1 /* Copyright (C) 2016-2017 Free Software Foundation, Inc.
2 Contributed by Martin Sebor <msebor@redhat.com>.
4 This file is part of GCC.
6 GCC is free software; you can redistribute it and/or modify it under
7 the terms of the GNU General Public License as published by the Free
8 Software Foundation; either version 3, or (at your option) any later
11 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
12 WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
16 You should have received a copy of the GNU General Public License
17 along with GCC; see the file COPYING3. If not see
18 <http://www.gnu.org/licenses/>. */
20 /* This file implements the printf-return-value pass. The pass does
21 two things: 1) it analyzes calls to formatted output functions like
22 sprintf looking for possible buffer overflows and calls to bounded
23 functions like snprintf for early truncation (and under the control
24 of the -Wformat-length option issues warnings), and 2) under the
25 control of the -fprintf-return-value option it folds the return
26 value of safe calls into constants, making it possible to eliminate
27 code that depends on the value of those constants.
29 For all functions (bounded or not) the pass uses the size of the
30 destination object. That means that it will diagnose calls to
31 snprintf not on the basis of the size specified by the function's
32 second argument but rathger on the basis of the size the first
33 argument points to (if possible). For bound-checking built-ins
34 like __builtin___snprintf_chk the pass uses the size typically
35 determined by __builtin_object_size and passed to the built-in
36 by the Glibc inline wrapper.
38 The pass handles all forms standard sprintf format directives,
39 including character, integer, floating point, pointer, and strings,
40 with the standard C flags, widths, and precisions. For integers
41 and strings it computes the length of output itself. For floating
42 point it uses MPFR to fornmat known constants with up and down
43 rounding and uses the resulting range of output lengths. For
44 strings it uses the length of string literals and the sizes of
45 character arrays that a character pointer may point to as a bound
46 on the longest string. */
50 #include "coretypes.h"
54 #include "tree-pass.h"
56 #include "gimple-fold.h"
57 #include "gimple-pretty-print.h"
58 #include "diagnostic-core.h"
59 #include "fold-const.h"
60 #include "gimple-iterator.h"
62 #include "tree-object-size.h"
65 #include "tree-ssa-propagate.h"
71 #include "stor-layout.h"
79 #include "substring-locations.h"
80 #include "diagnostic.h"
82 /* The likely worst case value of MB_LEN_MAX for the target, large enough
83 for UTF-8. Ideally, this would be obtained by a target hook if it were
84 to be used for optimization but it's good enough as is for warnings. */
85 #define target_mb_len_max 6
87 /* The maximum number of bytes a single non-string directive can result
88 in. This is the result of printf("%.*Lf", INT_MAX, -LDBL_MAX) for
89 LDBL_MAX_10_EXP of 4932. */
90 #define IEEE_MAX_10_EXP 4932
91 #define target_dir_max() (target_int_max () + IEEE_MAX_10_EXP + 2)
95 const pass_data pass_data_sprintf_length
= {
96 GIMPLE_PASS
, // pass type
97 "printf-return-value", // pass name
98 OPTGROUP_NONE
, // optinfo_flags
100 PROP_cfg
, // properties_required
101 0, // properties_provided
102 0, // properties_destroyed
103 0, // properties_start
104 0, // properties_finish
107 struct format_result
;
109 class pass_sprintf_length
: public gimple_opt_pass
111 bool fold_return_value
;
114 pass_sprintf_length (gcc::context
*ctxt
)
115 : gimple_opt_pass (pass_data_sprintf_length
, ctxt
),
116 fold_return_value (false)
119 opt_pass
* clone () { return new pass_sprintf_length (m_ctxt
); }
121 virtual bool gate (function
*);
123 virtual unsigned int execute (function
*);
125 void set_pass_param (unsigned int n
, bool param
)
128 fold_return_value
= param
;
131 void handle_gimple_call (gimple_stmt_iterator
*);
134 bool compute_format_length (call_info
&, format_result
*);
138 pass_sprintf_length::gate (function
*)
140 /* Run the pass iff -Warn-format-length is specified and either
141 not optimizing and the pass is being invoked early, or when
142 optimizing and the pass is being invoked during optimization
144 return ((warn_format_length
> 0 || flag_printf_return_value
)
145 && (optimize
> 0) == fold_return_value
);
148 /* The result of a call to a formatted function. */
152 /* Number of characters written by the formatted function, exact,
153 minimum and maximum when an exact number cannot be determined.
154 Setting the minimum to HOST_WIDE_INT_MAX disables all length
155 tracking for the remainder of the format string.
156 Setting either of the other two members to HOST_WIDE_INT_MAX
157 disables the exact or maximum length tracking, respectively,
158 but continues to track the maximum. */
159 unsigned HOST_WIDE_INT number_chars
;
160 unsigned HOST_WIDE_INT number_chars_min
;
161 unsigned HOST_WIDE_INT number_chars_max
;
163 /* True when the range given by NUMBER_CHARS_MIN and NUMBER_CHARS_MAX
164 can be relied on for value range propagation, false otherwise.
165 This means that BOUNDED must not be set if the number of bytes
166 produced by any directive is unspecified or implementation-
167 defined (unless the implementation's behavior is known and
168 determined via a target hook).
169 Note that BOUNDED only implies that the length of a function's
170 output is known to be within some range, not that it's constant
171 and a candidate for string folding. BOUNDED is a stronger
172 guarantee than KNOWNRANGE. */
175 /* True when the range above is obtained from known values of
176 directive arguments or their bounds and not the result of
177 heuristics that depend on warning levels. It is used to
178 issue stricter diagnostics in cases where strings of unknown
179 lengths are bounded by the arrays they are determined to
180 refer to. KNOWNRANGE must not be used to set the range of
181 the return value of a call. */
184 /* True when the output of the formatted call is constant (and
185 thus a candidate for string constant folding). This is rare
186 and typically requires that the arguments of all directives
187 are also constant. CONSTANT implies BOUNDED. */
190 /* True if no individual directive resulted in more than 4095 bytes
191 of output (the total NUMBER_CHARS might be greater). */
194 /* True when a floating point directive has been seen in the format
198 /* True when an intermediate result has caused a warning. Used to
199 avoid issuing duplicate warnings while finishing the processing
203 /* Preincrement the number of output characters by 1. */
204 format_result
& operator++ ()
209 /* Postincrement the number of output characters by 1. */
210 format_result
operator++ (int)
212 format_result
prev (*this);
217 /* Increment the number of output characters by N. */
218 format_result
& operator+= (unsigned HOST_WIDE_INT n
)
220 gcc_assert (n
< HOST_WIDE_INT_MAX
);
222 if (number_chars
< HOST_WIDE_INT_MAX
)
224 if (number_chars_min
< HOST_WIDE_INT_MAX
)
225 number_chars_min
+= n
;
226 if (number_chars_max
< HOST_WIDE_INT_MAX
)
227 number_chars_max
+= n
;
232 /* Return the value of INT_MIN for the target. */
234 static inline HOST_WIDE_INT
237 return tree_to_shwi (TYPE_MIN_VALUE (integer_type_node
));
240 /* Return the value of INT_MAX for the target. */
242 static inline unsigned HOST_WIDE_INT
245 return tree_to_uhwi (TYPE_MAX_VALUE (integer_type_node
));
248 /* Return the value of SIZE_MAX for the target. */
250 static inline unsigned HOST_WIDE_INT
253 return tree_to_uhwi (TYPE_MAX_VALUE (size_type_node
));
256 /* Return the constant initial value of DECL if available or DECL
257 otherwise. Same as the synonymous function in c/c-typeck.c. */
260 decl_constant_value (tree decl
)
262 if (/* Don't change a variable array bound or initial value to a constant
263 in a place where a variable is invalid. Note that DECL_INITIAL
264 isn't valid for a PARM_DECL. */
265 current_function_decl
!= 0
266 && TREE_CODE (decl
) != PARM_DECL
267 && !TREE_THIS_VOLATILE (decl
)
268 && TREE_READONLY (decl
)
269 && DECL_INITIAL (decl
) != 0
270 && TREE_CODE (DECL_INITIAL (decl
)) != ERROR_MARK
271 /* This is invalid if initial value is not constant.
272 If it has either a function call, a memory reference,
273 or a variable, then re-evaluating it could give different results. */
274 && TREE_CONSTANT (DECL_INITIAL (decl
))
275 /* Check for cases where this is sub-optimal, even though valid. */
276 && TREE_CODE (DECL_INITIAL (decl
)) != CONSTRUCTOR
)
277 return DECL_INITIAL (decl
);
281 /* Given FORMAT, set *PLOC to the source location of the format string
282 and return the format string if it is known or null otherwise. */
285 get_format_string (tree format
, location_t
*ploc
)
289 /* Pull out a constant value if the front end didn't. */
290 format
= decl_constant_value (format
);
294 if (integer_zerop (format
))
296 /* FIXME: Diagnose null format string if it hasn't been diagnosed
297 by -Wformat (the latter diagnoses only nul pointer constants,
298 this pass can do better). */
302 HOST_WIDE_INT offset
= 0;
304 if (TREE_CODE (format
) == POINTER_PLUS_EXPR
)
306 tree arg0
= TREE_OPERAND (format
, 0);
307 tree arg1
= TREE_OPERAND (format
, 1);
311 if (TREE_CODE (arg1
) != INTEGER_CST
)
316 /* POINTER_PLUS_EXPR offsets are to be interpreted signed. */
317 if (!cst_and_fits_in_hwi (arg1
))
320 offset
= int_cst_value (arg1
);
323 if (TREE_CODE (format
) != ADDR_EXPR
)
326 *ploc
= EXPR_LOC_OR_LOC (format
, input_location
);
328 format
= TREE_OPERAND (format
, 0);
330 if (TREE_CODE (format
) == ARRAY_REF
331 && tree_fits_shwi_p (TREE_OPERAND (format
, 1))
332 && (offset
+= tree_to_shwi (TREE_OPERAND (format
, 1))) >= 0)
333 format
= TREE_OPERAND (format
, 0);
339 tree array_size
= NULL_TREE
;
342 && TREE_CODE (TREE_TYPE (format
)) == ARRAY_TYPE
343 && (array_init
= decl_constant_value (format
)) != format
344 && TREE_CODE (array_init
) == STRING_CST
)
346 /* Extract the string constant initializer. Note that this may
347 include a trailing NUL character that is not in the array (e.g.
348 const char a[3] = "foo";). */
349 array_size
= DECL_SIZE_UNIT (format
);
353 if (TREE_CODE (format
) != STRING_CST
)
356 if (TYPE_MAIN_VARIANT (TREE_TYPE (TREE_TYPE (format
))) != char_type_node
)
358 /* Wide format string. */
362 const char *fmtstr
= TREE_STRING_POINTER (format
);
363 unsigned fmtlen
= TREE_STRING_LENGTH (format
);
367 /* Variable length arrays can't be initialized. */
368 gcc_assert (TREE_CODE (array_size
) == INTEGER_CST
);
370 if (tree_fits_shwi_p (array_size
))
372 HOST_WIDE_INT array_size_value
= tree_to_shwi (array_size
);
373 if (array_size_value
> 0
374 && array_size_value
== (int) array_size_value
375 && fmtlen
> array_size_value
)
376 fmtlen
= array_size_value
;
381 if (offset
>= fmtlen
)
388 if (fmtlen
< 1 || fmtstr
[--fmtlen
] != 0)
390 /* FIXME: Diagnose an unterminated format string if it hasn't been
391 diagnosed by -Wformat. Similarly to a null format pointer,
392 -Wformay diagnoses only nul pointer constants, this pass can
400 /* The format_warning_at_substring function is not used here in a way
401 that makes using attribute format viable. Suppress the warning. */
403 #pragma GCC diagnostic push
404 #pragma GCC diagnostic ignored "-Wsuggest-attribute=format"
406 /* For convenience and brevity. */
409 (* const fmtwarn
) (const substring_loc
&, const source_range
*,
410 const char *, int, const char *, ...)
