xref: /netbsd-src/usr.bin/xlint/lint2/chk.c (revision 404fbe5fb94ca1e054339640cabb2801ce52dd30)
1 /* $NetBSD: chk.c,v 1.19 2008/04/26 19:38:30 christos Exp $ */
2 
3 /*
4  * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
5  * Copyright (c) 1994, 1995 Jochen Pohl
6  * All Rights Reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *      This product includes software developed by Jochen Pohl for
19  *	The NetBSD Project.
20  * 4. The name of the author may not be used to endorse or promote products
21  *    derived from this software without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #if HAVE_NBTOOL_CONFIG_H
36 #include "nbtool_config.h"
37 #endif
38 
39 #include <sys/cdefs.h>
40 #if defined(__RCSID) && !defined(lint)
41 __RCSID("$NetBSD: chk.c,v 1.19 2008/04/26 19:38:30 christos Exp $");
42 #endif
43 
44 #include <ctype.h>
45 #include <limits.h>
46 #include <stdlib.h>
47 
48 #include "lint2.h"
49 
50 static	void	chkund(hte_t *);
51 static	void	chkdnu(hte_t *);
52 static	void	chkdnud(hte_t *);
53 static	void	chkmd(hte_t *);
54 static	void	chkvtui(hte_t *, sym_t *, sym_t *);
55 static	void	chkvtdi(hte_t *, sym_t *, sym_t *);
56 static	void	chkfaui(hte_t *, sym_t *, sym_t *);
57 static	void	chkau(hte_t *, int, sym_t *, sym_t *, pos_t *,
58 			   fcall_t *, fcall_t *, type_t *, type_t *);
59 static	void	chkrvu(hte_t *, sym_t *);
60 static	void	chkadecl(hte_t *, sym_t *, sym_t *);
61 static	void	printflike(hte_t *,fcall_t *, int, const char *, type_t **);
62 static	void	scanflike(hte_t *, fcall_t *, int, const char *, type_t **);
63 static	void	badfmt(hte_t *, fcall_t *);
64 static	void	inconarg(hte_t *, fcall_t *, int);
65 static	void	tofewarg(hte_t *, fcall_t *);
66 static	void	tomanyarg(hte_t *, fcall_t *);
67 static	int	eqtype(type_t *, type_t *, int, int, int, int *);
68 static	int	eqargs(type_t *, type_t *, int *);
69 static	int	mnoarg(type_t *, int *);
70 
71 
72 /*
73  * If there is a symbol named "main", mark it as used.
74  */
75 void
76 mainused(void)
77 {
78 	hte_t	*hte;
79 
80 	if ((hte = hsearch("main", 0)) != NULL)
81 		hte->h_used = 1;
82 }
83 
84 /*
85  * Performs all tests for a single name
86  */
87 void
88 chkname(hte_t *hte)
89 {
90 	sym_t	*sym, *def, *pdecl, *decl;
91 
92 	if (uflag) {
93 		chkund(hte);
94 		chkdnu(hte);
95 		if (xflag)
96 			chkdnud(hte);
97 	}
98 	chkmd(hte);
99 
100 	/* Get definition, prototype declaration and declaration */
101 	def = pdecl = decl = NULL;
102 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
103 		if (def == NULL && (sym->s_def == DEF || sym->s_def == TDEF))
104 			def = sym;
105 		if (pdecl == NULL && sym->s_def == DECL &&
106 		    TP(sym->s_type)->t_tspec == FUNC &&
107 		    TP(sym->s_type)->t_proto) {
108 			pdecl = sym;
109 		}
110 		if (decl == NULL && sym->s_def == DECL)
111 			decl = sym;
112 	}
113 
114 	/* A prototype is better than an old style declaration. */
115 	if (pdecl != NULL)
116 		decl = pdecl;
117 
118 	chkvtui(hte, def, decl);
119 
120 	chkvtdi(hte, def, decl);
121 
122 	chkfaui(hte, def, decl);
123 
124 	chkrvu(hte, def);
125 
126 	chkadecl(hte, def, decl);
127 }
128 
129 /*
130  * Print a warning if the name has been used, but not defined.
131  */
132 static void
133 chkund(hte_t *hte)
134 {
135 	fcall_t	*fcall;
136 	usym_t	*usym;
137 
138 	if (!hte->h_used || hte->h_def)
139 		return;
140 
141 	if ((fcall = hte->h_calls) != NULL) {
142 		/* %s used( %s ), but not defined */
143 		msg(0, hte->h_name, mkpos(&fcall->f_pos));
144 	} else if ((usym = hte->h_usyms) != NULL) {
145 		/* %s used( %s ), but not defined */
146 		msg(0, hte->h_name, mkpos(&usym->u_pos));
147 	}
148 }
149 
150 /*
151  * Print a warning if the name has been defined, but never used.
152  */
153 static void
154 chkdnu(hte_t *hte)
155 {
156 	sym_t	*sym;
157 
158 	if (!hte->h_def || hte->h_used)
159 		return;
160 
161 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
162 		if (sym->s_def == DEF || sym->s_def == TDEF) {
163 			/* %s defined( %s ), but never used */
164 			msg(1, hte->h_name, mkpos(&sym->s_pos));
165 			break;
166 		}
167 	}
168 }
169 
170 /*
171  * Print a warning if the variable has been declared, but is not used
172  * or defined.
173  */
174 static void
175 chkdnud(hte_t *hte)
176 {
177 	sym_t	*sym;
178 
179 	if (hte->h_syms == NULL || hte->h_used || hte->h_def)
180 		return;
181 
182 	sym = hte->h_syms;
183 	if (TP(sym->s_type)->t_tspec == FUNC)
184 		return;
185 
186 	if (sym->s_def != DECL)
187 		errx(1, "internal error: chkdnud() 1");
188 	/* %s declared( %s ), but never used or defined */
189 	msg(2, hte->h_name, mkpos(&sym->s_pos));
190 }
191 
192 /*
193  * Print a warning if there is more than one definition for
194  * this name.
