Daily bump.
[official-gcc.git] / gcc / gimple-ssa-sprintf.c
blob2474391cadf6eb328a15f1397be4e14b1031f2c6
1 /* Copyright (C) 2016-2017 Free Software Foundation, Inc.
2 Contributed by Martin Sebor <msebor@redhat.com>.
4 This file is part of GCC.
6 GCC is free software; you can redistribute it and/or modify it under
7 the terms of the GNU General Public License as published by the Free
8 Software Foundation; either version 3, or (at your option) any later
9 version.
11 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
12 WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 for more details.
16 You should have received a copy of the GNU General Public License
17 along with GCC; see the file COPYING3. If not see
18 <http://www.gnu.org/licenses/>. */
20 /* This file implements the printf-return-value pass. The pass does
21 two things: 1) it analyzes calls to formatted output functions like
22 sprintf looking for possible buffer overflows and calls to bounded
23 functions like snprintf for early truncation (and under the control
24 of the -Wformat-length option issues warnings), and 2) under the
25 control of the -fprintf-return-value option it folds the return
26 value of safe calls into constants, making it possible to eliminate
27 code that depends on the value of those constants.
29 For all functions (bounded or not) the pass uses the size of the
30 destination object. That means that it will diagnose calls to
31 snprintf not on the basis of the size specified by the function's
32 second argument but rathger on the basis of the size the first
33 argument points to (if possible). For bound-checking built-ins
34 like __builtin___snprintf_chk the pass uses the size typically
35 determined by __builtin_object_size and passed to the built-in
36 by the Glibc inline wrapper.
38 The pass handles all forms standard sprintf format directives,
39 including character, integer, floating point, pointer, and strings,
40 with the standard C flags, widths, and precisions. For integers
41 and strings it computes the length of output itself. For floating
42 point it uses MPFR to fornmat known constants with up and down
43 rounding and uses the resulting range of output lengths. For
44 strings it uses the length of string literals and the sizes of
45 character arrays that a character pointer may point to as a bound
46 on the longest string. */
48 #include "config.h"
49 #include "system.h"
50 #include "coretypes.h"
51 #include "backend.h"
52 #include "tree.h"
53 #include "gimple.h"
54 #include "tree-pass.h"
55 #include "ssa.h"
56 #include "gimple-fold.h"
57 #include "gimple-pretty-print.h"
58 #include "diagnostic-core.h"
59 #include "fold-const.h"
60 #include "gimple-iterator.h"
61 #include "tree-ssa.h"
62 #include "tree-object-size.h"
63 #include "params.h"
64 #include "tree-cfg.h"
65 #include "tree-ssa-propagate.h"
66 #include "calls.h"
67 #include "cfgloop.h"
68 #include "intl.h"
70 #include "builtins.h"
71 #include "stor-layout.h"
73 #include "realmpfr.h"
74 #include "target.h"
76 #include "cpplib.h"
77 #include "input.h"
78 #include "toplev.h"
79 #include "substring-locations.h"
80 #include "diagnostic.h"
82 /* The likely worst case value of MB_LEN_MAX for the target, large enough
83 for UTF-8. Ideally, this would be obtained by a target hook if it were
84 to be used for optimization but it's good enough as is for warnings. */
85 #define target_mb_len_max() 6
87 /* The maximum number of bytes a single non-string directive can result
88 in. This is the result of printf("%.*Lf", INT_MAX, -LDBL_MAX) for
89 LDBL_MAX_10_EXP of 4932. */
90 #define IEEE_MAX_10_EXP 4932
91 #define target_dir_max() (target_int_max () + IEEE_MAX_10_EXP + 2)
93 namespace {
95 const pass_data pass_data_sprintf_length = {
96 GIMPLE_PASS, // pass type
97 "printf-return-value", // pass name
98 OPTGROUP_NONE, // optinfo_flags
99 TV_NONE, // tv_id
100 PROP_cfg, // properties_required
101 0, // properties_provided
102 0, // properties_destroyed
103 0, // properties_start
104 0, // properties_finish
107 /* Set to the warning level for the current function which is equal
108 either to warn_format_trunc for bounded functions or to
109 warn_format_overflow otherwise. */
111 static int warn_level;
113 struct format_result;
115 class pass_sprintf_length : public gimple_opt_pass
117 bool fold_return_value;
119 public:
120 pass_sprintf_length (gcc::context *ctxt)
121 : gimple_opt_pass (pass_data_sprintf_length, ctxt),
122 fold_return_value (false)
125 opt_pass * clone () { return new pass_sprintf_length (m_ctxt); }
127 virtual bool gate (function *);
129 virtual unsigned int execute (function *);
131 void set_pass_param (unsigned int n, bool param)
133 gcc_assert (n == 0);
134 fold_return_value = param;
137 bool handle_gimple_call (gimple_stmt_iterator *);
139 struct call_info;
140 bool compute_format_length (call_info &, format_result *);
143 bool
144 pass_sprintf_length::gate (function *)
146 /* Run the pass iff -Warn-format-overflow or -Warn-format-truncation
147 is specified and either not optimizing and the pass is being invoked
148 early, or when optimizing and the pass is being invoked during
149 optimization (i.e., "late"). */
150 return ((warn_format_overflow > 0
151 || warn_format_trunc > 0
152 || flag_printf_return_value)
153 && (optimize > 0) == fold_return_value);
156 /* The minimum, maximum, likely, and unlikely maximum number of bytes
157 of output either a formatting function or an individual directive
158 can result in. */
160 struct result_range
162 /* The absolute minimum number of bytes. The result of a successful
163 conversion is guaranteed to be no less than this. (An erroneous
164 conversion can be indicated by MIN > HOST_WIDE_INT_MAX.) */
165 unsigned HOST_WIDE_INT min;
166 /* The likely maximum result that is used in diagnostics. In most
167 cases MAX is the same as the worst case UNLIKELY result. */
168 unsigned HOST_WIDE_INT max;
169 /* The likely result used to trigger diagnostics. For conversions
170 that result in a range of bytes [MIN, MAX], LIKELY is somewhere
171 in that range. */
172 unsigned HOST_WIDE_INT likely;
173 /* In rare cases (e.g., for nultibyte characters) UNLIKELY gives
174 the worst cases maximum result of a directive. In most cases
175 UNLIKELY == MAX. UNLIKELY is used to control the return value
176 optimization but not in diagnostics. */
177 unsigned HOST_WIDE_INT unlikely;
180 /* The result of a call to a formatted function. */
182 struct format_result
184 /* Range of characters written by the formatted function.
185 Setting the minimum to HOST_WIDE_INT_MAX disables all
186 length tracking for the remainder of the format string. */
187 result_range range;
189 /* True when the range above is obtained from known values of
190 directive arguments, or bounds on the amount of output such
191 as width and precision, and not the result of heuristics that
192 depend on warning levels. It's used to issue stricter diagnostics
193 in cases where strings of unknown lengths are bounded by the arrays
194 they are determined to refer to. KNOWNRANGE must not be used for
195 the return value optimization. */
196 bool knownrange;
198 /* True if no individual directive resulted in more than 4095 bytes
199 of output (the total NUMBER_CHARS_{MIN,MAX} might be greater).
200 Implementations are not required to handle directives that produce
201 more than 4K bytes (leading to undefined behavior) and so when one
202 is found it disables the return value optimization. */
203 bool under4k;
205 /* True when a floating point directive has been seen in the format
206 string. */
207 bool floating;
209 /* True when an intermediate result has caused a warning. Used to
210 avoid issuing duplicate warnings while finishing the processing
211 of a call. WARNED also disables the return value optimization. */
212 bool warned;
214 /* Preincrement the number of output characters by 1. */
215 format_result& operator++ ()
217 return *this += 1;
220 /* Postincrement the number of output characters by 1. */
221 format_result operator++ (int)
223 format_result prev (*this);
224 *this += 1;
225 return prev;
228 /* Increment the number of output characters by N. */
229 format_result& operator+= (unsigned HOST_WIDE_INT);
232 format_result&
233 format_result::operator+= (unsigned HOST_WIDE_INT n)
235 gcc_assert (n < HOST_WIDE_INT_MAX);
237 if (range.min < HOST_WIDE_INT_MAX)
238 range.min += n;
240 if (range.max < HOST_WIDE_INT_MAX)
241 range.max += n;
243 if (range.likely < HOST_WIDE_INT_MAX)
244 range.likely += n;
246 if (range.unlikely < HOST_WIDE_INT_MAX)
247 range.unlikely += n;
249 return *this;
252 /* Return the value of INT_MIN for the target. */
254 static inline HOST_WIDE_INT
255 target_int_min ()
257 return tree_to_shwi (TYPE_MIN_VALUE (integer_type_node));
260 /* Return the value of INT_MAX for the target. */
262 static inline unsigned HOST_WIDE_INT
263 target_int_max ()
265 return tree_to_uhwi (TYPE_MAX_VALUE (integer_type_node));
268 /* Return the value of SIZE_MAX for the target. */
270 static inline unsigned HOST_WIDE_INT
271 target_size_max ()
273 return tree_to_uhwi (TYPE_MAX_VALUE (size_type_node));
276 /* Return the constant initial value of DECL if available or DECL
277 otherwise. Same as the synonymous function in c/c-typeck.c. */
279 static tree
280 decl_constant_value (tree decl)
282 if (/* Don't change a variable array bound or initial value to a constant
283 in a place where a variable is invalid. Note that DECL_INITIAL
284 isn't valid for a PARM_DECL. */
285 current_function_decl != 0
286 && TREE_CODE (decl) != PARM_DECL
287 && !TREE_THIS_VOLATILE (decl)
288 && TREE_READONLY (decl)
289 && DECL_INITIAL (decl) != 0
290 && TREE_CODE (DECL_INITIAL (decl)) != ERROR_MARK
291 /* This is invalid if initial value is not constant.
292 If it has either a function call, a memory reference,
293 or a variable, then re-evaluating it could give different results. */
294 && TREE_CONSTANT (DECL_INITIAL (decl))
295 /* Check for cases where this is sub-optimal, even though valid. */
296 && TREE_CODE (DECL_INITIAL (decl)) != CONSTRUCTOR)
297 return DECL_INITIAL (decl);
298 return decl;
301 /* Given FORMAT, set *PLOC to the source location of the format string
302 and return the format string if it is known or null otherwise. */
304 static const char*
305 get_format_string (tree format, location_t *ploc)
307 if (VAR_P (format))
309 /* Pull out a constant value if the front end didn't. */
310 format = decl_constant_value (format);
311 STRIP_NOPS (format);
314 if (integer_zerop (format))
316 /* FIXME: Diagnose null format string if it hasn't been diagnosed
317 by -Wformat (the latter diagnoses only nul pointer constants,
318 this pass can do better). */
319 return NULL;
322 HOST_WIDE_INT offset = 0;
324 if (TREE_CODE (format) == POINTER_PLUS_EXPR)
326 tree arg0 = TREE_OPERAND (format, 0);
327 tree arg1 = TREE_OPERAND (format, 1);
328 STRIP_NOPS (arg0);
329 STRIP_NOPS (arg1);
331 if (TREE_CODE (arg1) != INTEGER_CST)
332 return NULL;
334 format = arg0;
336 /* POINTER_PLUS_EXPR offsets are to be interpreted signed. */
337 if (!cst_and_fits_in_hwi (arg1))
338 return NULL;
340 offset = int_cst_value (arg1);
343 if (TREE_CODE (format) != ADDR_EXPR)
344 return NULL;
346 *ploc = EXPR_LOC_OR_LOC (format, input_location);
348 format = TREE_OPERAND (format, 0);
350 if (TREE_CODE (format) == ARRAY_REF
351 && tree_fits_shwi_p (TREE_OPERAND (format, 1))
352 && (offset += tree_to_shwi (TREE_OPERAND (format, 1))) >= 0)
353 format = TREE_OPERAND (format, 0);
355 if (offset < 0)
356 return NULL;
358 tree array_init;
359 tree array_size = NULL_TREE;
361 if (VAR_P (format)
362 && TREE_CODE (TREE_TYPE (format)) == ARRAY_TYPE
363 && (array_init = decl_constant_value (format)) != format
364 && TREE_CODE (array_init) == STRING_CST)
366 /* Extract the string constant initializer. Note that this may
367 include a trailing NUL character that is not in the array (e.g.
368 const char a[3] = "foo";). */
369 array_size = DECL_SIZE_UNIT (format);
370 format = array_init;
373 if (TREE_CODE (format) != STRING_CST)
374 return NULL;
376 if (TYPE_MAIN_VARIANT (TREE_TYPE (TREE_TYPE (format))) != char_type_node)
378 /* Wide format string. */
379 return NULL;
382 const char *fmtstr = TREE_STRING_POINTER (format);
383 unsigned fmtlen = TREE_STRING_LENGTH (format);
385 if (array_size)
387 /* Variable length arrays can't be initialized. */
388 gcc_assert (TREE_CODE (array_size) == INTEGER_CST);
390 if (tree_fits_shwi_p (array_size))
392 HOST_WIDE_INT array_size_value = tree_to_shwi (array_size);
393 if (array_size_value > 0
394 && array_size_value == (int) array_size_value
395 && fmtlen > array_size_value)
396 fmtlen = array_size_value;
399 if (offset)
401 if (offset >= fmtlen)
402 return NULL;
404 fmtstr += offset;
405 fmtlen -= offset;
408 if (fmtlen < 1 || fmtstr[--fmtlen] != 0)
410 /* FIXME: Diagnose an unterminated format string if it hasn't been
411 diagnosed by -Wformat. Similarly to a null format pointer,
412 -Wformay diagnoses only nul pointer constants, this pass can
413 do better). */
414 return NULL;
417 return fmtstr;
420 /* The format_warning_at_substring function is not used here in a way
421 that makes using attribute format viable. Suppress the warning. */
423 #pragma GCC diagnostic push
424 #pragma GCC diagnostic ignored "-Wsuggest-attribute=format"
426 /* For convenience and brevity. */
428 static bool
429 (* const fmtwarn) (const substring_loc &, const source_range *,
430 const char *, int, const char *, ...)