411 = format_warning_at_substring
;
413 /* Format length modifiers. */
418 FMT_LEN_hh
, // char argument
421 FMT_LEN_ll
, // long long
422 FMT_LEN_L
, // long double (and GNU long long)
424 FMT_LEN_t
, // ptrdiff_t
425 FMT_LEN_j
// intmax_t
429 /* A minimum and maximum number of bytes. */
433 unsigned HOST_WIDE_INT min
, max
;
436 /* Description of the result of conversion either of a single directive
437 or the whole format string. */
442 : argmin (), argmax (), knownrange (), bounded (), constant (), nullp ()
444 range
.min
= range
.max
= HOST_WIDE_INT_MAX
;
447 /* The range a directive's argument is in. */
450 /* The minimum and maximum number of bytes that a directive
451 results in on output for an argument in the range above. */
454 /* True when the range above is obtained from a known value of
455 a directive's argument or its bounds and not the result of
456 heuristics that depend on warning levels. */
459 /* True when the range is the result of an argument determined
460 to be bounded to a subrange of its type or value (such as by
461 value range propagation or the width of the formt directive),
465 /* True when the output of a directive is constant. This is rare
466 and typically requires that the argument(s) of the directive
467 are also constant (such as determined by constant propagation,
468 though not value range propagation). */
471 /* True when the argument is a null pointer. */
475 /* Description of a conversion specification. */
477 struct conversion_spec
479 /* A bitmap of flags, one for each character. */
480 unsigned flags
[256 / sizeof (int)];
481 /* Numeric width as in "%8x". */
483 /* Numeric precision as in "%.32s". */
486 /* Width specified via the '*' character. Need not be INTEGER_CST.
487 For vararg functions set to void_node. */
489 /* Precision specified via the asterisk. Need not be INTEGER_CST.
490 For vararg functions set to void_node. */
493 /* Length modifier. */
494 format_lengths modifier
;
496 /* Format specifier character. */
499 /* Numeric width was given. */
500 unsigned have_width
: 1;
501 /* Numeric precision was given. */
502 unsigned have_precision
: 1;
503 /* Non-zero when certain flags should be interpreted even for a directive
504 that normally doesn't accept them (used when "%p" with flags such as
505 space or plus is interepreted as a "%x". */
506 unsigned force_flags
: 1;
508 /* Format conversion function that given a conversion specification
509 and an argument returns the formatting result. */
510 fmtresult (*fmtfunc
) (const conversion_spec
&, tree
);
512 /* Return True when a the format flag CHR has been used. */
513 bool get_flag (char chr
) const
515 unsigned char c
= chr
& 0xff;
516 return (flags
[c
/ (CHAR_BIT
* sizeof *flags
)]
517 & (1U << (c
% (CHAR_BIT
* sizeof *flags
))));
520 /* Make a record of the format flag CHR having been used. */
521 void set_flag (char chr
)
523 unsigned char c
= chr
& 0xff;
524 flags
[c
/ (CHAR_BIT
* sizeof *flags
)]
525 |= (1U << (c
% (CHAR_BIT
* sizeof *flags
)));
528 /* Reset the format flag CHR. */
529 void clear_flag (char chr
)
531 unsigned char c
= chr
& 0xff;
532 flags
[c
/ (CHAR_BIT
* sizeof *flags
)]
533 &= ~(1U << (c
% (CHAR_BIT
* sizeof *flags
)));
537 /* Return the logarithm of X in BASE. */
540 ilog (unsigned HOST_WIDE_INT x
, int base
)
551 /* Return the number of bytes resulting from converting into a string
552 the INTEGER_CST tree node X in BASE with a minimum of PREC digits.
553 PLUS indicates whether 1 for a plus sign should be added for positive
554 numbers, and PREFIX whether the length of an octal ('O') or hexadecimal
555 ('0x') prefix should be added for nonzero numbers. Return -1 if X cannot
559 tree_digits (tree x
, int base
, HOST_WIDE_INT prec
, bool plus
, bool prefix
)
561 unsigned HOST_WIDE_INT absval
;
565 if (TYPE_UNSIGNED (TREE_TYPE (x
)))
567 if (tree_fits_uhwi_p (x
))
569 absval
= tree_to_uhwi (x
);
577 if (tree_fits_shwi_p (x
))
579 HOST_WIDE_INT i
= tree_to_shwi (x
);
595 int ndigs
= ilog (absval
, base
);
597 res
+= prec
< ndigs
? ndigs
: prec
;
599 if (prefix
&& absval
)
610 /* Given the formatting result described by RES and NAVAIL, the number
611 of available in the destination, return the number of bytes remaining
612 in the destination. */
614 static inline result_range
615 bytes_remaining (unsigned HOST_WIDE_INT navail
, const format_result
&res
)
619 if (HOST_WIDE_INT_MAX
<= navail
)
621 range
.min
= range
.max
= navail
;
625 if (res
.number_chars
< navail
)
627 range
.min
= range
.max
= navail
- res
.number_chars
;
629 else if (res
.number_chars_min
< navail
)
631 range
.max
= navail
- res
.number_chars_min
;
636 if (res
.number_chars_max
< navail
)
637 range
.min
= navail
- res
.number_chars_max
;
644 /* Given the formatting result described by RES and NAVAIL, the number
645 of available in the destination, return the minimum number of bytes
646 remaining in the destination. */
648 static inline unsigned HOST_WIDE_INT
649 min_bytes_remaining (unsigned HOST_WIDE_INT navail
, const format_result
&res
)
651 if (HOST_WIDE_INT_MAX
<= navail
)
654 if (1 < warn_format_length
|| res
.knownrange
)
656 /* At level 2, or when all directives output an exact number
657 of bytes or when their arguments were bounded by known
658 ranges, use the greater of the two byte counters if it's
659 valid to compute the result. */
660 if (res
.number_chars_max
< HOST_WIDE_INT_MAX
)
661 navail
-= res
.number_chars_max
;
662 else if (res
.number_chars
< HOST_WIDE_INT_MAX
)
663 navail
-= res
.number_chars
;
664 else if (res
.number_chars_min
< HOST_WIDE_INT_MAX
)
665 navail
-= res
.number_chars_min
;
669 /* At level 1 use the smaller of the byte counters to compute
671 if (res
.number_chars
< HOST_WIDE_INT_MAX
)
672 navail
-= res
.number_chars
;
673 else if (res
.number_chars_min
< HOST_WIDE_INT_MAX
)
674 navail
-= res
.number_chars_min
;
675 else if (res
.number_chars_max
< HOST_WIDE_INT_MAX
)
676 navail
-= res
.number_chars_max
;
679 if (navail
> HOST_WIDE_INT_MAX
)
685 /* Description of a call to a formatted function. */
687 struct pass_sprintf_length::call_info
689 /* Function call statement. */
692 /* Function called. */
695 /* Called built-in function code. */
696 built_in_function fncode
;
698 /* Format argument and format string extracted from it. */
702 /* The location of the format argument. */
705 /* The destination object size for __builtin___xxx_chk functions
706 typically determined by __builtin_object_size, or -1 if unknown. */
707 unsigned HOST_WIDE_INT objsize
;
709 /* Number of the first variable argument. */
710 unsigned HOST_WIDE_INT argidx
;
712 /* True for functions like snprintf that specify the size of
713 the destination, false for others like sprintf that don't. */
716 /* True for bounded functions like snprintf that specify a zero-size
717 buffer as a request to compute the size of output without actually
718 writing any. NOWRITE is cleared in response to the %n directive
719 which has side-effects similar to writing output. */
723 /* Return the result of formatting the '%%' directive. */
726 format_percent (const conversion_spec
&, tree
)
729 res
.argmin
= res
.argmax
= NULL_TREE
;
730 res
.range
.min
= res
.range
.max
= 1;
731 res
.bounded
= res
.constant
= true;
736 /* Compute intmax_type_node and uintmax_type_node similarly to how
737 tree.c builds size_type_node. */
740 build_intmax_type_nodes (tree
*pintmax
, tree
*puintmax
)
742 if (strcmp (UINTMAX_TYPE
, "unsigned int") == 0)
744 *pintmax
= integer_type_node
;
745 *puintmax
= unsigned_type_node
;
747 else if (strcmp (UINTMAX_TYPE
, "long unsigned int") == 0)
749 *pintmax
= long_integer_type_node
;
750 *puintmax
= long_unsigned_type_node
;
752 else if (strcmp (UINTMAX_TYPE
, "long long unsigned int") == 0)
754 *pintmax
= long_long_integer_type_node
;
755 *puintmax
= long_long_unsigned_type_node
;
759 for (int i
= 0; i
< NUM_INT_N_ENTS
; i
++)
760 if (int_n_enabled_p
[i
])
763 sprintf (name
, "__int%d unsigned", int_n_data
[i
].bitsize
);
765 if (strcmp (name
, UINTMAX_TYPE
) == 0)
767 *pintmax
= int_n_trees
[i
].signed_type
;
768 *puintmax
= int_n_trees
[i
].unsigned_type
;
776 /* Set *PWIDTH and *PPREC according to the width and precision specified
777 in SPEC. Each is set to HOST_WIDE_INT_MIN when the corresponding
778 field is specified but unknown, to zero for width and -1 for precision,
779 respectively when it's not specified, or to a non-negative value
780 corresponding to the known value. */
783 get_width_and_precision (const conversion_spec
&spec
,
784 HOST_WIDE_INT
*pwidth
, HOST_WIDE_INT
*pprec
)
786 HOST_WIDE_INT width
= spec
.have_width
? spec
.width
: 0;
787 HOST_WIDE_INT prec
= spec
.have_precision
? spec
.precision
: -1;
791 if (TREE_CODE (spec
.star_width
) == INTEGER_CST
)
793 width
= tree_to_shwi (spec
.star_width
);
796 if (width
== HOST_WIDE_INT_MIN
)
798 /* Avoid undefined behavior due to negating a minimum.
799 This case will be diagnosed since it will result in
800 more than INT_MAX bytes on output, either by the
801 directive itself (when INT_MAX < HOST_WIDE_INT_MAX)
802 or by the format function itself. */
803 width
= HOST_WIDE_INT_MAX
;
810 width
= HOST_WIDE_INT_MIN
;
813 if (spec
.star_precision
)
815 if (TREE_CODE (spec
.star_precision
) == INTEGER_CST
)
817 prec
= tree_to_shwi (spec
.star_precision
);
822 prec
= HOST_WIDE_INT_MIN
;
829 /* With the range [*ARGMIN, *ARGMAX] of an integer directive's actual
830 argument, due to the conversion from either *ARGMIN or *ARGMAX to
831 the type of the directive's formal argument it's possible for both
832 to result in the same number of bytes or a range of bytes that's
833 less than the number of bytes that would result from formatting
834 some other value in the range [*ARGMIN, *ARGMAX]. This can be
835 determined by checking for the actual argument being in the range
836 of the type of the directive. If it isn't it must be assumed to
837 take on the full range of the directive's type.
