| /* { dg-do compile } */ |
| /* { dg-options "-Wformat -Wformat-overflow=2 -ftrack-macro-expansion=0" } */ |
| |
| /* When debugging, define LINE to the line number of the test case to exercise |
| and avoid exercising any of the others. The buffer and objsize macros |
| below make use of LINE to avoid warnings for other lines. */ |
| #ifndef LINE |
| # define LINE 0 |
| #endif |
| |
| char buffer [256]; |
| extern char *ptr; |
| |
| #define buffer(size) \ |
| (!LINE || __LINE__ == LINE ? buffer + sizeof buffer - size : ptr) |
| |
| #define objsize(size) (!LINE || __LINE__ == LINE ? size : __SIZE_MAX__ / 2) |
| |
| typedef __SIZE_TYPE__ size_t; |
| |
| #if !__cplusplus |
| typedef __WCHAR_TYPE__ wchar_t; |
| #endif |
| |
| typedef unsigned char UChar; |
| |
| #define T(size, fmt, ...) \ |
| __builtin_sprintf (buffer (size), fmt, __VA_ARGS__) |
| |
| __builtin_va_list va; |
| |
| /* Exercise buffer overflow detection with const string arguments. */ |
| |
| void test_s_const (void) |
| { |
| /* Wide string literals are handled slightly differently than |
| at level 1. At level 1, each wide character is assumed to |
| convert into a single byte. At level 2, they are assumed |
| to convert into at least one byte. */ |
| T (0, "%ls", L""); /* { dg-warning "nul past the end" } */ |
| T (1, "%ls", L""); |
| T (1, "%ls", L"\0"); |
| T (1, "%1ls", L""); /* { dg-warning "nul past the end" } */ |
| |
| T (0, "%*ls", 0, L""); /* { dg-warning "nul past the end" } */ |
| T (1, "%*ls", 0, L""); |
| T (1, "%*ls", 0, L"\0"); |
| T (1, "%*ls", 1, L""); /* { dg-warning "nul past the end" } */ |
| |
| /* A wide character converts into between zero and MB_LEN_MAX bytes |
| (although individual ASCII characters are assumed to convert into |
| 1 bt %lc so this could be made smarter. */ |
| T (1, "%ls", L"1"); /* { dg-warning "directive writing up to 6 bytes into a region of size 1" } */ |
| T (1, "%.0ls", L"1"); |
| T (2, "%.0ls", L"1"); |
| T (2, "%.1ls", L"1"); |
| T (2, "%.2ls", L"1"); /* { dg-warning "nul past the end" } */ |
| T (2, "%.3ls", L"1"); /* { dg-warning "directive writing up to 3 bytes into a region of size 2" } */ |
| T (2, "%.7ls", L"1"); /* { dg-warning "directive writing up to 6 bytes into a region of size 2" } */ |
| T (2, "%.2ls", L"12"); /* { dg-warning "nul past the end" } */ |
| |
| /* The "%.2ls" directive below will write at a minimum 1 byte (because |
| L"1" is known and can be assumed to convert to at least one multibyte |
| character), and at most 2 bytes because of the precision. Since its |
| output is explicitly bounded it is diagnosed. */ |
| T (2, "%.2ls", L"1"); /* { dg-warning "nul past the end" } */ |
| T (2, "%.*ls", 2, L"1"); /* { dg-warning "nul past the end" } */ |
| |
| /* The following three are constrained by the precision to at most |
| that many bytes of the converted wide string plus a terminating NUL. */ |
| T (2, "%.0ls", L"1"); |
| T (2, "%.1ls", L"1"); |
| T (3, "%.2ls", L"1"); |
| T (3, "%.2ls", L"12"); |
| T (3, "%.3ls", L"12"); /* { dg-warning "nul past the end" } */ |
| T (4, "%.3ls", L"123"); |
| T (4, "%.4ls", L"123"); /* { dg-warning "nul past the end" } */ |