195  */
196 static void
197 chkmd(hte_t *hte)
198 {
199 	sym_t	*sym, *def1;
200 	char	*pos1;
201 
202 	if (!hte->h_def)
203 		return;
204 
205 	def1 = NULL;
206 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
207 		/*
208 		 * ANSI C allows tentative definitions of the same name in
209 		 * only one compilation unit.
210 		 */
211 		if (sym->s_def != DEF && (!sflag || sym->s_def != TDEF))
212 			continue;
213 		if (def1 == NULL) {
214 			def1 = sym;
215 			continue;
216 		}
217 		pos1 = xstrdup(mkpos(&def1->s_pos));
218 		/* %s multiply defined\t%s  ::  %s */
219 		msg(3, hte->h_name, pos1, mkpos(&sym->s_pos));
220 		free(pos1);
221 	}
222 }
223 
224 /*
225  * Print a warning if the return value assumed for a function call
226  * differs from the return value of the function definition or
227  * function declaration.
228  *
229  * If no definition/declaration can be found, the assumed return values
230  * are always int. So there is no need to compare with another function
231  * call as it's done for function arguments.
232  */
233 static void
234 chkvtui(hte_t *hte, sym_t *def, sym_t *decl)
235 {
236 	fcall_t	*call;
237 	char	*pos1;
238 	type_t	*tp1, *tp2;
239 	/* LINTED (automatic hides external declaration: warn) */
240 	int	warn, eq;
241 	tspec_t	t1;
242 
243 	if (hte->h_calls == NULL)
244 		return;
245 
246 	if (def == NULL)
247 		def = decl;
248 	if (def == NULL)
249 		return;
250 
251 	t1 = (tp1 = TP(def->s_type)->t_subt)->t_tspec;
252 	for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
253 		tp2 = TP(call->f_type)->t_subt;
254 		eq = eqtype(tp1, tp2, 1, 0, 0, (warn = 0, &warn));
255 		if (!call->f_rused) {
256 			/* no return value used */
257 			if ((t1 == STRUCT || t1 == UNION) && !eq) {
258 				/*
259 				 * If a function returns a struct or union it
260 				 * must be declared to return a struct or
261 				 * union, also if the return value is ignored.
262 				 * This is necessary because the caller must
263 				 * allocate stack space for the return value.
264 				 * If it does not, the return value would over-
265 				 * write other data.
266 				 * XXX Following massage may be confusing
267 				 * because it appears also if the return value
268 				 * was declared inconsistently. But this
269 				 * behaviour matches pcc based lint, so it is
270 				 * accepted for now.
271 				 */
272 				pos1 = xstrdup(mkpos(&def->s_pos));
273 				/* %s value must be decl. before use %s :: %s */
274 				msg(17, hte->h_name,
275 				    pos1, mkpos(&call->f_pos));
276 				free(pos1);
277 			}
278 			continue;
279 		}
280 		if (!eq || (sflag && warn)) {
281 			pos1 = xstrdup(mkpos(&def->s_pos));
282 			/* %s value used inconsistenty\t%s  ::  %s */
283 			msg(4, hte->h_name, pos1, mkpos(&call->f_pos));
284 			free(pos1);
285 		}
286 	}
287 }
288 
289 /*
290  * Print a warning if a definition/declaration does not match another
291  * definition/declaration of the same name. For functions, only the
292  * types of return values are tested.
293  */
294 static void
295 chkvtdi(hte_t *hte, sym_t *def, sym_t *decl)
296 {
297 	sym_t	*sym;
298 	type_t	*tp1, *tp2;
299 	/* LINTED (automatic hides external declaration: warn) */
300 	int	eq, warn;
301 	char	*pos1;
302 
303 	if (def == NULL)
304 		def = decl;
305 	if (def == NULL)
306 		return;
307 
308 	tp1 = TP(def->s_type);
309 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
310 		type_t *xt1, *xt2;
311 		if (sym == def)
312 			continue;
313 		tp2 = TP(sym->s_type);
314 		warn = 0;
315 		if (tp1->t_tspec == FUNC && tp2->t_tspec == FUNC) {
316 			eq = eqtype(xt1 = tp1->t_subt, xt2 = tp2->t_subt,
317 			    1, 0, 0, &warn);
318 		} else {
319 			eq = eqtype(xt1 = tp1, xt2 = tp2, 0, 0, 0, &warn);
320 		}
321 		if (!eq || (sflag && warn)) {
322 			char b1[64], b2[64];
323 			pos1 = xstrdup(mkpos(&def->s_pos));
324 			/* %s value declared inconsistently\t%s  ::  %s */
325 			msg(5, hte->h_name, tyname(b1, sizeof(b1), xt1),
326 			    tyname(b2, sizeof(b2), xt2), pos1,
327 			    mkpos(&sym->s_pos));
328 			free(pos1);
329 		}
330 	}
331 }
332 
333 /*
334  * Print a warning if a function is called with arguments which does
335  * not match the function definition, declaration or another call
336  * of the same function.
337  */
338 static void
339 chkfaui(hte_t *hte, sym_t *def, sym_t *decl)
340 {
341 	type_t	*tp1, *tp2, **ap1, **ap2;
342 	pos_t	*pos1p = NULL;
343 	fcall_t	*calls, *call, *call1;
344 	int	n, as;
345 	char	*pos1;
346 	arginf_t *ai;
347 
348 	if ((calls = hte->h_calls) == NULL)
349 		return;
350 
351 	/*
352 	 * If we find a function definition, we use this for comparison,
353 	 * otherwise the first prototype we can find. If there is no
354 	 * definition or prototype declaration, the first function call
355 	 * is used.
