From: Ted Kremenek <kremenek@apple.com>
Date: Tue, 24 Aug 2010 22:24:51 +0000 (+0000)
Subject: Fix printf format string checking for '%lc' (which expects a wint_t or compatible... 
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=9325eaf08fcccbc0d038e703f570c64daacdaa31;p=clang

Fix printf format string checking for '%lc' (which expects a wint_t or compatible argument).  Fixes PR 7981.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@111978 91177308-0d34-0410-b5e6-96231b3b80d8
---

diff --git a/include/clang/Analysis/Analyses/FormatString.h b/include/clang/Analysis/Analyses/FormatString.h
index 3a5722a54a..280b1260ac 100644
--- a/include/clang/Analysis/Analyses/FormatString.h
+++ b/include/clang/Analysis/Analyses/FormatString.h
@@ -199,7 +199,7 @@ protected:
 class ArgTypeResult {
 public:
   enum Kind { UnknownTy, InvalidTy, SpecificTy, ObjCPointerTy, CPointerTy,
-    CStrTy, WCStrTy };
+    CStrTy, WCStrTy, WIntTy };
 private:
   const Kind K;
   QualType T;
diff --git a/lib/Analysis/FormatString.cpp b/lib/Analysis/FormatString.cpp
index a6cfba228e..388b9d34a2 100644
--- a/lib/Analysis/FormatString.cpp
+++ b/lib/Analysis/FormatString.cpp
@@ -277,6 +277,23 @@ bool ArgTypeResult::matchesType(ASTContext &C, QualType argTy) const {
         C.getCanonicalType(PT->getPointeeType()).getUnqualifiedType();
       return pointeeTy == C.getWCharType();
     }
+    
+    case WIntTy: {
+      // Instead of doing a lookup for the definition of 'wint_t' (which
+      // is defined by the system headers) instead see if wchar_t and
+      // the argument type promote to the same type.
+      QualType PromoWChar =
+        C.getWCharType()->isPromotableIntegerType() 
+          ? C.getPromotedIntegerType(C.getWCharType()) : C.getWCharType();
+      QualType PromoArg = 
+        argTy->isPromotableIntegerType()
+          ? C.getPromotedIntegerType(argTy) : argTy;
+      
+      PromoWChar = C.getCanonicalType(PromoWChar).getUnqualifiedType();
+      PromoArg = C.getCanonicalType(PromoArg).getUnqualifiedType();
+      
+      return PromoWChar == PromoArg;
+    }
 
     case CPointerTy:
       return argTy->getAs<PointerType>() != NULL ||
@@ -308,6 +325,10 @@ QualType ArgTypeResult::getRepresentativeType(ASTContext &C) const {
       return C.ObjCBuiltinIdTy;
     case CPointerTy:
       return C.VoidPtrTy;
+    case WIntTy: {
+      QualType WC = C.getWCharType();
+      return WC->isPromotableIntegerType() ? C.getPromotedIntegerType(WC) : WC;
+    }
   }
 
   // FIXME: Should be unreachable, but Clang is currently emitting
diff --git a/lib/Analysis/PrintfFormatString.cpp b/lib/Analysis/PrintfFormatString.cpp
index 727de2934f..b8c327cdeb 100644
--- a/lib/Analysis/PrintfFormatString.cpp
+++ b/lib/Analysis/PrintfFormatString.cpp
@@ -281,6 +281,14 @@ ArgTypeResult PrintfSpecifier::getArgType(ASTContext &Ctx) const {
   if (!CS.consumesDataArgument())
     return ArgTypeResult::Invalid();
 
+  if (CS.getKind() == ConversionSpecifier::cArg)
+    switch (LM.getKind()) {
+      case LengthModifier::None: return Ctx.IntTy;
+      case LengthModifier::AsLong: return ArgTypeResult::WIntTy;
+      default:
+        return ArgTypeResult::Invalid();
+    }
+  
   if (CS.isIntArg())
     switch (LM.getKind()) {
       case LengthModifier::AsLongDouble:
diff --git a/lib/Sema/SemaChecking.cpp b/lib/Sema/SemaChecking.cpp
index 6148faaf90..61d209f683 100644
--- a/lib/Sema/SemaChecking.cpp
+++ b/lib/Sema/SemaChecking.cpp
@@ -1595,6 +1595,9 @@ CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
       llvm::raw_svector_ostream os(buf);
       fixedFS.toString(os);
 
+      // FIXME: getRepresentativeType() perhaps should return a string
+      // instead of a QualType to better handle when the representative
+      // type is 'wint_t' (which is defined in the system headers).
       S.Diag(getLocationOfByte(CS.getStart()),
           diag::warn_printf_conversion_argument_type_mismatch)
         << ATR.getRepresentativeType(S.Context) << Ex->getType()
diff --git a/test/Sema/format-strings.c b/test/Sema/format-strings.c
index 080e4dbeb5..2325454c0b 100644
--- a/test/Sema/format-strings.c
+++ b/test/Sema/format-strings.c
@@ -286,3 +286,18 @@ void bug7377_bad_length_mod_usage() {
   printf("%-0f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
   printf("%-+f", 1.23); // no-warning
 }
+
+// PR 7981 - handle '%lc' (wint_t)
+#ifndef wint_t
+typedef int __darwin_wint_t;
+typedef __darwin_wint_t wint_t;
+#endif
+
+void pr7981(wint_t c, wchar_t c2) {
+  printf("%lc", c); // no-warning
+  printf("%lc", 1.0); // expected-warning{{the argument has type 'double'}}
+  printf("%lc", (char) 1); // no-warning
+  printf("%lc", &c); // expected-warning{{the argument has type 'wint_t *' (aka 'int *')}}
+  printf("%lc", c2); // no-warning
+}
+