1 //= ScanfFormatString.cpp - Analysis of printf format strings --*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // Handling of format string in scanf and friends. The structure of format
11 // strings for fscanf() are described in C99 7.19.6.2.
13 //===----------------------------------------------------------------------===//
15 #include "clang/Analysis/Analyses/FormatString.h"
16 #include "FormatStringParsing.h"
17 #include "clang/Basic/TargetInfo.h"
19 using clang::analyze_format_string::ArgType;
20 using clang::analyze_format_string::FormatStringHandler;
21 using clang::analyze_format_string::LengthModifier;
22 using clang::analyze_format_string::OptionalAmount;
23 using clang::analyze_format_string::ConversionSpecifier;
24 using clang::analyze_scanf::ScanfConversionSpecifier;
25 using clang::analyze_scanf::ScanfSpecifier;
26 using clang::UpdateOnReturn;
27 using namespace clang;
29 typedef clang::analyze_format_string::SpecifierResult<ScanfSpecifier>
32 static bool ParseScanList(FormatStringHandler &H,
33 ScanfConversionSpecifier &CS,
34 const char *&Beg, const char *E) {
36 const char *start = I - 1;
37 UpdateOnReturn <const char*> UpdateBeg(Beg, I);
39 // No more characters?
41 H.HandleIncompleteScanList(start, I);
45 // Special case: ']' is the first character.
48 H.HandleIncompleteScanList(start, I - 1);
53 // Special case: "^]" are the first characters.
54 if (I + 1 != E && I[0] == '^' && I[1] == ']') {
57 H.HandleIncompleteScanList(start, I - 1);
62 // Look for a ']' character which denotes the end of the scan list.
65 H.HandleIncompleteScanList(start, I - 1);
74 // FIXME: Much of this is copy-paste from ParsePrintfSpecifier.
75 // We can possibly refactor.
76 static ScanfSpecifierResult ParseScanfSpecifier(FormatStringHandler &H,
80 const LangOptions &LO,
81 const TargetInfo &Target) {
82 using namespace clang::analyze_format_string;
83 using namespace clang::analyze_scanf;
85 const char *Start = nullptr;
86 UpdateOnReturn <const char*> UpdateBeg(Beg, I);
88 // Look for a '%' character that indicates the start of a format specifier.
89 for ( ; I != E ; ++I) {
92 // Detect spurious null characters, which are likely errors.
97 Start = I++; // Record the start of the format specifier.
102 // No format specifier found?
107 // No more characters left?
108 H.HandleIncompleteSpecifier(Start, E - Start);
113 if (ParseArgPosition(H, FS, Start, I, E))
117 // No more characters left?
118 H.HandleIncompleteSpecifier(Start, E - Start);
122 // Look for '*' flag if it is present.
124 FS.setSuppressAssignment(I);
126 H.HandleIncompleteSpecifier(Start, E - Start);
131 // Look for the field width (if any). Unlike printf, this is either
132 // a fixed integer or isn't present.
133 const OptionalAmount &Amt = clang::analyze_format_string::ParseAmount(I, E);
134 if (Amt.getHowSpecified() != OptionalAmount::NotSpecified) {
135 assert(Amt.getHowSpecified() == OptionalAmount::Constant);
136 FS.setFieldWidth(Amt);
139 // No more characters left?
140 H.HandleIncompleteSpecifier(Start, E - Start);
145 // Look for the length modifier.
146 if (ParseLengthModifier(FS, I, E, LO, /*scanf=*/true) && I == E) {
147 // No more characters left?
148 H.HandleIncompleteSpecifier(Start, E - Start);
152 // Detect spurious null characters, which are likely errors.
158 // Finally, look for the conversion specifier.