356 	 */
357 	tp1 = NULL;
358 	call1 = NULL;
359 	if (def != NULL) {
360 		if ((tp1 = TP(def->s_type))->t_tspec != FUNC)
361 			return;
362 		pos1p = &def->s_pos;
363 	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
364 		if ((tp1 = TP(decl->s_type))->t_tspec != FUNC)
365 			return;
366 		pos1p = &decl->s_pos;
367 	}
368 	if (tp1 == NULL) {
369 		call1 = calls;
370 		calls = calls->f_nxt;
371 		if ((tp1 = TP(call1->f_type))->t_tspec != FUNC)
372 			return;
373 		pos1p = &call1->f_pos;
374 	}
375 
376 	n = 1;
377 	for (call = calls; call != NULL; call = call->f_nxt) {
378 		if ((tp2 = TP(call->f_type))->t_tspec != FUNC)
379 			continue;
380 		ap1 = tp1->t_args;
381 		ap2 = tp2->t_args;
382 		n = 0;
383 		while (*ap1 != NULL && *ap2 != NULL) {
384 			if (def != NULL && def->s_va && n >= def->s_nva)
385 				break;
386 			n++;
387 			chkau(hte, n, def, decl, pos1p, call1, call,
388 			      *ap1, *ap2);
389 			ap1++;
390 			ap2++;
391 		}
392 		if (*ap1 == *ap2) {
393 			/* equal # of arguments */
394 		} else if (def != NULL && def->s_va && n >= def->s_nva) {
395 			/*
396 			 * function definition with VARARGS; The # of
397 			 * arguments of the call must be at least as large
398 			 * as the parameter of VARARGS.
399 			 */
400 		} else if (*ap2 != NULL && tp1->t_proto && tp1->t_vararg) {
401 			/*
402 			 * prototype with ... and function call with
403 			 * at least the same # of arguments as declared
404 			 * in the prototype.
405 			 */
406 		} else {
407 			pos1 = xstrdup(mkpos(pos1p));
408 			/* %s: variable # of args\t%s  ::  %s */
409 			msg(7, hte->h_name, pos1, mkpos(&call->f_pos));
410 			free(pos1);
411 			continue;
412 		}
413 
414 		/* perform SCANFLIKE/PRINTFLIKE tests */
415 		if (def == NULL || (!def->s_prfl && !def->s_scfl))
416 			continue;
417 		as = def->s_prfl ? def->s_nprfl : def->s_nscfl;
418 		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
419 			if (ai->a_num == as)
420 				break;
421 		}
422 		if (ai == NULL || !ai->a_fmt)
423 			continue;
424 		if (def->s_prfl) {
425 			printflike(hte, call, n, ai->a_fstrg, ap2);
426 		} else {
427 			scanflike(hte, call, n, ai->a_fstrg, ap2);
428 		}
429 	}
430 }
431 
432 /*
433  * Check a single argument in a function call.
434  *
435  *  hte		a pointer to the hash table entry of the function
436  *  n		the number of the argument (1..)
437  *  def		the function definition or NULL
438  *  decl	prototype declaration, old style declaration or NULL
439  *  pos1p	position of definition, declaration of first call
440  *  call1	first call, if both def and decl are old style def/decl
441  *  call	checked call
442  *  arg1	currently checked argument of def/decl/call1
443  *  arg2	currently checked argument of call
444  *
445  */
446 static void
447 chkau(hte_t *hte, int n, sym_t *def, sym_t *decl, pos_t *pos1p,
448 	fcall_t *call1, fcall_t *call, type_t *arg1, type_t *arg2)
449 {
450 	/* LINTED (automatic hides external declaration: warn) */
451 	int	promote, asgn, warn;
452 	tspec_t	t1, t2;
453 	arginf_t *ai, *ai1;
454 	char	*pos1;
455 	char	tyname1[64], tyname2[64];
456 
457 	/*
458 	 * If a function definition is available (def != NULL), we compair the
459 	 * function call (call) with the definition. Otherwise, if a function
460 	 * definition is available and it is not an old style definition
461 	 * (decl != NULL && TP(decl->s_type)->t_proto), we compair the call
462 	 * with this declaration. Otherwise we compair it with the first
463 	 * call we have found (call1).
464 	 */
465 
466 	/* arg1 must be promoted if it stems from an old style definition */
467 	promote = def != NULL && def->s_osdef;
468 
469 	/*
470 	 * If we compair with a definition or declaration, we must perform
471 	 * the same checks for qualifiers in indirected types as in
472 	 * assignments.
473 	 */
474 	asgn = def != NULL || (decl != NULL && TP(decl->s_type)->t_proto);
475 
476 	warn = 0;
477 	if (eqtype(arg1, arg2, 1, promote, asgn, &warn) && (!sflag || !warn))
478 		return;
479 
480 	/*
481 	 * Other lint implementations print warnings as soon as the type
482 	 * of an argument does not match exactly the expected type. The
483 	 * result are lots of warnings which are really not necessary.
484 	 * We print a warning only if
485 	 *   (0) at least one type is not an interger type and types differ
486 	 *   (1) hflag is set and types differ
487 	 *   (2) types differ, except in signedness
488 	 * If the argument is an integer constant whose msb is not set,
489 	 * signedness is ignored (e.g. 0 matches both signed and unsigned
490 	 * int). This is with and without hflag.
491 	 * If the argument is an integer constant with value 0 and the
492 	 * expected argument is of type pointer and the width of the
493 	 * interger constant is the same as the width of the pointer,
494 	 * no warning is printed.
495 	 */
496 	t1 = arg1->t_tspec;
497 	t2 = arg2->t_tspec;
498 	if (isityp(t1) && isityp(t2) && !arg1->t_isenum && !arg2->t_isenum) {
499 		if (promote) {
500 			/*
501 			 * XXX Here is a problem: Althrough it is possible to
502 			 * pass an int where a char/short it expected, there
503 			 * may be loss in significant digits. We should first
504 			 * check for const arguments if they can be converted
505 			 * into the original parameter type.