| T (4, "%.5ls", L"123"); /* { dg-warning "directive writing up to 5 bytes into a region of size 4" } */ |
| T (4, "%.6ls", L"123"); /* { dg-warning "directive writing up to 6 bytes into a region of size 4" } */ |
| } |
| |
| |
| struct Arrays { |
| char a1 [1]; |
| char a2 [2]; |
| char a3 [3]; |
| char a4 [4]; |
| char a0 [0]; |
| char ax []; |
| }; |
| |
| /* Exercise buffer overflow detection with non-const string arguments. */ |
| |
| void test_s_nonconst (int w, int p, const char *s, const wchar_t *ws, |
| struct Arrays *a) |
| { |
| T (0, "%s", s); /* { dg-warning "into a region" } */ |
| T (1, "%s", s); /* { dg-warning "nul past the end" } */ |
| T (1, "%1s", s); /* { dg-warning "writing a terminating nul" } */ |
| T (1, "%.0s", s); |
| T (1, "%.1s", s); /* { dg-warning "may write a terminating nul" } */ |
| T (1, "%*s", 0, s); /* { dg-warning "may write a terminating nul" } */ |
| T (1, "%*s", 1, s); /* { dg-warning "writing a terminating nul" } */ |
| T (1, "%*s", 2, s); /* { dg-warning "directive writing 2 or more bytes" } */ |
| T (1, "%*s", 3, s); /* { dg-warning "directive writing 3 or more bytes" } */ |
| |
| T (1, "%.*s", 1, s); /* { dg-warning "may write a terminating nul" } */ |
| T (1, "%.*s", 2, s); /* { dg-warning "writing up to 2 bytes" } */ |
| T (1, "%.*s", 3, s); /* { dg-warning "writing up to 3 bytes" } */ |
| |
| T (1, "%.0ls", ws); |
| T (1, "%.1ls", ws); /* { dg-warning "may write a terminating nul" } */ |
| T (1, "%ls", ws); /* { dg-warning "may write a terminating nul" } */ |
| |
| /* Verify that the size of the array is used in lieu of its length. */ |
| T (1, "%s", a->a1); |
| |
| /* In the following test, since the length of the strings isn't known, |
| their type (the array) is used to bound the maximum length to 1, |
| which means the "%s" directive would not overflow the buffer, |
| but it would leave no room for the terminating nul. */ |
| T (1, "%s", a->a2); /* { dg-warning "may write a terminating nul" } */ |
| |
| /* Unlike in the test above, since the length of the string is bounded |
| by the array type to at most 2, the "%s" directive is diagnosed firts, |
| preventing the diagnostic about the terminatinb nul. */ |
| T (1, "%s", a->a3); /* { dg-warning "directive writing up to 2 bytes" } */ |
| |
| /* The length of a zero length array and flexible array member is |
| unknown and at leve 2 assumed to be at least 1. */ |
| T (1, "%s", a->a0); /* { dg-warning "may write a terminating nul" } */ |
| T (1, "%s", a->ax); /* { dg-warning "may write a terminating nul" } */ |
| |
| T (2, "%s", a->a0); |
| T (2, "%s", a->ax); |
| } |
| |
| /* Exercise buffer overflow detection with non-const integer arguments. */ |
| |
| void test_hh_nonconst (int w, int p, int x, unsigned y) |
| { |
| T (1, "%hhi", x); /* { dg-warning "into a region" } */ |
| T (2, "%hhi", x); /* { dg-warning "into a region" } */ |
| T (3, "%hhi", x); /* { dg-warning "into a region" } */ |
| T (4, "%hhi", x); /* { dg-warning "may write a terminating nul past the end of the destination" } */ |
| |
| T (1, "%hhi", y); /* { dg-warning "between 1 and 4 bytes" } */ |
| T (2, "%hhi", y); /* { dg-warning "into a region" } */ |
| T (3, "%hhi", y); /* { dg-warning "into a region" } */ |
