1 //= ScanfFormatString.cpp - Analysis of printf format strings --*- C++ -*-===// 2 // 3 // The LLVM Compiler Infrastructure 4 // 5 // This file is distributed under the University of Illinois Open Source 6 // License. See LICENSE.TXT for details. 7 // 8 //===----------------------------------------------------------------------===// 9 // 10 // Handling of format string in scanf and friends. The structure of format 11 // strings for fscanf() are described in C99 7.19.6.2. 12 // 13 //===----------------------------------------------------------------------===// 14 15 #include "clang/Analysis/Analyses/FormatString.h" 16 #include "FormatStringParsing.h" 17 #include "clang/Basic/TargetInfo.h" 18 19 using clang::analyze_format_string::ArgType; 20 using clang::analyze_format_string::FormatStringHandler; 21 using clang::analyze_format_string::LengthModifier; 22 using clang::analyze_format_string::OptionalAmount; 23 using clang::analyze_format_string::ConversionSpecifier; 24 using clang::analyze_scanf::ScanfConversionSpecifier; 25 using clang::analyze_scanf::ScanfSpecifier; 26 using clang::UpdateOnReturn; 27 using namespace clang; 28 29 typedef clang::analyze_format_string::SpecifierResult<ScanfSpecifier> 30 ScanfSpecifierResult; 31 32 static bool ParseScanList(FormatStringHandler &H, 33 ScanfConversionSpecifier &CS, 34 const char *&Beg, const char *E) { 35 const char *I = Beg; 36 const char *start = I - 1; 37 UpdateOnReturn <const char*> UpdateBeg(Beg, I); 38 39 // No more characters? 40 if (I == E) { 41 H.HandleIncompleteScanList(start, I); 42 return true; 43 } 44 45 // Special case: ']' is the first character. 46 if (*I == ']') { 47 if (++I == E) { 48 H.HandleIncompleteScanList(start, I - 1); 49 return true; 50 } 51 } 52 53 // Special case: "^]" are the first characters. 54 if (I + 1 != E && I[0] == '^' && I[1] == ']') { 55 I += 2; 56 if (I == E) { 57 H.HandleIncompleteScanList(start, I - 1); 58 return true; 59 } 60 } 61 62 // Look for a ']' character which denotes the end of the scan list. 63 while (*I != ']') { 64 if (++I == E) { 65 H.HandleIncompleteScanList(start, I - 1); 66 return true; 67 } 68 } 69 70 CS.setEndScanList(I); 71 return false; 72 } 73 74 // FIXME: Much of this is copy-paste from ParsePrintfSpecifier. 75 // We can possibly refactor. 76 static ScanfSpecifierResult ParseScanfSpecifier(FormatStringHandler &H, 77 const char *&Beg, 78 const char *E, 79 unsigned &argIndex, 80 const LangOptions &LO, 81 const TargetInfo &Target) { 82 83 using namespace clang::analyze_scanf; 84 const char *I = Beg; 85 const char *Start = nullptr; 86 UpdateOnReturn <const char*> UpdateBeg(Beg, I); 87 88 // Look for a '%' character that indicates the start of a format specifier. 89 for ( ; I != E ; ++I) { 90 char c = *I; 91 if (c == '\0') { 92 // Detect spurious null characters, which are likely errors. 93 H.HandleNullChar(I); 94 return true; 95 } 96 if (c == '%') { 97 Start = I++; // Record the start of the format specifier. 98 break; 99 } 100 } 101 102 // No format specifier found? 103 if (!Start) 104 return false; 105 106 if (I == E) { 107 // No more characters left? 108 H.HandleIncompleteSpecifier(Start, E - Start); 109 return true; 110 } 111 112 ScanfSpecifier FS; 113 if (ParseArgPosition(H, FS, Start, I, E)) 114 return true; 115 116 if (I == E) { 117 // No more characters left? 118 H.HandleIncompleteSpecifier(Start, E - Start); 119 return true; 120 } 121 122 // Look for '*' flag if it is present. 