838 Return true when the range has been adjusted to the full unsigned
839 range of DIRTYPE, or [0, DIRTYPE_MAX], and false otherwise. */
842 adjust_range_for_overflow (tree dirtype
, tree
*argmin
, tree
*argmax
)
844 tree argtype
= TREE_TYPE (*argmin
);
845 unsigned argprec
= TYPE_PRECISION (argtype
);
846 unsigned dirprec
= TYPE_PRECISION (dirtype
);
848 /* If the actual argument and the directive's argument have the same
849 precision and sign there can be no overflow and so there is nothing
851 if (argprec
== dirprec
&& TYPE_SIGN (argtype
) == TYPE_SIGN (dirtype
))
854 /* The logic below was inspired/lifted from the CONVERT_EXPR_CODE_P
855 branch in the extract_range_from_unary_expr function in tree-vrp.c. */
857 if (TREE_CODE (*argmin
) == INTEGER_CST
858 && TREE_CODE (*argmax
) == INTEGER_CST
859 && (dirprec
>= argprec
860 || integer_zerop (int_const_binop (RSHIFT_EXPR
,
861 int_const_binop (MINUS_EXPR
,
864 size_int (dirprec
)))))
866 *argmin
= force_fit_type (dirtype
, wi::to_widest (*argmin
), 0, false);
867 *argmax
= force_fit_type (dirtype
, wi::to_widest (*argmax
), 0, false);
869 /* If *ARGMIN is still less than *ARGMAX the conversion above
870 is safe. Otherwise, it has overflowed and would be unsafe. */
871 if (tree_int_cst_le (*argmin
, *argmax
))
875 tree dirmin
= TYPE_MIN_VALUE (dirtype
);
876 tree dirmax
= TYPE_MAX_VALUE (dirtype
);
878 if (TYPE_UNSIGNED (dirtype
))
885 *argmin
= integer_zero_node
;
892 /* Return a range representing the minimum and maximum number of bytes
893 that the conversion specification SPEC will write on output for the
894 integer argument ARG when non-null. ARG may be null (for vararg
898 format_integer (const conversion_spec
&spec
, tree arg
)
900 tree intmax_type_node
;
901 tree uintmax_type_node
;
903 /* Set WIDTH and PRECISION based on the specification. */
906 get_width_and_precision (spec
, &width
, &prec
);
908 bool sign
= spec
.specifier
== 'd' || spec
.specifier
== 'i';
910 /* The type of the "formal" argument expected by the directive. */
911 tree dirtype
= NULL_TREE
;
913 /* Determine the expected type of the argument from the length
915 switch (spec
.modifier
)
918 if (spec
.specifier
== 'p')
919 dirtype
= ptr_type_node
;
921 dirtype
= sign
? integer_type_node
: unsigned_type_node
;
925 dirtype
= sign
? short_integer_type_node
: short_unsigned_type_node
;
929 dirtype
= sign
? signed_char_type_node
: unsigned_char_type_node
;
933 dirtype
= sign
? long_integer_type_node
: long_unsigned_type_node
;
939 ? long_long_integer_type_node
940 : long_long_unsigned_type_node
);
944 dirtype
= signed_or_unsigned_type_for (!sign
, size_type_node
);
948 dirtype
= signed_or_unsigned_type_for (!sign
, ptrdiff_type_node
);
952 build_intmax_type_nodes (&intmax_type_node
, &uintmax_type_node
);
953 dirtype
= sign
? intmax_type_node
: uintmax_type_node
;
960 /* The type of the argument to the directive, either deduced from
961 the actual non-constant argument if one is known, or from
962 the directive itself when none has been provided because it's
964 tree argtype
= NULL_TREE
;
968 /* When the argument has not been provided, use the type of
969 the directive's argument as an approximation. This will
970 result in false positives for directives like %i with
971 arguments with smaller precision (such as short or char). */
974 else if (TREE_CODE (arg
) == INTEGER_CST
)
976 /* When a constant argument has been provided use its value
977 rather than type to determine the length of the output. */
979 /* Base to format the number in. */
982 /* True when a signed conversion is preceded by a sign or space. */
983 bool maybesign
= false;
985 switch (spec
.specifier
)
989 /* Space and '+' are only meaningful for signed conversions. */
990 maybesign
= spec
.get_flag (' ') | spec
.get_flag ('+');
1009 if ((prec
== HOST_WIDE_INT_MIN
|| prec
== 0) && integer_zerop (arg
))
1011 /* As a special case, a precision of zero with a zero argument
1012 results in zero bytes except in base 8 when the '#' flag is
1013 specified, and for signed conversions in base 8 and 10 when
1014 flags when either the space or '+' flag has been specified
1015 when it results in just one byte (with width having the normal
1016 effect). This must extend to the case of a specified precision
1017 with an unknown value because it can be zero. */
1018 len
= ((base
== 8 && spec
.get_flag ('#')) || maybesign
);
1022 /* Convert the argument to the type of the directive. */
1023 arg
= fold_convert (dirtype
, arg
);
1025 /* True when a conversion is preceded by a prefix indicating the base
1026 of the argument (octal or hexadecimal). */
1027 bool maybebase
= spec
.get_flag ('#');
1028 len
= tree_digits (arg
, base
, prec
, maybesign
, maybebase
);
1030 len
= HOST_WIDE_INT_MAX
;
1036 /* The minimum and maximum number of bytes produced by the directive. */
1039 res
.range
.min
= len
;
1041 /* The upper bound of the number of bytes is unlimited when either
1042 width or precision is specified but its value is unknown, and
1043 the same as the lower bound otherwise. */
1044 if (width
== HOST_WIDE_INT_MIN
|| prec
== HOST_WIDE_INT_MIN
)
1046 res
.range
.max
= HOST_WIDE_INT_MAX
;
1050 res
.range
.max
= len
;
1052 res
.constant
= true;
1053 res
.knownrange
= true;
1059 else if (TREE_CODE (TREE_TYPE (arg
)) == INTEGER_TYPE
1060 || TREE_CODE (TREE_TYPE (arg
)) == POINTER_TYPE
)
1061 /* Determine the type of the provided non-constant argument. */
1062 argtype
= TREE_TYPE (arg
);
1064 /* Don't bother with invalid arguments since they likely would
1065 have already been diagnosed, and disable any further checking
1066 of the format string by returning [-1, -1]. */
1067 return fmtresult ();
1071 /* The result is bounded unless width or precision has been specified
1072 whose value is unknown. */
1073 res
.bounded
= width
!= HOST_WIDE_INT_MIN
&& prec
!= HOST_WIDE_INT_MIN
;
1075 /* Using either the range the non-constant argument is in, or its
1076 type (either "formal" or actual), create a range of values that
1077 constrain the length of output given the warning level. */
1078 tree argmin
= NULL_TREE
;
1079 tree argmax
= NULL_TREE
;
1082 && TREE_CODE (arg
) == SSA_NAME
1083 && TREE_CODE (argtype
) == INTEGER_TYPE
)
1085 /* Try to determine the range of values of the integer argument
1086 (range information is not available for pointers). */
1088 enum value_range_type range_type
= get_range_info (arg
, &min
, &max
);
1089 if (range_type
== VR_RANGE
)
1091 argmin
= build_int_cst (argtype
, wi::fits_uhwi_p (min
)
1092 ? min
.to_uhwi () : min
.to_shwi ());
1093 argmax
= build_int_cst (argtype
, wi::fits_uhwi_p (max
)
1094 ? max
.to_uhwi () : max
.to_shwi ());
1096 /* Set KNOWNRANGE if the argument is in a known subrange
1097 of the directive's type (KNOWNRANGE may be reset below). */
1099 = (!tree_int_cst_equal (TYPE_MIN_VALUE (dirtype
), argmin
)
1100 || !tree_int_cst_equal (TYPE_MAX_VALUE (dirtype
), argmax
));
1102 res
.argmin
= argmin
;
1103 res
.argmax
= argmax
;
1105 else if (range_type
== VR_ANTI_RANGE
)
1107 /* Handle anti-ranges if/when bug 71690 is resolved. */
1109 else if (range_type
== VR_VARYING
)
1111 /* The argument here may be the result of promoting the actual
1112 argument to int. Try to determine the type of the actual
1113 argument before promotion and narrow down its range that
1115 gimple
*def
= SSA_NAME_DEF_STMT (arg
);
1116 if (is_gimple_assign (def
))
1118 tree_code code
= gimple_assign_rhs_code (def
);
1119 if (code
== INTEGER_CST
)
1121 arg
= gimple_assign_rhs1 (def
);
1122 return format_integer (spec
, arg
);
1125 if (code
== NOP_EXPR
)
1127 tree type
= TREE_TYPE (gimple_assign_rhs1 (def
));
1128 if (TREE_CODE (type
) == INTEGER_TYPE
1129 || TREE_CODE (type
) == POINTER_TYPE
)
1138 /* For an unknown argument (e.g., one passed to a vararg function)
1139 or one whose value range cannot be determined, create a T_MIN
1140 constant if the argument's type is signed and T_MAX otherwise,
1141 and use those to compute the range of bytes that the directive
1142 can output. When precision is specified but unknown, use zero
1143 as the minimum since it results in no bytes on output (unless
1144 width is specified to be greater than 0). */
1145 argmin
= build_int_cst (argtype
, prec
&& prec
!= HOST_WIDE_INT_MIN
);
1147 int typeprec
= TYPE_PRECISION (dirtype
);
1148 int argprec
= TYPE_PRECISION (argtype
);
1150 if (argprec
< typeprec
)
1152 if (POINTER_TYPE_P (argtype
))
1153 argmax
= build_all_ones_cst (argtype
);
1154 else if (TYPE_UNSIGNED (argtype
))
1155 argmax
= TYPE_MAX_VALUE (argtype
);
1157 argmax
= TYPE_MIN_VALUE (argtype
);
1161 if (POINTER_TYPE_P (dirtype
))
1162 argmax
= build_all_ones_cst (dirtype
);
1163 else if (TYPE_UNSIGNED (dirtype
))
1164 argmax
= TYPE_MAX_VALUE (dirtype
);
1166 argmax
= TYPE_MIN_VALUE (dirtype
);
1169 res
.argmin
= argmin
;
1170 res
.argmax
= argmax
;
1173 if (tree_int_cst_lt (argmax
, argmin
))
1180 /* Clear KNOWNRANGE if the range has been adjusted to the maximum
1181 of the directive. If it has been cleared then since ARGMIN and/or
1182 ARGMAX have been adjusted also adjust the corresponding ARGMIN and
1183 ARGMAX in the result to include in diagnostics. */
1184 if (adjust_range_for_overflow (dirtype
, &argmin
, &argmax
))
1186 res
.knownrange
= false;
1187 res
.argmin
= argmin
;
1188 res
.argmax
= argmax
;
1191 /* Recursively compute the minimum and maximum from the known range,
1192 taking care to swap them if the lower bound results in longer
1193 output than the upper bound (e.g., in the range [-1, 0]. */
1195 if (TYPE_UNSIGNED (dirtype
))
1197 /* For unsigned conversions/directives, use the minimum (i.e., 0
1198 or 1) and maximum to compute the shortest and longest output,
1200 res
.range
.min
= format_integer (spec
, argmin
).range
.min
;
1201 res
.range
.max
= format_integer (spec
, argmax
).range
.max
;
1205 /* For signed conversions/directives, use the maximum (i.e., 0)
1206 to compute the shortest output and the minimum (i.e., TYPE_MIN)
1207 to compute the longest output. This is important when precision
1208 is specified but unknown because otherwise both output lengths
1209 would reflect the largest possible precision (i.e., INT_MAX). */
1210 res
.range
.min
= format_integer (spec
, argmax
).range
.min
;
1211 res
.range
.max
= format_integer (spec
, argmin
).range
.max
;
1214 /* The result is bounded either when the argument is determined to be
1215 (e.g., when it's within some range) or when the minimum and maximum
1216 are the same. That can happen here for example when the specified
1217 width is as wide as the greater of MIN and MAX, as would be the case
1218 with sprintf (d, "%08x", x) with a 32-bit integer x. */
1219 res
.bounded
|= res
.range
.min
== res
.range
.max
;
1221 if (res
.range
.max
< res
.range
.min
)
1223 unsigned HOST_WIDE_INT tmp
= res
.range
.max
;
1224 res
.range
.max
= res
.range
.min
;
1225 res
.range
.min
= tmp
;
1231 /* Return the number of bytes that a format directive consisting of FLAGS,
1232 PRECision, format SPECification, and MPFR rounding specifier RNDSPEC,
1233 would result for argument X under ideal conditions (i.e., if PREC
1234 weren't excessive). MPFR 3.1 allocates large amounts of memory for
1235 values of PREC with large magnitude and can fail (see MPFR bug #21056).