| T (4, "%hhi", y); /* { dg-warning "may write a terminating nul past the end of the destination" } */ |
| |
| /* Negative precision is treated as if none were specified. */ |
| T (1, "%.*hhi", -1, x); /* { dg-warning "between 1 and 4 bytes" } */ |
| T (2, "%.*hhi", -1, x); /* { dg-warning "into a region" } */ |
| T (3, "%.*hhi", -1, x); /* { dg-warning "into a region" } */ |
| T (4, "%.*hhi", -1, x); /* { dg-warning "may write a terminating nul past the end of the destination" } */ |
| |
| /* Zero precision means that zero argument formats as no bytes unless |
| length or flags make it otherwise. */ |
| T (1, "%.*hhi", 0, x); /* { dg-warning "writing up to 4 bytes" } */ |
| T (2, "%.*hhi", 0, x); /* { dg-warning "writing up to 4 bytes" } */ |
| T (3, "%.*hhi", 0, x); /* { dg-warning "writing up to 4 bytes" } */ |
| T (4, "%.*hhi", 0, x); /* { dg-warning "may write a terminating nul past the end of the destination" } */ |
| |
| T (1, "%.*hhi", 0, y); /* { dg-warning "writing up to 4 bytes" } */ |
| T (2, "%.*hhi", 0, y); /* { dg-warning "writing up to 4 bytes" } */ |
| T (3, "%.*hhi", 0, y); /* { dg-warning "writing up to 4 bytes" } */ |
| T (4, "%.*hhi", 0, y); /* { dg-warning "may write a terminating nul past the end of the destination" } */ |
| |
| T (1, "%#.*hhi", 0, y); /* { dg-warning "writing up to 4 bytes" } */ |
| /* { dg-warning ".#. flag used" "-Wformat" { target *-*-* } .-1 } */ |
| T (1, "%+.*hhi", 0, y); /* { dg-warning "between 1 and 4 bytes" } */ |
| T (1, "%-.*hhi", 0, y); /* { dg-warning "writing up to 4 bytes" } */ |
| T (1, "% .*hhi", 0, y); /* { dg-warning "between 1 and 4 bytes" } */ |
| |
| T (1, "%#.*hhi", 1, y); /* { dg-warning "between 1 and 4 bytes" } */ |
| /* { dg-warning ".#. flag used" "-Wformat" { target *-*-* } .-1 } */ |
| T (1, "%+.*hhi", 1, y); /* { dg-warning "between 2 and 4 bytes" } */ |
| T (1, "%-.*hhi", 1, y); /* { dg-warning "between 1 and 4 bytes" } */ |
| T (1, "% .*hhi", 1, y); /* { dg-warning "between 2 and 4 bytes" } */ |
| |
| T (1, "%#.*hhi", p, y); /* { dg-warning "writing up to \[0-9\]+ bytes" } */ |
| /* { dg-warning ".#. flag used" "-Wformat" { target *-*-* } .-1 } */ |
| T (1, "%+.*hhi", p, y); /* { dg-warning "writing 1 or more bytes|writing between 1 and \[0-9\]+ bytes" } */ |
| T (1, "%-.*hhi", p, y); /* { dg-warning "writing up to \[0-9\]+ bytes" } */ |
| T (1, "% .*hhi", p, y); /* { dg-warning "writing between 1 and \[0-9\]+ bytes|writing 1 or more bytes" } */ |
| |
| T (1, "%#.*hhu", 0, y); /* { dg-warning "writing up to 3 bytes" } */ |
| /* { dg-warning ".#. flag used" "-Wformat" { target *-*-* } .-1 } */ |
| T (1, "%+.*hhu", 0, y); /* { dg-warning "writing up to 3 bytes" } */ |
| /* { dg-warning ".\\+. flag used" "-Wformat" { target *-*-* } .-1 } */ |
| T (1, "%-.*hhu", 0, y); /* { dg-warning "writing up to 3 bytes" } */ |
| T (1, "% .*hhu", 0, y); /* { dg-warning "writing up to 3 bytes" } */ |
| /* { dg-warning ". . flag used" "-Wformat" { target *-*-* } .-1 } */ |
| } |
| |
| void test_h_nonconst (int x) |
| { |
| extern UChar uc; |
| |
| T (1, "%hi", uc); /* { dg-warning "into a region" } */ |
| T (2, "%hi", uc); /* { dg-warning "into a region" } */ |
| /* Formatting an 8-bit unsigned char as a signed short (or any other |