431 = format_warning_at_substring;
433 /* Format length modifiers. */
435 enum format_lengths
437 FMT_LEN_none,
438 FMT_LEN_hh, // char argument
439 FMT_LEN_h, // short
440 FMT_LEN_l, // long
441 FMT_LEN_ll, // long long
442 FMT_LEN_L, // long double (and GNU long long)
443 FMT_LEN_z, // size_t
444 FMT_LEN_t, // ptrdiff_t
445 FMT_LEN_j // intmax_t
449 /* Description of the result of conversion either of a single directive
450 or the whole format string. */
452 struct fmtresult
454 /* Construct a FMTRESULT object with all counters initialized
455 to MIN. KNOWNRANGE is set when MIN is valid. */
456 fmtresult (unsigned HOST_WIDE_INT min = HOST_WIDE_INT_MAX)
457 : argmin (), argmax (),
458 knownrange (min < HOST_WIDE_INT_MAX),
459 nullp ()
461 range.min = min;
462 range.max = min;
463 range.likely = min;
464 range.unlikely = min;
467 /* Construct a FMTRESULT object with MIN, MAX, and LIKELY counters.
468 KNOWNRANGE is set when both MIN and MAX are valid. */
469 fmtresult (unsigned HOST_WIDE_INT min, unsigned HOST_WIDE_INT max,
470 unsigned HOST_WIDE_INT likely = HOST_WIDE_INT_MAX)
471 : argmin (), argmax (),
472 knownrange (min < HOST_WIDE_INT_MAX && max < HOST_WIDE_INT_MAX),
473 nullp ()
475 range.min = min;
476 range.max = max;
477 range.likely = max < likely ? min : likely;
478 range.unlikely = max;
481 /* Adjust result upward to reflect the RANGE of values the specified
482 width or precision is known to be in. */
483 fmtresult& adjust_for_width_or_precision (const HOST_WIDE_INT[2],
484 tree = NULL_TREE,
485 unsigned = 0, unsigned = 0);
487 /* Return the maximum number of decimal digits a value of TYPE
488 formats as on output. */
489 static unsigned type_max_digits (tree, int);
491 /* The range a directive's argument is in. */
492 tree argmin, argmax;
494 /* The minimum and maximum number of bytes that a directive
495 results in on output for an argument in the range above. */
496 result_range range;
498 /* True when the range above is obtained from a known value of
499 a directive's argument or its bounds and not the result of
500 heuristics that depend on warning levels. */
501 bool knownrange;
503 /* True when the argument is a null pointer. */
504 bool nullp;
507 /* Adjust result upward to reflect the range ADJUST of values the
508 specified width or precision is known to be in. When non-null,
509 TYPE denotes the type of the directive whose result is being
510 adjusted, BASE gives the base of the directive (octal, decimal,
511 or hex), and ADJ denotes the additional adjustment to the LIKELY
512 counter that may need to be added when ADJUST is a range. */
514 fmtresult&
515 fmtresult::adjust_for_width_or_precision (const HOST_WIDE_INT adjust[2],
516 tree type /* = NULL_TREE */,
517 unsigned base /* = 0 */,
518 unsigned adj /* = 0 */)
520 bool minadjusted = false;
522 /* Adjust the minimum and likely counters. */
523 if (adjust[0] >= 0)
525 if (range.min < (unsigned HOST_WIDE_INT)adjust[0])
527 range.min = adjust[0];
528 minadjusted = true;
531 /* Adjust the likely counter. */
532 if (range.likely < range.min)
533 range.likely = range.min;
535 else if (adjust[0] == target_int_min ()
536 && (unsigned HOST_WIDE_INT)adjust[1] == target_int_max ())
537 knownrange = false;
539 /* Adjust the maximum counter. */
540 if (adjust[1] > 0)
542 if (range.max < (unsigned HOST_WIDE_INT)adjust[1])
544 range.max = adjust[1];
546 /* Set KNOWNRANGE if both the minimum and maximum have been
547 adjusted. Otherwise leave it at what it was before. */
548 knownrange = minadjusted;
552 if (warn_level > 1 && type)
554 /* For large non-constant width or precision whose range spans
555 the maximum number of digits produced by the directive for
556 any argument, set the likely number of bytes to be at most
557 the number digits plus other adjustment determined by the
558 caller (one for sign or two for the hexadecimal "0x"
559 prefix). */
560 unsigned dirdigs = type_max_digits (type, base);
561 if (adjust[0] < dirdigs && dirdigs < adjust[1]
562 && range.likely < dirdigs)
563 range.likely = dirdigs + adj;
565 else if (range.likely < (range.min ? range.min : 1))
567 /* Conservatively, set LIKELY to at least MIN but no less than
568 1 unless MAX is zero. */
569 range.likely = (range.min
570 ? range.min
571 : range.max && (range.max < HOST_WIDE_INT_MAX
572 || warn_level > 1) ? 1 : 0);
575 /* Finally adjust the unlikely counter to be at least as large as
576 the maximum. */
577 if (range.unlikely < range.max)
578 range.unlikely = range.max;
580 return *this;
583 /* Return the maximum number of digits a value of TYPE formats in
584 BASE on output, not counting base prefix . */
586 unsigned
587 fmtresult::type_max_digits (tree type, int base)
589 unsigned prec = TYPE_PRECISION (type);
590 if (base == 8)
591 return (prec + 2) / 3;
593 if (base == 16)
594 return prec / 4;
596 /* Decimal approximation: yields 3, 5, 10, and 20 for precision
597 of 8, 16, 32, and 64 bits. */
598 return prec * 301 / 1000 + 1;
601 static bool
602 get_int_range (tree, tree, HOST_WIDE_INT *, HOST_WIDE_INT *,
603 bool, HOST_WIDE_INT);
605 /* Description of a format directive. A directive is either a plain
606 string or a conversion specification that starts with '%'. */
608 struct directive
610 /* The 1-based directive number (for debugging). */
611 unsigned dirno;
613 /* The first character of the directive and its length. */
614 const char *beg;
615 size_t len;
617 /* A bitmap of flags, one for each character. */
618 unsigned flags[256 / sizeof (int)];
620 /* The range of values of the specified width, or -1 if not specified. */
621 HOST_WIDE_INT width[2];
622 /* The range of values of the specified precision, or -1 if not
623 specified. */
624 HOST_WIDE_INT prec[2];
626 /* Length modifier. */
627 format_lengths modifier;
629 /* Format specifier character. */
630 char specifier;
632 /* The argument of the directive or null when the directive doesn't
633 take one or when none is available (such as for vararg functions). */
634 tree arg;
636 /* Format conversion function that given a directive and an argument
637 returns the formatting result. */
638 fmtresult (*fmtfunc) (const directive &, tree);
640 /* Return True when a the format flag CHR has been used. */
641 bool get_flag (char chr) const
643 unsigned char c = chr & 0xff;
644 return (flags[c / (CHAR_BIT * sizeof *flags)]
645 & (1U << (c % (CHAR_BIT * sizeof *flags))));
648 /* Make a record of the format flag CHR having been used. */
649 void set_flag (char chr)
651 unsigned char c = chr & 0xff;
652 flags[c / (CHAR_BIT * sizeof *flags)]
653 |= (1U << (c % (CHAR_BIT * sizeof *flags)));
656 /* Reset the format flag CHR. */
657 void clear_flag (char chr)
659 unsigned char c = chr & 0xff;
660 flags[c / (CHAR_BIT * sizeof *flags)]
661 &= ~(1U << (c % (CHAR_BIT * sizeof *flags)));
664 /* Set both bounds of the width range to VAL. */
665 void set_width (HOST_WIDE_INT val)
667 width[0] = width[1] = val;
670 /* Set the width range according to ARG, with both bounds being
671 no less than 0. For a constant ARG set both bounds to its value
672 or 0, whichever is greater. For a non-constant ARG in some range
673 set width to its range adjusting each bound to -1 if it's less.
674 For an indeterminate ARG set width to [0, INT_MAX]. */
675 void set_width (tree arg)
677 get_int_range (arg, integer_type_node, width, width + 1, true, 0);
680 /* Set both bounds of the precision range to VAL. */
681 void set_precision (HOST_WIDE_INT val)
683 prec[0] = prec[1] = val;
686 /* Set the precision range according to ARG, with both bounds being
687 no less than -1. For a constant ARG set both bounds to its value
688 or -1 whichever is greater. For a non-constant ARG in some range
689 set precision to its range adjusting each bound to -1 if it's less.
690 For an indeterminate ARG set precision to [-1, INT_MAX]. */
691 void set_precision (tree arg)
693 get_int_range (arg, integer_type_node, prec, prec + 1, false, -1);
696 /* Return true if both width and precision are known to be
697 either constant or in some range, false otherwise. */
698 bool known_width_and_precision () const
700 return ((width[1] < 0
701 || (unsigned HOST_WIDE_INT)width[1] <= target_int_max ())
702 && (prec[1] < 0
703 || (unsigned HOST_WIDE_INT)prec[1] < target_int_max ()));
707 /* Return the logarithm of X in BASE. */
709 static int
710 ilog (unsigned HOST_WIDE_INT x, int base)
712 int res = 0;
715 ++res;
716 x /= base;
717 } while (x);
718 return res;
721 /* Return the number of bytes resulting from converting into a string
722 the INTEGER_CST tree node X in BASE with a minimum of PREC digits.
723 PLUS indicates whether 1 for a plus sign should be added for positive
724 numbers, and PREFIX whether the length of an octal ('O') or hexadecimal
725 ('0x') prefix should be added for nonzero numbers. Return -1 if X cannot
726 be represented. */
728 static HOST_WIDE_INT
729 tree_digits (tree x, int base, HOST_WIDE_INT prec, bool plus, bool prefix)
731 unsigned HOST_WIDE_INT absval;
733 HOST_WIDE_INT res;
735 if (TYPE_UNSIGNED (TREE_TYPE (x)))
737 if (tree_fits_uhwi_p (x))
739 absval = tree_to_uhwi (x);
740 res = plus;
742 else
743 return -1;
745 else
747 if (tree_fits_shwi_p (x))
749 HOST_WIDE_INT i = tree_to_shwi (x);
750 if (HOST_WIDE_INT_MIN == i)
752 /* Avoid undefined behavior due to negating a minimum. */
753 absval = HOST_WIDE_INT_MAX;
754 res = 1;
756 else if (i < 0)
758 absval = -i;
759 res = 1;
761 else
763 absval = i;
764 res = plus;
767 else
768 return -1;
771 int ndigs = ilog (absval, base);
773 res += prec < ndigs ? ndigs : prec;
775 /* Adjust a non-zero value for the base prefix, either hexadecimal,
776 or, unless precision has resulted in a leading zero, also octal. */
777 if (prefix && absval && (base == 16 || prec <= ndigs))
779 if (base == 8)
780 res += 1;
781 else if (base == 16)
782 res += 2;
785 return res;
788 /* Given the formatting result described by RES and NAVAIL, the number
789 of available in the destination, return the range of bytes remaining
790 in the destination. */
792 static inline result_range
793 bytes_remaining (unsigned HOST_WIDE_INT navail, const format_result &res)
795 result_range range;
797 if (HOST_WIDE_INT_MAX <= navail)
799 range.min = range.max = range.likely = range.unlikely = navail;
800 return range;
803 /* The lower bound of the available range is the available size
804 minus the maximum output size, and the upper bound is the size
805 minus the minimum. */
806 range.max = res.range.min < navail ? navail - res.range.min : 0;
808 range.likely = res.range.likely < navail ? navail - res.range.likely : 0;
810 if (res.range.max < HOST_WIDE_INT_MAX)
811 range.min = res.range.max < navail ? navail - res.range.max : 0;
812 else
813 range.min = range.likely;
815 range.unlikely = (res.range.unlikely < navail
816 ? navail - res.range.unlikely : 0);
818 return range;
821 /* Description of a call to a formatted function. */
823 struct pass_sprintf_length::call_info
825 /* Function call statement. */
826 gimple *callstmt;
828 /* Function called. */
829 tree func;
831 /* Called built-in function code. */
832 built_in_function fncode;
834 /* Format argument and format string extracted from it. */
835 tree format;
836 const char *fmtstr;
838 /* The location of the format argument. */
839 location_t fmtloc;
841 /* The destination object size for __builtin___xxx_chk functions
842 typically determined by __builtin_object_size, or -1 if unknown. */
843 unsigned HOST_WIDE_INT objsize;
845 /* Number of the first variable argument. */
846 unsigned HOST_WIDE_INT argidx;
848 /* True for functions like snprintf that specify the size of
849 the destination, false for others like sprintf that don't. */
850 bool bounded;
852 /* True for bounded functions like snprintf that specify a zero-size
853 buffer as a request to compute the size of output without actually
854 writing any. NOWRITE is cleared in response to the %n directive
855 which has side-effects similar to writing output. */
856 bool nowrite;
858 /* Return true if the called function's return value is used. */
859 bool retval_used () const
861 return gimple_get_lhs (callstmt);
864 /* Return the warning option corresponding to the called function. */
865 int warnopt () const
867 return bounded ? OPT_Wformat_truncation_ : OPT_Wformat_overflow_;
871 /* Return the result of formatting a no-op directive (such as '%n'). */
873 static fmtresult
874 format_none (const directive &, tree)
876 fmtresult res (0);
877 return res;
880 /* Return the result of formatting the '%%' directive. */
882 static fmtresult
883 format_percent (const directive &, tree)
885 fmtresult res (1);
886 return res;
890 /* Compute intmax_type_node and uintmax_type_node similarly to how
891 tree.c builds size_type_node. */
893 static void
894 build_intmax_type_nodes (tree *pintmax, tree *puintmax)
896 if (strcmp (UINTMAX_TYPE, "unsigned int") == 0)
898 *pintmax = integer_type_node;
899 *puintmax = unsigned_type_node;
901 else if (strcmp (UINTMAX_TYPE, "long unsigned int") == 0)
903 *pintmax = long_integer_type_node;
904 *puintmax = long_unsigned_type_node;
906 else if (strcmp (UINTMAX_TYPE, "long long unsigned int") == 0)
908 *pintmax = long_long_integer_type_node;
909 *puintmax = long_long_unsigned_type_node;
911 else
913 for (int i = 0; i < NUM_INT_N_ENTS; i++)
914 if (int_n_enabled_p[i])
916 char name[50];
917 sprintf (name, "__int%d unsigned", int_n_data[i].bitsize);
919 if (strcmp (name, UINTMAX_TYPE) == 0)
921 *pintmax = int_n_trees[i].signed_type;
922 *puintmax = int_n_trees[i].unsigned_type;
923 return;
926 gcc_unreachable ();
930 /* Determine the range [*PMIN, *PMAX] that the expression ARG of TYPE
931 is in. Return true when the range is a subrange of that of TYPE.