1236 This function works around those problems. */
1238 static unsigned HOST_WIDE_INT
1239 get_mpfr_format_length (mpfr_ptr x
, const char *flags
, HOST_WIDE_INT prec
,
1240 char spec
, char rndspec
)
1244 HOST_WIDE_INT len
= strlen (flags
);
1247 memcpy (fmtstr
+ 1, flags
, len
);
1248 memcpy (fmtstr
+ 1 + len
, ".*R", 3);
1249 fmtstr
[len
+ 4] = rndspec
;
1250 fmtstr
[len
+ 5] = spec
;
1251 fmtstr
[len
+ 6] = '\0';
1253 spec
= TOUPPER (spec
);
1254 if (spec
== 'E' || spec
== 'F')
1256 /* For %e, specify the precision explicitly since mpfr_sprintf
1257 does its own thing just to be different (see MPFR bug 21088). */
1263 /* Avoid passing negative precisions with larger magnitude to MPFR
1264 to avoid exposing its bugs. (A negative precision is supposed
1270 HOST_WIDE_INT p
= prec
;
1274 /* For G/g, precision gives the maximum number of significant
1275 digits which is bounded by LDBL_MAX_10_EXP, or, for a 128
1276 bit IEEE extended precision, 4932. Using twice as much
1277 here should be more than sufficient for any real format. */
1278 if ((IEEE_MAX_10_EXP
* 2) < prec
)
1279 prec
= IEEE_MAX_10_EXP
* 2;
1284 /* Cap precision arbitrarily at 1KB and add the difference
1285 (if any) to the MPFR result. */
1290 len
= mpfr_snprintf (NULL
, 0, fmtstr
, (int)p
, x
);
1292 /* Handle the unlikely (impossible?) error by returning more than
1293 the maximum dictated by the function's return type. */
1295 return target_dir_max () + 1;
1297 /* Adjust the return value by the difference. */
1304 /* Return the number of bytes to format using the format specifier
1305 SPEC and the precision PREC the largest value in the real floating
1308 static unsigned HOST_WIDE_INT
1309 format_floating_max (tree type
, char spec
, HOST_WIDE_INT prec
)
1311 machine_mode mode
= TYPE_MODE (type
);
1313 /* IBM Extended mode. */
1314 if (MODE_COMPOSITE_P (mode
))
1317 /* Get the real type format desription for the target. */
1318 const real_format
*rfmt
= REAL_MODE_FORMAT (mode
);
1323 get_max_float (rfmt
, buf
, sizeof buf
);
1324 real_from_string (&rv
, buf
);
1327 /* Convert the GCC real value representation with the precision
1328 of the real type to the mpfr_t format with the GCC default
1329 round-to-nearest mode. */
1331 mpfr_init2 (x
, rfmt
->p
);
1332 mpfr_from_real (x
, &rv
, GMP_RNDN
);
1334 /* Return a value one greater to account for the leading minus sign. */
1335 return 1 + get_mpfr_format_length (x
, "", prec
, spec
, 'D');
1338 /* Return a range representing the minimum and maximum number of bytes
1339 that the conversion specification SPEC will output for any argument
1340 given the WIDTH and PRECISION (extracted from SPEC). This function
1341 is used when the directive argument or its value isn't known. */
1344 format_floating (const conversion_spec
&spec
, HOST_WIDE_INT width
,
1349 switch (spec
.modifier
)
1353 type
= double_type_node
;
1357 type
= long_double_type_node
;
1361 type
= long_double_type_node
;
1365 return fmtresult ();
1368 /* The minimum and maximum number of bytes produced by the directive. */
1371 /* The result is always bounded (though the range may be all of int). */
1374 /* The minimum output as determined by flags. It's always at least 1. */
1375 int flagmin
= (1 /* for the first digit */
1376 + (spec
.get_flag ('+') | spec
.get_flag (' '))
1377 + (prec
== 0 && spec
.get_flag ('#')));
1379 if (width
== INT_MIN
|| prec
== INT_MIN
)
1381 /* When either width or precision is specified but unknown
1382 the upper bound is the maximum. Otherwise it will be
1383 computed for each directive below. */
1384 res
.range
.max
= HOST_WIDE_INT_MAX
;
1387 res
.range
.max
= HOST_WIDE_INT_M1U
;
1389 switch (spec
.specifier
)
1394 res
.range
.min
= flagmin
+ 5 + (prec
> 0 ? prec
+ 1 : 0);
1395 if (res
.range
.max
== HOST_WIDE_INT_M1U
)
1397 /* Compute the upper bound for -TYPE_MAX. */
1398 res
.range
.max
= format_floating_max (type
, 'a', prec
);
1407 /* The minimum output is "[-+]1.234567e+00" regardless
1408 of the value of the actual argument. */
1409 res
.range
.min
= (flagmin
1411 ? 0 : prec
< 0 ? 7 : prec
? prec
+ 1 : 0)
1414 if (res
.range
.max
== HOST_WIDE_INT_M1U
)
1416 /* MPFR uses a precision of 16 by default for some reason.
1417 Set it to the C default of 6. */
1418 res
.range
.max
= format_floating_max (type
, 'e',
1419 -1 == prec
? 6 : prec
);
1427 /* The lower bound when precision isn't specified is 8 bytes
1428 ("1.23456" since precision is taken to be 6). When precision
1429 is zero, the lower bound is 1 byte (e.g., "1"). Otherwise,
1430 when precision is greater than zero, then the lower bound
1431 is 2 plus precision (plus flags). */
1432 res
.range
.min
= (flagmin
1433 + (prec
!= INT_MIN
) /* for decimal point */
1435 ? 0 : prec
< 0 ? 6 : prec
? prec
: -1));
1437 if (res
.range
.max
== HOST_WIDE_INT_M1U
)
1439 /* Compute the upper bound for -TYPE_MAX. */
1440 res
.range
.max
= format_floating_max (type
, 'f', prec
);
1448 /* The %g output depends on precision and the exponent of
1449 the argument. Since the value of the argument isn't known
1450 the lower bound on the range of bytes (not counting flags
1452 res
.range
.min
= flagmin
;
1453 if (res
.range
.max
== HOST_WIDE_INT_M1U
)
1455 /* Compute the upper bound for -TYPE_MAX which should be
1456 the lesser of %e and %f. */
1457 res
.range
.max
= format_floating_max (type
, 'g', prec
);
1463 return fmtresult ();
1468 /* If width has been specified use it to adjust the range. */
1469 if (res
.range
.min
< (unsigned)width
)
1470 res
.range
.min
= width
;
1471 if (res
.range
.max
< (unsigned)width
)
1472 res
.range
.max
= width
;
1478 /* Return a range representing the minimum and maximum number of bytes
1479 that the conversion specification SPEC will write on output for the
1480 floating argument ARG. */
1483 format_floating (const conversion_spec
&spec
, tree arg
)
1485 /* Set WIDTH to -1 when it's not specified, to HOST_WIDE_INT_MIN when
1486 it is specified by the asterisk to an unknown value, and otherwise
1487 to a non-negative value corresponding to the specified width. */
1488 HOST_WIDE_INT width
= -1;
1489 HOST_WIDE_INT prec
= -1;
1491 /* The minimum and maximum number of bytes produced by the directive. */
1493 res
.constant
= arg
&& TREE_CODE (arg
) == REAL_CST
;
1495 if (spec
.have_width
)
1497 else if (spec
.star_width
)
1499 if (TREE_CODE (spec
.star_width
) == INTEGER_CST
)
1501 width
= tree_to_shwi (spec
.star_width
);
1509 if (spec
.have_precision
)
1510 prec
= spec
.precision
;
1511 else if (spec
.star_precision
)
1513 if (TREE_CODE (spec
.star_precision
) == INTEGER_CST
)
1515 prec
= tree_to_shwi (spec
.star_precision
);
1522 else if (res
.constant
&& TOUPPER (spec
.specifier
) != 'A')
1524 /* Specify the precision explicitly since mpfr_sprintf defaults
1531 /* Get the real type format desription for the target. */
1532 const REAL_VALUE_TYPE
*rvp
= TREE_REAL_CST_PTR (arg
);
1533 const real_format
*rfmt
= REAL_MODE_FORMAT (TYPE_MODE (TREE_TYPE (arg
)));
1535 /* Convert the GCC real value representation with the precision
1536 of the real type to the mpfr_t format with the GCC default
1537 round-to-nearest mode. */
1539 mpfr_init2 (mpfrval
, rfmt
->p
);
1540 mpfr_from_real (mpfrval
, rvp
, GMP_RNDN
);
1543 char *pfmt
= fmtstr
;
1546 for (const char *pf
= "-+ #0"; *pf
; ++pf
)
1547 if (spec
.get_flag (*pf
))
1553 /* Set up an array to easily iterate over below. */
1554 unsigned HOST_WIDE_INT
* const minmax
[] = {
1555 &res
.range
.min
, &res
.range
.max
1558 for (int i
= 0; i
!= sizeof minmax
/ sizeof *minmax
; ++i
)
1560 /* Use the MPFR rounding specifier to round down in the first
1561 iteration and then up. In most but not all cases this will
1562 result in the same number of bytes. */
1563 char rndspec
= "DU"[i
];
1565 /* Format it and store the result in the corresponding member
1566 of the result struct. */
1567 unsigned HOST_WIDE_INT len
1568 = get_mpfr_format_length (mpfrval
, fmtstr
, prec
,
1569 spec
.specifier
, rndspec
);
1570 if (0 < width
&& len
< (unsigned)width
)
1577 /* Make sure the minimum is less than the maximum (MPFR rounding
1578 in the call to mpfr_snprintf can result in the reverse. */
1579 if (res
.range
.max
< res
.range
.min
)
1581 unsigned HOST_WIDE_INT tmp
= res
.range
.min
;
1582 res
.range
.min
= res
.range
.max
;
1583 res
.range
.max
= tmp
;
1586 /* The range of output is known even if the result isn't bounded. */
1587 if (width
== HOST_WIDE_INT_MIN
)
1589 res
.knownrange
= false;
1590 res
.range
.max
= HOST_WIDE_INT_MAX
;
1593 res
.knownrange
= true;
1595 /* The output of all directives except "%a" is fully specified
1596 and so the result is bounded unless it exceeds INT_MAX.
1597 For "%a" the output is fully specified only when precision
1598 is explicitly specified. */
1599 res
.bounded
= (res
.knownrange
1600 && (TOUPPER (spec
.specifier
) != 'A'
1601 || (0 <= prec
&& (unsigned) prec
< target_int_max ()))
1602 && res
.range
.min
< target_int_max ());
1607 return format_floating (spec
, width
, prec
);
1610 /* Return a FMTRESULT struct set to the lengths of the shortest and longest
1611 strings referenced by the expression STR, or (-1, -1) when not known.