| type with greater precision) can write at most 3 characters. */ |
| T (3, "%hi", uc); /* { dg-warning "terminating nul past" } */ |
| T (4, "%hi", uc); |
| |
| /* Verify that the same thing works when the int argument is cast |
| to unsigned char. */ |
| T (1, "%hi", (UChar)x); /* { dg-warning "into a region" } */ |
| T (2, "%hi", (UChar)x); /* { dg-warning "into a region" } */ |
| T (3, "%hi", (UChar)x); /* { dg-warning "may write a terminating nul past the end of the destination" } */ |
| T (4, "%hi", (UChar)x); |
| } |
| |
| void test_i_nonconst (int x) |
| { |
| extern UChar uc; |
| |
| T (1, "%i", uc); /* { dg-warning "into a region" } */ |
| T (2, "%i", uc); /* { dg-warning "into a region" } */ |
| T (3, "%i", uc); /* { dg-warning "terminating nul past" } */ |
| T (4, "%i", uc); |
| |
| T (1, "%i", (UChar)x); /* { dg-warning "into a region" } */ |
| T (2, "%i", (UChar)x); /* { dg-warning "into a region" } */ |
| T (3, "%i", (UChar)x); /* { dg-warning "terminating nul past" } */ |
| T (4, "%i", (UChar)x); |
| |
| /* Verify the same thing using a bit-field. */ |
| extern struct { |
| unsigned int b1: 1; |
| unsigned int b2: 2; |
| unsigned int b3: 3; |
| unsigned int b4: 4; |
| int sb4: 4; |
| unsigned int b5: 5; |
| unsigned int b6: 6; |
| unsigned int b7: 7; |
| unsigned int b8: 8; |
| } bf, abf[], *pbf; |
| |
| T (1, "%i", bf.b1); /* { dg-warning "nul past the end" } */ |
| T (1, "%i", abf [x].b1); /* { dg-warning "nul past the end" } */ |
| T (1, "%i", pbf->b1); /* { dg-warning "nul past the end" } */ |
| /* A one bit bit-field can only be formatted as '0' or '1'. Similarly, |
| two- and three-bit bit-fields can only be formatted as a single |
| decimal digit. */ |
| T (2, "%i", bf.b1); |
| T (2, "%i", abf [x].b1); |
| T (2, "%i", pbf->b1); |
| T (2, "%i", bf.b2); |
| T (2, "%i", abf [x].b2); |
| T (2, "%i", pbf->b2); |
| T (2, "%i", bf.b3); |
| T (2, "%i", abf [x].b3); |
| T (2, "%i", pbf->b3); |
| /* A four-bit bit-field can be formatted as either one or two digits. */ |
| T (2, "%i", bf.b4); /* { dg-warning "nul past the end" } */ |
| T (2, "%i", abf [x].b4); /* { dg-warning "nul past the end" } */ |
| T (2, "%i", pbf->b4); /* { dg-warning "nul past the end" } */ |
| |
| T (3, "%i", bf.b4); |
| T (3, "%i", pbf->b4); |
| T (3, "%i", bf.b5); |
| T (3, "%i", pbf->b5); |
| T (3, "%i", bf.b6); |
| T (3, "%i", pbf->b6); |
| T (3, "%i", bf.b7); /* { dg-warning "nul past the end" } */ |
| T (3, "%i", pbf->b7); /* { dg-warning "nul past the end" } */ |
| |
| T (1, "%i", bf.b8); /* { dg-warning "into a region" } */ |
| T (2, "%i", bf.b8); /* { dg-warning "into a region" } */ |
| /* Formatting an 8-bit unsigned char as a signed short (or any other |
| type with greater precision) int can write at most 3 characters. */ |
| T (3, "%i", bf.b8); /* { dg-warning "terminating nul past" } */ |
| T (4, "%i", bf.b8); |
| |
| T (1, "%i", bf.b8); /* { dg-warning "into a region" } */ |
| T (2, "%i", bf.b8); /* { dg-warning "into a region" } */ |
| T (3, "%i", bf.b8); /* { dg-warning "terminating nul past" } */ |
| |
| T (2, "%i", bf.sb4); /* { dg-warning "terminating nul past" } */ |
| T (3, "%i", bf.sb4); |
| T (4, "%i", bf.sb4); |
| } |
