		return;
1065 
1066 	if (def->s_rval) {
1067 		/* function has return value */
1068 		used = ignored = 0;
1069 		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1070 			used |= call->f_rused || call->f_rdisc;
1071 			ignored |= !call->f_rused && !call->f_rdisc;
1072 		}
1073 		/*
1074 		 * XXX as soon as we are able to disable single warnings
1075 		 * the following dependencies from hflag should be removed.
1076 		 * but for now I do'nt want to be botherd by this warnings
1077 		 * which are almost always useless.
1078 		 */
1079 		if (!used && ignored) {
1080 			if (hflag)
1081 				/* %s returns value which is always ignored */
1082 				msg(8, hte->h_name);
1083 		} else if (used && ignored) {
1084 			if (hflag)
1085 				/* %s returns value which is sometimes ign. */
1086 				msg(9, hte->h_name);
1087 		}
1088 	} else {
1089 		/* function has no return value */
1090 		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1091 			if (call->f_rused)
1092 				/* %s value is used( %s ), but none ret. */
1093 				msg(10, hte->h_name, mkpos(&call->f_pos));
1094 		}
1095 	}
1096 }
1097 
1098 /*
1099  * Print warnings for inconsistent argument declarations.
1100  */
1101 static void
1102 chkadecl(hte_t *hte, sym_t *def, sym_t *decl)
1103 {
1104 	int	osdef, eq, dowarn, n;
1105 	sym_t	*sym1, *sym;
1106 	type_t	**ap1, **ap2, *tp1, *tp2;
1107 	char	*pos1;
1108 	const	char *pos2;
1109 
1110 	osdef = 0;
1111 	if (def != NULL) {
1112 		osdef = def->s_osdef;
1113 		sym1 = def;
1114 	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
1115 		sym1 = decl;
1116 	} else {
1117 		return;
1118 	}
1119 	if (TP(sym1->s_type)->t_tspec != FUNC)
1120 		return;
1121 
1122 	/*
1123 	 * XXX Prototypes should also be compared with old style function
1124 	 * declarations.
1125 	 */
1126 
1127 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
1128 		if (sym == sym1 || !TP(sym->s_type)->t_proto)
1129 			continue;
1130 		ap1 = TP(sym1->s_type)->t_args;
1131 		ap2 = TP(sym->s_type)->t_args;
1132 		n = 0;
1133 		while (*ap1 != NULL && *ap2 != NULL) {
1134 			type_t *xt1, *xt2;
1135 			dowarn = 0;
1136 			eq = eqtype(xt1 = *ap1, xt2 = *ap2, 1, osdef, 0, &dowarn);
1137 			if (!eq || dowarn) {
1138 				char b1[64], b2[64];
1139 				pos1 = xstrdup(mkpos(&sym1->s_pos));
1140 				pos2 = mkpos(&sym->s_pos);
1141 				/* %s, arg %d declared inconsistently ... */
1142 				msg(11, hte->h_name, n + 1,
1143 				    tyname(b1, sizeof(b1), xt1),
1144 				    tyname(b2, sizeof(b2), xt2), pos1, pos2);
1145 				free(pos1);
1146 			}
1147 			n++;
1148 			ap1++;
1149 			ap2++;
1150 		}
1151 		if (*ap1 == *ap2) {
1152 			tp1 = TP(sym1->s_type);
1153 			tp2 = TP(sym->s_type);
1154 			if (tp1->t_vararg == tp2->t_vararg)
1155 				continue;
1156 			if (tp2->t_vararg &&
1157 			    sym1->s_va && sym1->s_nva == n && !sflag) {
1158 				continue;
1159 			}
1160 		}
1161 		/* %s: variable # of args declared\t%s  ::  %s */
1162 		pos1 = xstrdup(mkpos(&sym1->s_pos));
1163 		msg(12, hte->h_name, pos1, mkpos(&sym->s_pos));
1164 		free(pos1);
1165 	}
1166 }
1167 
1168 
1169 /*
1170  * Check compatibility of two types. Returns 1 if types are compatible,
1171  * otherwise 0.
1172  *
1173  * ignqual	if set, ignore qualifiers of outhermost type; used for
1174  *		function arguments
1175  * promote	if set, promote left type before comparison; used for
1176  *		comparisons of arguments with parameters of old style
1177  *		definitions
1178  * asgn		left indirected type must have at least the same qualifiers
1179  *		like right indirected type (for assignments and function
1180  *		arguments)
1181  * *dowarn	set to 1 if an old style declaration was compared with
1182  *		an incompatible prototype declaration
1183  */
1184 static int
1185 eqtype(type_t *tp1, type_t *tp2, int ignqual, int promot, int asgn, int *dowarn)
1186 {
1187 	tspec_t	t, to;
1188 	int	indir;
1189 
1190 	to = NOTSPEC;
1191 	indir = 0;
1192 
1193 	while (tp1 != NULL && tp2 != NULL) {
1194 
1195 		t = tp1->t_tspec;
1196 		if (promot) {
1197 			if (t == FLOAT) {
1198 				t = DOUBLE;
1199 			} else if (t == CHAR || t == SCHAR) {
1200 				t = INT;
1201 			} else if (t == UCHAR) {
1202 				t = tflag ? UINT : INT;
1203 			} else if (t == SHORT) {
1204 				t = INT;
1205 			} else if (t == USHORT) {
1206 				/* CONSTCOND */
1207 				t = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
1208 			}
1209 		}
1210 
1211 		if (asgn && to == PTR) {
1212 			if (indir == 1 && (t == VOID || tp2->t_tspec == VOID))
1213 				return (1);
1214 		}
1215 
1216 		if (t != tp2->t_tspec) {
1217 			/*
1218 			 * Give pointer to types which differ only in
1219 			 * signedness a chance if not sflag and not hflag.