123 if (*I == '*') { 124 FS.setSuppressAssignment(I); 125 if (++I == E) { 126 H.HandleIncompleteSpecifier(Start, E - Start); 127 return true; 128 } 129 } 130 131 // Look for the field width (if any). Unlike printf, this is either 132 // a fixed integer or isn't present. 133 const OptionalAmount &Amt = clang::analyze_format_string::ParseAmount(I, E); 134 if (Amt.getHowSpecified() != OptionalAmount::NotSpecified) { 135 assert(Amt.getHowSpecified() == OptionalAmount::Constant); 136 FS.setFieldWidth(Amt); 137 138 if (I == E) { 139 // No more characters left? 140 H.HandleIncompleteSpecifier(Start, E - Start); 141 return true; 142 } 143 } 144 145 // Look for the length modifier. 146 if (ParseLengthModifier(FS, I, E, LO, /*scanf=*/true) && I == E) { 147 // No more characters left? 148 H.HandleIncompleteSpecifier(Start, E - Start); 149 return true; 150 } 151 152 // Detect spurious null characters, which are likely errors. 153 if (*I == '\0') { 154 H.HandleNullChar(I); 155 return true; 156 } 157 158 // Finally, look for the conversion specifier. 159 const char *conversionPosition = I++; 160 ScanfConversionSpecifier::Kind k = ScanfConversionSpecifier::InvalidSpecifier; 161 switch (*conversionPosition) { 162 default: 163 break; 164 case '%': k = ConversionSpecifier::PercentArg; break; 165 case 'A': k = ConversionSpecifier::AArg; break; 166 case 'E': k = ConversionSpecifier::EArg; break; 167 case 'F': k = ConversionSpecifier::FArg; break; 168 case 'G': k = ConversionSpecifier::GArg; break; 169 case 'X': k = ConversionSpecifier::XArg; break; 170 case 'a': k = ConversionSpecifier::aArg; break; 171 case 'd': k = ConversionSpecifier::dArg; break; 172 case 'e': k = ConversionSpecifier::eArg; break; 173 case 'f': k = ConversionSpecifier::fArg; break; 174 case 'g': k = ConversionSpecifier::gArg; break; 175 case 'i': k = ConversionSpecifier::iArg; break; 176 case 'n': k = ConversionSpecifier::nArg; break; 177 case 'c': k = ConversionSpecifier::cArg; break; 178 case 'C': k = ConversionSpecifier::CArg; break; 179 case 'S': k = ConversionSpecifier::SArg; break; 180 case '[': k = ConversionSpecifier::ScanListArg; break; 181 case 'u': k = ConversionSpecifier::uArg; break; 182 case 'x': k = ConversionSpecifier::xArg; break; 183 case 'o': k = ConversionSpecifier::oArg; break; 184 case 's': k = ConversionSpecifier::sArg; break; 185 case 'p': k = ConversionSpecifier::pArg; break; 186 // Apple extensions 187 // Apple-specific 188 case 'D': 189 if (Target.getTriple().isOSDarwin()) 190 k = ConversionSpecifier::DArg; 191 break; 192 case 'O': 193 if (Target.getTriple().isOSDarwin()) 194 k = ConversionSpecifier::OArg; 195 break; 196 case 'U': 197 if (Target.getTriple().isOSDarwin()) 198 k = ConversionSpecifier::UArg; 199 break; 200 } 201 ScanfConversionSpecifier CS(conversionPosition, k); 202 if (k == ScanfConversionSpecifier::ScanListArg) { 203 if (ParseScanList(H, CS, I, E)) 204 return true; 205 } 206 FS.setConversionSpecifier(CS); 207 if (CS.consumesDataArgument() && !FS.getSuppressAssignment() 208 && !FS.usesPositionalArg()) 209 FS.setArgIndex(argIndex++); 210 211 // FIXME: '%' and '*' doesn't make sense. Issue a warning. 212 // FIXME: 'ConsumedSoFar' and '*' doesn't make sense. 213 214 if (k == ScanfConversionSpecifier::InvalidSpecifier) { 215 // Assume the conversion takes one argument. 