159 const char *conversionPosition = I++;
160 ScanfConversionSpecifier::Kind k = ScanfConversionSpecifier::InvalidSpecifier;
161 switch (*conversionPosition) {
164 case '%': k = ConversionSpecifier::PercentArg; break;
165 case 'A': k = ConversionSpecifier::AArg; break;
166 case 'E': k = ConversionSpecifier::EArg; break;
167 case 'F': k = ConversionSpecifier::FArg; break;
168 case 'G': k = ConversionSpecifier::GArg; break;
169 case 'X': k = ConversionSpecifier::XArg; break;
170 case 'a': k = ConversionSpecifier::aArg; break;
171 case 'd': k = ConversionSpecifier::dArg; break;
172 case 'e': k = ConversionSpecifier::eArg; break;
173 case 'f': k = ConversionSpecifier::fArg; break;
174 case 'g': k = ConversionSpecifier::gArg; break;
175 case 'i': k = ConversionSpecifier::iArg; break;
176 case 'n': k = ConversionSpecifier::nArg; break;
177 case 'c': k = ConversionSpecifier::cArg; break;
178 case 'C': k = ConversionSpecifier::CArg; break;
179 case 'S': k = ConversionSpecifier::SArg; break;
180 case '[': k = ConversionSpecifier::ScanListArg; break;
181 case 'u': k = ConversionSpecifier::uArg; break;
182 case 'x': k = ConversionSpecifier::xArg; break;
183 case 'o': k = ConversionSpecifier::oArg; break;
184 case 's': k = ConversionSpecifier::sArg; break;
185 case 'p': k = ConversionSpecifier::pArg; break;
189 if (Target.getTriple().isOSDarwin())
190 k = ConversionSpecifier::DArg;
193 if (Target.getTriple().isOSDarwin())
194 k = ConversionSpecifier::OArg;
197 if (Target.getTriple().isOSDarwin())
198 k = ConversionSpecifier::UArg;
201 ScanfConversionSpecifier CS(conversionPosition, k);
202 if (k == ScanfConversionSpecifier::ScanListArg) {
203 if (ParseScanList(H, CS, I, E))
206 FS.setConversionSpecifier(CS);
207 if (CS.consumesDataArgument() && !FS.getSuppressAssignment()
208 && !FS.usesPositionalArg())
209 FS.setArgIndex(argIndex++);
211 // FIXME: '%' and '*' doesn't make sense. Issue a warning.
212 // FIXME: 'ConsumedSoFar' and '*' doesn't make sense.
214 if (k == ScanfConversionSpecifier::InvalidSpecifier) {
215 unsigned Len = I - Beg;
216 if (ParseUTF8InvalidSpecifier(Beg, E, Len)) {
217 CS.setEndScanList(Beg + Len);
218 FS.setConversionSpecifier(CS);
220 // Assume the conversion takes one argument.
221 return !H.HandleInvalidScanfConversionSpecifier(FS, Beg, Len);
223 return ScanfSpecifierResult(Start, FS);
226 ArgType ScanfSpecifier::getArgType(ASTContext &Ctx) const {
227 const ScanfConversionSpecifier &CS = getConversionSpecifier();
229 if (!CS.consumesDataArgument())
230 return ArgType::Invalid();
232 switch(CS.getKind()) {
234 case ConversionSpecifier::dArg:
235 case ConversionSpecifier::DArg:
236 case ConversionSpecifier::iArg:
237 switch (LM.getKind()) {
238 case LengthModifier::None:
239 return ArgType::PtrTo(Ctx.IntTy);
240 case LengthModifier::AsChar:
241 return ArgType::PtrTo(ArgType::AnyCharTy);
242 case LengthModifier::AsShort:
243 return ArgType::PtrTo(Ctx.ShortTy);
244 case LengthModifier::AsLong:
245 return ArgType::PtrTo(Ctx.LongTy);
246 case LengthModifier::AsLongLong:
247 case LengthModifier::AsQuad:
248 return ArgType::PtrTo(Ctx.LongLongTy);
249 case LengthModifier::AsInt64:
250 return ArgType::PtrTo(ArgType(Ctx.LongLongTy, "__int64"));
251 case LengthModifier::AsIntMax:
252 return ArgType::PtrTo(ArgType(Ctx.getIntMaxType(), "intmax_t"));
253 case LengthModifier::AsSizeT:
254 return ArgType::PtrTo(ArgType(Ctx.getSignedSizeType(), "ssize_t"));
255 case LengthModifier::AsPtrDiff:
256 return ArgType::PtrTo(ArgType(Ctx.getPointerDiffType(), "ptrdiff_t"));
257 case LengthModifier::AsLongDouble:
259 return ArgType::PtrTo(Ctx.LongLongTy);
260 case LengthModifier::AsAllocate:
261 case LengthModifier::AsMAllocate:
262 case LengthModifier::AsInt32:
263 case LengthModifier::AsInt3264:
264 case LengthModifier::AsWide:
265 return ArgType::Invalid();
269 case ConversionSpecifier::oArg:
270 case ConversionSpecifier::OArg:
271 case ConversionSpecifier::uArg:
272 case ConversionSpecifier::UArg:
273 case ConversionSpecifier::xArg:
274 case ConversionSpecifier::XArg:
275 switch (LM.getKind()) {