506 			 */
507 			if (t1 == FLOAT) {
508 				t1 = DOUBLE;
509 			} else if (t1 == CHAR || t1 == SCHAR) {
510 				t1 = INT;
511 			} else if (t1 == UCHAR) {
512 				t1 = tflag ? UINT : INT;
513 			} else if (t1 == SHORT) {
514 				t1 = INT;
515 			} else if (t1 == USHORT) {
516 				/* CONSTCOND */
517 				t1 = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
518 			}
519 		}
520 
521 		if (styp(t1) == styp(t2)) {
522 
523 			/*
524 			 * types differ only in signedness; get information
525 			 * about arguments
526 			 */
527 
528 			/*
529 			 * treat a definition like a call with variable
530 			 * arguments
531 			 */
532 			ai1 = call1 != NULL ? call1->f_args : NULL;
533 
534 			/*
535 			 * if two calls are compared, ai1 is set to the
536 			 * information for the n-th argument, if this was
537 			 * a constant, otherwise to NULL
538 			 */
539 			for ( ; ai1 != NULL; ai1 = ai1->a_nxt) {
540 				if (ai1->a_num == n)
541 					break;
542 			}
543 			/*
544 			 * ai is set to the information of the n-th arg
545 			 * of the (second) call, if this was a constant,
546 			 * otherwise to NULL
547 			 */
548 			for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
549 				if (ai->a_num == n)
550 					break;
551 			}
552 
553 			if (ai1 == NULL && ai == NULL) {
554 				/* no constant at all */
555 				if (!hflag)
556 					return;
557 			} else if (ai1 == NULL || ai == NULL) {
558 				/* one constant */
559 				if (ai == NULL)
560 					ai = ai1;
561 				if (ai->a_zero || ai->a_pcon)
562 					/* same value in signed and unsigned */
563 					return;
564 				/* value (not representation) differently */
565 			} else {
566 				/*
567 				 * two constants, one signed, one unsigned;
568 				 * if the msb of one of the constants is set,
569 				 * the argument is used inconsistently.
570 				 */
571 				if (!ai1->a_ncon && !ai->a_ncon)
572 					return;
573 			}
574 		}
575 
576 	} else if (t1 == PTR && isityp(t2)) {
577 		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
578 			if (ai->a_num == n)
579 				break;
580 		}
581 		/*
582 		 * Vendor implementations of lint (e.g. HP-UX, Digital UNIX)
583 		 * don't care about the size of the integer argument,
584 		 * only whether or not it is zero.  We do the same.
585 		 */
586 		if (ai != NULL && ai->a_zero)
587 			return;
588 	}
589 
590 	pos1 = xstrdup(mkpos(pos1p));
591 	/* %s, arg %d used inconsistently\t%s[%s]  ::  %s[%s] */
592 	msg(6, hte->h_name, n, pos1,
593 	    tyname(tyname1, sizeof(tyname1), arg1),
594 	    mkpos(&call->f_pos),
595 	    tyname(tyname2, sizeof(tyname2), arg2));
596 	free(pos1);
597 }
598 
599 /*
600  * Compare the types in the NULL-terminated array ap with the format
601  * string fmt.
602  */
603 static void
604 printflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
605 {
606 	const	char *fp;
607 	int	fc;
608 	int	fwidth, prec, left, sign, space, alt, zero;
609 	tspec_t	sz, t1, t2 = NOTSPEC;
610 	type_t	*tp;
611 
612 	fp = fmt;
613 	fc = *fp++;
614 
615 	for ( ; ; ) {
616 		if (fc == '\0') {
617 			if (*ap != NULL)
618 				tomanyarg(hte, call);
619 			break;
620 		}
621 		if (fc != '%') {
622 			badfmt(hte, call);
623 			break;
624 		}
625 		fc = *fp++;
626 		fwidth = prec = left = sign = space = alt = zero = 0;
627 		sz = NOTSPEC;
628 
629 		/* Flags */
630 		for ( ; ; ) {
631 			if (fc == '-') {
632 				if (left)
633 					break;
634 				left = 1;
635 			} else if (fc == '+') {
636 				if (sign)
637 					break;
638 				sign = 1;
639 			} else if (fc == ' ') {
640 				if (space)
641 					break;
642 				space = 1;
643 			} else if (fc == '#') {
644 				if (alt)
645 					break;
646 				alt = 1;
647 			} else if (fc == '0') {
648 				if (zero)
649 					break;
650 				zero = 1;
651 			} else {
652 				break;
653 			}
654 			fc = *fp++;
655 		}
656 
657 		/* field width */
658 		if (isdigit(fc)) {
659 			fwidth = 1;
660 			do { fc = *fp++; } while (isdigit(fc)) ;
661 		} else if (fc == '*') {
662 			fwidth = 1;
663 			fc = *fp++;
664 			if ((tp = *ap++) == NULL) {
665 				tofewarg(hte, call);
666 				break;
667 			}
668 			n++;
669 			if ((t1 = tp->t_tspec) != INT && (hflag || t1 != UINT))
670 				inconarg(hte, call, n);
671 		}
672 
673 		/* precision */
674 		if (fc == '.') {
675 			fc = *fp++;
676 			prec = 1;
677 			if (isdigit(fc)) {
678 				do { fc = *fp++; } while (isdigit(fc));
679 			} else if (fc == '*') {
680 				fc = *fp++;
681 				if ((tp = *ap++) == NULL) {
682 					tofewarg(hte, call);
683 					break;
684 				}
685 				n++;
686 				if (tp->t_tspec != INT)
687 					inconarg(hte, call, n);
688 			} else {
689 				badfmt(hte, call);
690 				break;
691 			}
692 		}
693 
694 		if (fc == 'h') {
695 			sz = SHORT;
696 		} else if (fc == 'l') {
697 			sz = LONG;
698 		} else if (fc == 'q') {
699 			sz = QUAD;
700 		} else if (fc == 'L') {
701 			sz = LDOUBLE;
702 		}
703 		if (sz != NOTSPEC)
704 			fc = *fp++;
705 
706 		if (fc == '%') {
707 			if (sz != NOTSPEC || left || sign || space ||
708 			    alt || zero || prec || fwidth) {
709 				badfmt(hte, call);
710 			}
711 			fc = *fp++;
712 			continue;
713 		}
714 
715 		if (fc == '\0') {
716 			badfmt(hte, call);
717 			break;
718 		}
719 
720 		if ((tp = *ap++) == NULL) {
721 			tofewarg(hte, call);
722 			break;
723 		}
724 		n++;
725 		if ((t1 = tp->t_tspec) == PTR)
726 			t2 = tp->t_subt->t_tspec;
727 
728 		if (fc == 'd' || fc == 'i') {
729 			if (alt || sz == LDOUBLE) {
730 				badfmt(hte, call);
731 				break;
732 			}
733 		int_conv:
734 			if (sz == LONG) {
735 				if (t1 != LONG && (hflag || t1 != ULONG))
736 					inconarg(hte, call, n);
737 			} else if (sz == QUAD) {
738 				if (t1 != QUAD && (hflag || t1 != UQUAD))
739 					inconarg(hte, call, n);
740 			} else {
741 				/*
742 				 * SHORT is always promoted to INT, USHORT
743 				 * to INT or UINT.