216 return !H.HandleInvalidScanfConversionSpecifier(FS, Beg, I - Beg); 217 } 218 return ScanfSpecifierResult(Start, FS); 219 } 220 221 ArgType ScanfSpecifier::getArgType(ASTContext &Ctx) const { 222 const ScanfConversionSpecifier &CS = getConversionSpecifier(); 223 224 if (!CS.consumesDataArgument()) 225 return ArgType::Invalid(); 226 227 switch(CS.getKind()) { 228 // Signed int. 229 case ConversionSpecifier::dArg: 230 case ConversionSpecifier::DArg: 231 case ConversionSpecifier::iArg: 232 switch (LM.getKind()) { 233 case LengthModifier::None: 234 return ArgType::PtrTo(Ctx.IntTy); 235 case LengthModifier::AsChar: 236 return ArgType::PtrTo(ArgType::AnyCharTy); 237 case LengthModifier::AsShort: 238 return ArgType::PtrTo(Ctx.ShortTy); 239 case LengthModifier::AsLong: 240 return ArgType::PtrTo(Ctx.LongTy); 241 case LengthModifier::AsLongLong: 242 case LengthModifier::AsQuad: 243 return ArgType::PtrTo(Ctx.LongLongTy); 244 case LengthModifier::AsInt64: 245 return ArgType::PtrTo(ArgType(Ctx.LongLongTy, "__int64")); 246 case LengthModifier::AsIntMax: 247 return ArgType::PtrTo(ArgType(Ctx.getIntMaxType(), "intmax_t")); 248 case LengthModifier::AsSizeT: 249 // FIXME: ssize_t. 250 return ArgType(); 251 case LengthModifier::AsPtrDiff: 252 return ArgType::PtrTo(ArgType(Ctx.getPointerDiffType(), "ptrdiff_t")); 253 case LengthModifier::AsLongDouble: 254 // GNU extension. 255 return ArgType::PtrTo(Ctx.LongLongTy); 256 case LengthModifier::AsAllocate: 257 case LengthModifier::AsMAllocate: 258 case LengthModifier::AsInt32: 259 case LengthModifier::AsInt3264: 260 case LengthModifier::AsWide: 261 return ArgType::Invalid(); 262 } 263 264 // Unsigned int. 265 case ConversionSpecifier::oArg: 266 case ConversionSpecifier::OArg: 267 case ConversionSpecifier::uArg: 268 case ConversionSpecifier::UArg: 269 case ConversionSpecifier::xArg: 270 case ConversionSpecifier::XArg: 271 switch (LM.getKind()) { 272 case LengthModifier::None: 273 return ArgType::PtrTo(Ctx.UnsignedIntTy); 274 case LengthModifier::AsChar: 275 return ArgType::PtrTo(Ctx.UnsignedCharTy); 276 case LengthModifier::AsShort: 277 return ArgType::PtrTo(Ctx.UnsignedShortTy); 278 case LengthModifier::AsLong: 279 return ArgType::PtrTo(Ctx.UnsignedLongTy); 280 case LengthModifier::AsLongLong: 281 case LengthModifier::AsQuad: 282 return ArgType::PtrTo(Ctx.UnsignedLongLongTy); 283 case LengthModifier::AsInt64: 284 return ArgType::PtrTo(ArgType(Ctx.UnsignedLongLongTy, "unsigned __int64")); 285 case LengthModifier::AsIntMax: 286 return ArgType::PtrTo(ArgType(Ctx.getUIntMaxType(), "uintmax_t")); 287 case LengthModifier::AsSizeT: 288 return ArgType::PtrTo(ArgType(Ctx.getSizeType(), "size_t")); 289 case LengthModifier::AsPtrDiff: 290 // FIXME: Unsigned version of ptrdiff_t? 291 return ArgType(); 292 case LengthModifier::AsLongDouble: 293 // GNU extension. 294 return ArgType::PtrTo(Ctx.UnsignedLongLongTy); 295 case LengthModifier::AsAllocate: 296 case LengthModifier::AsMAllocate: 297 case LengthModifier::AsInt32: 298 case LengthModifier::AsInt3264: 299 case LengthModifier::AsWide: 300 return ArgType::Invalid(); 301 } 302 303 // Float. 304 case ConversionSpecifier::aArg: 305 case ConversionSpecifier::AArg: 306 case ConversionSpecifier::eArg: 307 case ConversionSpecifier::EArg: 308 case ConversionSpecifier::fArg: 309 case ConversionSpecifier::FArg: 310 case ConversionSpecifier::gArg: 311 case ConversionSpecifier::GArg: 312 switch (LM.getKind()) { 313 case LengthModifier::None: 314 return ArgType::PtrTo(Ctx.FloatTy); 315 case LengthModifier::AsLong: 316 return ArgType::PtrTo(Ctx.DoubleTy); 317 case LengthModifier::AsLongDouble: 318 return ArgType::PtrTo(Ctx.LongDoubleTy); 319 default: 320 return ArgType::Invalid(); 321 } 322 323 // Char, string and scanlist. 