blob: d5a44cb8e0b70bc19b21aeb0e471bc9ba2fa13a9 [file] [log] [blame]
Ted Kremenekd9c904d2010-07-16 02:11:31 +00001//= ScanfFormatString.cpp - Analysis of printf format strings --*- C++ -*-===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// Handling of format string in scanf and friends. The structure of format
11// strings for fscanf() are described in C99 7.19.6.2.
12//
13//===----------------------------------------------------------------------===//
14
15#include "clang/Analysis/Analyses/FormatString.h"
16#include "FormatStringParsing.h"
17
18using clang::analyze_format_string::ArgTypeResult;
19using clang::analyze_format_string::FormatStringHandler;
20using clang::analyze_format_string::LengthModifier;
21using clang::analyze_format_string::OptionalAmount;
Ted Kremenek1e51c202010-07-20 20:04:47 +000022using clang::analyze_format_string::ConversionSpecifier;
Hans Wennborg6fcd9322011-12-10 13:20:11 +000023using clang::analyze_scanf::ScanfArgTypeResult;
Ted Kremenek6ecb9502010-07-20 20:04:27 +000024using clang::analyze_scanf::ScanfConversionSpecifier;
Ted Kremenekd9c904d2010-07-16 02:11:31 +000025using clang::analyze_scanf::ScanfSpecifier;
Dan Gohman3c46e8d2010-07-26 21:25:24 +000026using clang::UpdateOnReturn;
Hans Wennborg6fcd9322011-12-10 13:20:11 +000027using namespace clang;
Ted Kremenekd9c904d2010-07-16 02:11:31 +000028
29typedef clang::analyze_format_string::SpecifierResult<ScanfSpecifier>
30 ScanfSpecifierResult;
31
32static bool ParseScanList(FormatStringHandler &H,
Ted Kremenek6ecb9502010-07-20 20:04:27 +000033 ScanfConversionSpecifier &CS,
Ted Kremenekd9c904d2010-07-16 02:11:31 +000034 const char *&Beg, const char *E) {
35 const char *I = Beg;
36 const char *start = I - 1;
37 UpdateOnReturn <const char*> UpdateBeg(Beg, I);
38
39 // No more characters?
40 if (I == E) {
41 H.HandleIncompleteScanList(start, I);
42 return true;
43 }
44
45 // Special case: ']' is the first character.
46 if (*I == ']') {
47 if (++I == E) {
Ted Kremenekb7c21012010-07-16 18:28:03 +000048 H.HandleIncompleteScanList(start, I - 1);
Ted Kremenekd9c904d2010-07-16 02:11:31 +000049 return true;
50 }
51 }
52
53 // Look for a ']' character which denotes the end of the scan list.
54 while (*I != ']') {
55 if (++I == E) {
Ted Kremenekb7c21012010-07-16 18:28:03 +000056 H.HandleIncompleteScanList(start, I - 1);
Ted Kremenekd9c904d2010-07-16 02:11:31 +000057 return true;
58 }
59 }
60
61 CS.setEndScanList(I);
62 return false;
63}
64
65// FIXME: Much of this is copy-paste from ParsePrintfSpecifier.
66// We can possibly refactor.
67static ScanfSpecifierResult ParseScanfSpecifier(FormatStringHandler &H,
68 const char *&Beg,
69 const char *E,
Hans Wennborgd02deeb2011-12-15 10:25:47 +000070 unsigned &argIndex,
71 const LangOptions &LO) {
Ted Kremenekd9c904d2010-07-16 02:11:31 +000072
73 using namespace clang::analyze_scanf;
74 const char *I = Beg;
75 const char *Start = 0;
76 UpdateOnReturn <const char*> UpdateBeg(Beg, I);
77
78 // Look for a '%' character that indicates the start of a format specifier.
79 for ( ; I != E ; ++I) {
80 char c = *I;
81 if (c == '\0') {
82 // Detect spurious null characters, which are likely errors.
83 H.HandleNullChar(I);
84 return true;
85 }
86 if (c == '%') {
87 Start = I++; // Record the start of the format specifier.
88 break;
89 }
90 }
91
92 // No format specifier found?
93 if (!Start)
94 return false;
95
96 if (I == E) {
97 // No more characters left?
98 H.HandleIncompleteSpecifier(Start, E - Start);
99 return true;
100 }
101
102 ScanfSpecifier FS;
103 if (ParseArgPosition(H, FS, Start, I, E))
104 return true;
105
106 if (I == E) {
107 // No more characters left?