744 				 */
745 				if (t1 != INT && (hflag || t1 != UINT))
746 					inconarg(hte, call, n);
747 			}
748 		} else if (fc == 'o' || fc == 'u' || fc == 'x' || fc == 'X') {
749 			if ((alt && fc == 'u') || sz == LDOUBLE)
750 				badfmt(hte, call);
751 		uint_conv:
752 			if (sz == LONG) {
753 				if (t1 != ULONG && (hflag || t1 != LONG))
754 					inconarg(hte, call, n);
755 			} else if (sz == QUAD) {
756 				if (t1 != UQUAD && (hflag || t1 != QUAD))
757 					inconarg(hte, call, n);
758 			} else if (sz == SHORT) {
759 				/* USHORT was promoted to INT or UINT */
760 				if (t1 != UINT && t1 != INT)
761 					inconarg(hte, call, n);
762 			} else {
763 				if (t1 != UINT && (hflag || t1 != INT))
764 					inconarg(hte, call, n);
765 			}
766 		} else if (fc == 'D' || fc == 'O' || fc == 'U') {
767 			if ((alt && fc != 'O') || sz != NOTSPEC || !tflag)
768 				badfmt(hte, call);
769 			sz = LONG;
770 			if (fc == 'D') {
771 				goto int_conv;
772 			} else {
773 				goto uint_conv;
774 			}
775 		} else if (fc == 'f' || fc == 'e' || fc == 'E' ||
776 			   fc == 'g' || fc == 'G') {
777 			if (sz == NOTSPEC)
778 				sz = DOUBLE;
779 			if (sz != DOUBLE && sz != LDOUBLE)
780 				badfmt(hte, call);
781 			if (t1 != sz)
782 				inconarg(hte, call, n);
783 		} else if (fc == 'c') {
784 			if (sz != NOTSPEC || alt || zero)
785 				badfmt(hte, call);
786 			if (t1 != INT)
787 				inconarg(hte, call, n);
788 		} else if (fc == 's') {
789 			if (sz != NOTSPEC || alt || zero)
790 				badfmt(hte, call);
791 			if (t1 != PTR ||
792 			    (t2 != CHAR && t2 != UCHAR && t2 != SCHAR)) {
793 				inconarg(hte, call, n);
794 			}
795 		} else if (fc == 'p') {
796 			if (fwidth || prec || sz != NOTSPEC || alt || zero)
797 				badfmt(hte, call);
798 			if (t1 != PTR || (hflag && t2 != VOID))
799 				inconarg(hte, call, n);
800 		} else if (fc == 'n') {
801 			if (fwidth || prec || alt || zero || sz == LDOUBLE)
802 				badfmt(hte, call);
803 			if (t1 != PTR) {
804 				inconarg(hte, call, n);
805 			} else if (sz == LONG) {
806 				if (t2 != LONG && t2 != ULONG)
807 					inconarg(hte, call, n);
808 			} else if (sz == SHORT) {
809 				if (t2 != SHORT && t2 != USHORT)
810 					inconarg(hte, call, n);
811 			} else {
812 				if (t2 != INT && t2 != UINT)
813 					inconarg(hte, call, n);
814 			}
815 		} else {
816 			badfmt(hte, call);
817 			break;
818 		}
819 
820 		fc = *fp++;
821 	}
822 }
823 
824 /*
825  * Compare the types in the NULL-terminated array ap with the format
826  * string fmt.
