scanf analysis: handle scanlists that start with ^] (PR19559)

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@207573 91177308-0d34-0410-b5e6-96231b3b80d8

diff --git a/lib/Analysis/ScanfFormatString.cpp b/lib/Analysis/ScanfFormatString.cpp
index 3ff7f0ad2e56a259cf67ba4c533f08f851f14a07..18505e263bef8cd3393ef8d3e35961fc9c48c2f6 100644 (file)
--- a/lib/Analysis/ScanfFormatString.cpp
+++ b/lib/Analysis/ScanfFormatString.cpp
@@ -50,6 +50,15 @@ static bool ParseScanList(FormatStringHandler &H,
     }
   }
 
+  // Special case: "]^" are the first characters.
+  if (I + 1 != E && I[0] == '^' && I[1] == ']') {
+    I += 2;
+    if (I == E) {
+      H.HandleIncompleteScanList(start, I - 1);
+      return true;
+    }
+  }
+
   // Look for a ']' character which denotes the end of the scan list.
   while (*I != ']') {
     if (++I == E) {

diff --git a/test/Sema/format-strings-scanf.c b/test/Sema/format-strings-scanf.c
index 381447c84a67e9241c0eda750afd867e87eea844..d3a03adf61959f358b86be44e631a01fb15364b5 100644 (file)
--- a/test/Sema/format-strings-scanf.c
+++ b/test/Sema/format-strings-scanf.c
@@ -86,6 +86,11 @@ void test_scanlist(int *ip, char *sp, wchar_t *ls) {
   scanf("%h[abc]", sp); // expected-warning{{length modifier 'h' results in undefined behavior or no effect with '[' conversion specifier}}
   scanf("%l[xyx]", ls); // no-warning
   scanf("%ll[xyx]", ls); // expected-warning {{length modifier 'll' results in undefined behavior or no effect with '[' conversion specifier}}
+
+  // PR19559
+  scanf("%[]% ]", sp); // no-warning
+  scanf("%[^]% ]", sp); // no-warning
+  scanf("%[a^]% ]", sp); // expected-warning {{invalid conversion specifier ' '}}
 }
 
 void test_alloc_extension(char **sp, wchar_t **lsp, float *fp) {