276 case LengthModifier::None:
277 return ArgType::PtrTo(Ctx.UnsignedIntTy);
278 case LengthModifier::AsChar:
279 return ArgType::PtrTo(Ctx.UnsignedCharTy);
280 case LengthModifier::AsShort:
281 return ArgType::PtrTo(Ctx.UnsignedShortTy);
282 case LengthModifier::AsLong:
283 return ArgType::PtrTo(Ctx.UnsignedLongTy);
284 case LengthModifier::AsLongLong:
285 case LengthModifier::AsQuad:
286 return ArgType::PtrTo(Ctx.UnsignedLongLongTy);
287 case LengthModifier::AsInt64:
288 return ArgType::PtrTo(ArgType(Ctx.UnsignedLongLongTy, "unsigned __int64"));
289 case LengthModifier::AsIntMax:
290 return ArgType::PtrTo(ArgType(Ctx.getUIntMaxType(), "uintmax_t"));
291 case LengthModifier::AsSizeT:
292 return ArgType::PtrTo(ArgType(Ctx.getSizeType(), "size_t"));
293 case LengthModifier::AsPtrDiff:
294 return ArgType::PtrTo(
295 ArgType(Ctx.getUnsignedPointerDiffType(), "unsigned ptrdiff_t"));
296 case LengthModifier::AsLongDouble:
298 return ArgType::PtrTo(Ctx.UnsignedLongLongTy);
299 case LengthModifier::AsAllocate:
300 case LengthModifier::AsMAllocate:
301 case LengthModifier::AsInt32:
302 case LengthModifier::AsInt3264:
303 case LengthModifier::AsWide:
304 return ArgType::Invalid();
308 case ConversionSpecifier::aArg:
309 case ConversionSpecifier::AArg:
310 case ConversionSpecifier::eArg:
311 case ConversionSpecifier::EArg:
312 case ConversionSpecifier::fArg:
313 case ConversionSpecifier::FArg:
314 case ConversionSpecifier::gArg:
315 case ConversionSpecifier::GArg:
316 switch (LM.getKind()) {
317 case LengthModifier::None:
318 return ArgType::PtrTo(Ctx.FloatTy);
319 case LengthModifier::AsLong:
320 return ArgType::PtrTo(Ctx.DoubleTy);
321 case LengthModifier::AsLongDouble:
322 return ArgType::PtrTo(Ctx.LongDoubleTy);
324 return ArgType::Invalid();
327 // Char, string and scanlist.
328 case ConversionSpecifier::cArg:
329 case ConversionSpecifier::sArg:
330 case ConversionSpecifier::ScanListArg:
331 switch (LM.getKind()) {
332 case LengthModifier::None:
333 return ArgType::PtrTo(ArgType::AnyCharTy);
334 case LengthModifier::AsLong:
335 case LengthModifier::AsWide:
336 return ArgType::PtrTo(ArgType(Ctx.getWideCharType(), "wchar_t"));
337 case LengthModifier::AsAllocate:
338 case LengthModifier::AsMAllocate:
339 return ArgType::PtrTo(ArgType::CStrTy);
340 case LengthModifier::AsShort:
341 if (Ctx.getTargetInfo().getTriple().isOSMSVCRT())
342 return ArgType::PtrTo(ArgType::AnyCharTy);
345 return ArgType::Invalid();
347 case ConversionSpecifier::CArg:
348 case ConversionSpecifier::SArg:
349 // FIXME: Mac OS X specific?
350 switch (LM.getKind()) {
351 case LengthModifier::None:
352 case LengthModifier::AsWide:
353 return ArgType::PtrTo(ArgType(Ctx.getWideCharType(), "wchar_t"));
354 case LengthModifier::AsAllocate:
355 case LengthModifier::AsMAllocate:
356 return ArgType::PtrTo(ArgType(ArgType::WCStrTy, "wchar_t *"));
357 case LengthModifier::AsShort:
358 if (Ctx.getTargetInfo().getTriple().isOSMSVCRT())
359 return ArgType::PtrTo(ArgType::AnyCharTy);
362 return ArgType::Invalid();
366 case ConversionSpecifier::pArg:
367 return ArgType::PtrTo(ArgType::CPointerTy);
370 case ConversionSpecifier::nArg:
371 switch (LM.getKind()) {
372 case LengthModifier::None:
373 return ArgType::PtrTo(Ctx.IntTy);
374 case LengthModifier::AsChar:
375 return ArgType::PtrTo(Ctx.SignedCharTy);
376 case LengthModifier::AsShort:
377 return ArgType::PtrTo(Ctx.ShortTy);
378 case LengthModifier::AsLong:
379 return ArgType::PtrTo(Ctx.LongTy);
380 case LengthModifier::AsLongLong:
381 case LengthModifier::AsQuad:
382 return ArgType::PtrTo(Ctx.LongLongTy);
383 case LengthModifier::AsInt64:
384 return ArgType::PtrTo(ArgType(Ctx.LongLongTy, "__int64"));
385 case LengthModifier::AsIntMax:
386 return ArgType::PtrTo(ArgType(Ctx.getIntMaxType(), "intmax_t"));
387 case LengthModifier::AsSizeT:
388 return ArgType::PtrTo(ArgType(Ctx.getSignedSizeType(), "ssize_t"));
389 case LengthModifier::AsPtrDiff:
390 return ArgType::PtrTo(ArgType(Ctx.getPointerDiffType(), "ptrdiff_t"));
391 case LengthModifier::AsLongDouble:
392 return ArgType(); // FIXME: Is this a known extension?