108 H.HandleIncompleteSpecifier(Start, E - Start);
109 return true;
110 }
111
112 // Look for '*' flag if it is present.
113 if (*I == '*') {
114 FS.setSuppressAssignment(I);
115 if (++I == E) {
116 H.HandleIncompleteSpecifier(Start, E - Start);
117 return true;
118 }
119 }
120
121 // Look for the field width (if any). Unlike printf, this is either
122 // a fixed integer or isn't present.
123 const OptionalAmount &Amt = clang::analyze_format_string::ParseAmount(I, E);
124 if (Amt.getHowSpecified() != OptionalAmount::NotSpecified) {
125 assert(Amt.getHowSpecified() == OptionalAmount::Constant);
126 FS.setFieldWidth(Amt);
127
128 if (I == E) {
129 // No more characters left?
130 H.HandleIncompleteSpecifier(Start, E - Start);
131 return true;
132 }
133 }
134
135 // Look for the length modifier.
Hans Wennborgd02deeb2011-12-15 10:25:47 +0000136 if (ParseLengthModifier(FS, I, E, LO, /*scanf=*/true) && I == E) {
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000137 // No more characters left?
138 H.HandleIncompleteSpecifier(Start, E - Start);
139 return true;
140 }
141
142 // Detect spurious null characters, which are likely errors.
143 if (*I == '\0') {
144 H.HandleNullChar(I);
145 return true;
146 }
147
148 // Finally, look for the conversion specifier.
149 const char *conversionPosition = I++;
Ted Kremenek6ecb9502010-07-20 20:04:27 +0000150 ScanfConversionSpecifier::Kind k = ScanfConversionSpecifier::InvalidSpecifier;
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000151 switch (*conversionPosition) {
152 default:
153 break;
Ted Kremenek1e51c202010-07-20 20:04:47 +0000154 case '%': k = ConversionSpecifier::PercentArg; break;
155 case 'A': k = ConversionSpecifier::AArg; break;
156 case 'E': k = ConversionSpecifier::EArg; break;
157 case 'F': k = ConversionSpecifier::FArg; break;
158 case 'G': k = ConversionSpecifier::GArg; break;
159 case 'X': k = ConversionSpecifier::XArg; break;
160 case 'a': k = ConversionSpecifier::aArg; break;
161 case 'd': k = ConversionSpecifier::dArg; break;
162 case 'e': k = ConversionSpecifier::eArg; break;
163 case 'f': k = ConversionSpecifier::fArg; break;
164 case 'g': k = ConversionSpecifier::gArg; break;
165 case 'i': k = ConversionSpecifier::iArg; break;
166 case 'n': k = ConversionSpecifier::nArg; break;
167 case 'c': k = ConversionSpecifier::cArg; break;
168 case 'C': k = ConversionSpecifier::CArg; break;
169 case 'S': k = ConversionSpecifier::SArg; break;
170 case '[': k = ConversionSpecifier::ScanListArg; break;
171 case 'u': k = ConversionSpecifier::uArg; break;
172 case 'x': k = ConversionSpecifier::xArg; break;
173 case 'o': k = ConversionSpecifier::oArg; break;
174 case 's': k = ConversionSpecifier::sArg; break;
175 case 'p': k = ConversionSpecifier::pArg; break;
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000176 }
Ted Kremenek6ecb9502010-07-20 20:04:27 +0000177 ScanfConversionSpecifier CS(conversionPosition, k);
178 if (k == ScanfConversionSpecifier::ScanListArg) {
Hans Wennborg6de0b482012-01-12 14:44:54 +0000179 if (ParseScanList(H, CS, I, E))
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000180 return true;
181 }
182 FS.setConversionSpecifier(CS);
183 if (CS.consumesDataArgument() && !FS.getSuppressAssignment()
184 && !FS.usesPositionalArg())
185 FS.setArgIndex(argIndex++);
186
187 // FIXME: '%' and '*' doesn't make sense. Issue a warning.
188 // FIXME: 'ConsumedSoFar' and '*' doesn't make sense.
189
Ted Kremenek6ecb9502010-07-20 20:04:27 +0000190 if (k == ScanfConversionSpecifier::InvalidSpecifier) {
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000191 // Assume the conversion takes one argument.