1612 Used by the format_string function below. */
1615 get_string_length (tree str
)
1618 return fmtresult ();
1620 if (tree slen
= c_strlen (str
, 1))
1622 /* Simply return the length of the string. */
1624 res
.range
.min
= res
.range
.max
= tree_to_shwi (slen
);
1626 res
.constant
= true;
1627 res
.knownrange
= true;
1631 /* Determine the length of the shortest and longest string referenced
1632 by STR. Strings of unknown lengths are bounded by the sizes of
1633 arrays that subexpressions of STR may refer to. Pointers that
1634 aren't known to point any such arrays result in LENRANGE[1] set
1637 get_range_strlen (str
, lenrange
);
1639 if (lenrange
[0] || lenrange
[1])
1643 res
.range
.min
= (tree_fits_uhwi_p (lenrange
[0])
1644 ? tree_to_uhwi (lenrange
[0]) : 1 < warn_format_length
);
1645 res
.range
.max
= (tree_fits_uhwi_p (lenrange
[1])
1646 ? tree_to_uhwi (lenrange
[1]) : HOST_WIDE_INT_M1U
);
1648 /* Set RES.BOUNDED to true if and only if all strings referenced
1649 by STR are known to be bounded (though not necessarily by their
1650 actual length but perhaps by their maximum possible length). */
1651 res
.bounded
= res
.range
.max
< target_int_max ();
1652 res
.knownrange
= res
.bounded
;
1654 /* Set RES.CONSTANT to false even though that may be overly
1655 conservative in rare cases like: 'x ? a : b' where a and
1656 b have the same lengths and consist of the same characters. */
1657 res
.constant
= false;
1662 return get_string_length (NULL_TREE
);
1665 /* Return the minimum and maximum number of characters formatted
1666 by the '%c' and '%s' format directives and ther wide character
1667 forms for the argument ARG. ARG can be null (for functions
1668 such as vsprinf). */
1671 format_string (const conversion_spec
&spec
, tree arg
)
1673 /* Set WIDTH and PRECISION based on the specification. */
1674 HOST_WIDE_INT width
;
1676 get_width_and_precision (spec
, &width
, &prec
);
1680 /* The maximum number of bytes for an unknown wide character argument
1681 to a "%lc" directive adjusted for precision but not field width.
1682 6 is the longest UTF-8 sequence for a single wide character. */
1683 const unsigned HOST_WIDE_INT max_bytes_for_unknown_wc
1684 = (0 <= prec
? prec
: 1 < warn_format_length
? 6 : 1);
1686 /* The maximum number of bytes for an unknown string argument to either
1687 a "%s" or "%ls" directive adjusted for precision but not field width. */
1688 const unsigned HOST_WIDE_INT max_bytes_for_unknown_str
1689 = (0 <= prec
? prec
: 1 < warn_format_length
);
1691 /* The result is bounded unless overriddden for a non-constant string
1692 of an unknown length. */
1693 bool bounded
= true;
1695 if (spec
.specifier
== 'c')
1697 if (spec
.modifier
== FMT_LEN_l
)
1699 /* Positive if the argument is a wide NUL character? */
1700 int nul
= (arg
&& TREE_CODE (arg
) == INTEGER_CST
1701 ? integer_zerop (arg
) : -1);
1703 /* A '%lc' directive is the same as '%ls' for a two element
1704 wide string character with the second element of NUL, so
1705 when the character is unknown the minimum number of bytes
1706 is the smaller of either 0 (at level 1) or 1 (at level 2)
1707 and WIDTH, and the maximum is MB_CUR_MAX in the selected
1708 locale, which is unfortunately, unknown. */
1709 res
.range
.min
= 1 == warn_format_length
? !nul
: nul
< 1;
1710 res
.range
.max
= max_bytes_for_unknown_wc
;
1711 /* The range above is good enough to issue warnings but not
1712 for value range propagation, so clear BOUNDED. */
1713 res
.bounded
= false;
1717 /* A plain '%c' directive. Its ouput is exactly 1. */
1718 res
.range
.min
= res
.range
.max
= 1;
1720 res
.knownrange
= true;
1721 res
.constant
= arg
&& TREE_CODE (arg
) == INTEGER_CST
;
1724 else /* spec.specifier == 's' */
1726 /* Compute the range the argument's length can be in. */
1727 fmtresult slen
= get_string_length (arg
);
1730 gcc_checking_assert (slen
.range
.min
== slen
.range
.max
);
1732 /* A '%s' directive with a string argument with constant length. */
1733 res
.range
= slen
.range
;
1735 /* The output of "%s" and "%ls" directives with a constant
1736 string is in a known range unless width of an unknown value
1737 is specified. For "%s" it is the length of the string. For
1738 "%ls" it is in the range [length, length * MB_LEN_MAX].
1739 (The final range can be further constrained by width and
1740 precision but it's always known.) */
1741 res
.knownrange
= -1 < width
;
1743 if (spec
.modifier
== FMT_LEN_l
)
1747 if (warn_format_length
> 1)
1749 /* Leave the minimum number of bytes the wide string
1750 converts to equal to its length and set the maximum
1751 to the worst case length which is the string length
1752 multiplied by MB_LEN_MAX. */
1754 /* It's possible to be smarter about computing the maximum
1755 by scanning the wide string for any 8-bit characters and
1756 if it contains none, using its length for the maximum.
1757 Even though this would be simple to do it's unlikely to
1758 be worth it when dealing with wide characters. */
1759 res
.range
.max
*= target_mb_len_max
;
1762 /* For a wide character string, use precision as the maximum
1763 even if precision is greater than the string length since
1764 the number of bytes the string converts to may be greater
1765 (due to MB_CUR_MAX). */
1767 res
.range
.max
= prec
;
1769 else if (0 <= width
)
1771 /* The output of a "%s" directive with a constant argument
1772 and constant or no width is bounded. It is constant if
1773 precision is either not specified or it is specified and
1774 its value is known. */
1776 res
.constant
= prec
!= HOST_WIDE_INT_MIN
;
1778 else if (width
== HOST_WIDE_INT_MIN
)
1780 /* Specified but unknown width makes the output unbounded. */
1781 res
.range
.max
= HOST_WIDE_INT_MAX
;
1784 if (0 <= prec
&& (unsigned HOST_WIDE_INT
)prec
< res
.range
.min
)
1786 res
.range
.min
= prec
;
1787 res
.range
.max
= prec
;
1789 else if (prec
== HOST_WIDE_INT_MIN
)
1791 /* When precision is specified but not known the lower
1792 bound is assumed to be as low as zero. */
1796 else if (arg
&& integer_zerop (arg
))
1798 /* Handle null pointer argument. */
1802 res
.range
.max
= HOST_WIDE_INT_MAX
;
1808 /* For a '%s' and '%ls' directive with a non-constant string,
1809 the minimum number of characters is the greater of WIDTH
1810 and either 0 in mode 1 or the smaller of PRECISION and 1
1811 in mode 2, and the maximum is PRECISION or -1 to disable
1816 if (slen
.range
.min
>= target_int_max ())
1818 else if ((unsigned HOST_WIDE_INT
)prec
< slen
.range
.min
)
1819 slen
.range
.min
= prec
;
1821 if ((unsigned HOST_WIDE_INT
)prec
< slen
.range
.max
1822 || slen
.range
.max
>= target_int_max ())
1823 slen
.range
.max
= prec
;
1825 else if (slen
.range
.min
>= target_int_max ())
1827 slen
.range
.min
= max_bytes_for_unknown_str
;
1828 slen
.range
.max
= max_bytes_for_unknown_str
;
1832 res
.range
= slen
.range
;
1834 /* The output is considered bounded when a precision has been
1835 specified to limit the number of bytes or when the number
1836 of bytes is known or contrained to some range. */
1837 res
.bounded
= 0 <= prec
|| slen
.bounded
;
1838 res
.knownrange
= slen
.knownrange
;
1839 res
.constant
= false;
1843 /* Adjust the lengths for field width. */
1846 if (res
.range
.min
< (unsigned HOST_WIDE_INT
)width
)
1847 res
.range
.min
= width
;
1849 if (res
.range
.max
< (unsigned HOST_WIDE_INT
)width
)
1850 res
.range
.max
= width
;
1852 /* Adjust BOUNDED if width happens to make them equal. */
1853 if (res
.range
.min
== res
.range
.max
&& res
.range
.min
< target_int_max ()
1858 /* When precision is specified the range of characters on output
1859 is known to be bounded by it. */
1860 if (-1 < width
&& -1 < prec
)
1861 res
.knownrange
= true;
1866 /* Compute the length of the output resulting from the conversion
1867 specification SPEC with the argument ARG in a call described by INFO
1868 and update the overall result of the call in *RES. The format directive
1869 corresponding to SPEC starts at CVTBEG and is CVTLEN characters long. */
1872 format_directive (const pass_sprintf_length::call_info
&info
,
1873 format_result
*res
, const char *cvtbeg
, size_t cvtlen
,
1874 const conversion_spec
&spec
, tree arg
)
1876 /* Offset of the beginning of the directive from the beginning
1877 of the format string. */
1878 size_t offset
= cvtbeg
- info
.fmtstr
;
1880 /* Create a location for the whole directive from the % to the format
1882 substring_loc
dirloc (info
.fmtloc
, TREE_TYPE (info
.format
),
1883 offset
, offset
, offset
+ cvtlen
- 1);
1885 /* Also create a location range for the argument if possible.
1886 This doesn't work for integer literals or function calls. */
1887 source_range argrange
;
1888 source_range
*pargrange
;
1889 if (arg
&& CAN_HAVE_LOCATION_P (arg
))
1891 argrange
= EXPR_LOCATION_RANGE (arg
);
1892 pargrange
= &argrange
;
1897 /* Bail when there is no function to compute the output length,
1898 or when minimum length checking has been disabled. */
1899 if (!spec
.fmtfunc
|| res
->number_chars_min
>= HOST_WIDE_INT_MAX
)
1902 /* Compute the (approximate) length of the formatted output. */
1903 fmtresult fmtres
= spec
.fmtfunc (spec
, arg
);
1905 /* The overall result is bounded and constant only if the output
1906 of every directive is bounded and constant, respectively. */
1907 res
->bounded
&= fmtres
.bounded
;
1908 res
->constant
&= fmtres
.constant
;
1910 /* Record whether the output of all directives is known to be
1911 bounded by some maximum, implying that their arguments are
1912 either known exactly or determined to be in a known range
1913 or, for strings, limited by the upper bounds of the arrays
1915 res
->knownrange
&= fmtres
.knownrange
;
1917 if (!fmtres
.knownrange
)
1919 /* Only when the range is known, check it against the host value
1920 of INT_MAX + (the number of bytes of the "%.*Lf" directive with
1921 INT_MAX precision, which is the longest possible output of any
1922 single directive). That's the largest valid byte count (though
1923 not valid call to a printf-like function because it can never
1924 return such a count). Otherwise, the range doesn't correspond
1925 to known values of the argument. */
1926 if (fmtres
.range
.max
> target_dir_max ())
1928 /* Normalize the MAX counter to avoid having to deal with it
1929 later. The counter can be less than HOST_WIDE_INT_M1U
1930 when compiling for an ILP32 target on an LP64 host. */
1931 fmtres
.range
.max
= HOST_WIDE_INT_M1U
;
1932 /* Disable exact and maximum length checking after a failure
1933 to determine the maximum number of characters (for example
1934 for wide characters or wide character strings) but continue
1935 tracking the minimum number of characters. */
1936 res
->number_chars_max
= HOST_WIDE_INT_M1U
;
1937 res
->number_chars
= HOST_WIDE_INT_M1U
;
1940 if (fmtres
.range
.min
> target_dir_max ())
1942 /* Disable exact length checking after a failure to determine
1943 even the minimum number of characters (it shouldn't happen
1944 except in an error) but keep tracking the minimum and maximum
1945 number of characters. */
1946 res
