1 //= ScanfFormatString.cpp - Analysis of printf format strings --*- C++ -*-===//
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 // Handling of format string in scanf and friends.  The structure of format
12 //===----------------------------------------------------------------------===//
14 #include "clang/AST/FormatString.h"
16 #include "clang/Basic/TargetInfo.h"
18 using clang::analyze_format_string::ArgType;
19 using clang::analyze_format_string::FormatStringHandler;
20 using clang::analyze_format_string::LengthModifier;
21 using clang::analyze_format_string::OptionalAmount;
22 using clang::analyze_format_string::ConversionSpecifier;
23 using clang::analyze_scanf::ScanfConversionSpecifier;
24 using clang::analyze_scanf::ScanfSpecifier;
25 using clang::UpdateOnReturn;
26 using namespace clang;
28 typedef clang::analyze_format_string::SpecifierResult<ScanfSpecifier>
35   const char *start = I - 1;  in ParseScanList()
47       H.HandleIncompleteScanList(start, I - 1);  in ParseScanList()
56       H.HandleIncompleteScanList(start, I - 1);  in ParseScanList()
64       H.HandleIncompleteScanList(start, I - 1);  in ParseScanList()
73 // FIXME: Much of this is copy-paste from ParsePrintfSpecifier.
81   using namespace clang::analyze_format_string;  in ParseScanfSpecifier()
82   using namespace clang::analyze_scanf;  in ParseScanfSpecifier()
87     // Look for a '%' character that indicates the start of a format specifier.  in ParseScanfSpecifier()
96       Start = I++;  // Record the start of the format specifier.  in ParseScanfSpecifier()
101     // No format specifier found?  in ParseScanfSpecifier()
107     H.HandleIncompleteSpecifier(Start, E - Start);  in ParseScanfSpecifier()
117     H.HandleIncompleteSpecifier(Start, E - Start);  in ParseScanfSpecifier()
125       H.HandleIncompleteSpecifier(Start, E - Start);  in ParseScanfSpecifier()
132   const OptionalAmount &Amt = clang::analyze_format_string::ParseAmount(I, E);  in ParseScanfSpecifier()
139       H.HandleIncompleteSpecifier(Start, E - Start);  in ParseScanfSpecifier()
147     H.HandleIncompleteSpecifier(Start, E - Start);  in ParseScanfSpecifier()
187       // Apple-specific  in ParseScanfSpecifier()
215     unsigned Len = I - Beg;  in ParseScanfSpecifier()
374     // Write-back.  in getArgType()
422   if (!QT->isPointerType())  in fixType()
425   QualType PT = QT->getPointeeType();  in fixType()
428   if (const EnumType *ETy = PT->getAs<EnumType>()) {  in fixType()
430     if (!ETy->getDecl()->isComplete())  in fixType()
432     PT = ETy->getDecl()->getIntegerType();  in fixType()
435   const BuiltinType *BT = PT->getAs<BuiltinType>();  in fixType()
440   if (PT->isAnyCharacterType()) {  in fixType()
442     if (PT->isWideCharType())  in fixType()
449       if (CAT->getSizeModifier() == ArraySizeModifier::Normal)  in fixType()
451                                     CAT->getZExtSize() - 1, "", 0, false);  in fixType()
457   switch (BT->getKind()) {  in fixType()
514   if (PT->isRealFloatingType())  in fixType()
516   else if (PT->isSignedIntegerType())  in fixType()
518   else if (PT->isUnsignedIntegerType())  in fixType()
539 bool clang::analyze_format_string::ParseScanfString(FormatStringHandler &H,  in ParseScanfString()
547   // Keep looking for a format specifier until we have exhausted the string.  in ParseScanfString()
551     // Did a fail-stop error of any kind occur when parsing the specifier?  in ParseScanfString()
559       // We have a format specifier.  Pass it to the callback.  in ParseScanfString()
561                                 I - FSR.getStart())) {  in ParseScanfString()
565   assert(I == E && "Format string not exhausted");  in ParseScanfString()