932 Whn ARG is null it is as if it had the full range of TYPE.
933 When ABSOLUTE is true the range reflects the absolute value of
934 the argument. When ABSOLUTE is false, negative bounds of
935 the determined range are replaced with NEGBOUND. */
937 static bool
938 get_int_range (tree arg, tree type, HOST_WIDE_INT *pmin, HOST_WIDE_INT *pmax,
939 bool absolute, HOST_WIDE_INT negbound)
941 bool knownrange = false;
943 if (!arg)
945 *pmin = (TYPE_UNSIGNED (type)
946 ? tree_to_uhwi (TYPE_MIN_VALUE (type))
947 : tree_to_shwi (TYPE_MIN_VALUE (type)));
948 *pmax = tree_to_uhwi (TYPE_MAX_VALUE (type));
950 else if (TREE_CODE (arg) == INTEGER_CST)
952 /* For a constant argument return its value adjusted as specified
953 by NEGATIVE and NEGBOUND and return true to indicate that the
954 result is known. */
955 *pmin = tree_fits_shwi_p (arg) ? tree_to_shwi (arg) : tree_to_uhwi (arg);
956 *pmax = *pmin;
957 knownrange = true;
959 else
961 /* True if the argument's range cannot be determined. */
962 bool unknown = true;
964 type = TREE_TYPE (arg);
966 if (TREE_CODE (arg) == SSA_NAME
967 && TREE_CODE (type) == INTEGER_TYPE)
969 /* Try to determine the range of values of the integer argument. */
970 wide_int min, max;
971 enum value_range_type range_type = get_range_info (arg, &min, &max);
972 if (range_type == VR_RANGE)
974 HOST_WIDE_INT type_min
975 = (TYPE_UNSIGNED (type)
976 ? tree_to_uhwi (TYPE_MIN_VALUE (type))
977 : tree_to_shwi (TYPE_MIN_VALUE (type)));
979 HOST_WIDE_INT type_max = tree_to_uhwi (TYPE_MAX_VALUE (type));
981 *pmin = min.to_shwi ();
982 *pmax = max.to_shwi ();
984 /* Return true if the adjusted range is a subrange of
985 the full range of the argument's type. */
986 knownrange = type_min < *pmin || *pmax < type_max;
988 unknown = false;
992 /* Handle an argument with an unknown range as if none had been
993 provided. */
994 if (unknown)
995 return get_int_range (NULL_TREE, type, pmin, pmax, absolute, negbound);
998 /* Adjust each bound as specified by ABSOLUTE and NEGBOUND. */
999 if (absolute)
1001 if (*pmin < 0)
1003 if (*pmin == *pmax)
1004 *pmin = *pmax = -*pmin;
1005 else
1007 HOST_WIDE_INT tmp = -*pmin;
1008 *pmin = 0;
1009 if (*pmax < tmp)
1010 *pmax = tmp;
1014 else if (*pmin < negbound)
1015 *pmin = negbound;
1017 return knownrange;
1020 /* With the range [*ARGMIN, *ARGMAX] of an integer directive's actual
1021 argument, due to the conversion from either *ARGMIN or *ARGMAX to
1022 the type of the directive's formal argument it's possible for both
1023 to result in the same number of bytes or a range of bytes that's
1024 less than the number of bytes that would result from formatting
1025 some other value in the range [*ARGMIN, *ARGMAX]. This can be
1026 determined by checking for the actual argument being in the range
1027 of the type of the directive. If it isn't it must be assumed to
1028 take on the full range of the directive's type.
1029 Return true when the range has been adjusted to the full range
1030 of DIRTYPE, and false otherwise. */
1032 static bool
1033 adjust_range_for_overflow (tree dirtype, tree *argmin, tree *argmax)
1035 tree argtype = TREE_TYPE (*argmin);
1036 unsigned argprec = TYPE_PRECISION (argtype);
1037 unsigned dirprec = TYPE_PRECISION (dirtype);
1039 /* If the actual argument and the directive's argument have the same
1040 precision and sign there can be no overflow and so there is nothing
1041 to adjust. */
1042 if (argprec == dirprec && TYPE_SIGN (argtype) == TYPE_SIGN (dirtype))
1043 return false;
1045 /* The logic below was inspired/lifted from the CONVERT_EXPR_CODE_P
1046 branch in the extract_range_from_unary_expr function in tree-vrp.c. */
1048 if (TREE_CODE (*argmin) == INTEGER_CST
1049 && TREE_CODE (*argmax) == INTEGER_CST
1050 && (dirprec >= argprec
1051 || integer_zerop (int_const_binop (RSHIFT_EXPR,
1052 int_const_binop (MINUS_EXPR,
1053 *argmax,
1054 *argmin),
1055 size_int (dirprec)))))
1057 *argmin = force_fit_type (dirtype, wi::to_widest (*argmin), 0, false);
1058 *argmax = force_fit_type (dirtype, wi::to_widest (*argmax), 0, false);
1060 /* If *ARGMIN is still less than *ARGMAX the conversion above
1061 is safe. Otherwise, it has overflowed and would be unsafe. */
1062 if (tree_int_cst_le (*argmin, *argmax))
1063 return false;
1066 *argmin = TYPE_MIN_VALUE (dirtype);
1067 *argmax = TYPE_MAX_VALUE (dirtype);
1068 return true;
1071 /* Return a range representing the minimum and maximum number of bytes
1072 that the format directive DIR will output for any argument given
1073 the WIDTH and PRECISION (extracted from DIR). This function is
1074 used when the directive argument or its value isn't known. */
1076 static fmtresult
1077 format_integer (const directive &dir, tree arg)
1079 tree intmax_type_node;
1080 tree uintmax_type_node;
1082 /* Base to format the number in. */
1083 int base;
1085 /* True when a conversion is preceded by a prefix indicating the base
1086 of the argument (octal or hexadecimal). */
1087 bool maybebase = dir.get_flag ('#');
1089 /* True when a signed conversion is preceded by a sign or space. */
1090 bool maybesign = false;
1092 /* True for signed conversions (i.e., 'd' and 'i'). */
1093 bool sign = false;
1095 switch (dir.specifier)
1097 case 'd':
1098 case 'i':
1099 /* Space and '+' are only meaningful for signed conversions. */
1100 maybesign = dir.get_flag (' ') | dir.get_flag ('+');
1101 sign = true;
1102 base = 10;
1103 break;
1104 case 'u':
1105 base = 10;
1106 break;
1107 case 'o':
1108 base = 8;
1109 break;
1110 case 'X':
1111 case 'x':
1112 base = 16;
1113 break;
1114 default:
1115 gcc_unreachable ();
1118 /* The type of the "formal" argument expected by the directive. */
1119 tree dirtype = NULL_TREE;
1121 /* Determine the expected type of the argument from the length
1122 modifier. */
1123 switch (dir.modifier)
1125 case FMT_LEN_none:
1126 if (dir.specifier == 'p')
1127 dirtype = ptr_type_node;
1128 else
1129 dirtype = sign ? integer_type_node : unsigned_type_node;
1130 break;
1132 case FMT_LEN_h:
1133 dirtype = sign ? short_integer_type_node : short_unsigned_type_node;
1134 break;
1136 case FMT_LEN_hh:
1137 dirtype = sign ? signed_char_type_node : unsigned_char_type_node;
1138 break;
1140 case FMT_LEN_l:
1141 dirtype = sign ? long_integer_type_node : long_unsigned_type_node;
1142 break;
1144 case FMT_LEN_L:
1145 case FMT_LEN_ll:
1146 dirtype = (sign
1147 ? long_long_integer_type_node
1148 : long_long_unsigned_type_node);
1149 break;
1151 case FMT_LEN_z:
1152 dirtype = signed_or_unsigned_type_for (!sign, size_type_node);
1153 break;
1155 case FMT_LEN_t:
1156 dirtype = signed_or_unsigned_type_for (!sign, ptrdiff_type_node);
1157 break;
1159 case FMT_LEN_j:
1160 build_intmax_type_nodes (&intmax_type_node, &uintmax_type_node);
1161 dirtype = sign ? intmax_type_node : uintmax_type_node;
1162 break;
1164 default:
1165 return fmtresult ();
1168 /* The type of the argument to the directive, either deduced from
1169 the actual non-constant argument if one is known, or from
1170 the directive itself when none has been provided because it's
1171 a va_list. */
1172 tree argtype = NULL_TREE;
1174 if (!arg)
1176 /* When the argument has not been provided, use the type of
1177 the directive's argument as an approximation. This will
1178 result in false positives for directives like %i with
1179 arguments with smaller precision (such as short or char). */
1180 argtype = dirtype;
1182 else if (TREE_CODE (arg) == INTEGER_CST)
1184 /* When a constant argument has been provided use its value
1185 rather than type to determine the length of the output. */
1186 fmtresult res;
1188 if ((dir.prec[0] <= 0 && dir.prec[1] >= 0) && integer_zerop (arg))
1190 /* As a special case, a precision of zero with a zero argument
1191 results in zero bytes except in base 8 when the '#' flag is
1192 specified, and for signed conversions in base 8 and 10 when
1193 either the space or '+' flag has been specified and it results
1194 in just one byte (with width having the normal effect). This
1195 must extend to the case of a specified precision with
1196 an unknown value because it can be zero. */
1197 res.range.min = ((base == 8 && dir.get_flag ('#')) || maybesign);
1198 if (res.range.min == 0 && dir.prec[0] != dir.prec[1])
1200 res.range.max = 1;
1201 res.range.likely = 1;
1203 else
1205 res.range.max = res.range.min;
1206 res.range.likely = res.range.min;
1209 else
1211 /* Convert the argument to the type of the directive. */
1212 arg = fold_convert (dirtype, arg);
1214 res.range.min = tree_digits (arg, base, dir.prec[0],
1215 maybesign, maybebase);
1216 if (dir.prec[0] == dir.prec[1])
1217 res.range.max = res.range.min;
1218 else
1219 res.range.max = tree_digits (arg, base, dir.prec[1],
1220 maybesign, maybebase);
1221 res.range.likely = res.range.min;
1224 res.range.unlikely = res.range.max;
1226 /* Bump up the counters if WIDTH is greater than LEN. */
1227 res.adjust_for_width_or_precision (dir.width, dirtype, base,
1228 (sign | maybebase) + (base == 16));
1229 /* Bump up the counters again if PRECision is greater still. */
1230 res.adjust_for_width_or_precision (dir.prec, dirtype, base,
1231 (sign | maybebase) + (base == 16));
1233 return res;
1235 else if (TREE_CODE (TREE_TYPE (arg)) == INTEGER_TYPE
1236 || TREE_CODE (TREE_TYPE (arg)) == POINTER_TYPE)
1237 /* Determine the type of the provided non-constant argument. */
1238 argtype = TREE_TYPE (arg);
1239 else
1240 /* Don't bother with invalid arguments since they likely would
1241 have already been diagnosed, and disable any further checking
1242 of the format string by returning [-1, -1]. */
1243 return fmtresult ();
1245 fmtresult res;
1247 /* Using either the range the non-constant argument is in, or its
1248 type (either "formal" or actual), create a range of values that
1249 constrain the length of output given the warning level. */
1250 tree argmin = NULL_TREE;
1251 tree argmax = NULL_TREE;
1253 if (arg
1254 && TREE_CODE (arg) == SSA_NAME
1255 && TREE_CODE (argtype) == INTEGER_TYPE)
1257 /* Try to determine the range of values of the integer argument
1258 (range information is not available for pointers). */
1259 wide_int min, max;
1260 enum value_range_type range_type = get_range_info (arg, &min, &max);
1261 if (range_type == VR_RANGE)
1263 argmin = wide_int_to_tree (argtype, min);
1264 argmax = wide_int_to_tree (argtype, max);
1266 /* Set KNOWNRANGE if the argument is in a known subrange
1267 of the directive's type and neither width nor precision
1268 is unknown. (KNOWNRANGE may be reset below). */
1269 res.knownrange
1270 = ((!tree_int_cst_equal (TYPE_MIN_VALUE (dirtype), argmin)
1271 || !tree_int_cst_equal (TYPE_MAX_VALUE (dirtype), argmax))
1272 && dir.known_width_and_precision ());
1274 res.argmin = argmin;
1275 res.argmax = argmax;
1277 else if (range_type == VR_ANTI_RANGE)
1279 /* Handle anti-ranges if/when bug 71690 is resolved. */
1281 else if (range_type == VR_VARYING)
1283 /* The argument here may be the result of promoting the actual
1284 argument to int. Try to determine the type of the actual
1285 argument before promotion and narrow down its range that
1286 way. */
1287 gimple *def = SSA_NAME_DEF_STMT (arg);
1288 if (is_gimple_assign (def))
1290 tree_code code = gimple_assign_rhs_code (def);
1291 if (code == INTEGER_CST)
1293 arg = gimple_assign_rhs1 (def);
1294 return format_integer (dir, arg);
1297 if (code == NOP_EXPR)
1299 tree type = TREE_TYPE (gimple_assign_rhs1 (def));
1300 if (TREE_CODE (type) == INTEGER_TYPE
1301 || TREE_CODE (type) == POINTER_TYPE)
1302 argtype = type;
1308 if (!argmin)
1310 if (TREE_CODE (argtype) == POINTER_TYPE)
1312 argmin = build_int_cst (pointer_sized_int_node, 0);
1313 argmax = build_all_ones_cst (pointer_sized_int_node);
1315 else
1317 argmin = TYPE_MIN_VALUE (argtype);
1318 argmax = TYPE_MAX_VALUE (argtype);
1322 /* Clear KNOWNRANGE if the range has been adjusted to the maximum
1323 of the directive. If it has been cleared then since ARGMIN and/or
1324 ARGMAX have been adjusted also adjust the corresponding ARGMIN and
1325 ARGMAX in the result to include in diagnostics. */
1326 if (adjust_range_for_overflow (dirtype, &argmin, &argmax))
1328 res.knownrange = false;
1329 res.argmin = argmin;
1330 res.argmax = argmax;
1333 /* Recursively compute the minimum and maximum from the known range. */
1334 if (TYPE_UNSIGNED (dirtype) || tree_int_cst_sgn (argmin) >= 0)
1336 /* For unsigned conversions/directives or signed when
1337 the minimum is positive, use the minimum and maximum to compute
1338 the shortest and longest output, respectively. */
1339 res.range.min = format_integer (dir, argmin).range.min;
1340 res.range.max = format_integer (dir, argmax).range.max;
1342 else if (tree_int_cst_sgn (argmax) < 0)
1344 /* For signed conversions/directives if maximum is negative,
1345 use the minimum as the longest output and maximum as the
1346 shortest output. */
1347 res.range.min = format_integer (dir, argmax).range.min;
1348 res.range.max = format_integer (dir, argmin).range.max;
1350 else
1352 /* Otherwise, 0 is inside of the range and minimum negative. Use 0
1353 as the shortest output and for the longest output compute the
1354 length of the output of both minimum and maximum and pick the
1355 longer. */
1356 unsigned HOST_WIDE_INT max1 = format_integer (dir, argmin).range.max;
1357 unsigned HOST_WIDE_INT max2 = format_integer (dir, argmax).range.max;
1358 res.range.min = format_integer (dir, integer_zero_node).range.min;
1359 res.range.max = MAX (max1, max2);
1362 /* If the range is known, use the maximum as the likely length. */
1363 if (res.knownrange)
1364 res.range.likely = res.range.max;
1365 else
1367 /* Otherwise, use the minimum. Except for the case where for %#x or
1368 %#o the minimum is just for a single value in the range (0) and
1369 for all other values it is something longer, like 0x1 or 01.