827  */
828 static void
829 scanflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
830 {
831 	const	char *fp;
832 	int	fc;
833 	int	noasgn, fwidth;
834 	tspec_t	sz, t1 = NOTSPEC, t2 = NOTSPEC;
835 	type_t	*tp = NULL;
836 
837 	fp = fmt;
838 	fc = *fp++;
839 
840 	for ( ; ; ) {
841 		if (fc == '\0') {
842 			if (*ap != NULL)
843 				tomanyarg(hte, call);
844 			break;
845 		}
846 		if (fc != '%') {
847 			badfmt(hte, call);
848 			break;
849 		}
850 		fc = *fp++;
851 
852 		noasgn = fwidth = 0;
853 		sz = NOTSPEC;
854 
855 		if (fc == '*') {
856 			noasgn = 1;
857 			fc = *fp++;
858 		}
859 
860 		if (isdigit(fc)) {
861 			fwidth = 1;
862 			do { fc = *fp++; } while (isdigit(fc));
863 		}
864 
865 		if (fc == 'h') {
866 			sz = SHORT;
867 		} else if (fc == 'l') {
868 			sz = LONG;
869 		} else if (fc == 'q') {
870 			sz = QUAD;
871 		} else if (fc == 'L') {
872 			sz = LDOUBLE;
873 		}
874 		if (sz != NOTSPEC)
875 			fc = *fp++;
876 
877 		if (fc == '%') {
878 			if (sz != NOTSPEC || noasgn || fwidth)
879 				badfmt(hte, call);
880 			fc = *fp++;
881 			continue;
882 		}
883 
884 		if (!noasgn) {
885 			if ((tp = *ap++) == NULL) {
886 				tofewarg(hte, call);
887 				break;
888 			}
889 			n++;
890 			if ((t1 = tp->t_tspec) == PTR)
891 				t2 = tp->t_subt->t_tspec;
892 		}
893 
894 		if (fc == 'd' || fc == 'i' || fc == 'n') {
895 			if (sz == LDOUBLE)
896 				badfmt(hte, call);
897 			if (sz != SHORT && sz != LONG && sz != QUAD)
898 				sz = INT;
899 		conv:
900 			if (!noasgn) {
901 				if (t1 != PTR) {
902 					inconarg(hte, call, n);
903 				} else if (t2 != styp(sz)) {
904 					inconarg(hte, call, n);
905 				} else if (hflag && t2 != sz) {
906 					inconarg(hte, call, n);
907 				} else if (tp->t_subt->t_const) {
908 					inconarg(hte, call, n);
909 				}
910 			}
911 		} else if (fc == 'o' || fc == 'u' || fc == 'x') {
912 			if (sz == LDOUBLE)
913 				badfmt(hte, call);
914 			if (sz == SHORT) {
915 				sz = USHORT;
916 			} else if (sz == LONG) {
917 				sz = ULONG;
918 			} else if (sz == QUAD) {
919 				sz = UQUAD;
920 			} else {
921 				sz = UINT;
922 			}
923 			goto conv;
924 		} else if (fc == 'D') {
925 			if (sz != NOTSPEC || !tflag)
926 				badfmt(hte, call);
927 			sz = LONG;
928 			goto conv;
929 		} else if (fc == 'O') {
930 			if (sz != NOTSPEC || !tflag)
931 				badfmt(hte, call);
932 			sz = ULONG;
933 			goto conv;
934 		} else if (fc == 'X') {
935 			/*
936 			 * XXX valid in ANSI C, but in NetBSD's libc imple-
937 			 * mented as "lx". Thats why it should be avoided.
938 			 */
939 			if (sz != NOTSPEC || !tflag)
940 				badfmt(hte, call);
941 			sz = ULONG;
942 			goto conv;
943 		} else if (fc == 'E') {
944 			/*
945 			 * XXX valid in ANSI C, but in NetBSD's libc imple-
946 			 * mented as "lf". Thats why it should be avoided.
947 			 */
948 			if (sz != NOTSPEC || !tflag)
949 				badfmt(hte, call);
950 			sz = DOUBLE;
951 			goto conv;
952 		} else if (fc == 'F') {
953 			/* XXX only for backward compatibility */
954 			if (sz != NOTSPEC || !tflag)
955 				badfmt(hte, call);
956 			sz = DOUBLE;
957 			goto conv;
958 		} else if (fc == 'G') {
959 			/*
960 			 * XXX valid in ANSI C, but in NetBSD's libc not
961 			 * implemented
962 			 */
963 			if (sz != NOTSPEC && sz != LONG && sz != LDOUBLE)
964 				badfmt(hte, call);
965 			goto fconv;
966 		} else if (fc == 'e' || fc == 'f' || fc == 'g') {
967 		fconv:
968 			if (sz == NOTSPEC) {
969 				sz = FLOAT;
970 			} else if (sz == LONG) {
971 				sz = DOUBLE;
972 			} else if (sz != LDOUBLE) {
973 				badfmt(hte, call);
974 				sz = FLOAT;
975 			}
976 			goto conv;
977 		} else if (fc == 's' || fc == '[' || fc == 'c') {
978 			if (sz != NOTSPEC)
979 				badfmt(hte, call);
980 			if (fc == '[') {
981 				if ((fc = *fp++) == '-') {
982 					badfmt(hte, call);
983 					fc = *fp++;
984 				}
985 				if (fc != ']') {
986 					badfmt(hte, call);
987 					if (fc == '\0')
988 						break;
989 				}
990 			}
991 			if (!noasgn) {
992 				if (t1 != PTR) {
993 					inconarg(hte, call, n);
994 				} else if (t2 != CHAR && t2 != UCHAR &&
995 					   t2 != SCHAR) {
996 					inconarg(hte, call, n);
997 				}
998 			}
999 		} else if (fc == 'p') {
1000 			if (sz != NOTSPEC)
1001 				badfmt(hte, call);
1002 			if (!noasgn) {
1003 				if (t1 != PTR || t2 != PTR) {
1004 					inconarg(hte, call, n);
1005 				} else if (tp->t_subt->t_subt->t_tspec!=VOID) {
1006 					if (hflag)
1007 						inconarg(hte, call, n);
1008 				}
1009 			}
1010 		} else {
1011 			badfmt(hte, call);
1012 			break;
1013 		}
1014 
1015 		fc = *fp++;
1016 	}
1017 }
1018 
1019 static void
1020 badfmt(hte_t *hte, fcall_t *call)
1021 {
1022 
1023 	/* %s: malformed format string\t%s */
1024 	msg(13, hte->h_name, mkpos(&call->f_pos));
1025 }
1026 
1027 static void
1028 inconarg(hte_t *hte, fcall_t *call, int n)
1029 {
1030 
1031 	/* %s, arg %d inconsistent with format\t%s(%d) */
1032 	msg(14, hte->h_name, n, mkpos(&call->f_pos));
1033 }
1034 
1035 static void
1036 tofewarg(hte_t *hte, fcall_t *call)
1037 {
1038 
1039 	/* %s: too few args for format  \t%s */
1040 	msg(15, hte->h_name, mkpos(&call->f_pos));
1041 }
1042 
1043 static void
1044 tomanyarg(hte_t *hte, fcall_t *call)
1045 {
1046 
1047 	/* %s: too many args for format  \t%s */
1048 	msg(16, hte->h_name, mkpos(&call->f_pos));
1049 }
1050 
1051 
1052 /*
1053  * Print warnings for return values which are used, but not returned,
1054  * or return values which are always or sometimes ignored.