->number_chars
= HOST_WIDE_INT_M1U
;
1953 fmtwarn (dirloc
, pargrange
, NULL
,
1954 OPT_Wformat_length_
,
1955 "%<%.*s%> directive argument is null",
1956 (int)cvtlen
, cvtbeg
);
1958 /* Don't bother processing the rest of the format string. */
1960 res
->number_chars
= HOST_WIDE_INT_M1U
;
1961 res
->number_chars_min
= res
->number_chars_max
= res
->number_chars
;
1965 bool warned
= res
->warned
;
1967 /* Compute the number of available bytes in the destination. There
1968 must always be at least one byte of space for the terminating
1969 NUL that's appended after the format string has been processed. */
1970 unsigned HOST_WIDE_INT navail
= min_bytes_remaining (info
.objsize
, *res
);
1972 if (fmtres
.range
.min
< fmtres
.range
.max
)
1974 /* The result is a range (i.e., it's inexact). */
1977 if (navail
< fmtres
.range
.min
)
1979 /* The minimum directive output is longer than there is
1980 room in the destination. */
1981 if (fmtres
.range
.min
== fmtres
.range
.max
)
1985 ? G_("%<%.*s%> directive output truncated writing "
1986 "%wu bytes into a region of size %wu")
1987 : G_("%<%.*s%> directive writing %wu bytes "
1988 "into a region of size %wu"));
1989 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
1990 OPT_Wformat_length_
, fmtstr
,
1991 (int)cvtlen
, cvtbeg
, fmtres
.range
.min
,
1994 else if (fmtres
.range
.max
< HOST_WIDE_INT_MAX
)
1998 ? G_("%<%.*s%> directive output truncated writing "
1999 "between %wu and %wu bytes into a region of "
2001 : G_("%<%.*s%> directive writing between %wu and "
2002 "%wu bytes into a region of size %wu"));
2003 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2004 OPT_Wformat_length_
, fmtstr
,
2005 (int)cvtlen
, cvtbeg
,
2006 fmtres
.range
.min
, fmtres
.range
.max
, navail
);
2012 ? G_("%<%.*s%> directive output truncated writing "
2013 "%wu or more bytes into a region of size %wu")
2014 : G_("%<%.*s%> directive writing %wu or more bytes "
2015 "into a region of size %wu"));
2016 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2017 OPT_Wformat_length_
, fmtstr
,
2018 (int)cvtlen
, cvtbeg
,
2019 fmtres
.range
.min
, navail
);
2022 else if (navail
< fmtres
.range
.max
2023 && (((spec
.specifier
== 's'
2024 && fmtres
.range
.max
< HOST_WIDE_INT_MAX
)
2025 /* && (spec.precision || spec.star_precision) */)
2026 || 1 < warn_format_length
))
2028 /* The maximum directive output is longer than there is
2029 room in the destination and the output length is either
2030 explicitly constrained by the precision (for strings)
2031 or the warning level is greater than 1. */
2032 if (fmtres
.range
.max
>= HOST_WIDE_INT_MAX
)
2036 ? G_("%<%.*s%> directive output may be truncated "
2037 "writing %wu or more bytes a region of size %wu")
2038 : G_("%<%.*s%> directive writing %wu or more bytes "
2039 "into a region of size %wu"));
2040 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2041 OPT_Wformat_length_
, fmtstr
,
2042 (int)cvtlen
, cvtbeg
,
2043 fmtres
.range
.min
, navail
);
2049 ? G_("%<%.*s%> directive output may be truncated "
2050 "writing between %wu and %wu bytes into a region "
2052 : G_("%<%.*s%> directive writing between %wu and %wu "
2053 "bytes into a region of size %wu"));
2054 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2055 OPT_Wformat_length_
, fmtstr
,
2056 (int)cvtlen
, cvtbeg
,
2057 fmtres
.range
.min
, fmtres
.range
.max
,
2063 /* Disable exact length checking but adjust the minimum and maximum. */
2064 res
->number_chars
= HOST_WIDE_INT_M1U
;
2065 if (res
->number_chars_max
< HOST_WIDE_INT_MAX
2066 && fmtres
.range
.max
< HOST_WIDE_INT_MAX
)
2067 res
->number_chars_max
+= fmtres
.range
.max
;
2069 res
->number_chars_min
+= fmtres
.range
.min
;
2073 if (!warned
&& fmtres
.range
.min
> 0 && navail
< fmtres
.range
.min
)
2077 ? (1 < fmtres
.range
.min
2078 ? G_("%<%.*s%> directive output truncated while writing "
2079 "%wu bytes into a region of size %wu")
2080 : G_("%<%.*s%> directive output truncated while writing "
2081 "%wu byte into a region of size %wu"))
2082 : (1 < fmtres
.range
.min
2083 ? G_("%<%.*s%> directive writing %wu bytes "
2084 "into a region of size %wu")
2085 : G_("%<%.*s%> directive writing %wu byte "
2086 "into a region of size %wu")));
2088 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2089 OPT_Wformat_length_
, fmtstr
,
2090 (int)cvtlen
, cvtbeg
, fmtres
.range
.min
,
2093 *res
+= fmtres
.range
.min
;
2096 /* Has the minimum directive output length exceeded the maximum
2097 of 4095 bytes required to be supported? */
2098 bool minunder4k
= fmtres
.range
.min
< 4096;
2099 if (!minunder4k
|| fmtres
.range
.max
> 4095)
2100 res
->under4k
= false;
2102 if (!warned
&& 1 < warn_format_length
2103 && (!minunder4k
|| fmtres
.range
.max
> 4095))
2105 /* The directive output may be longer than the maximum required
2106 to be handled by an implementation according to 7.21.6.1, p15
2107 of C11. Warn on this only at level 2 but remember this and
2108 prevent folding the return value when done. This allows for
2109 the possibility of the actual libc call failing due to ENOMEM
2110 (like Glibc does under some conditions). */
2112 if (fmtres
.range
.min
== fmtres
.range
.max
)
2113 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2114 OPT_Wformat_length_
,
2115 "%<%.*s%> directive output of %wu bytes exceeds "
2116 "minimum required size of 4095",
2117 (int)cvtlen
, cvtbeg
, fmtres
.range
.min
);
2122 ? G_("%<%.*s%> directive output between %qu and %wu "
2123 "bytes may exceed minimum required size of 4095")
2124 : G_("%<%.*s%> directive output between %qu and %wu "
2125 "bytes exceeds minimum required size of 4095"));
2127 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2128 OPT_Wformat_length_
, fmtstr
,
2129 (int)cvtlen
, cvtbeg
,
2130 fmtres
.range
.min
, fmtres
.range
.max
);
2134 /* Has the minimum directive output length exceeded INT_MAX? */
2135 bool exceedmin
= res
->number_chars_min
> target_int_max ();
2139 || (1 < warn_format_length
2140 && res
->number_chars_max
> target_int_max ())))
2142 /* The directive output causes the total length of output
2143 to exceed INT_MAX bytes. */
2145 if (fmtres
.range
.min
== fmtres
.range
.max
)
2146 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2147 OPT_Wformat_length_
,
2148 "%<%.*s%> directive output of %wu bytes causes "
2149 "result to exceed %<INT_MAX%>",
2150 (int)cvtlen
, cvtbeg
, fmtres
.range
.min
);
2155 ? G_ ("%<%.*s%> directive output between %wu and %wu "
2156 "bytes causes result to exceed %<INT_MAX%>")
2157 : G_ ("%<%.*s%> directive output between %wu and %wu "
2158 "bytes may cause result to exceed %<INT_MAX%>"));
2159 warned
= fmtwarn (dirloc
, pargrange
, NULL
,
2160 OPT_Wformat_length_
, fmtstr
,
2161 (int)cvtlen
, cvtbeg
,
2162 fmtres
.range
.min
, fmtres
.range
.max
);
2166 if (warned
&& fmtres
.argmin
)
2168 if (fmtres
.argmin
== fmtres
.argmax
)
2169 inform (info
.fmtloc
, "directive argument %qE", fmtres
.argmin
);
2170 else if (fmtres
.knownrange
)
2171 inform (info
.fmtloc
, "directive argument in the range [%E, %E]",
2172 fmtres
.argmin
, fmtres
.argmax
);
2174 inform (info
.fmtloc
,
2175 "using the range [%E, %E] for directive argument",
2176 fmtres
.argmin
, fmtres
.argmax
);
2179 res
->warned
|= warned
;
2182 /* Account for the number of bytes between BEG and END (or between
2183 BEG + strlen (BEG) when END is null) in the format string in a call
2184 to a formatted output function described by INFO. Reflect the count
2185 in RES and issue warnings as appropriate. */
2188 add_bytes (const pass_sprintf_length::call_info
&info
,
2189 const char *beg
, const char *end
, format_result
*res
)
2191 if (res
->number_chars_min
>= HOST_WIDE_INT_MAX
)
2194 /* The number of bytes to output is the number of bytes between
2195 the end of the last directive and the beginning of the next
2196 one if it exists, otherwise the number of characters remaining
2197 in the format string plus 1 for the terminating NUL. */
2198 size_t nbytes
= end
? end
- beg
: strlen (beg
) + 1;
2200 /* Return if there are no bytes to add at this time but there are
2201 directives remaining in the format string. */
2205 /* Compute the range of available bytes in the destination. There
2206 must always be at least one byte left for the terminating NUL
2207 that's appended after the format string has been processed. */
2208 result_range avail_range
= bytes_remaining (info
.objsize
, *res
);
2210 /* If issuing a diagnostic (only when one hasn't already been issued),
2211 distinguish between a possible overflow ("may write") and a certain
2212 overflow somewhere "past the end." (Ditto for truncation.)
2213 KNOWNRANGE is used to warn even at level 1 about possibly writing
2214 past the end or truncation due to strings of unknown lengths that
2215 are bounded by the arrays they are known to refer to. */
2217 && (avail_range
.max
< nbytes
2218 || ((res
->knownrange
|| 1 < warn_format_length
)
2219 && avail_range
.min
< nbytes
)))
2221 /* Set NAVAIL to the number of available bytes used to decide
2222 whether or not to issue a warning below. The exact kind of
2223 warning will depend on AVAIL_RANGE. */
2224 unsigned HOST_WIDE_INT navail
= avail_range
.max
;
2225 if (nbytes
<= navail
&& avail_range
.min
< HOST_WIDE_INT_MAX
2226 && (res
->knownrange
|| 1 < warn_format_length
))
2227 navail
= avail_range
.min
;
2229 /* Compute the offset of the first format character that is beyond
2230 the end of the destination region and the length of the rest of
2231 the format string from that point on. */
2232 unsigned HOST_WIDE_INT off
2233 = (unsigned HOST_WIDE_INT
)(beg
- info
.fmtstr
) + navail
;
2235 size_t len
= strlen (info
.fmtstr
+ off
);
2237 /* Create a location that underscores the substring of the format
2238 string that is or may be written past the end (or is or may be
2239 truncated), pointing the caret at the first character of the
2242 (info
.fmtloc
, TREE_TYPE (info
.format
), off
, len
? off
: 0,
2245 /* Is the output of the last directive the result of the argument
2246 being within a range whose lower bound would fit in the buffer
2247 but the upper bound would not? If so, use the word "may" to
2248 indicate that the overflow/truncation may (but need not) happen. */
2250 = (res
->number_chars_min
< res
->number_chars_max
2251 && res
->number_chars_min
+ nbytes
<= info
.objsize
);
2253 if (!end
&& ((nbytes
- navail
) == 1 || boundrange
))
2255 /* There is room for the rest of the format string but none
2256 for the terminating nul. */
2258 = (info
.bounded
// Snprintf and the like.
2260 ? G_("output may be truncated before the last format character"
2261 : "output truncated before the last format character"))
2263 ? G_("may write a terminating nul past the end "
2264 "of the destination")
2265 : G_("writing a terminating nul past the end "
2266 "of the destination")));
2268 res
->warned
= fmtwarn (loc
, NULL
, NULL
, OPT_Wformat_length_
, text
);
2272 /* There isn't enough room for 1 or more characters that remain
2273 to copy from the format string. */
2275 = (info
.bounded
// Snprintf and the like.