1370 Use the length for value 1 in that case instead as the likely
1371 length. */
1372 res.range.likely = res.range.min;
1373 if (maybebase
1374 && base != 10
1375 && (tree_int_cst_sgn (argmin) < 0 || tree_int_cst_sgn (argmax) > 0))
1377 if (res.range.min == 1)
1378 res.range.likely += base == 8 ? 1 : 2;
1379 else if (res.range.min == 2
1380 && base == 16
1381 && (dir.width[0] == 2 || dir.prec[0] == 2))
1382 ++res.range.likely;
1386 res.range.unlikely = res.range.max;
1387 res.adjust_for_width_or_precision (dir.width, dirtype, base,
1388 (sign | maybebase) + (base == 16));
1389 res.adjust_for_width_or_precision (dir.prec, dirtype, base,
1390 (sign | maybebase) + (base == 16));
1392 return res;
1395 /* Return the number of bytes that a format directive consisting of FLAGS,
1396 PRECision, format SPECification, and MPFR rounding specifier RNDSPEC,
1397 would result for argument X under ideal conditions (i.e., if PREC
1398 weren't excessive). MPFR 3.1 allocates large amounts of memory for
1399 values of PREC with large magnitude and can fail (see MPFR bug #21056).
1400 This function works around those problems. */
1402 static unsigned HOST_WIDE_INT
1403 get_mpfr_format_length (mpfr_ptr x, const char *flags, HOST_WIDE_INT prec,
1404 char spec, char rndspec)
1406 char fmtstr[40];
1408 HOST_WIDE_INT len = strlen (flags);
1410 fmtstr[0] = '%';
1411 memcpy (fmtstr + 1, flags, len);
1412 memcpy (fmtstr + 1 + len, ".*R", 3);
1413 fmtstr[len + 4] = rndspec;
1414 fmtstr[len + 5] = spec;
1415 fmtstr[len + 6] = '\0';
1417 spec = TOUPPER (spec);
1418 if (spec == 'E' || spec == 'F')
1420 /* For %e, specify the precision explicitly since mpfr_sprintf
1421 does its own thing just to be different (see MPFR bug 21088). */
1422 if (prec < 0)
1423 prec = 6;
1425 else
1427 /* Avoid passing negative precisions with larger magnitude to MPFR
1428 to avoid exposing its bugs. (A negative precision is supposed
1429 to be ignored.) */
1430 if (prec < 0)
1431 prec = -1;
1434 HOST_WIDE_INT p = prec;
1436 if (spec == 'G' && !strchr (flags, '#'))
1438 /* For G/g without the pound flag, precision gives the maximum number
1439 of significant digits which is bounded by LDBL_MAX_10_EXP, or, for
1440 a 128 bit IEEE extended precision, 4932. Using twice as much here
1441 should be more than sufficient for any real format. */
1442 if ((IEEE_MAX_10_EXP * 2) < prec)
1443 prec = IEEE_MAX_10_EXP * 2;
1444 p = prec;
1446 else
1448 /* Cap precision arbitrarily at 1KB and add the difference
1449 (if any) to the MPFR result. */
1450 if (prec > 1024)
1451 p = 1024;
1454 len = mpfr_snprintf (NULL, 0, fmtstr, (int)p, x);
1456 /* Handle the unlikely (impossible?) error by returning more than
1457 the maximum dictated by the function's return type. */
1458 if (len < 0)
1459 return target_dir_max () + 1;
1461 /* Adjust the return value by the difference. */
1462 if (p < prec)
1463 len += prec - p;
1465 return len;
1468 /* Return the number of bytes to format using the format specifier
1469 SPEC and the precision PREC the largest value in the real floating
1470 TYPE. */
1472 static unsigned HOST_WIDE_INT
1473 format_floating_max (tree type, char spec, HOST_WIDE_INT prec)
1475 machine_mode mode = TYPE_MODE (type);
1477 /* IBM Extended mode. */
1478 if (MODE_COMPOSITE_P (mode))
1479 mode = DFmode;
1481 /* Get the real type format desription for the target. */
1482 const real_format *rfmt = REAL_MODE_FORMAT (mode);
1483 REAL_VALUE_TYPE rv;
1485 real_maxval (&rv, 0, mode);
1487 /* Convert the GCC real value representation with the precision
1488 of the real type to the mpfr_t format with the GCC default
1489 round-to-nearest mode. */
1490 mpfr_t x;
1491 mpfr_init2 (x, rfmt->p);
1492 mpfr_from_real (x, &rv, GMP_RNDN);
1494 /* Return a value one greater to account for the leading minus sign. */
1495 unsigned HOST_WIDE_INT r
1496 = 1 + get_mpfr_format_length (x, "", prec, spec, 'D');
1497 mpfr_clear (x);
1498 return r;
1501 /* Return a range representing the minimum and maximum number of bytes
1502 that the directive DIR will output for any argument. PREC gives
1503 the adjusted precision range to account for negative precisions
1504 meaning the default 6. This function is used when the directive
1505 argument or its value isn't known. */
1507 static fmtresult
1508 format_floating (const directive &dir, const HOST_WIDE_INT prec[2])
1510 tree type;
1512 switch (dir.modifier)
1514 case FMT_LEN_l:
1515 case FMT_LEN_none:
1516 type = double_type_node;
1517 break;
1519 case FMT_LEN_L:
1520 type = long_double_type_node;
1521 break;
1523 case FMT_LEN_ll:
1524 type = long_double_type_node;
1525 break;
1527 default:
1528 return fmtresult ();
1531 /* The minimum and maximum number of bytes produced by the directive. */
1532 fmtresult res;
1534 /* The minimum output as determined by flags. It's always at least 1.
1535 When plus or space are set the output is preceded by either a sign
1536 or a space. */
1537 unsigned flagmin = (1 /* for the first digit */
1538 + (dir.get_flag ('+') | dir.get_flag (' ')));
1540 /* When the pound flag is set the decimal point is included in output
1541 regardless of precision. Whether or not a decimal point is included
1542 otherwise depends on the specification and precision. */
1543 bool radix = dir.get_flag ('#');
1545 switch (dir.specifier)
1547 case 'A':
1548 case 'a':
1550 HOST_WIDE_INT minprec = 6 + !radix /* decimal point */;
1551 if (dir.prec[0] <= 0)
1552 minprec = 0;
1553 else if (dir.prec[0] > 0)
1554 minprec = dir.prec[0] + !radix /* decimal point */;
1556 res.range.min = (2 /* 0x */
1557 + flagmin
1558 + radix
1559 + minprec
1560 + 3 /* p+0 */);
1562 res.range.max = format_floating_max (type, 'a', prec[1]);
1563 res.range.likely = res.range.min;
1565 /* The unlikely maximum accounts for the longest multibyte
1566 decimal point character. */
1567 res.range.unlikely = res.range.max;
1568 if (dir.prec[1] > 0)
1569 res.range.unlikely += target_mb_len_max () - 1;
1571 break;
1574 case 'E':
1575 case 'e':
1577 /* Minimum output attributable to precision and, when it's
1578 non-zero, decimal point. */
1579 HOST_WIDE_INT minprec = prec[0] ? prec[0] + !radix : 0;
1581 /* The minimum output is "[-+]1.234567e+00" regardless
1582 of the value of the actual argument. */
1583 res.range.min = (flagmin
1584 + radix
1585 + minprec
1586 + 2 /* e+ */ + 2);
1588 res.range.max = format_floating_max (type, 'e', prec[1]);
1589 res.range.likely = res.range.min;
1591 /* The unlikely maximum accounts for the longest multibyte
1592 decimal point character. */
1593 if (dir.prec[0] != dir.prec[1]
1594 || dir.prec[0] == -1 || dir.prec[0] > 0)
1595 res.range.unlikely = res.range.max + target_mb_len_max () -1;
1596 else
1597 res.range.unlikely = res.range.max;
1598 break;
1601 case 'F':
1602 case 'f':
1604 /* Minimum output attributable to precision and, when it's non-zero,
1605 decimal point. */
1606 HOST_WIDE_INT minprec = prec[0] ? prec[0] + !radix : 0;
1608 /* The lower bound when precision isn't specified is 8 bytes
1609 ("1.23456" since precision is taken to be 6). When precision
1610 is zero, the lower bound is 1 byte (e.g., "1"). Otherwise,
1611 when precision is greater than zero, then the lower bound
1612 is 2 plus precision (plus flags). */
1613 res.range.min = flagmin + radix + minprec;
1615 /* Compute the upper bound for -TYPE_MAX. */
1616 res.range.max = format_floating_max (type, 'f', prec[1]);
1618 /* The minimum output with unknown precision is a single byte
1619 (e.g., "0") but the more likely output is 3 bytes ("0.0"). */
1620 if (dir.prec[0] < 0 && dir.prec[1] > 0)
1621 res.range.likely = 3;
1622 else
1623 res.range.likely = res.range.min;
1625 /* The unlikely maximum accounts for the longest multibyte
1626 decimal point character. */
1627 if (dir.prec[0] != dir.prec[1]
1628 || dir.prec[0] == -1 || dir.prec[0] > 0)
1629 res.range.unlikely = res.range.max + target_mb_len_max () - 1;
1630 break;
1633 case 'G':
1634 case 'g':
1636 /* The %g output depends on precision and the exponent of
1637 the argument. Since the value of the argument isn't known
1638 the lower bound on the range of bytes (not counting flags
1639 or width) is 1 plus radix (i.e., either "0" or "0." for
1640 "%g" and "%#g", respectively, with a zero argument). */
1641 res.range.min = flagmin + radix;
1643 char spec = 'g';
1644 HOST_WIDE_INT maxprec = dir.prec[1];
1645 if (radix && maxprec)
1647 /* When the pound flag (radix) is set, trailing zeros aren't
1648 trimmed and so the longest output is the same as for %e,
1649 except with precision minus 1 (as specified in C11). */
1650 spec = 'e';
1651 if (maxprec > 0)
1652 --maxprec;
1653 else if (maxprec < 0)
1654 maxprec = 5;
1656 else
1657 maxprec = prec[1];
1659 res.range.max = format_floating_max (type, spec, maxprec);
1661 /* The likely output is either the maximum computed above
1662 minus 1 (assuming the maximum is positive) when precision
1663 is known (or unspecified), or the same minimum as for %e
1664 (which is computed for a non-negative argument). Unlike
1665 for the other specifiers above the likely output isn't
1666 the minimum because for %g that's 1 which is unlikely. */
1667 if (dir.prec[1] < 0
1668 || (unsigned HOST_WIDE_INT)dir.prec[1] < target_int_max ())
1669 res.range.likely = res.range.max - 1;
1670 else
1672 HOST_WIDE_INT minprec = 6 + !radix /* decimal point */;
1673 res.range.likely = (flagmin
1674 + radix
1675 + minprec
1676 + 2 /* e+ */ + 2);
1679 /* The unlikely maximum accounts for the longest multibyte
1680 decimal point character. */
1681 res.range.unlikely = res.range.max + target_mb_len_max () - 1;
1682 break;
1685 default:
1686 return fmtresult ();
1689 /* Bump up the byte counters if WIDTH is greater. */
1690 res.adjust_for_width_or_precision (dir.width);
1691 return res;
1694 /* Return a range representing the minimum and maximum number of bytes
1695 that the directive DIR will write on output for the floating argument
1696 ARG. */
1698 static fmtresult
1699 format_floating (const directive &dir, tree arg)
1701 HOST_WIDE_INT prec[] = { dir.prec[0], dir.prec[1] };
1703 /* For an indeterminate precision the lower bound must be assumed
1704 to be zero. */
1705 if (TOUPPER (dir.specifier) == 'A')
1707 /* Get the number of fractional decimal digits needed to represent
1708 the argument without a loss of accuracy. */
1709 tree type = arg ? TREE_TYPE (arg) :
1710 (dir.modifier == FMT_LEN_L || dir.modifier == FMT_LEN_ll
1711 ? long_double_type_node : double_type_node);
1713 unsigned fmtprec
1714 = REAL_MODE_FORMAT (TYPE_MODE (type))->p;
1716 /* The precision of the IEEE 754 double format is 53.