1055  */
1056 static void
1057 chkrvu(hte_t *hte, sym_t *def)
1058 {
1059 	fcall_t	*call;
1060 	int	used, ignored;
1061 
1062 	if (def == NULL)
1063 		/* don't know wheter or not the functions returns a value */
1064 		return;
1065 
1066 	if (hte->h_calls == NULL)
1067 		return;
1068 
1069 	if (def->s_rval) {
1070 		/* function has return value */
1071 		used = ignored = 0;
1072 		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1073 			used |= call->f_rused || call->f_rdisc;
1074 			ignored |= !call->f_rused && !call->f_rdisc;
1075 		}
1076 		/*
1077 		 * XXX as soon as we are able to disable single warnings
1078 		 * the following dependencies from hflag should be removed.
1079 		 * but for now I do'nt want to be botherd by this warnings
1080 		 * which are almost always useless.
1081 		 */
1082 		if (!used && ignored) {
1083 			if (hflag)
1084 				/* %s returns value which is always ignored */
1085 				msg(8, hte->h_name);
1086 		} else if (used && ignored) {
1087 			if (hflag)
1088 				/* %s returns value which is sometimes ign. */
1089 				msg(9, hte->h_name);
1090 		}
1091 	} else {
1092 		/* function has no return value */
1093 		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1094 			if (call->f_rused)
1095 				/* %s value is used( %s ), but none ret. */
1096 				msg(10, hte->h_name, mkpos(&call->f_pos));
1097 		}
1098 	}
1099 }
1100 
1101 /*
1102  * Print warnings for inconsistent argument declarations.
1103  */
1104 static void
1105 chkadecl(hte_t *hte, sym_t *def, sym_t *decl)
1106 {
1107 	/* LINTED (automatic hides external declaration: warn) */
1108 	int	osdef, eq, warn, n;
1109 	sym_t	*sym1, *sym;
1110 	type_t	**ap1, **ap2, *tp1, *tp2;
1111 	char	*pos1;
1112 	const	char *pos2;
1113 
1114 	osdef = 0;
1115 	if (def != NULL) {
1116 		osdef = def->s_osdef;
1117 		sym1 = def;
1118 	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
1119 		sym1 = decl;
1120 	} else {
1121 		return;
1122 	}
1123 	if (TP(sym1->s_type)->t_tspec != FUNC)
1124 		return;
1125 
1126 	/*
1127 	 * XXX Prototypes should also be compared with old style function
1128 	 * declarations.
1129 	 */
1130 
1131 	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
1132 		if (sym == sym1 || !TP(sym->s_type)->t_proto)
1133 			continue;
1134 		ap1 = TP(sym1->s_type)->t_args;
1135 		ap2 = TP(sym->s_type)->t_args;
1136 		n = 0;
1137 		while (*ap1 != NULL && *ap2 != NULL) {
1138 			type_t *xt1, *xt2;
1139 			warn = 0;
1140 			eq = eqtype(xt1 = *ap1, xt2 = *ap2, 1, osdef, 0, &warn);
1141 			if (!eq || warn) {
1142 				char b1[64], b2[64];
1143 				pos1 = xstrdup(mkpos(&sym1->s_pos));
1144 				pos2 = mkpos(&sym->s_pos);
1145 				/* %s, arg %d declared inconsistently ... */
1146 				msg(11, hte->h_name, n + 1,
1147 				    tyname(b1, sizeof(b1), xt1),
1148 				    tyname(b2, sizeof(b2), xt2), pos1, pos2);
1149 				free(pos1);
1150 			}
1151 			n++;
1152 			ap1++;
1153 			ap2++;
1154 		}
1155 		if (*ap1 == *ap2) {
1156 			tp1 = TP(sym1->s_type);
1157 			tp2 = TP(sym->s_type);
1158 			if (tp1->t_vararg == tp2->t_vararg)
1159 				continue;
1160 			if (tp2->t_vararg &&
1161 			    sym1->s_va && sym1->s_nva == n && !sflag) {
1162 				continue;
1163 			}
1164 		}
1165 		/* %s: variable # of args declared\t%s  ::  %s */
1166 		pos1 = xstrdup(mkpos(&sym1->s_pos));
1167 		msg(12, hte->h_name, pos1, mkpos(&sym->s_pos));
1168 		free(pos1);
1169 	}
1170 }
1171 
1172 
1173 /*
1174  * Check compatibility of two types. Returns 1 if types are compatible,
1175  * otherwise 0.
1176  *
1177  * ignqual	if set, ignore qualifiers of outhermost type; used for
1178  *		function arguments
1179  * promote	if set, promote left type before comparison; used for
1180  *		comparisons of arguments with parameters of old style
1181  *		definitions
1182  * asgn		left indirected type must have at least the same qualifiers
1183  *		like right indirected type (for assignments and function
1184  *		arguments)
1185  * *warn	set to 1 if an old style declaration was compared with
1186  *		an incompatible prototype declaration
1187  */
1188 static int
1189 eqtype(type_t *tp1, type_t *tp2, int ignqual, int promot, int asgn, int *warn)
1190 {
1191 	tspec_t	t, to;
1192 	int	indir;
1193 
1194 	to = NOTSPEC;
1195 	indir = 0;
1196 
1197 	while (tp1 != NULL && tp2 != NULL) {
1198 
1199 		t = tp1->t_tspec;
1200 		if (promot) {
1201 			if (t == FLOAT) {
1202 				t = DOUBLE;
1203 			} else if (t == CHAR || t == SCHAR) {
1204 				t = INT;
1205 			} else if (t == UCHAR) {
1206 				t = tflag ? UINT : INT;
1207 			} else if (t == SHORT) {
1208 				t = INT;
1209 			} else if (t == USHORT) {
1210 				/* CONSTCOND */
1211 				t = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
1212 			}
1213 		}
1214 
1215 		if (asgn && to == PTR) {
1216 			if (indir == 1 && (t == VOID || tp2->t_tspec == VOID))
1217 				return (1);
1218 		}
1219 
1220 		if (t != tp2->t_tspec) {
1221 			/*
1222 			 * Give pointer to types which differ only in
1223 			 * signedness a chance if not sflag and not hflag.