324 case ConversionSpecifier::cArg: 325 case ConversionSpecifier::sArg: 326 case ConversionSpecifier::ScanListArg: 327 switch (LM.getKind()) { 328 case LengthModifier::None: 329 return ArgType::PtrTo(ArgType::AnyCharTy); 330 case LengthModifier::AsLong: 331 case LengthModifier::AsWide: 332 return ArgType::PtrTo(ArgType(Ctx.getWideCharType(), "wchar_t")); 333 case LengthModifier::AsAllocate: 334 case LengthModifier::AsMAllocate: 335 return ArgType::PtrTo(ArgType::CStrTy); 336 case LengthModifier::AsShort: 337 if (Ctx.getTargetInfo().getTriple().isOSMSVCRT()) 338 return ArgType::PtrTo(ArgType::AnyCharTy); 339 default: 340 return ArgType::Invalid(); 341 } 342 case ConversionSpecifier::CArg: 343 case ConversionSpecifier::SArg: 344 // FIXME: Mac OS X specific? 345 switch (LM.getKind()) { 346 case LengthModifier::None: 347 case LengthModifier::AsWide: 348 return ArgType::PtrTo(ArgType(Ctx.getWideCharType(), "wchar_t")); 349 case LengthModifier::AsAllocate: 350 case LengthModifier::AsMAllocate: 351 return ArgType::PtrTo(ArgType(ArgType::WCStrTy, "wchar_t *")); 352 case LengthModifier::AsShort: 353 if (Ctx.getTargetInfo().getTriple().isOSMSVCRT()) 354 return ArgType::PtrTo(ArgType::AnyCharTy); 355 default: 356 return ArgType::Invalid(); 357 } 358 359 // Pointer. 360 case ConversionSpecifier::pArg: 361 return ArgType::PtrTo(ArgType::CPointerTy); 362 363 // Write-back. 364 case ConversionSpecifier::nArg: 365 switch (LM.getKind()) { 366 case LengthModifier::None: 367 return ArgType::PtrTo(Ctx.IntTy); 368 case LengthModifier::AsChar: 369 return ArgType::PtrTo(Ctx.SignedCharTy); 370 case LengthModifier::AsShort: 371 return ArgType::PtrTo(Ctx.ShortTy); 372 case LengthModifier::AsLong: 373 return ArgType::PtrTo(Ctx.LongTy); 374 case LengthModifier::AsLongLong: 375 case LengthModifier::AsQuad: 376 return ArgType::PtrTo(Ctx.LongLongTy); 377 case LengthModifier::AsInt64: 378 return ArgType::PtrTo(ArgType(Ctx.LongLongTy, "__int64")); 379 case LengthModifier::AsIntMax: 380 return ArgType::PtrTo(ArgType(Ctx.getIntMaxType(), "intmax_t")); 381 case LengthModifier::AsSizeT: 382 return ArgType(); // FIXME: ssize_t 383 case LengthModifier::AsPtrDiff: 384 return ArgType::PtrTo(ArgType(Ctx.getPointerDiffType(), "ptrdiff_t")); 385 case LengthModifier::AsLongDouble: 386 return ArgType(); // FIXME: Is this a known extension? 387 case LengthModifier::AsAllocate: 388 case LengthModifier::AsMAllocate: 389 case LengthModifier::AsInt32: 390 case LengthModifier::AsInt3264: 391 case LengthModifier::AsWide: 392 return ArgType::Invalid(); 393 } 394 395 default: 396 break; 397 } 398 399 return ArgType(); 400 } 401 402 bool ScanfSpecifier::fixType(QualType QT, QualType RawQT, 403 const LangOptions &LangOpt, 404 ASTContext &Ctx) { 405 406 // %n is different from other conversion specifiers; don't try to fix it. 407 if (CS.getKind() == ConversionSpecifier::nArg) 408 return false; 409 410 if (!QT->isPointerType()) 411 return false; 412 413 QualType PT = QT->getPointeeType(); 414 415 // If it's an enum, get its underlying type. 416 if (const EnumType *ETy = PT->getAs<EnumType>()) 417 PT = ETy->getDecl()->getIntegerType(); 418 419 const BuiltinType *BT = PT->getAs<BuiltinType>(); 420 if (!BT) 421 return false; 422 423 // Pointer to a character. 