1717 The precision of all other GCC binary double formats
1718 is 56 or less. */
1719 unsigned maxprec = fmtprec <= 56 ? 13 : 15;
1721 /* For %a, leave the minimum precision unspecified to let
1722 MFPR trim trailing zeros (as it and many other systems
1723 including Glibc happen to do) and set the maximum
1724 precision to reflect what it would be with trailing zeros
1725 present (as Solaris and derived systems do). */
1726 if (dir.prec[1] < 0)
1728 /* Both bounds are negative implies that precision has
1729 not been specified. */
1730 prec[0] = maxprec;
1731 prec[1] = -1;
1733 else if (dir.prec[0] < 0)
1735 /* With a negative lower bound and a non-negative upper
1736 bound set the minimum precision to zero and the maximum
1737 to the greater of the maximum precision (i.e., with
1738 trailing zeros present) and the specified upper bound. */
1739 prec[0] = 0;
1740 prec[1] = dir.prec[1] < maxprec ? maxprec : dir.prec[1];
1743 else if (dir.prec[0] < 0)
1745 if (dir.prec[1] < 0)
1747 /* A precision in a strictly negative range is ignored and
1748 the default of 6 is used instead. */
1749 prec[0] = prec[1] = 6;
1751 else
1753 /* For a precision in a partly negative range, the lower bound
1754 must be assumed to be zero and the new upper bound is the
1755 greater of 6 (the default precision used when the specified
1756 precision is negative) and the upper bound of the specified
1757 range. */
1758 prec[0] = 0;
1759 prec[1] = dir.prec[1] < 6 ? 6 : dir.prec[1];
1763 if (!arg || TREE_CODE (arg) != REAL_CST)
1764 return format_floating (dir, prec);
1766 /* The minimum and maximum number of bytes produced by the directive. */
1767 fmtresult res;
1769 /* Get the real type format desription for the target. */
1770 const REAL_VALUE_TYPE *rvp = TREE_REAL_CST_PTR (arg);
1771 const real_format *rfmt = REAL_MODE_FORMAT (TYPE_MODE (TREE_TYPE (arg)));
1773 char fmtstr [40];
1774 char *pfmt = fmtstr;
1776 /* Append flags. */
1777 for (const char *pf = "-+ #0"; *pf; ++pf)
1778 if (dir.get_flag (*pf))
1779 *pfmt++ = *pf;
1781 *pfmt = '\0';
1784 /* Set up an array to easily iterate over. */
1785 unsigned HOST_WIDE_INT* const minmax[] = {
1786 &res.range.min, &res.range.max
1789 for (int i = 0; i != sizeof minmax / sizeof *minmax; ++i)
1791 /* Convert the GCC real value representation with the precision
1792 of the real type to the mpfr_t format rounding down in the
1793 first iteration that computes the minimm and up in the second
1794 that computes the maximum. This order is arbibtrary because
1795 rounding in either direction can result in longer output. */
1796 mpfr_t mpfrval;
1797 mpfr_init2 (mpfrval, rfmt->p);
1798 mpfr_from_real (mpfrval, rvp, i ? GMP_RNDU : GMP_RNDD);
1800 /* Use the MPFR rounding specifier to round down in the first
1801 iteration and then up. In most but not all cases this will
1802 result in the same number of bytes. */
1803 char rndspec = "DU"[i];
1805 /* Format it and store the result in the corresponding member
1806 of the result struct. */
1807 *minmax[i] = get_mpfr_format_length (mpfrval, fmtstr, prec[i],
1808 dir.specifier, rndspec);
1809 mpfr_clear (mpfrval);
1813 /* Make sure the minimum is less than the maximum (MPFR rounding
1814 in the call to mpfr_snprintf can result in the reverse. */
1815 if (res.range.max < res.range.min)
1817 unsigned HOST_WIDE_INT tmp = res.range.min;
1818 res.range.min = res.range.max;
1819 res.range.max = tmp;
1822 /* The range is known unless either width or precision is unknown. */
1823 res.knownrange = dir.known_width_and_precision ();
1825 /* For the same floating point constant, unless width or precision
1826 is unknown, use the longer output as the likely maximum since
1827 with round to nearest either is equally likely. Otheriwse, when
1828 precision is unknown, use the greater of the minimum and 3 as
1829 the likely output (for "0.0" since zero precision is unlikely). */
1830 if (res.knownrange)
1831 res.range.likely = res.range.max;
1832 else if (res.range.min < 3
1833 && dir.prec[0] < 0
1834 && (unsigned HOST_WIDE_INT)dir.prec[1] == target_int_max ())
1835 res.range.likely = 3;
1836 else
1837 res.range.likely = res.range.min;
1839 res.range.unlikely = res.range.max;
1841 if (res.range.max > 2 && (prec[0] != 0 || prec[1] != 0))
1843 /* Unless the precision is zero output longer than 2 bytes may
1844 include the decimal point which must be a single character
1845 up to MB_LEN_MAX in length. This is overly conservative
1846 since in some conversions some constants result in no decimal
1847 point (e.g., in %g). */
1848 res.range.unlikely += target_mb_len_max () - 1;
1851 res.adjust_for_width_or_precision (dir.width);
1852 return res;
1855 /* Return a FMTRESULT struct set to the lengths of the shortest and longest
1856 strings referenced by the expression STR, or (-1, -1) when not known.
1857 Used by the format_string function below. */
1859 static fmtresult
1860 get_string_length (tree str)
1862 if (!str)
1863 return fmtresult ();
1865 if (tree slen = c_strlen (str, 1))
1867 /* Simply return the length of the string. */
1868 fmtresult res (tree_to_shwi (slen));
1869 return res;
1872 /* Determine the length of the shortest and longest string referenced
1873 by STR. Strings of unknown lengths are bounded by the sizes of
1874 arrays that subexpressions of STR may refer to. Pointers that
1875 aren't known to point any such arrays result in LENRANGE[1] set
1876 to SIZE_MAX. */
1877 tree lenrange[2];
1878 bool flexarray = get_range_strlen (str, lenrange);
1880 if (lenrange [0] || lenrange [1])
1882 HOST_WIDE_INT min
1883 = (tree_fits_uhwi_p (lenrange[0])
1884 ? tree_to_uhwi (lenrange[0])
1885 : 0);
1887 HOST_WIDE_INT max
1888 = (tree_fits_uhwi_p (lenrange[1])
1889 ? tree_to_uhwi (lenrange[1])
1890 : HOST_WIDE_INT_M1U);
1892 /* get_range_strlen() returns the target value of SIZE_MAX for
1893 strings of unknown length. Bump it up to HOST_WIDE_INT_M1U
1894 which may be bigger. */
1895 if ((unsigned HOST_WIDE_INT)min == target_size_max ())
1896 min = HOST_WIDE_INT_M1U;
1897 if ((unsigned HOST_WIDE_INT)max == target_size_max ())
1898 max = HOST_WIDE_INT_M1U;
1900 fmtresult res (min, max);
1902 /* Set RES.KNOWNRANGE to true if and only if all strings referenced
1903 by STR are known to be bounded (though not necessarily by their
1904 actual length but perhaps by their maximum possible length). */
1905 if (res.range.max < target_int_max ())
1907 res.knownrange = true;
1908 /* When the the length of the longest string is known and not
1909 excessive use it as the likely length of the string(s). */
1910 res.range.likely = res.range.max;
1912 else
1914 /* When the upper bound is unknown (it can be zero or excessive)
1915 set the likely length to the greater of 1 and the length of
1916 the shortest string and reset the lower bound to zero. */
1917 res.range.likely = res.range.min ? res.range.min : warn_level > 1;
1918 res.range.min = 0;
1921 /* If the range of string length has been estimated from the size
1922 of an array at the end of a struct assume that it's longer than
1923 the array bound says it is in case it's used as a poor man's
1924 flexible array member, such as in struct S { char a[4]; }; */
1925 res.range.unlikely = flexarray ? HOST_WIDE_INT_MAX : res.range.max;
1927 return res;
1930 return get_string_length (NULL_TREE);
1933 /* Return the minimum and maximum number of characters formatted
1934 by the '%c' format directives and its wide character form for
1935 the argument ARG. ARG can be null (for functions such as
1936 vsprinf). */
1938 static fmtresult
1939 format_character (const directive &dir, tree arg)
1941 fmtresult res;
1943 res.knownrange = true;
1945 if (dir.modifier == FMT_LEN_l)
1947 /* A wide character can result in as few as zero bytes. */
1948 res.range.min = 0;
1950 HOST_WIDE_INT min, max;
1951 if (get_int_range (arg, integer_type_node, &min, &max, false, 0))
1953 if (min == 0 && max == 0)
1955 /* The NUL wide character results in no bytes. */
1956 res.range.max = 0;
1957 res.range.likely = 0;
1958 res.range.unlikely = 0;
1960 else if (min > 0 && min < 128)
1962 /* A wide character in the ASCII range most likely results
1963 in a single byte, and only unlikely in up to MB_LEN_MAX. */
1964 res.range.max = 1;
1965 res.range.likely = 1;
1966 res.range.unlikely = target_mb_len_max ();
1968 else
1970 /* A wide character outside the ASCII range likely results
1971 in up to two bytes, and only unlikely in up to MB_LEN_MAX. */
1972 res.range.max = target_mb_len_max ();
1973 res.range.likely = 2;
1974 res.range.unlikely = res.range.max;
1977 else
1979 /* An unknown wide character is treated the same as a wide
1980 character outside the ASCII range. */
1981 res.range.max = target_mb_len_max ();
1982 res.range.likely = 2;
1983 res.range.unlikely = res.range.max;
1986 else
1988 /* A plain '%c' directive. Its ouput is exactly 1. */
1989 res.range.min = res.range.max = 1;
1990 res.range.likely = res.range.unlikely = 1;
1991 res.knownrange = true;
1994 /* Bump up the byte counters if WIDTH is greater. */
1995 return res.adjust_for_width_or_precision (dir.width);
1998 /* Return the minimum and maximum number of characters formatted
1999 by the '%s' format directive and its wide character form for
2000 the argument ARG. ARG can be null (for functions such as
2001 vsprinf). */
2003 static fmtresult
2004 format_string (const directive &dir, tree arg)
2006 fmtresult res;
2008 /* Compute the range the argument's length can be in. */
2009 fmtresult slen = get_string_length (arg);
2010 if (slen.range.min == slen.range.max
2011 && slen.range.min < HOST_WIDE_INT_MAX)
2013 /* The argument is either a string constant or it refers
2014 to one of a number of strings of the same length. */
2016 /* A '%s' directive with a string argument with constant length. */
2017 res.range = slen.range;
2019 if (dir.modifier == FMT_LEN_l)
2021 /* In the worst case the length of output of a wide string S
2022 is bounded by MB_LEN_MAX * wcslen (S). */
2023 res.range.max *= target_mb_len_max ();
2024 res.range.unlikely = res.range.max;
2025 /* It's likely that the the total length is not more that
2026 2 * wcslen (S).*/
2027 res.range.likely = res.range.min * 2;
2029 if (dir.prec[1] >= 0
2030 && (unsigned HOST_WIDE_INT)dir.prec[1] < res.range.max)
2032 res.range.max = dir.prec[1];
2033 res.range.likely = dir.prec[1];
2034 res.range.unlikely = dir.prec[1];
2037 if (dir.prec[0] < 0 && dir.prec[1] > -1)
2038 res.range.min = 0;
2039 else if (dir.prec[0] >= 0)
2040 res.range.likely = dir.prec[0];
2042 /* Even a non-empty wide character string need not convert into
2043 any bytes. */
2044 res.range.min = 0;
2046 else
2048 res.knownrange = true;
2050 if (dir.prec[0] < 0 && dir.prec[1] > -1)
2051 res.range.min = 0;
2052 else if ((unsigned HOST_WIDE_INT)dir.prec[0] < res.range.min)
2053 res.range.min = dir.prec[0];
2055 if ((unsigned HOST_WIDE_INT)dir.prec[1] < res.range.max)
2057 res.range.max = dir.prec[1];
2058 res.range.likely = dir.prec[1];
2059 res.range.unlikely = dir.prec[1];
2063 else if (arg && integer_zerop (arg))
2065 /* Handle null pointer argument. */
2067 fmtresult res (0);
2068 res.nullp = true;
2069 return res;
2071 else
2073 /* For a '%s' and '%ls' directive with a non-constant string (either
2074 one of a number of strings of known length or an unknown string)
2075 the minimum number of characters is lesser of PRECISION[0] and
2076 the length of the shortest known string or zero, and the maximum
2077 is the lessser of the length of the longest known string or
2078 PTRDIFF_MAX and PRECISION[1]. The likely length is either
2079 the minimum at level 1 and the greater of the minimum and 1
2080 at level 2. This result is adjust upward for width (if it's
2081 specified). */
2083 if (dir.modifier == FMT_LEN_l)
2085 /* A wide character converts to as few as zero bytes. */
2086 slen.range.min = 0;
2087 if (slen.range.max < target_int_max ())
2088 slen.range.max *= target_mb_len_max ();
2090 if (slen.range.likely < target_int_max ())
2091 slen.range.likely *= 2;
2093 if (slen.range.likely < target_int_max ())
2094 slen.range.unlikely *= target_mb_len_max ();
2097 res.range = slen.range;
2099 if (dir.prec[0] >= 0)
2101 /* Adjust the minimum to zero if the string length is unknown,
2102 or at most the lower bound of the precision otherwise. */
2103 if (slen.range.min >= target_int_max ())
2104 res.range.min = 0;
2105 else if ((unsigned HOST_WIDE_INT)dir.prec[0] < slen.range.min)
2106 res.range.min = dir.prec[0];
2108 /* Make both maxima no greater than the upper bound of precision. */
2109 if ((unsigned HOST_WIDE_INT)dir.prec[1] < slen.range.max
2110 || slen.range.max >= target_int_max ())
2112 res.range.max = dir.prec[1];
2113 res.range.unlikely = dir.prec[1];
2116 /* If precision is constant, set the likely counter to the lesser
2117 of it and the maximum string length. Otherwise, if the lower
2118 bound of precision is greater than zero, set the likely counter
2119 to the minimum. Otherwise set it to zero or one based on
2120 the warning level. */
2121 if (dir.prec[0] == dir.prec[1])
2122 res.range.likely
2123 = ((unsigned HOST_WIDE_INT)dir.prec[0] < slen.range.max
2124 ? dir.prec[0] : slen.range.max);
2125 else if (dir.prec[0] > 0)
2126 res.range.likely = res.range.min;
2127 else
2128 res.range.likely = warn_level > 1;
2130 else if (dir.prec[1] >= 0)
2132 res.range.min = 0;
2133 if ((unsigned HOST_WIDE_INT)dir.prec[1] < slen.range.max)
2134 res.range.max = dir.prec[1];
2135 res.range.likely = dir.prec[1] ? warn_level > 1 : 0;
2137 else if (slen.range.min >= target_int_max ())
2139 res.range.min = 0;
2140 res.range.max = HOST_WIDE_INT_MAX;
2141 /* At level 1 strings of unknown length are assumed to be
2142 empty, while at level 1 they are assumed to be one byte
2143 long. */
2144 res.range.likely = warn_level > 1;
2146 else
2148 /* A string of unknown length unconstrained by precision is
2149 assumed to be empty at level 1 and just one character long
2150 at higher levels. */
2151 if (res.range.likely >= target_int_max ())
2152 res.range.likely = warn_level > 1;
2155 res.range.unlikely = res.range.max;
2158 /* Bump up the byte counters if WIDTH is greater. */
2159 return res.adjust_for_width_or_precision (dir.width);
2162 /* Format plain string (part of the format string itself). */
2164 static fmtresult
2165 format_plain (const directive &dir, tree)
2167 fmtresult res (dir.len);
2168 return res;
2171 /* Return true if the RESULT of a directive in a call describe by INFO
2172 should be diagnosed given the AVAILable space in the destination. */
2174 static bool
2175 should_warn_p (const pass_sprintf_length::call_info &info,
2176 const result_range &avail, const result_range &result)
2178 if (result.max <= avail.min)
2180 /* The least amount of space remaining in the destination is big
2181 enough for the longest output. */
2182 return false;
2185 if (info.bounded)
2187 if (warn_format_trunc == 1 && result.min <= avail.max
2188 && info.retval_used ())
2190 /* The likely amount of space remaining in the destination is big
2191 enough for the least output and the return value is used. */
2192 return false;
2195 if (warn_format_trunc == 1 && result.likely <= avail.likely
2196 && !info.retval_used ())
2198 /* The likely amount of space remaining in the destination is big
2199 enough for the likely output and the return value is unused. */
2200 return false;
2203 if (warn_format_trunc == 2
2204 && result.likely <= avail.min
2205 && (result.max <= avail.min
2206 || result.max > HOST_WIDE_INT_MAX))
2208 /* The minimum amount of space remaining in the destination is big
2209 enough for the longest output. */
2210 return false;
2213 else
2215 if (warn_level == 1 && result.likely <= avail.likely)
2217 /* The likely amount of space remaining in the destination is big
2218 enough for the likely output. */
2219 return false;
2222 if (warn_level == 2
2223 && result.likely <= avail.min
2224 && (result.max <= avail.min
2225 || result.max > HOST_WIDE_INT_MAX))
2227 /* The minimum amount of space remaining in the destination is big
2228 enough for the longest output. */
2229 return false;
2233 return true;
2236 /* At format string location describe by DIRLOC in a call described
2237 by INFO, issue a warning for a directive DIR whose output may be
2238 in excess of the available space AVAIL_RANGE in the destination
2239 given the formatting result FMTRES. This function does nothing
2240 except decide whether to issue a warning for a possible write
2241 past the end or truncation and, if so, format the warning.