1224 			 */
1225 			if (sflag || hflag || to != PTR)
1226 				return (0);
1227 			if (styp(t) != styp(tp2->t_tspec))
1228 				return (0);
1229 		}
1230 
1231 		if (tp1->t_isenum && tp2->t_isenum) {
1232 			if (tp1->t_istag && tp2->t_istag) {
1233 				return (tp1->t_tag == tp2->t_tag);
1234 			} else if (tp1->t_istynam && tp2->t_istynam) {
1235 				return (tp1->t_tynam == tp2->t_tynam);
1236 			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1237 				return (tp1->t_uniqpos.p_line ==
1238 				      tp2->t_uniqpos.p_line &&
1239 				    tp1->t_uniqpos.p_file ==
1240 				      tp2->t_uniqpos.p_file &&
1241 				    tp1->t_uniqpos.p_uniq ==
1242 				      tp2->t_uniqpos.p_uniq);
1243 			} else {
1244 				return (0);
1245 			}
1246 		}
1247 
1248 		/*
1249 		 * XXX Handle combinations of enum and int if eflag is set.
1250 		 * But note: enum and 0 should be allowed.
1251 		 */
1252 
1253 		if (asgn && indir == 1) {
1254 			if (!tp1->t_const && tp2->t_const)
1255 				return (0);
1256 			if (!tp1->t_volatile && tp2->t_volatile)
1257 				return (0);
1258 		} else if (!ignqual && !tflag) {
1259 			if (tp1->t_const != tp2->t_const)
1260 				return (0);
1261 			if (tp1->t_const != tp2->t_const)
1262 				return (0);
1263 		}
1264 
1265 		if (t == STRUCT || t == UNION) {
1266 			if (tp1->t_istag && tp2->t_istag) {
1267 				return (tp1->t_tag == tp2->t_tag);
1268 			} else if (tp1->t_istynam && tp2->t_istynam) {
1269 				return (tp1->t_tynam == tp2->t_tynam);
1270 			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1271 				return (tp1->t_uniqpos.p_line ==
1272 				      tp2->t_uniqpos.p_line &&
1273 				    tp1->t_uniqpos.p_file ==
1274 				      tp2->t_uniqpos.p_file &&
1275 				    tp1->t_uniqpos.p_uniq ==
1276 				      tp2->t_uniqpos.p_uniq);
1277 			} else {
1278 				return (0);
1279 			}
1280 		}
1281 
1282 		if (t == ARRAY && tp1->t_dim != tp2->t_dim) {
1283 			if (tp1->t_dim != 0 && tp2->t_dim != 0)
1284 				return (0);
1285 		}
1286 
1287 		if (t == FUNC) {
1288 			if (tp1->t_proto && tp2->t_proto) {
1289 				if (!eqargs(tp1, tp2, warn))
1290 					return (0);
1291 			} else if (tp1->t_proto) {
1292 				if (!mnoarg(tp1, warn))
1293 					return (0);
1294 			} else if (tp2->t_proto) {
1295 				if (!mnoarg(tp2, warn))
1296 					return (0);
1297 			}
1298 		}
1299 
1300 		tp1 = tp1->t_subt;
1301 		tp2 = tp2->t_subt;
1302 		ignqual = promot = 0;
1303 		to = t;
1304 		indir++;
1305 
1306 	}
1307 
1308 	return (tp1 == tp2);
1309 }
1310 
1311 /*
1312  * Compares arguments of two prototypes
1313  */
1314 static int
1315 eqargs(type_t *tp1, type_t *tp2, int *warn)
1316 {
1317 	type_t	**a1, **a2;
1318 
1319 	if (tp1->t_vararg != tp2->t_vararg)
1320 		return (0);
1321 
1322 	a1 = tp1->t_args;
1323 	a2 = tp2->t_args;
1324 
1325 	while (*a1 != NULL && *a2 != NULL) {
1326 
1327 		if (eqtype(*a1, *a2, 1, 0, 0, warn) == 0)
1328 			return (0);
1329 
1330 		a1++;
1331 		a2++;
1332 
1333 	}
1334 
1335 	return (*a1 == *a2);
1336 }
1337 
1338 /*
1339  * mnoarg() (matches functions with no argument type information)
1340  * returns 1 if all parameters of a prototype are compatible with
1341  * and old style function declaration.
1342  * This is the case if following conditions are met:
1343  *	1. the prototype must have a fixed number of parameters
1344  *	2. no parameter is of type float
1345  *	3. no parameter is converted to another type if integer promotion
1346  *	   is applied on it
1347  */
1348 static int
1349 mnoarg(type_t *tp, int *warn)
1350 {
1351 	type_t	**arg;
1352 	tspec_t	t;
1353 
1354 	if (tp->t_vararg && warn != NULL)
1355 		*warn = 1;
1356 	for (arg = tp->t_args; *arg != NULL; arg++) {
1357 		if ((t = (*arg)->t_tspec) == FLOAT)
1358 			return (0);
1359 		if (t == CHAR || t == SCHAR || t == UCHAR)
1360 			return (0);
1361 		if (t == SHORT || t == USHORT)
1362 			return (0);
1363 	}
1364 	return (1);
1365 }
1366