192 return !H.HandleInvalidScanfConversionSpecifier(FS, Beg, I - Beg);
193 }
194 return ScanfSpecifierResult(Start, FS);
195}
Hans Wennborg6fcd9322011-12-10 13:20:11 +0000196
197ScanfArgTypeResult ScanfSpecifier::getArgType(ASTContext &Ctx) const {
198 const ScanfConversionSpecifier &CS = getConversionSpecifier();
199
200 if (!CS.consumesDataArgument())
201 return ScanfArgTypeResult::Invalid();
202
203 switch(CS.getKind()) {
204 // Signed int.
205 case ConversionSpecifier::dArg:
206 case ConversionSpecifier::iArg:
207 switch (LM.getKind()) {
208 case LengthModifier::None: return ArgTypeResult(Ctx.IntTy);
209 case LengthModifier::AsChar:
210 return ArgTypeResult(ArgTypeResult::AnyCharTy);
211 case LengthModifier::AsShort: return ArgTypeResult(Ctx.ShortTy);
212 case LengthModifier::AsLong: return ArgTypeResult(Ctx.LongTy);
213 case LengthModifier::AsLongLong: return ArgTypeResult(Ctx.LongLongTy);
214 case LengthModifier::AsIntMax:
215 return ScanfArgTypeResult(Ctx.getIntMaxType(), "intmax_t *");
216 case LengthModifier::AsSizeT:
217 // FIXME: ssize_t.
218 return ScanfArgTypeResult();
219 case LengthModifier::AsPtrDiff:
220 return ScanfArgTypeResult(Ctx.getPointerDiffType(), "ptrdiff_t *");
221 case LengthModifier::AsLongDouble: return ScanfArgTypeResult::Invalid();
Hans Wennborgd02deeb2011-12-15 10:25:47 +0000222 case LengthModifier::AsAllocate: return ScanfArgTypeResult::Invalid();
Hans Wennborg37969b72012-01-12 17:11:12 +0000223 case LengthModifier::AsMAllocate: return ScanfArgTypeResult::Invalid();
Hans Wennborg6fcd9322011-12-10 13:20:11 +0000224 }
225
226 // Unsigned int.
227 case ConversionSpecifier::oArg:
228 case ConversionSpecifier::uArg:
229 case ConversionSpecifier::xArg:
230 case ConversionSpecifier::XArg:
231 switch (LM.getKind()) {
232 case LengthModifier::None: return ArgTypeResult(Ctx.UnsignedIntTy);
233 case LengthModifier::AsChar: return ArgTypeResult(Ctx.UnsignedCharTy);
234 case LengthModifier::AsShort: return ArgTypeResult(Ctx.UnsignedShortTy);
235 case LengthModifier::AsLong: return ArgTypeResult(Ctx.UnsignedLongTy);
236 case LengthModifier::AsLongLong:
237 return ArgTypeResult(Ctx.UnsignedLongLongTy);
238 case LengthModifier::AsIntMax:
239 return ScanfArgTypeResult(Ctx.getUIntMaxType(), "uintmax_t *");
240 case LengthModifier::AsSizeT:
241 return ScanfArgTypeResult(Ctx.getSizeType(), "size_t *");
242 case LengthModifier::AsPtrDiff:
243 // FIXME: Unsigned version of ptrdiff_t?
244 return ScanfArgTypeResult();
245 case LengthModifier::AsLongDouble: return ScanfArgTypeResult::Invalid();
Hans Wennborgd02deeb2011-12-15 10:25:47 +0000246 case LengthModifier::AsAllocate: return ScanfArgTypeResult::Invalid();
Hans Wennborg37969b72012-01-12 17:11:12 +0000247 case LengthModifier::AsMAllocate: return ScanfArgTypeResult::Invalid();
Hans Wennborg6fcd9322011-12-10 13:20:11 +0000248 }
249
250 // Float.
251 case ConversionSpecifier::aArg:
252 case ConversionSpecifier::AArg:
253 case ConversionSpecifier::eArg:
254 case ConversionSpecifier::EArg:
255 case ConversionSpecifier::fArg:
256 case ConversionSpecifier::FArg:
257 case ConversionSpecifier::gArg:
258 case ConversionSpecifier::GArg:
259 switch (LM.getKind()) {
260 case LengthModifier::None: return ArgTypeResult(Ctx.FloatTy);
261 case LengthModifier::AsLong: return ArgTypeResult(Ctx.DoubleTy);
262 case LengthModifier::AsLongDouble:
263 return ArgTypeResult(Ctx.LongDoubleTy);
264 default:
265 return ScanfArgTypeResult::Invalid();
266 }
267
268 // Char, string and scanlist.