2242 Return true if a warning has been issued. */
2244 static bool
2245 maybe_warn (substring_loc &dirloc, source_range *pargrange,
2246 const pass_sprintf_length::call_info &info,
2247 const result_range &avail_range, const result_range &res,
2248 const directive &dir)
2250 if (!should_warn_p (info, avail_range, res))
2251 return false;
2253 /* A warning will definitely be issued below. */
2255 /* The maximum byte count to reference in the warning. Larger counts
2256 imply that the upper bound is unknown (and could be anywhere between
2257 RES.MIN + 1 and SIZE_MAX / 2) are printed as "N or more bytes" rather
2258 than "between N and X" where X is some huge number. */
2259 unsigned HOST_WIDE_INT maxbytes = target_dir_max ();
2261 /* True when there is enough room in the destination for the least
2262 amount of a directive's output but not enough for its likely or
2263 maximum output. */
2264 bool maybe = (res.min <= avail_range.max
2265 && (avail_range.min < res.likely
2266 || (res.max < HOST_WIDE_INT_MAX
2267 && avail_range.min < res.max)));
2269 if (avail_range.min == avail_range.max)
2271 /* The size of the destination region is exact. */
2272 unsigned HOST_WIDE_INT navail = avail_range.max;
2274 if (*dir.beg != '%')
2276 /* For plain character directives (i.e., the format string itself)
2277 but not others, point the caret at the first character that's
2278 past the end of the destination. */
2279 dirloc.set_caret_index (dirloc.get_caret_idx () + navail);
2282 if (*dir.beg == '\0')
2284 /* This is the terminating nul. */
2285 gcc_assert (res.min == 1 && res.min == res.max);
2287 const char *fmtstr
2288 = (info.bounded
2289 ? (maybe
2290 ? G_("%qE output may be truncated before the last format "
2291 "character")
2292 : G_("%qE output truncated before the last format character"))
2293 : (maybe
2294 ? G_("%qE may write a terminating nul past the end "
2295 "of the destination")
2296 : G_("%qE writing a terminating nul past the end "
2297 "of the destination")));
2299 return fmtwarn (dirloc, NULL, NULL, info.warnopt (), fmtstr,
2300 info.func);
2303 if (res.min == res.max)
2305 const char* fmtstr
2306 = (res.min == 1
2307 ? (info.bounded
2308 ? (maybe
2309 ? G_("%<%.*s%> directive output may be truncated writing "
2310 "%wu byte into a region of size %wu")
2311 : G_("%<%.*s%> directive output truncated writing "
2312 "%wu byte into a region of size %wu"))
2313 : G_("%<%.*s%> directive writing %wu byte "
2314 "into a region of size %wu"))
2315 : (info.bounded
2316 ? (maybe
2317 ? G_("%<%.*s%> directive output may be truncated writing "
2318 "%wu bytes into a region of size %wu")
2319 : G_("%<%.*s%> directive output truncated writing "
2320 "%wu bytes into a region of size %wu"))
2321 : G_("%<%.*s%> directive writing %wu bytes "
2322 "into a region of size %wu")));
2323 return fmtwarn (dirloc, pargrange, NULL,
2324 info.warnopt (), fmtstr,
2325 dir.len, dir.beg, res.min,
2326 navail);
2329 if (res.min == 0 && res.max < maxbytes)
2331 const char* fmtstr
2332 = (info.bounded
2333 ? (maybe
2334 ? G_("%<%.*s%> directive output may be truncated writing "
2335 "up to %wu bytes into a region of size %wu")
2336 : G_("%<%.*s%> directive output truncated writing "
2337 "up to %wu bytes into a region of size %wu"))
2338 : G_("%<%.*s%> directive writing up to %wu bytes "
2339 "into a region of size %wu"));
2340 return fmtwarn (dirloc, pargrange, NULL,
2341 info.warnopt (), fmtstr,
2342 dir.len, dir.beg,
2343 res.max, navail);
2346 if (res.min == 0 && maxbytes <= res.max)
2348 /* This is a special case to avoid issuing the potentially
2349 confusing warning:
2350 writing 0 or more bytes into a region of size 0. */
2351 const char* fmtstr
2352 = (info.bounded
2353 ? (maybe
2354 ? G_("%<%.*s%> directive output may be truncated writing "
2355 "likely %wu or more bytes into a region of size %wu")
2356 : G_("%<%.*s%> directive output truncated writing "
2357 "likely %wu or more bytes into a region of size %wu"))
2358 : G_("%<%.*s%> directive writing likely %wu or more bytes "
2359 "into a region of size %wu"));
2360 return fmtwarn (dirloc, pargrange, NULL,
2361 info.warnopt (), fmtstr,
2362 dir.len, dir.beg,
2363 res.likely, navail);
2366 if (res.max < maxbytes)
2368 const char* fmtstr
2369 = (info.bounded
2370 ? (maybe
2371 ? G_("%<%.*s%> directive output may be truncated writing "
2372 "between %wu and %wu bytes into a region of size %wu")
2373 : G_("%<%.*s%> directive output truncated writing "
2374 "between %wu and %wu bytes into a region of size %wu"))
2375 : G_("%<%.*s%> directive writing between %wu and "
2376 "%wu bytes into a region of size %wu"));
2377 return fmtwarn (dirloc, pargrange, NULL,
2378 info.warnopt (), fmtstr,
2379 dir.len, dir.beg,
2380 res.min, res.max,
2381 navail);
2384 const char* fmtstr
2385 = (info.bounded
2386 ? (maybe
2387 ? G_("%<%.*s%> directive output may be truncated writing "
2388 "%wu or more bytes into a region of size %wu")
2389 : G_("%<%.*s%> directive output truncated writing "
2390 "%wu or more bytes into a region of size %wu"))
2391 : G_("%<%.*s%> directive writing %wu or more bytes "
2392 "into a region of size %wu"));
2393 return fmtwarn (dirloc, pargrange, NULL,
2394 info.warnopt (), fmtstr,
2395 dir.len, dir.beg,
2396 res.min, navail);
2399 /* The size of the destination region is a range. */
2401 if (*dir.beg != '%')
2403 unsigned HOST_WIDE_INT navail = avail_range.max;
2405 /* For plain character directives (i.e., the format string itself)
2406 but not others, point the caret at the first character that's
2407 past the end of the destination. */
2408 dirloc.set_caret_index (dirloc.get_caret_idx () + navail);
2411 if (*dir.beg == '\0')
2413 gcc_assert (res.min == 1 && res.min == res.max);
2415 const char *fmtstr
2416 = (info.bounded
2417 ? (maybe
2418 ? G_("%qE output may be truncated before the last format "
2419 "character")
2420 : G_("%qE output truncated before the last format character"))
2421 : (maybe
2422 ? G_("%qE may write a terminating nul past the end "
2423 "of the destination")
2424 : G_("%qE writing a terminating nul past the end "
2425 "of the destination")));
2427 return fmtwarn (dirloc, NULL, NULL, info.warnopt (), fmtstr,
2428 info.func);
2431 if (res.min == res.max)
2433 const char* fmtstr
2434 = (res.min == 1
2435 ? (info.bounded
2436 ? (maybe
2437 ? G_("%<%.*s%> directive output may be truncated writing "
2438 "%wu byte into a region of size between %wu and %wu")
2439 : G_("%<%.*s%> directive output truncated writing "
2440 "%wu byte into a region of size between %wu and %wu"))
2441 : G_("%<%.*s%> directive writing %wu byte "
2442 "into a region of size between %wu and %wu"))
2443 : (info.bounded
2444 ? (maybe
2445 ? G_("%<%.*s%> directive output may be truncated writing "
2446 "%wu bytes into a region of size between %wu and %wu")
2447 : G_("%<%.*s%> directive output truncated writing "
2448 "%wu bytes into a region of size between %wu and %wu"))
2449 : G_("%<%.*s%> directive writing %wu bytes "
2450 "into a region of size between %wu and %wu")));
2452 return fmtwarn (dirloc, pargrange, NULL,
2453 info.warnopt (), fmtstr,
2454 dir.len, dir.beg, res.min,
2455 avail_range.min, avail_range.max);
2458 if (res.min == 0 && res.max < maxbytes)
2460 const char* fmtstr
2461 = (info.bounded
2462 ? (maybe
2463 ? G_("%<%.*s%> directive output may be truncated writing "
2464 "up to %wu bytes into a region of size between "
2465 "%wu and %wu")
2466 : G_("%<%.*s%> directive output truncated writing "
2467 "up to %wu bytes into a region of size between "
2468 "%wu and %wu"))
2469 : G_("%<%.*s%> directive writing up to %wu bytes "
2470 "into a region of size between %wu and %wu"));
2471 return fmtwarn (dirloc, pargrange, NULL,
2472 info.warnopt (), fmtstr,
2473 dir.len, dir.beg, res.max,
2474 avail_range.min, avail_range.max);
2477 if (res.min == 0 && maxbytes <= res.max)
2479 /* This is a special case to avoid issuing the potentially confusing
2480 warning:
2481 writing 0 or more bytes into a region of size between 0 and N. */
2482 const char* fmtstr
2483 = (info.bounded
2484 ? (maybe
2485 ? G_("%<%.*s%> directive output may be truncated writing "
2486 "likely %wu or more bytes into a region of size between "
2487 "%wu and %wu")
2488 : G_("%<%.*s%> directive output truncated writing likely "
2489 "%wu or more bytes into a region of size between "
2490 "%wu and %wu"))
2491 : G_("%<%.*s%> directive writing likely %wu or more bytes "
2492 "into a region of size between %wu and %wu"));
2493 return fmtwarn (dirloc, pargrange, NULL,
2494 info.warnopt (), fmtstr,
2495 dir.len, dir.beg, res.likely,
2496 avail_range.min, avail_range.max);
2499 if (res.max < maxbytes)
2501 const char* fmtstr
2502 = (info.bounded
2503 ? (maybe
2504 ? G_("%<%.*s%> directive output may be truncated writing "
2505 "between %wu and %wu bytes into a region of size "
2506 "between %wu and %wu")
2507 : G_("%<%.*s%> directive output truncated writing "
2508 "between %wu and %wu bytes into a region of size "
2509 "between %wu and %wu"))
2510 : G_("%<%.*s%> directive writing between %wu and "
2511 "%wu bytes into a region of size between %wu and %wu"));
2512 return fmtwarn (dirloc, pargrange, NULL,
2513 info.warnopt (), fmtstr,
2514 dir.len, dir.beg,
2515 res.min, res.max,
2516 avail_range.min, avail_range.max);
2519 const char* fmtstr
2520 = (info.bounded
2521 ? (maybe
2522 ? G_("%<%.*s%> directive output may be truncated writing "
2523 "%wu or more bytes into a region of size between "
2524 "%wu and %wu")
2525 : G_("%<%.*s%> directive output truncated writing "
2526 "%wu or more bytes into a region of size between "
2527 "%wu and %wu"))
2528 : G_("%<%.*s%> directive writing %wu or more bytes "
2529 "into a region of size between %wu and %wu"));
2530 return fmtwarn (dirloc, pargrange, NULL,
2531 info.warnopt (), fmtstr,
2532 dir.len, dir.beg,
2533 res.min,
2534 avail_range.min, avail_range.max);
2537 /* Compute the length of the output resulting from the directive DIR
2538 in a call described by INFO and update the overall result of the call
2539 in *RES. Return true if the directive has been handled. */
2541 static bool
2542 format_directive (const pass_sprintf_length::call_info &info,
2543 format_result *res, const directive &dir)
2545 /* Offset of the beginning of the directive from the beginning
2546 of the format string. */
2547 size_t offset = dir.beg - info.fmtstr;
2548 size_t start = offset;
2549 size_t length = offset + dir.len - !!dir.len;
2551 /* Create a location for the whole directive from the % to the format
2552 specifier. */
2553 substring_loc dirloc (info.fmtloc, TREE_TYPE (info.format),
2554 offset, start, length);
2556 /* Also create a location range for the argument if possible.