424 if (PT->isAnyCharacterType()) { 425 CS.setKind(ConversionSpecifier::sArg); 426 if (PT->isWideCharType()) 427 LM.setKind(LengthModifier::AsWideChar); 428 else 429 LM.setKind(LengthModifier::None); 430 431 // If we know the target array length, we can use it as a field width. 432 if (const ConstantArrayType *CAT = Ctx.getAsConstantArrayType(RawQT)) { 433 if (CAT->getSizeModifier() == ArrayType::Normal) 434 FieldWidth = OptionalAmount(OptionalAmount::Constant, 435 CAT->getSize().getZExtValue() - 1, 436 "", 0, false); 437 438 } 439 return true; 440 } 441 442 // Figure out the length modifier. 443 switch (BT->getKind()) { 444 // no modifier 445 case BuiltinType::UInt: 446 case BuiltinType::Int: 447 case BuiltinType::Float: 448 LM.setKind(LengthModifier::None); 449 break; 450 451 // hh 452 case BuiltinType::Char_U: 453 case BuiltinType::UChar: 454 case BuiltinType::Char_S: 455 case BuiltinType::SChar: 456 LM.setKind(LengthModifier::AsChar); 457 break; 458 459 // h 460 case BuiltinType::Short: 461 case BuiltinType::UShort: 462 LM.setKind(LengthModifier::AsShort); 463 break; 464 465 // l 466 case BuiltinType::Long: 467 case BuiltinType::ULong: 468 case BuiltinType::Double: 469 LM.setKind(LengthModifier::AsLong); 470 break; 471 472 // ll 473 case BuiltinType::LongLong: 474 case BuiltinType::ULongLong: 475 LM.setKind(LengthModifier::AsLongLong); 476 break; 477 478 // L 479 case BuiltinType::LongDouble: 480 LM.setKind(LengthModifier::AsLongDouble); 481 break; 482 483 // Don't know. 484 default: 485 return false; 486 } 487 488 // Handle size_t, ptrdiff_t, etc. that have dedicated length modifiers in C99. 489 if (isa<TypedefType>(PT) && (LangOpt.C99 || LangOpt.CPlusPlus11)) 490 namedTypeToLengthModifier(PT, LM); 491 492 // If fixing the length modifier was enough, we are done. 493 if (hasValidLengthModifier(Ctx.getTargetInfo())) { 494 const analyze_scanf::ArgType &AT = getArgType(Ctx); 495 if (AT.isValid() && AT.matchesType(Ctx, QT)) 496 return true; 497 } 498 499 // Figure out the conversion specifier. 500 if (PT->isRealFloatingType()) 501 CS.setKind(ConversionSpecifier::fArg); 502 else if (PT->isSignedIntegerType()) 503 CS.setKind(ConversionSpecifier::dArg); 504 else if (PT->isUnsignedIntegerType()) 505 CS.setKind(ConversionSpecifier::uArg); 506 else 507 llvm_unreachable("Unexpected type"); 508 509 return true; 510 } 511 512 void ScanfSpecifier::toString(raw_ostream &os) const { 513 os << "%"; 514 515 if (usesPositionalArg()) 516 os << getPositionalArgIndex() << "$"; 517 if (SuppressAssignment) 518 os << "*"; 519 520 FieldWidth.toString(os); 521 os << LM.toString(); 522 os << CS.toString(); 523 } 524 525 bool clang::analyze_format_string::ParseScanfString(FormatStringHandler &H, 526 const char *I, 527 const char *E, 528 const LangOptions &LO, 529 const TargetInfo &Target) { 530 531 unsigned argIndex = 0; 532 533 // Keep looking for a format specifier until we have exhausted the string. 534 while (I != E) { 535 const ScanfSpecifierResult &FSR = ParseScanfSpecifier(H, I, E, argIndex, 536 LO, Target); 537 // Did a fail-stop error of any kind occur when parsing the specifier? 538 // If so, don't do any more processing. 539 if (FSR.shouldStop()) 540 return true; 541 // Did we exhaust the string or encounter an error that 542 // we can recover from? 543 if (!FSR.hasValue()) 544 continue; 545 // We have a format specifier. Pass it to the callback. 546 if (!H.HandleScanfSpecifier(FSR.getValue(), FSR.getStart(), 547 I - FSR.getStart())) { 548 return true; 549 } 550 } 551 assert(I == E && "Format string not exhausted"); 552 return false; 553 } 554