2277 ? G_("output may be truncated at or before format character "
2278 "%qc at offset %wu")
2279 : G_("output truncated at format character %qc at offset %wu"))
2280 : (res
->number_chars
>= HOST_WIDE_INT_MAX
2281 ? G_("may write format character %#qc at offset %wu past "
2282 "the end of the destination")
2283 : G_("writing format character %#qc at offset %wu past "
2284 "the end of the destination")));
2286 res
->warned
= fmtwarn (loc
, NULL
, NULL
, OPT_Wformat_length_
,
2287 text
, info
.fmtstr
[off
], off
);
2291 if (res
->warned
&& !end
&& info
.objsize
< HOST_WIDE_INT_MAX
)
2293 /* If a warning has been issued for buffer overflow or truncation
2294 (but not otherwise) help the user figure out how big a buffer
2297 location_t callloc
= gimple_location (info
.callstmt
);
2299 unsigned HOST_WIDE_INT min
= res
->number_chars_min
;
2300 unsigned HOST_WIDE_INT max
= res
->number_chars_max
;
2301 unsigned HOST_WIDE_INT exact
2302 = (res
->number_chars
< HOST_WIDE_INT_MAX
2303 ? res
->number_chars
: res
->number_chars_min
);
2305 if (min
< max
&& max
< HOST_WIDE_INT_MAX
)
2307 "format output between %wu and %wu bytes into "
2308 "a destination of size %wu",
2309 min
+ nbytes
, max
+ nbytes
, info
.objsize
);
2312 (nbytes
+ exact
== 1
2313 ? G_("format output %wu byte into a destination of size %wu")
2314 : G_("format output %wu bytes into a destination of size %wu")),
2315 nbytes
+ exact
, info
.objsize
);
2318 /* Add the number of bytes and then check for INT_MAX overflow. */
2321 /* Has the minimum output length minus the terminating nul exceeded
2323 bool exceedmin
= (res
->number_chars_min
- !end
) > target_int_max ();
2327 || (1 < warn_format_length
2328 && (res
->number_chars_max
- !end
) > target_int_max ())))
2330 /* The function's output exceeds INT_MAX bytes. */
2332 /* Set NAVAIL to the number of available bytes used to decide
2333 whether or not to issue a warning below. The exact kind of
2334 warning will depend on AVAIL_RANGE. */
2335 unsigned HOST_WIDE_INT navail
= avail_range
.max
;
2336 if (nbytes
<= navail
&& avail_range
.min
< HOST_WIDE_INT_MAX
2337 && (res
->bounded
|| 1 < warn_format_length
))
2338 navail
= avail_range
.min
;
2340 /* Compute the offset of the first format character that is beyond
2341 the end of the destination region and the length of the rest of
2342 the format string from that point on. */
2343 unsigned HOST_WIDE_INT off
= (unsigned HOST_WIDE_INT
)(beg
- info
.fmtstr
);
2344 if (navail
< HOST_WIDE_INT_MAX
)
2347 size_t len
= strlen (info
.fmtstr
+ off
);
2350 (info
.fmtloc
, TREE_TYPE (info
.format
), off
- !len
, len
? off
: 0,
2353 if (res
->number_chars_min
== res
->number_chars_max
)
2354 res
->warned
= fmtwarn (loc
, NULL
, NULL
,
2355 OPT_Wformat_length_
,
2356 "output of %wu bytes causes "
2357 "result to exceed %<INT_MAX%>",
2358 res
->number_chars_min
- !end
);
2363 ? G_ ("output between %wu and %wu bytes causes "
2364 "result to exceed %<INT_MAX%>")
2365 : G_ ("output between %wu and %wu bytes may cause "
2366 "result to exceed %<INT_MAX%>"));
2367 res
->warned
= fmtwarn (loc
, NULL
, NULL
, OPT_Wformat_length_
,
2369 res
->number_chars_min
- !end
,
2370 res
->number_chars_max
- !end
);
2375 #pragma GCC diagnostic pop
2377 /* Compute the length of the output resulting from the call to a formatted
2378 output function described by INFO and store the result of the call in
2379 *RES. Issue warnings for detected past the end writes. Return true
2380 if the complete format string has been processed and *RES can be relied
2381 on, false otherwise (e.g., when a unknown or unhandled directive was seen
2382 that caused the processing to be terminated early). */
2385 pass_sprintf_length::compute_format_length (call_info
&info
,
2388 /* The variadic argument counter. */
2389 unsigned argno
= info
.argidx
;
2391 /* Reset exact, minimum, and maximum character counters. */
2392 res
->number_chars
= res
->number_chars_min
= res
->number_chars_max
= 0;
2394 /* No directive has been seen yet so the length of output is bounded
2395 by the known range [0, 0] and constant (with no conversion producing
2396 more than 4K bytes) until determined otherwise. */
2397 res
->bounded
= true;
2398 res
->knownrange
= true;
2399 res
->constant
= true;
2400 res
->under4k
= true;
2401 res
->floating
= false;
2402 res
->warned
= false;
2404 const char *pf
= info
.fmtstr
;
2408 /* The beginning of the next format directive. */
2409 const char *dir
= strchr (pf
, '%');
2411 /* Add the number of bytes between the end of the last directive
2412 and either the next if one exists, or the end of the format
2414 add_bytes (info
, pf
, dir
, res
);
2423 /* Incomplete directive. */
2427 conversion_spec spec
= conversion_spec ();
2429 /* POSIX numbered argument index or zero when none. */
2430 unsigned dollar
= 0;
2434 /* This could be either a POSIX positional argument, the '0'
2435 flag, or a width, depending on what follows. Store it as
2436 width and sort it out later after the next character has
2439 spec
.width
= strtol (pf
, &end
, 10);
2440 spec
.have_width
= true;
2443 else if ('*' == *pf
)
2445 /* Similarly to the block above, this could be either a POSIX
2446 positional argument or a width, depending on what follows. */
2447 if (argno
< gimple_call_num_args (info
.callstmt
))
2448 spec
.star_width
= gimple_call_arg (info
.callstmt
, argno
++);
2450 spec
.star_width
= void_node
;
2456 /* Handle the POSIX dollar sign which references the 1-based
2457 positional argument number. */
2458 if (spec
.have_width
)
2459 dollar
= spec
.width
+ info
.argidx
;
2460 else if (spec
.star_width
2461 && TREE_CODE (spec
.star_width
) == INTEGER_CST
)
2462 dollar
= spec
.width
+ tree_to_shwi (spec
.star_width
);
2464 /* Bail when the numbered argument is out of range (it will
2465 have already been diagnosed by -Wformat). */
2467 || dollar
== info
.argidx
2468 || dollar
> gimple_call_num_args (info
.callstmt
))
2473 spec
.star_width
= NULL_TREE
;
2474 spec
.have_width
= false;
2478 if (dollar
|| !spec
.star_width
)
2480 if (spec
.have_width
)
2482 if (spec
.width
== 0)
2484 /* The '0' that has been interpreted as a width above is
2485 actually a flag. Reset HAVE_WIDTH, set the '0' flag,
2486 and continue processing other flags. */
2487 spec
.have_width
= false;
2488 spec
.set_flag ('0');
2492 /* (Non-zero) width has been seen. The next character
2493 is either a period or a digit. */
2494 goto start_precision
;
2497 /* When either '$' has been seen, or width has not been seen,
2498 the next field is the optional flags followed by an optional
2508 spec
.set_flag (*pf
++);
2520 spec
.width
= strtol (pf
, &end
, 10);
2521 spec
.have_width
= true;
2524 else if ('*' == *pf
)
2526 if (argno
< gimple_call_num_args (info
.callstmt
))
2527 spec
.star_width
= gimple_call_arg (info
.callstmt
, argno
++);
2529 spec
.star_width
= void_node
;
2532 else if ('\'' == *pf
)
2534 /* The POSIX apostrophe indicating a numeric grouping
2535 in the current locale. Even though it's possible to
2536 estimate the upper bound on the size of the output
2537 based on the number of digits it probably isn't worth
2551 spec
.precision
= strtol (pf
, &end
, 10);
2552 spec
.have_precision
= true;
2555 else if ('*' == *pf
)
2557 if (argno
< gimple_call_num_args (info
.callstmt
))
2558 spec
.star_precision
= gimple_call_arg (info
.callstmt
, argno
++);
2560 spec
.star_precision
= void_node
;
2565 /* The decimal precision or the asterisk are optional.
2566 When neither is specified it's taken to be zero. */
2568 spec
.have_precision
= true;
2578 spec
.modifier
= FMT_LEN_hh
;
2581 spec
.modifier
= FMT_LEN_h
;
2586 spec
.modifier
= FMT_LEN_j
;
2591 spec
.modifier
= FMT_LEN_L
;
2599 spec
.modifier
= FMT_LEN_ll
;
2602 spec
.modifier
= FMT_LEN_l
;
2607 spec
.modifier
= FMT_LEN_t
;
2612 spec
.modifier
= FMT_LEN_z
;
2619 /* Handle a sole '%' character the same as "%%" but since it's
2620 undefined prevent the result from being folded. */
2623 res
->bounded
= false;
2626 spec
.fmtfunc
= format_percent
;
2637 res
->floating
= true;
2638 spec
.fmtfunc
= format_floating
;
2647 spec
.fmtfunc
= format_integer
;
2651 /* The %p output is implementation-defined. It's possible
2652 to determine this format but due to extensions (especially
2653 those of the Linux kernel -- see bug 78512) the first %p
2654 in the format string disables any further processing. */
2658 /* %n has side-effects even when nothing is actually printed to
2660 info
.nowrite
= false;
2666 spec
.fmtfunc
= format_string
;
2670 /* Unknown conversion specification. */
2674 spec
.specifier
= *pf
++;
2676 /* Compute the length of the format directive. */
2677 size_t dirlen
= pf
- dir
;
2679 /* Extract the argument if the directive takes one and if it's
2680 available (e.g., the function doesn't take a va_list). Treat
2681 missing arguments the same as va_list, even though they will
2682 have likely already been diagnosed by -Wformat. */
2683 tree arg
= NULL_TREE
;
2684 if (spec
.specifier
!= '%'
2685 && argno
< gimple_call_num_args (info
.callstmt
))
2686 arg
= gimple_call_arg (info
.callstmt
, dollar
? dollar
: argno
++);
2688 ::format_directive (info
, res
, dir
, dirlen
, spec
, arg
);
2691 /* Complete format string was processed (with or without warnings). */
2695 /* Return the size of the object referenced by the expression DEST if
2696 available, or -1 otherwise. */
2698 static unsigned HOST_WIDE_INT
2699 get_destination_size (tree dest
)
2701 /* Use __builtin_object_size to determine the size of the destination
2702 object. When optimizing, determine the smallest object (such as
2703 a member array as opposed to the whole enclosing object), otherwise
2704 use type-zero object size to determine the size of the enclosing
2705 object (the function fails without optimization in this type). */
2706 int ost
= optimize
> 0;
2707 unsigned HOST_WIDE_INT size
;
2708 if (compute_builtin_object_size (dest
, ost
, &size
))
2711 return HOST_WIDE_INT_M1U
;
2714 /* Given a suitable result RES of a call to a formatted output function
2715 described by INFO, substitute the result for the return value of
2716 the call. The result is suitable if the number of bytes it represents
2717 is known and exact. A result that isn't suitable for substitution may
2718 have its range set to the range of return values, if that is known. */
2721 try_substitute_return_value (gimple_stmt_iterator
*gsi
,
2722 const pass_sprintf_length::call_info
&info
,
2723 const format_result
&res
)
2725 tree lhs
= gimple_get_lhs (info
.callstmt
);
2727 /* Avoid the return value optimization when the behavior of the call
2728 is undefined either because any directive may have produced 4K or
2729 more of output, or the return value exceeds INT_MAX, or because
2730 the output overflows the destination object (but leave it enabled