269 case ConversionSpecifier::cArg:
270 case ConversionSpecifier::sArg:
271 case ConversionSpecifier::ScanListArg:
272 switch (LM.getKind()) {
273 case LengthModifier::None: return ScanfArgTypeResult::CStrTy;
274 case LengthModifier::AsLong:
275 return ScanfArgTypeResult(ScanfArgTypeResult::WCStrTy, "wchar_t *");
Hans Wennborg37969b72012-01-12 17:11:12 +0000276 case LengthModifier::AsAllocate:
277 case LengthModifier::AsMAllocate:
278 return ScanfArgTypeResult(ArgTypeResult::CStrTy);
Hans Wennborg6fcd9322011-12-10 13:20:11 +0000279 default:
280 return ScanfArgTypeResult::Invalid();
281 }
282 case ConversionSpecifier::CArg:
283 case ConversionSpecifier::SArg:
284 // FIXME: Mac OS X specific?
Hans Wennborg37969b72012-01-12 17:11:12 +0000285 switch (LM.getKind()) {
286 case LengthModifier::None:
287 return ScanfArgTypeResult(ScanfArgTypeResult::WCStrTy, "wchar_t *");
288 case LengthModifier::AsAllocate:
289 case LengthModifier::AsMAllocate:
290 return ScanfArgTypeResult(ArgTypeResult::WCStrTy, "wchar_t **");
291 default:
292 return ScanfArgTypeResult::Invalid();
293 }
Hans Wennborg6fcd9322011-12-10 13:20:11 +0000294
295 // Pointer.
296 case ConversionSpecifier::pArg:
297 return ScanfArgTypeResult(ArgTypeResult(ArgTypeResult::CPointerTy));
298
299 default:
300 break;
301 }
302
303 return ScanfArgTypeResult();
304}
305
306bool ScanfSpecifier::fixType(QualType QT, const LangOptions &LangOpt)
307{
308 if (!QT->isPointerType())
309 return false;
310
311 QualType PT = QT->getPointeeType();
312 const BuiltinType *BT = PT->getAs<BuiltinType>();
313 if (!BT)
314 return false;
315
316 // Pointer to a character.
317 if (PT->isAnyCharacterType()) {
318 CS.setKind(ConversionSpecifier::sArg);
319 if (PT->isWideCharType())
320 LM.setKind(LengthModifier::AsWideChar);
321 else
322 LM.setKind(LengthModifier::None);
323 return true;
324 }
325
326 // Figure out the length modifier.
327 switch (BT->getKind()) {
328 // no modifier
329 case BuiltinType::UInt:
330 case BuiltinType::Int:
331 case BuiltinType::Float:
332 LM.setKind(LengthModifier::None);
333 break;
334
335 // hh
336 case BuiltinType::Char_U:
337 case BuiltinType::UChar:
338 case BuiltinType::Char_S:
339 case BuiltinType::SChar:
340 LM.setKind(LengthModifier::AsChar);
341 break;
342
343 // h
344 case BuiltinType::Short:
345 case BuiltinType::UShort:
346 LM.setKind(LengthModifier::AsShort);
347 break;
348
349 // l
350 case BuiltinType::Long:
351 case BuiltinType::ULong:
352 case BuiltinType::Double:
353 LM.setKind(LengthModifier::AsLong);
354 break;
355
356 // ll
357 case BuiltinType::LongLong:
358 case BuiltinType::ULongLong:
359 LM.setKind(LengthModifier::AsLongLong);
360 break;
361
362 // L
363 case BuiltinType::LongDouble:
364 LM.setKind(LengthModifier::AsLongDouble);
365 break;
366
367 // Don't know.
368 default:
369 return false;
370 }
371
372 // Handle size_t, ptrdiff_t, etc. that have dedicated length modifiers in C99.
373 if (isa<TypedefType>(PT) && (LangOpt.C99 || LangOpt.CPlusPlus0x)) {
374 const IdentifierInfo *Identifier = QT.getBaseTypeIdentifier();
375 if (Identifier->getName() == "size_t") {
376 LM.setKind(LengthModifier::AsSizeT);
377 } else if (Identifier->getName() == "ssize_t") {
378 // Not C99, but common in Unix.