393 case LengthModifier::AsAllocate:
394 case LengthModifier::AsMAllocate:
395 case LengthModifier::AsInt32:
396 case LengthModifier::AsInt3264:
397 case LengthModifier::AsWide:
398 return ArgType::Invalid();
408 bool ScanfSpecifier::fixType(QualType QT, QualType RawQT,
409 const LangOptions &LangOpt,
412 // %n is different from other conversion specifiers; don't try to fix it.
413 if (CS.getKind() == ConversionSpecifier::nArg)
416 if (!QT->isPointerType())
419 QualType PT = QT->getPointeeType();
421 // If it's an enum, get its underlying type.
422 if (const EnumType *ETy = PT->getAs<EnumType>()) {
423 // Don't try to fix incomplete enums.
424 if (!ETy->getDecl()->isComplete())
426 PT = ETy->getDecl()->getIntegerType();
429 const BuiltinType *BT = PT->getAs<BuiltinType>();
433 // Pointer to a character.
434 if (PT->isAnyCharacterType()) {
435 CS.setKind(ConversionSpecifier::sArg);
436 if (PT->isWideCharType())
437 LM.setKind(LengthModifier::AsWideChar);
439 LM.setKind(LengthModifier::None);
441 // If we know the target array length, we can use it as a field width.
442 if (const ConstantArrayType *CAT = Ctx.getAsConstantArrayType(RawQT)) {
443 if (CAT->getSizeModifier() == ArrayType::Normal)
444 FieldWidth = OptionalAmount(OptionalAmount::Constant,
445 CAT->getSize().getZExtValue() - 1,
452 // Figure out the length modifier.
453 switch (BT->getKind()) {
455 case BuiltinType::UInt:
456 case BuiltinType::Int:
457 case BuiltinType::Float:
458 LM.setKind(LengthModifier::None);
462 case BuiltinType::Char_U:
463 case BuiltinType::UChar:
464 case BuiltinType::Char_S:
465 case BuiltinType::SChar:
466 LM.setKind(LengthModifier::AsChar);
470 case BuiltinType::Short:
471 case BuiltinType::UShort:
472 LM.setKind(LengthModifier::AsShort);
476 case BuiltinType::Long:
477 case BuiltinType::ULong:
478 case BuiltinType::Double:
479 LM.setKind(LengthModifier::AsLong);
483 case BuiltinType::LongLong:
484 case BuiltinType::ULongLong:
485 LM.setKind(LengthModifier::AsLongLong);
489 case BuiltinType::LongDouble:
490 LM.setKind(LengthModifier::AsLongDouble);
498 // Handle size_t, ptrdiff_t, etc. that have dedicated length modifiers in C99.
499 if (isa<TypedefType>(PT) && (LangOpt.C99 || LangOpt.CPlusPlus11))
500 namedTypeToLengthModifier(PT, LM);
502 // If fixing the length modifier was enough, we are done.
503 if (hasValidLengthModifier(Ctx.getTargetInfo())) {
504 const analyze_scanf::ArgType &AT = getArgType(Ctx);
505 if (AT.isValid() && AT.matchesType(Ctx, QT))
509 // Figure out the conversion specifier.
510 if (PT->isRealFloatingType())
511 CS.setKind(ConversionSpecifier::fArg);
512 else if (PT->isSignedIntegerType())
513 CS.setKind(ConversionSpecifier::dArg);
514 else if (PT->isUnsignedIntegerType())
515 CS.setKind(ConversionSpecifier::uArg);
517 llvm_unreachable("Unexpected type");
522 void ScanfSpecifier::toString(raw_ostream &os) const {
525 if (usesPositionalArg())
526 os << getPositionalArgIndex() << "$";
527 if (SuppressAssignment)
530 FieldWidth.toString(os);
535 bool clang::analyze_format_string::ParseScanfString(FormatStringHandler &H,
538 const LangOptions &LO,
539 const TargetInfo &Target) {
541 unsigned argIndex = 0;
543 // Keep looking for a format specifier until we have exhausted the string.
545 const ScanfSpecifierResult &FSR = ParseScanfSpecifier(H, I, E, argIndex,
547 // Did a fail-stop error of any kind occur when parsing the specifier?
548 // If so, don't do any more processing.
549 if (FSR.shouldStop())
551 // Did we exhaust the string or encounter an error that
552 // we can recover from?
555 // We have a format specifier. Pass it to the callback.
556 if (!H.HandleScanfSpecifier(FSR.getValue(), FSR.getStart(),
557 I - FSR.getStart())) {
561 assert(I == E && "Format string not exhausted");