1220 			 */
1221 			if (sflag || hflag || to != PTR)
1222 				return (0);
1223 			if (styp(t) != styp(tp2->t_tspec))
1224 				return (0);
1225 		}
1226 
1227 		if (tp1->t_isenum && tp2->t_isenum) {
1228 			if (tp1->t_istag && tp2->t_istag) {
1229 				return (tp1->t_tag == tp2->t_tag);
1230 			} else if (tp1->t_istynam && tp2->t_istynam) {
1231 				return (tp1->t_tynam == tp2->t_tynam);
1232 			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1233 				return (tp1->t_uniqpos.p_line ==
1234 				      tp2->t_uniqpos.p_line &&
1235 				    tp1->t_uniqpos.p_file ==
1236 				      tp2->t_uniqpos.p_file &&
1237 				    tp1->t_uniqpos.p_uniq ==
1238 				      tp2->t_uniqpos.p_uniq);
1239 			} else {
1240 				return (0);
1241 			}
1242 		}
1243 
1244 		/*
1245 		 * XXX Handle combinations of enum and int if eflag is set.
1246 		 * But note: enum and 0 should be allowed.
1247 		 */
1248 
1249 		if (asgn && indir == 1) {
1250 			if (!tp1->t_const && tp2->t_const)
1251 				return (0);
1252 			if (!tp1->t_volatile && tp2->t_volatile)
1253 				return (0);
1254 		} else if (!ignqual && !tflag) {
1255 			if (tp1->t_const != tp2->t_const)
1256 				return (0);
1257 			if (tp1->t_const != tp2->t_const)
1258 				return (0);
1259 		}
1260 
1261 		if (t == STRUCT || t == UNION) {
1262 			if (tp1->t_istag && tp2->t_istag) {
1263 				return (tp1->t_tag == tp2->t_tag);
1264 			} else if (tp1->t_istynam && tp2->t_istynam) {
1265 				return (tp1->t_tynam == tp2->t_tynam);
1266 			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1267 				return (tp1->t_uniqpos.p_line ==
1268 				      tp2->t_uniqpos.p_line &&
1269 				    tp1->t_uniqpos.p_file ==
1270 				      tp2->t_uniqpos.p_file &&
1271 				    tp1->t_uniqpos.p_uniq ==
1272 				      tp2->t_uniqpos.p_uniq);
1273 			} else {
1274 				return (0);
1275 			}
1276 		}
1277 
1278 		if (t == ARRAY && tp1->t_dim != tp2->t_dim) {
1279 			if (tp1->t_dim != 0 && tp2->t_dim != 0)
1280 				return (0);
1281 		}
1282 
1283 		if (t == FUNC) {
1284 			if (tp1->t_proto && tp2->t_proto) {
1285 				if (!eqargs(tp1, tp2, dowarn))
1286 					return (0);
1287 			} else if (tp1->t_proto) {
1288 				if (!mnoarg(tp1, dowarn))
1289 					return (0);
1290 			} else if (tp2->t_proto) {
1291 				if (!mnoarg(tp2, dowarn))
1292 					return (0);
1293 			}
1294 		}
1295 
1296 		tp1 = tp1->t_subt;
1297 		tp2 = tp2->t_subt;
1298 		ignqual = promot = 0;
1299 		to = t;
1300 		indir++;
1301 
1302 	}
1303 
1304 	return (tp1 == tp2);
1305 }
1306 
1307 /*
1308  * Compares arguments of two prototypes
1309  */
1310 static int
1311 eqargs(type_t *tp1, type_t *tp2, int *dowarn)
1312 {
1313 	type_t	**a1, **a2;
1314 
1315 	if (tp1->t_vararg != tp2->t_vararg)
1316 		return (0);
1317 
1318 	a1 = tp1->t_args;
1319 	a2 = tp2->t_args;
1320 
1321 	while (*a1 != NULL && *a2 != NULL) {
1322 
1323 		if (eqtype(*a1, *a2, 1, 0, 0, dowarn) == 0)
1324 			return (0);
1325 
1326 		a1++;
1327 		a2++;
1328 
1329 	}
1330 
1331 	return (*a1 == *a2);
1332 }
1333 
1334 /*
1335  * mnoarg() (matches functions with no argument type information)
1336  * returns 1 if all parameters of a prototype are compatible with
1337  * and old style function declaration.
1338  * This is the case if following conditions are met:
1339  *	1. the prototype must have a fixed number of parameters
1340  *	2. no parameter is of type float
1341  *	3. no parameter is converted to another type if integer promotion
1342  *	   is applied on it
1343  */
1344 static int
1345 mnoarg(type_t *tp, int *dowarn)
1346 {
1347 	type_t	**arg;
1348 	tspec_t	t;
1349 
1350 	if (tp->t_vararg && dowarn != NULL)
1351 		*dowarn = 1;
1352 	for (arg = tp->t_args; *arg != NULL; arg++) {
1353 		if ((t = (*arg)->t_tspec) == FLOAT)
1354 			return (0);
1355 		if (t == CHAR || t == SCHAR || t == UCHAR)
1356 			return (0);
1357 		if (t == SHORT || t == USHORT)
1358 			return (0);
1359 	}
1360 	return (1);
1361 }
1362