2731 when the function is bounded because then the behavior is well-
2736 && (info
.bounded
|| res
.number_chars
<= info
.objsize
)
2737 && res
.number_chars
- 1 <= target_int_max ()
2738 /* Not prepared to handle possibly throwing calls here; they shouldn't
2739 appear in non-artificial testcases, except when the __*_chk routines
2740 are badly declared. */
2741 && !stmt_ends_bb_p (info
.callstmt
))
2743 tree cst
= build_int_cst (integer_type_node
, res
.number_chars
- 1);
2747 /* Replace the call to the bounded function with a zero size
2748 (e.g., snprintf(0, 0, "%i", 123) with the constant result
2749 of the function minus 1 for the terminating NUL which
2750 the function's return value does not include. */
2751 if (!update_call_from_tree (gsi
, cst
))
2752 gimplify_and_update_call_from_tree (gsi
, cst
);
2753 gimple
*callstmt
= gsi_stmt (*gsi
);
2754 update_stmt (callstmt
);
2758 /* Replace the left-hand side of the call with the constant
2759 result of the formatted function minus 1 for the terminating
2760 NUL which the function's return value does not include. */
2761 gimple_call_set_lhs (info
.callstmt
, NULL_TREE
);
2762 gimple
*g
= gimple_build_assign (lhs
, cst
);
2763 gsi_insert_after (gsi
, g
, GSI_NEW_STMT
);
2764 update_stmt (info
.callstmt
);
2769 location_t callloc
= gimple_location (info
.callstmt
);
2770 fprintf (dump_file
, "On line %i substituting ",
2771 LOCATION_LINE (callloc
));
2772 print_generic_expr (dump_file
, cst
, dump_flags
);
2773 fprintf (dump_file
, " for ");
2774 print_generic_expr (dump_file
, info
.func
, dump_flags
);
2775 fprintf (dump_file
, " %s (output %s).\n",
2776 info
.nowrite
? "call" : "return value",
2777 res
.constant
? "constant" : "variable");
2782 unsigned HOST_WIDE_INT maxbytes
;
2786 && ((maxbytes
= res
.number_chars
- 1) <= target_int_max ()
2787 || (res
.number_chars_min
- 1 <= target_int_max ()
2788 && (maxbytes
= res
.number_chars_max
- 1) <= target_int_max ()))
2789 && (info
.bounded
|| maxbytes
< info
.objsize
))
2791 /* If the result is in a valid range bounded by the size of
2792 the destination set it so that it can be used for subsequent
2794 int prec
= TYPE_PRECISION (integer_type_node
);
2796 if (res
.number_chars
< target_int_max () && res
.under4k
)
2798 wide_int num
= wi::shwi (res
.number_chars
- 1, prec
);
2799 set_range_info (lhs
, VR_RANGE
, num
, num
);
2801 else if (res
.number_chars_min
< target_int_max ()
2802 && res
.number_chars_max
< target_int_max ())
2804 wide_int min
= wi::shwi (res
.under4k
? res
.number_chars_min
- 1
2805 : target_int_min (), prec
);
2806 wide_int max
= wi::shwi (res
.number_chars_max
- 1, prec
);
2807 set_range_info (lhs
, VR_RANGE
, min
, max
);
2813 const char *inbounds
2814 = (res
.number_chars_min
<= info
.objsize
2815 ? (res
.number_chars_max
<= info
.objsize
2816 ? "in" : "potentially out-of")
2819 location_t callloc
= gimple_location (info
.callstmt
);
2820 fprintf (dump_file
, "On line %i ", LOCATION_LINE (callloc
));
2821 print_generic_expr (dump_file
, info
.func
, dump_flags
);
2823 const char *ign
= lhs
? "" : " ignored";
2824 if (res
.number_chars
>= HOST_WIDE_INT_MAX
)
2826 " %s-bounds return value in range [%lu, %lu]%s.\n",
2828 (unsigned long)res
.number_chars_min
- 1,
2829 (unsigned long)res
.number_chars_max
- 1, ign
);
2831 fprintf (dump_file
, " %s-bounds return value %lu%s.\n",
2832 inbounds
, (unsigned long)res
.number_chars
- 1, ign
);
2837 /* Determine if a GIMPLE CALL is to one of the sprintf-like built-in
2838 functions and if so, handle it. */
2841 pass_sprintf_length::handle_gimple_call (gimple_stmt_iterator
*gsi
)
2843 call_info info
= call_info ();
2845 info
.callstmt
= gsi_stmt (*gsi
);
2846 if (!gimple_call_builtin_p (info
.callstmt
, BUILT_IN_NORMAL
))
2849 info
.func
= gimple_call_fndecl (info
.callstmt
);
2850 info
.fncode
= DECL_FUNCTION_CODE (info
.func
);
2852 /* The size of the destination as in snprintf(dest, size, ...). */
2853 unsigned HOST_WIDE_INT dstsize
= HOST_WIDE_INT_M1U
;
2855 /* The size of the destination determined by __builtin_object_size. */
2856 unsigned HOST_WIDE_INT objsize
= HOST_WIDE_INT_M1U
;
2858 /* Buffer size argument number (snprintf and vsnprintf). */
2859 unsigned HOST_WIDE_INT idx_dstsize
= HOST_WIDE_INT_M1U
;
2861 /* Object size argument number (snprintf_chk and vsnprintf_chk). */
2862 unsigned HOST_WIDE_INT idx_objsize
= HOST_WIDE_INT_M1U
;
2864 /* Format string argument number (valid for all functions). */
2865 unsigned idx_format
;
2867 switch (info
.fncode
)
2869 case BUILT_IN_SPRINTF
:
2871 // __builtin_sprintf (dst, format, ...)
2876 case BUILT_IN_SPRINTF_CHK
:
2878 // __builtin___sprintf_chk (dst, ost, objsize, format, ...)
2884 case BUILT_IN_SNPRINTF
:
2886 // __builtin_snprintf (dst, size, format, ...)
2890 info
.bounded
= true;
2893 case BUILT_IN_SNPRINTF_CHK
:
2895 // __builtin___snprintf_chk (dst, size, ost, objsize, format, ...)
2900 info
.bounded
= true;
2903 case BUILT_IN_VSNPRINTF
:
2905 // __builtin_vsprintf (dst, size, format, va)
2909 info
.bounded
= true;
2912 case BUILT_IN_VSNPRINTF_CHK
:
2914 // __builtin___vsnprintf_chk (dst, size, ost, objsize, format, va)
2919 info
.bounded
= true;
2922 case BUILT_IN_VSPRINTF
:
2924 // __builtin_vsprintf (dst, format, va)
2929 case BUILT_IN_VSPRINTF_CHK
:
2931 // __builtin___vsprintf_chk (dst, ost, objsize, format, va)
2941 /* The first argument is a pointer to the destination. */
2942 tree dstptr
= gimple_call_arg (info
.callstmt
, 0);
2944 info
.format
= gimple_call_arg (info
.callstmt
, idx_format
);
2946 if (idx_dstsize
== HOST_WIDE_INT_M1U
)
2948 /* For non-bounded functions like sprintf, determine the size
2949 of the destination from the object or pointer passed to it
2950 as the first argument. */
2951 dstsize
= get_destination_size (dstptr
);
2953 else if (tree size
= gimple_call_arg (info
.callstmt
, idx_dstsize
))
2955 /* For bounded functions try to get the size argument. */
2957 if (TREE_CODE (size
) == INTEGER_CST
)
2959 dstsize
= tree_to_uhwi (size
);
2960 /* No object can be larger than SIZE_MAX bytes (half the address
2961 space) on the target.
2962 The functions are defined only for output of at most INT_MAX
2963 bytes. Specifying a bound in excess of that limit effectively
2964 defeats the bounds checking (and on some implementations such
2965 as Solaris cause the function to fail with EINVAL). */
2966 if (dstsize
> target_size_max () / 2)
2968 /* Avoid warning if -Wstringop-overflow is specified since
2969 it also warns for the same thing though only for the
2970 checking built-ins. */
2971 if ((idx_objsize
== HOST_WIDE_INT_M1U
2972 || !warn_stringop_overflow
))
2973 warning_at (gimple_location (info
.callstmt
),
2974 OPT_Wformat_length_
,
2975 "specified bound %wu exceeds maximum object size "
2977 dstsize
, target_size_max () / 2);
2979 else if (dstsize
> target_int_max ())
2980 warning_at (gimple_location (info
.callstmt
), OPT_Wformat_length_
,
2981 "specified bound %wu exceeds %<INT_MAX %>",
2984 else if (TREE_CODE (size
) == SSA_NAME
)
2986 /* Try to determine the range of values of the argument
2987 and use the greater of the two at -Wformat-level 1 and
2988 the smaller of them at level 2. */
2990 enum value_range_type range_type
2991 = get_range_info (size
, &min
, &max
);
2992 if (range_type
== VR_RANGE
)
2995 = (warn_format_length
< 2
2996 ? wi::fits_uhwi_p (max
) ? max
.to_uhwi () : max
.to_shwi ()
2997 : wi::fits_uhwi_p (min
) ? min
.to_uhwi () : min
.to_shwi ());
3002 if (idx_objsize
!= HOST_WIDE_INT_M1U
)
3004 if (tree size
= gimple_call_arg (info
.callstmt
, idx_objsize
))
3005 if (tree_fits_uhwi_p (size
))
3006 objsize
= tree_to_uhwi (size
);
3009 if (info
.bounded
&& !dstsize
)
3011 /* As a special case, when the explicitly specified destination
3012 size argument (to a bounded function like snprintf) is zero
3013 it is a request to determine the number of bytes on output
3014 without actually producing any. Pretend the size is
3015 unlimited in this case. */
3016 info
.objsize
= HOST_WIDE_INT_MAX
;
3017 info
.nowrite
= true;
3021 /* For calls to non-bounded functions or to those of bounded
3022 functions with a non-zero size, warn if the destination
3024 if (integer_zerop (dstptr
))
3026 /* This is diagnosed with -Wformat only when the null is a constant
3027 pointer. The warning here diagnoses instances where the pointer
3029 location_t loc
= gimple_location (info
.callstmt
);
3030 warning_at (EXPR_LOC_OR_LOC (dstptr
, loc
),
3031 OPT_Wformat_length_
, "null destination pointer");
3035 /* Set the object size to the smaller of the two arguments
3036 of both have been specified and they're not equal. */
3037 info
.objsize
= dstsize
< objsize
? dstsize
: objsize
;
3040 && dstsize
< target_size_max () / 2 && objsize
< dstsize
3041 /* Avoid warning if -Wstringop-overflow is specified since
3042 it also warns for the same thing though only for the
3043 checking built-ins. */
3044 && (idx_objsize
== HOST_WIDE_INT_M1U
3045 || !warn_stringop_overflow
))
3047 warning_at (gimple_location (info
.callstmt
), OPT_Wformat_length_
,
3048 "specified bound %wu exceeds the size %wu "
3049 "of the destination object", dstsize
, objsize
);
3053 if (integer_zerop (info
.format
))
3055 /* This is diagnosed with -Wformat only when the null is a constant
3056 pointer. The warning here diagnoses instances where the pointer
3058 location_t loc
= gimple_location (info
.callstmt
);
3059 warning_at (EXPR_LOC_OR_LOC (info
.format
, loc
),
3060 OPT_Wformat_length_
, "null format string");
3064 info
.fmtstr
= get_format_string (info
.format
, &info
.fmtloc
);
3068 /* The result is the number of bytes output by the formatted function,
3069 including the terminating NUL. */
3070 format_result res
= format_result ();
3072 bool success
= compute_format_length (info
, &res
);
3074 /* When optimizing and the printf return value optimization is enabled,
3075 attempt to substitute the computed result for the return value of
3076 the call. Avoid this optimization when -frounding-math is in effect
3077 and the format string contains a floating point directive. */
3080 && flag_printf_return_value
3081 && (!flag_rounding_math
|| !res
.floating
))
3082 try_substitute_return_value (gsi
, info
, res
);
3085 /* Execute the pass for function FUN. */
3088 pass_sprintf_length::execute (function
*fun
)
3091 FOR_EACH_BB_FN (bb
, fun
)
3093 for (gimple_stmt_iterator si
= gsi_start_bb (bb
); !gsi_end_p (si
);
3096 /* Iterate over statements, looking for function calls. */
3097 gimple
*stmt
= gsi_stmt (si
);
3099 if (is_gimple_call (stmt
))
3100 handle_gimple_call (&si
);
3107 } /* Unnamed namespace. */
3109 /* Return a pointer to a pass object newly constructed from the context
3113 make_pass_sprintf_length (gcc::context
*ctxt
)
3115 return new pass_sprintf_length (ctxt
);