2557 This doesn't work for integer literals or function calls. */
2558 source_range argrange;
2559 source_range *pargrange;
2560 if (dir.arg && CAN_HAVE_LOCATION_P (dir.arg))
2562 argrange = EXPR_LOCATION_RANGE (dir.arg);
2563 pargrange = &argrange;
2565 else
2566 pargrange = NULL;
2568 /* Bail when there is no function to compute the output length,
2569 or when minimum length checking has been disabled. */
2570 if (!dir.fmtfunc || res->range.min >= HOST_WIDE_INT_MAX)
2571 return false;
2573 /* Compute the range of lengths of the formatted output. */
2574 fmtresult fmtres = dir.fmtfunc (dir, dir.arg);
2576 /* Record whether the output of all directives is known to be
2577 bounded by some maximum, implying that their arguments are
2578 either known exactly or determined to be in a known range
2579 or, for strings, limited by the upper bounds of the arrays
2580 they refer to. */
2581 res->knownrange &= fmtres.knownrange;
2583 if (!fmtres.knownrange)
2585 /* Only when the range is known, check it against the host value
2586 of INT_MAX + (the number of bytes of the "%.*Lf" directive with
2587 INT_MAX precision, which is the longest possible output of any
2588 single directive). That's the largest valid byte count (though
2589 not valid call to a printf-like function because it can never
2590 return such a count). Otherwise, the range doesn't correspond
2591 to known values of the argument. */
2592 if (fmtres.range.max > target_dir_max ())
2594 /* Normalize the MAX counter to avoid having to deal with it
2595 later. The counter can be less than HOST_WIDE_INT_M1U
2596 when compiling for an ILP32 target on an LP64 host. */
2597 fmtres.range.max = HOST_WIDE_INT_M1U;
2598 /* Disable exact and maximum length checking after a failure
2599 to determine the maximum number of characters (for example
2600 for wide characters or wide character strings) but continue
2601 tracking the minimum number of characters. */
2602 res->range.max = HOST_WIDE_INT_M1U;
2605 if (fmtres.range.min > target_dir_max ())
2607 /* Disable exact length checking after a failure to determine
2608 even the minimum number of characters (it shouldn't happen
2609 except in an error) but keep tracking the minimum and maximum
2610 number of characters. */
2611 return true;
2615 int dirlen = dir.len;
2617 if (fmtres.nullp)
2619 fmtwarn (dirloc, pargrange, NULL, info.warnopt (),
2620 "%<%.*s%> directive argument is null",
2621 dirlen, dir.beg);
2623 /* Don't bother processing the rest of the format string. */
2624 res->warned = true;
2625 res->range.min = HOST_WIDE_INT_M1U;
2626 res->range.max = HOST_WIDE_INT_M1U;
2627 return false;
2630 /* Compute the number of available bytes in the destination. There
2631 must always be at least one byte of space for the terminating
2632 NUL that's appended after the format string has been processed. */
2633 result_range avail_range = bytes_remaining (info.objsize, *res);
2635 bool warned = res->warned;
2637 if (!warned)
2638 warned = maybe_warn (dirloc, pargrange, info, avail_range,
2639 fmtres.range, dir);
2641 /* Bump up the total maximum if it isn't too big. */
2642 if (res->range.max < HOST_WIDE_INT_MAX
2643 && fmtres.range.max < HOST_WIDE_INT_MAX)
2644 res->range.max += fmtres.range.max;
2646 /* Raise the total unlikely maximum by the larger of the maximum
2647 and the unlikely maximum. */
2648 unsigned HOST_WIDE_INT save = res->range.unlikely;
2649 if (fmtres.range.max < fmtres.range.unlikely)
2650 res->range.unlikely += fmtres.range.unlikely;
2651 else
2652 res->range.unlikely += fmtres.range.max;
2654 if (res->range.unlikely < save)
2655 res->range.unlikely = HOST_WIDE_INT_M1U;
2657 res->range.min += fmtres.range.min;
2658 res->range.likely += fmtres.range.likely;
2660 /* Has the minimum directive output length exceeded the maximum
2661 of 4095 bytes required to be supported? */
2662 bool minunder4k = fmtres.range.min < 4096;
2663 bool maxunder4k = fmtres.range.max < 4096;
2664 /* Clear UNDER4K in the overall result if the maximum has exceeded
2665 the 4k (this is necessary to avoid the return valuye optimization
2666 that may not be safe in the maximum case). */
2667 if (!maxunder4k)
2668 res->under4k = false;
2670 if (!warned
2671 /* Only warn at level 2. */
2672 && 1 < warn_level
2673 && (!minunder4k
2674 || (!maxunder4k && fmtres.range.max < HOST_WIDE_INT_MAX)))
2676 /* The directive output may be longer than the maximum required
2677 to be handled by an implementation according to 7.21.6.1, p15
2678 of C11. Warn on this only at level 2 but remember this and
2679 prevent folding the return value when done. This allows for
2680 the possibility of the actual libc call failing due to ENOMEM
2681 (like Glibc does under some conditions). */
2683 if (fmtres.range.min == fmtres.range.max)
2684 warned = fmtwarn (dirloc, pargrange, NULL,
2685 info.warnopt (),
2686 "%<%.*s%> directive output of %wu bytes exceeds "
2687 "minimum required size of 4095",
2688 dirlen, dir.beg, fmtres.range.min);
2689 else
2691 const char *fmtstr
2692 = (minunder4k
2693 ? G_("%<%.*s%> directive output between %wu and %wu "
2694 "bytes may exceed minimum required size of 4095")
2695 : G_("%<%.*s%> directive output between %wu and %wu "
2696 "bytes exceeds minimum required size of 4095"));
2698 warned = fmtwarn (dirloc, pargrange, NULL,
2699 info.warnopt (), fmtstr,
2700 dirlen, dir.beg,
2701 fmtres.range.min, fmtres.range.max);
2705 /* Has the likely and maximum directive output exceeded INT_MAX? */
2706 bool likelyximax = *dir.beg && res->range.likely > target_int_max ();
2707 /* Don't consider the maximum to be in excess when it's the result
2708 of a string of unknown length (i.e., whose maximum has been set
2709 to be greater than or equal to HOST_WIDE_INT_MAX. */
2710 bool maxximax = (*dir.beg
2711 && res->range.max > target_int_max ()
2712 && res->range.max < HOST_WIDE_INT_MAX);
2714 if (!warned
2715 /* Warn for the likely output size at level 1. */
2716 && (likelyximax
2717 /* But only warn for the maximum at level 2. */
2718 || (1 < warn_level
2719 && maxximax
2720 && fmtres.range.max < HOST_WIDE_INT_MAX)))
2722 /* The directive output causes the total length of output
2723 to exceed INT_MAX bytes. */
2725 if (fmtres.range.min == fmtres.range.max)
2726 warned = fmtwarn (dirloc, pargrange, NULL, info.warnopt (),
2727 "%<%.*s%> directive output of %wu bytes causes "
2728 "result to exceed %<INT_MAX%>",
2729 dirlen, dir.beg, fmtres.range.min);
2730 else
2732 const char *fmtstr
2733 = (fmtres.range.min > target_int_max ()
2734 ? G_ ("%<%.*s%> directive output between %wu and %wu "
2735 "bytes causes result to exceed %<INT_MAX%>")
2736 : G_ ("%<%.*s%> directive output between %wu and %wu "
2737 "bytes may cause result to exceed %<INT_MAX%>"));
2738 warned = fmtwarn (dirloc, pargrange, NULL,
2739 info.warnopt (), fmtstr,
2740 dirlen, dir.beg,
2741 fmtres.range.min, fmtres.range.max);
2745 if (warned && fmtres.range.min < fmtres.range.likely
2746 && fmtres.range.likely < fmtres.range.max)
2748 inform (info.fmtloc,
2749 (1 == fmtres.range.likely
2750 ? G_("assuming directive output of %wu byte")
2751 : G_("assuming directive output of %wu bytes")),
2752 fmtres.range.likely);
2755 if (warned && fmtres.argmin)
2757 if (fmtres.argmin == fmtres.argmax)
2758 inform (info.fmtloc, "directive argument %qE", fmtres.argmin);
2759 else if (fmtres.knownrange)
2760 inform (info.fmtloc, "directive argument in the range [%E, %E]",
2761 fmtres.argmin, fmtres.argmax);
2762 else
2763 inform (info.fmtloc,
2764 "using the range [%E, %E] for directive argument",
2765 fmtres.argmin, fmtres.argmax);
2768 res->warned |= warned;
2770 if (!dir.beg[0] && res->warned && info.objsize < HOST_WIDE_INT_MAX)
2772 /* If a warning has been issued for buffer overflow or truncation
2773 (but not otherwise) help the user figure out how big a buffer
2774 they need. */
2776 location_t callloc = gimple_location (info.callstmt);
2778 unsigned HOST_WIDE_INT min = res->range.min;
2779 unsigned HOST_WIDE_INT max = res->range.max;
2781 if (min == max)
2782 inform (callloc,
2783 (min == 1
2784 ? G_("%qE output %wu byte into a destination of size %wu")
2785 : G_("%qE output %wu bytes into a destination of size %wu")),
2786 info.func, min, info.objsize);
2787 else if (max < HOST_WIDE_INT_MAX)
2788 inform (callloc,
2789 "%qE output between %wu and %wu bytes into "
2790 "a destination of size %wu",
2791 info.func, min, max, info.objsize);
2792 else if (min < res->range.likely && res->range.likely < max)
2793 inform (callloc,
2794 "%qE output %wu or more bytes (assuming %wu) into "
2795 "a destination of size %wu",
2796 info.func, min, res->range.likely, info.objsize);
2797 else
2798 inform (callloc,
2799 "%qE output %wu or more bytes into a destination of size %wu",
2800 info.func, min, info.objsize);
2803 if (dump_file && *dir.beg)
2805 fprintf (dump_file, " Result: %lli, %lli, %lli, %lli "
2806 "(%lli, %lli, %lli, %lli)\n",
2807 (long long)fmtres.range.min,
2808 (long long)fmtres.range.likely,
2809 (long long)fmtres.range.max,
2810 (long long)fmtres.range.unlikely,
2811 (long long)res->range.min,
2812 (long long)res->range.likely,
2813 (long long)res->range.max,
2814 (long long)res->range.unlikely);
2817 return true;
2820 #pragma GCC diagnostic pop
2822 /* Parse a format directive in function call described by INFO starting
2823 at STR and populate DIR structure. Bump up *ARGNO by the number of
2824 arguments extracted for the directive. Return the length of
2825 the directive. */
2827 static size_t
2828 parse_directive (pass_sprintf_length::call_info &info,
2829 directive &dir, format_result *res,
2830 const char *str, unsigned *argno)
2832 const char *pcnt = strchr (str, '%');
2833 dir.beg = str;
2835 if (size_t len = pcnt ? pcnt - str : *str ? strlen (str) : 1)
2837 /* This directive is either a plain string or the terminating nul
2838 (which isn't really a directive but it simplifies things to
2839 handle it as if it were). */
2840 dir.len = len;
2841 dir.fmtfunc = format_plain;
2843 if (dump_file)
2845 fprintf (dump_file, " Directive %u at offset %llu: \"%.*s\", "
2846 "length = %llu\n",
2847 dir.dirno,
2848 (unsigned long long)(size_t)(dir.beg - info.fmtstr),
2849 (int)dir.len, dir.beg, (unsigned long long)dir.len);
2852 return len - !*str;
2855 const char *pf = pcnt + 1;
2857 /* POSIX numbered argument index or zero when none. */
2858 unsigned dollar = 0;
2860 /* With and precision. -1 when not specified, HOST_WIDE_INT_MIN
2861 when given by a va_list argument, and a non-negative value
2862 when specified in the format string itself. */
2863 HOST_WIDE_INT width = -1;
2864 HOST_WIDE_INT precision = -1;
2866 /* Width specified via the asterisk. Need not be INTEGER_CST.
2867 For vararg functions set to void_node. */
2868 tree star_width = NULL_TREE;
2870 /* Width specified via the asterisk. Need not be INTEGER_CST.
2871 For vararg functions set to void_node. */
2872 tree star_precision = NULL_TREE;
2874 if (ISDIGIT (*pf))
2876 /* This could be either a POSIX positional argument, the '0'
2877 flag, or a width, depending on what follows. Store it as
2878 width and sort it out later after the next character has
2879 been seen. */
2880 char *end;
2881 width = strtol (pf, &end, 10);
2882 pf = end;
2884 else if ('*' == *pf)
2886 /* Similarly to the block above, this could be either a POSIX
2887 positional argument or a width, depending on what follows. */
2888 if (*argno < gimple_call_num_args (info.callstmt))
2889 star_width = gimple_call_arg (info.callstmt, (*argno)++);
2890 else
2891 star_width = void_node;
2892 ++pf;
2895 if (*pf == '$')
2897 /* Handle the POSIX dollar sign which references the 1-based
2898 positional argument number. */
2899 if (width != -1)
2900 dollar = width + info.argidx;
2901 else if (star_width
2902 && TREE_CODE (star_width) == INTEGER_CST)
2903 dollar = width + tree_to_shwi (star_width);
2905 /* Bail when the numbered argument is out of range (it will
2906 have already been diagnosed by -Wformat). */
2907 if (dollar == 0
2908 || dollar == info.argidx
2909 || dollar > gimple_call_num_args (info.callstmt))
2910 return false;
2912 --dollar;
2914 star_width = NULL_TREE;
2915 width = -1;
2916 ++pf;
2919 if (dollar || !star_width)
2921 if (width != -1)
2923 if (width == 0)
2925 /* The '0' that has been interpreted as a width above is
2926 actually a flag. Reset HAVE_WIDTH, set the '0' flag,
2927 and continue processing other flags. */
2928 width = -1;
2929 dir.set_flag ('0');
2931 else if (!dollar)
2933 /* (Non-zero) width has been seen. The next character
2934 is either a period or a digit. */
2935 goto start_precision;
2938 /* When either '$' has been seen, or width has not been seen,
2939 the next field is the optional flags followed by an optional
2940 width. */
2941 for ( ; ; ) {
2942 switch (*pf)
2944 case ' ':
2945 case '0':
2946 case '+':
2947 case '-':
2948 case '#':
2949 dir.set_flag (*pf++);
2950 break;
2952 default:
2953 goto start_width;
2957 start_width:
2958 if (ISDIGIT (*pf))
2960 char *end;
2961 width = strtol (pf, &end, 10);
2962 pf = end;
2964 else if ('*' == *pf)
2966 if (*argno < gimple_call_num_args (info.callstmt))
2967 star_width = gimple_call_arg (info.callstmt, (*argno)++);
2968 else
2970 /* This is (likely) a va_list. It could also be an invalid
2971 call with insufficient arguments. */
2972 star_width = void_node;
2974 ++pf;
2976 else if ('\'' == *pf)
2978 /* The POSIX apostrophe indicating a numeric grouping
2979 in the current locale. Even though it's possible to
2980 estimate the upper bound on the size of the output
2981 based on the number of digits it probably isn't worth
2982 continuing. */
2983 return 0;
2987 start_precision:
2988 if ('.' == *pf)
2990 ++pf;
2992 if (ISDIGIT (*pf))
2994 char *end;
2995 precision = strtol (pf, &end, 10);
2996 pf = end;
2998 else if ('*' == *pf)
3000 if (*argno < gimple_call_num_args (info.callstmt))
3001 star_precision = gimple_call_arg (info.callstmt, (*argno)++);
3002 else
3004 /* This is (likely) a va_list. It could also be an invalid
3005 call with insufficient arguments. */
3006 star_precision = void_node;
3008 ++pf;
3010 else
3012 /* The decimal precision or the asterisk are optional.