379 LM.setKind(LengthModifier::AsSizeT);
380 } else if (Identifier->getName() == "intmax_t") {
381 LM.setKind(LengthModifier::AsIntMax);
382 } else if (Identifier->getName() == "uintmax_t") {
383 LM.setKind(LengthModifier::AsIntMax);
384 } else if (Identifier->getName() == "ptrdiff_t") {
385 LM.setKind(LengthModifier::AsPtrDiff);
386 }
387 }
388
389 // Figure out the conversion specifier.
390 if (PT->isRealFloatingType())
391 CS.setKind(ConversionSpecifier::fArg);
392 else if (PT->isSignedIntegerType())
393 CS.setKind(ConversionSpecifier::dArg);
394 else if (PT->isUnsignedIntegerType()) {
395 // Preserve the original formatting, e.g. 'X', 'o'.
396 if (!CS.isUIntArg()) {
397 CS.setKind(ConversionSpecifier::uArg);
398 }
399 } else
400 llvm_unreachable("Unexpected type");
401
402 return true;
403}
404
405void ScanfSpecifier::toString(raw_ostream &os) const {
406 os << "%";
407
408 if (usesPositionalArg())
409 os << getPositionalArgIndex() << "$";
410 if (SuppressAssignment)
411 os << "*";
412
413 FieldWidth.toString(os);
414 os << LM.toString();
415 os << CS.toString();
416}
417
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000418bool clang::analyze_format_string::ParseScanfString(FormatStringHandler &H,
419 const char *I,
Hans Wennborgd02deeb2011-12-15 10:25:47 +0000420 const char *E,
421 const LangOptions &LO) {
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000422
423 unsigned argIndex = 0;
424
425 // Keep looking for a format specifier until we have exhausted the string.
426 while (I != E) {
Hans Wennborgd02deeb2011-12-15 10:25:47 +0000427 const ScanfSpecifierResult &FSR = ParseScanfSpecifier(H, I, E, argIndex,
428 LO);
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000429 // Did a fail-stop error of any kind occur when parsing the specifier?
430 // If so, don't do any more processing.
431 if (FSR.shouldStop())
432 return true;;
433 // Did we exhaust the string or encounter an error that
434 // we can recover from?
435 if (!FSR.hasValue())
436 continue;
437 // We have a format specifier. Pass it to the callback.
438 if (!H.HandleScanfSpecifier(FSR.getValue(), FSR.getStart(),
439 I - FSR.getStart())) {
440 return true;
441 }
442 }
443 assert(I == E && "Format string not exhausted");
444 return false;
445}
446
Hans Wennborg6fcd9322011-12-10 13:20:11 +0000447bool ScanfArgTypeResult::matchesType(ASTContext& C, QualType argTy) const {
448 switch (K) {
449 case InvalidTy:
450 llvm_unreachable("ArgTypeResult must be valid");
451 case UnknownTy:
452 return true;
453 case CStrTy:
454 return ArgTypeResult(ArgTypeResult::CStrTy).matchesType(C, argTy);
455 case WCStrTy:
456 return ArgTypeResult(ArgTypeResult::WCStrTy).matchesType(C, argTy);
457 case PtrToArgTypeResultTy: {
458 const PointerType *PT = argTy->getAs<PointerType>();
459 if (!PT)
460 return false;
461 return A.matchesType(C, PT->getPointeeType());
462 }
463 }
Ted Kremenekd9c904d2010-07-16 02:11:31 +0000464
Hans Wennborg6fcd9322011-12-10 13:20:11 +0000465 return false; // Unreachable, but we still get a warning.
466}
467
468QualType ScanfArgTypeResult::getRepresentativeType(ASTContext &C) const {
469 switch (K) {
470 case InvalidTy:
471 llvm_unreachable("No representative type for Invalid ArgTypeResult");
472 case UnknownTy:
473 return QualType();
474 case CStrTy:
475 return C.getPointerType(C.CharTy);
476 case WCStrTy:
477 return C.getPointerType(C.getWCharType());
478 case PtrToArgTypeResultTy:
479 return C.getPointerType(A.getRepresentativeType(C));
480 }
481
482 return QualType(); // Not reachable.
483}
484
485std::string ScanfArgTypeResult::getRepresentativeTypeName(ASTContext& C) const {
486 std::string S = getRepresentativeType(C).getAsString();
487 if (!Name)
488 return std::string("'") + S + "'";
489 return std::string("'") + Name + "' (aka '" + S + "')";
490}