3013 When neither is dirified it's taken to be zero. */
3014 precision = 0;
3018 switch (*pf)
3020 case 'h':
3021 if (pf[1] == 'h')
3023 ++pf;
3024 dir.modifier = FMT_LEN_hh;
3026 else
3027 dir.modifier = FMT_LEN_h;
3028 ++pf;
3029 break;
3031 case 'j':
3032 dir.modifier = FMT_LEN_j;
3033 ++pf;
3034 break;
3036 case 'L':
3037 dir.modifier = FMT_LEN_L;
3038 ++pf;
3039 break;
3041 case 'l':
3042 if (pf[1] == 'l')
3044 ++pf;
3045 dir.modifier = FMT_LEN_ll;
3047 else
3048 dir.modifier = FMT_LEN_l;
3049 ++pf;
3050 break;
3052 case 't':
3053 dir.modifier = FMT_LEN_t;
3054 ++pf;
3055 break;
3057 case 'z':
3058 dir.modifier = FMT_LEN_z;
3059 ++pf;
3060 break;
3063 switch (*pf)
3065 /* Handle a sole '%' character the same as "%%" but since it's
3066 undefined prevent the result from being folded. */
3067 case '\0':
3068 --pf;
3069 res->range.min = res->range.max = HOST_WIDE_INT_M1U;
3070 /* FALLTHRU */
3071 case '%':
3072 dir.fmtfunc = format_percent;
3073 break;
3075 case 'a':
3076 case 'A':
3077 case 'e':
3078 case 'E':
3079 case 'f':
3080 case 'F':
3081 case 'g':
3082 case 'G':
3083 res->floating = true;
3084 dir.fmtfunc = format_floating;
3085 break;
3087 case 'd':
3088 case 'i':
3089 case 'o':
3090 case 'u':
3091 case 'x':
3092 case 'X':
3093 dir.fmtfunc = format_integer;
3094 break;
3096 case 'p':
3097 /* The %p output is implementation-defined. It's possible
3098 to determine this format but due to extensions (edirially
3099 those of the Linux kernel -- see bug 78512) the first %p
3100 in the format string disables any further processing. */
3101 return false;
3103 case 'n':
3104 /* %n has side-effects even when nothing is actually printed to
3105 any buffer. */
3106 info.nowrite = false;
3107 dir.fmtfunc = format_none;
3108 break;
3110 case 'c':
3111 dir.fmtfunc = format_character;
3112 break;
3114 case 'S':
3115 case 's':
3116 dir.fmtfunc = format_string;
3117 break;
3119 default:
3120 /* Unknown conversion specification. */
3121 return 0;
3124 dir.specifier = *pf++;
3126 if (star_width)
3128 if (TREE_CODE (TREE_TYPE (star_width)) == INTEGER_TYPE)
3129 dir.set_width (star_width);
3130 else
3132 /* Width specified by a va_list takes on the range [0, -INT_MIN]
3133 (width is the absolute value of that specified). */
3134 dir.width[0] = 0;
3135 dir.width[1] = target_int_max () + 1;
3138 else
3139 dir.set_width (width);
3141 if (star_precision)
3143 if (TREE_CODE (TREE_TYPE (star_precision)) == INTEGER_TYPE)
3144 dir.set_precision (star_precision);
3145 else
3147 /* Precision specified by a va_list takes on the range [-1, INT_MAX]
3148 (unlike width, negative precision is ignored). */
3149 dir.prec[0] = -1;
3150 dir.prec[1] = target_int_max ();
3153 else
3154 dir.set_precision (precision);
3156 /* Extract the argument if the directive takes one and if it's
3157 available (e.g., the function doesn't take a va_list). Treat
3158 missing arguments the same as va_list, even though they will
3159 have likely already been diagnosed by -Wformat. */
3160 if (dir.specifier != '%'
3161 && *argno < gimple_call_num_args (info.callstmt))
3162 dir.arg = gimple_call_arg (info.callstmt, dollar ? dollar : (*argno)++);
3164 /* Return the length of the format directive. */
3165 dir.len = pf - pcnt;
3167 if (dump_file)
3169 fprintf (dump_file, " Directive %u at offset %llu: \"%.*s\"",
3170 dir.dirno, (unsigned long long)(size_t)(dir.beg - info.fmtstr),
3171 (int)dir.len, dir.beg);
3172 if (star_width)
3174 if (dir.width[0] == dir.width[1])
3175 fprintf (dump_file, ", width = %lli", (long long)dir.width[0]);
3176 else
3177 fprintf (dump_file, ", width in range [%lli, %lli]",
3178 (long long)dir.width[0], (long long)dir.width[1]);
3181 if (star_precision)
3183 if (dir.prec[0] == dir.prec[1])
3184 fprintf (dump_file, ", precision = %lli", (long long)dir.prec[0]);
3185 else
3186 fprintf (dump_file, ", precision in range [%lli, %lli]",
3187 (long long)dir.prec[0], (long long)dir.prec[1]);
3189 fputc ('\n', dump_file);
3192 return dir.len;
3195 /* Compute the length of the output resulting from the call to a formatted
3196 output function described by INFO and store the result of the call in
3197 *RES. Issue warnings for detected past the end writes. Return true
3198 if the complete format string has been processed and *RES can be relied
3199 on, false otherwise (e.g., when a unknown or unhandled directive was seen
3200 that caused the processing to be terminated early). */
3202 bool
3203 pass_sprintf_length::compute_format_length (call_info &info,
3204 format_result *res)
3206 if (dump_file)
3208 location_t callloc = gimple_location (info.callstmt);
3209 fprintf (dump_file, "%s:%i: ",
3210 LOCATION_FILE (callloc), LOCATION_LINE (callloc));
3211 print_generic_expr (dump_file, info.func, dump_flags);
3213 fprintf (dump_file, ": objsize = %llu, fmtstr = \"%s\"\n",
3214 (unsigned long long)info.objsize, info.fmtstr);
3217 /* Reset the minimum and maximum byte counters. */
3218 res->range.min = res->range.max = 0;
3220 /* No directive has been seen yet so the length of output is bounded
3221 by the known range [0, 0] (with no conversion producing more than
3222 4K bytes) until determined otherwise. */
3223 res->knownrange = true;
3224 res->under4k = true;
3225 res->floating = false;
3226 res->warned = false;
3228 /* 1-based directive counter. */
3229 unsigned dirno = 1;
3231 /* The variadic argument counter. */
3232 unsigned argno = info.argidx;
3234 for (const char *pf = info.fmtstr; ; ++dirno)
3236 directive dir = directive ();
3237 dir.dirno = dirno;
3239 size_t n = parse_directive (info, dir, res, pf, &argno);
3241 /* Return failure if the format function fails. */
3242 if (!format_directive (info, res, dir))
3243 return false;
3245 /* Return success the directive is zero bytes long and it's
3246 the last think in the format string (i.e., it's the terminating
3247 nul, which isn't really a directive but handling it as one makes
3248 things simpler). */
3249 if (!n)
3250 return *pf == '\0';
3252 pf += n;
3255 /* The complete format string was processed (with or without warnings). */
3256 return true;
3259 /* Return the size of the object referenced by the expression DEST if
3260 available, or -1 otherwise. */
3262 static unsigned HOST_WIDE_INT
3263 get_destination_size (tree dest)
3265 /* Initialize object size info before trying to compute it. */
3266 init_object_sizes ();
3268 /* Use __builtin_object_size to determine the size of the destination
3269 object. When optimizing, determine the smallest object (such as
3270 a member array as opposed to the whole enclosing object), otherwise
3271 use type-zero object size to determine the size of the enclosing
3272 object (the function fails without optimization in this type). */
3273 int ost = optimize > 0;
3274 unsigned HOST_WIDE_INT size;
3275 if (compute_builtin_object_size (dest, ost, &size))
3276 return size;
3278 return HOST_WIDE_INT_M1U;
3281 /* Given a suitable result RES of a call to a formatted output function
3282 described by INFO, substitute the result for the return value of
3283 the call. The result is suitable if the number of bytes it represents
3284 is known and exact. A result that isn't suitable for substitution may
3285 have its range set to the range of return values, if that is known.
3286 Return true if the call is removed and gsi_next should not be performed
3287 in the caller. */
3289 static bool
3290 try_substitute_return_value (gimple_stmt_iterator *gsi,
3291 const pass_sprintf_length::call_info &info,
3292 const format_result &res)
3294 tree lhs = gimple_get_lhs (info.callstmt);
3296 /* Set to true when the entire call has been removed. */
3297 bool removed = false;
3299 /* The minimum return value. */
3300 unsigned HOST_WIDE_INT minretval = res.range.min;
3302 /* The maximum return value is in most cases bounded by RES.RANGE.MAX
3303 but in cases involving multibyte characters could be as large as
3304 RES.RANGE.UNLIKELY. */
3305 unsigned HOST_WIDE_INT maxretval
3306 = res.range.unlikely < res.range.max ? res.range.max : res.range.unlikely;
3308 /* Adjust the number of bytes which includes the terminating nul
3309 to reflect the return value of the function which does not.
3310 Because the valid range of the function is [INT_MIN, INT_MAX],
3311 a valid range before the adjustment below is [0, INT_MAX + 1]
3312 (the functions only return negative values on error or undefined
3313 behavior). */
3314 if (minretval <= target_int_max () + 1)
3315 --minretval;
3316 if (maxretval <= target_int_max () + 1)
3317 --maxretval;
3319 /* Avoid the return value optimization when the behavior of the call
3320 is undefined either because any directive may have produced 4K or
3321 more of output, or the return value exceeds INT_MAX, or because
3322 the output overflows the destination object (but leave it enabled
3323 when the function is bounded because then the behavior is well-
3324 defined). */
3325 if (res.under4k
3326 && minretval == maxretval
3327 && (info.bounded || minretval < info.objsize)
3328 && minretval <= target_int_max ()
3329 /* Not prepared to handle possibly throwing calls here; they shouldn't
3330 appear in non-artificial testcases, except when the __*_chk routines
3331 are badly declared. */
3332 && !stmt_ends_bb_p (info.callstmt))
3334 tree cst = build_int_cst (integer_type_node, minretval);
3336 if (lhs == NULL_TREE
3337 && info.nowrite)
3339 /* Remove the call to the bounded function with a zero size
3340 (e.g., snprintf(0, 0, "%i", 123)) if there is no lhs. */
3341 unlink_stmt_vdef (info.callstmt);
3342 gsi_remove (gsi, true);
3343 removed = true;
3345 else if (info.nowrite)
3347 /* Replace the call to the bounded function with a zero size
3348 (e.g., snprintf(0, 0, "%i", 123) with the constant result
3349 of the function. */
3350 if (!update_call_from_tree (gsi, cst))
3351 gimplify_and_update_call_from_tree (gsi, cst);
3352 gimple *callstmt = gsi_stmt (*gsi);
3353 update_stmt (callstmt);
3355 else if (lhs)
3357 /* Replace the left-hand side of the call with the constant
3358 result of the formatted function. */
3359 gimple_call_set_lhs (info.callstmt, NULL_TREE);
3360 gimple *g = gimple_build_assign (lhs, cst);
3361 gsi_insert_after (gsi, g, GSI_NEW_STMT);
3362 update_stmt (info.callstmt);
3365 if (dump_file)
3367 if (removed)
3368 fprintf (dump_file, " Removing call statement.");
3369 else
3371 fprintf (dump_file, " Substituting ");
3372 print_generic_expr (dump_file, cst, dump_flags);
3373 fprintf (dump_file, " for %s.\n",
3374 info.nowrite ? "statement" : "return value");
3378 else if (lhs)
3380 bool setrange = false;
3382 if ((info.bounded || maxretval < info.objsize)
3383 && res.under4k
3384 && (minretval < target_int_max ()
3385 && maxretval < target_int_max ()))
3387 /* If the result is in a valid range bounded by the size of
3388 the destination set it so that it can be used for subsequent
3389 optimizations. */
3390 int prec = TYPE_PRECISION (integer_type_node);
3392 wide_int min = wi::shwi (minretval, prec);
3393 wide_int max = wi::shwi (maxretval, prec);
3394 set_range_info (lhs, VR_RANGE, min, max);
3396 setrange = true;
3399 if (dump_file)
3401 const char *inbounds
3402 = (minretval < info.objsize
3403 ? (maxretval < info.objsize
3404 ? "in" : "potentially out-of")
3405 : "out-of");
3407 const char *what = setrange ? "Setting" : "Discarding";
3408 if (minretval != maxretval)
3409 fprintf (dump_file,
3410 " %s %s-bounds return value range [%llu, %llu].\n",
3411 what, inbounds,
3412 (unsigned long long)minretval,
3413 (unsigned long long)maxretval);
3414 else
3415 fprintf (dump_file, " %s %s-bounds return value %llu.\n",
3416 what, inbounds, (unsigned long long)minretval);
3420 if (dump_file)
3421 fputc ('\n', dump_file);
3423 return removed;
3426 /* Determine if a GIMPLE CALL is to one of the sprintf-like built-in
3427 functions and if so, handle it. Return true if the call is removed
3428 and gsi_next should not be performed in the caller. */
3430 bool
3431 pass_sprintf_length::handle_gimple_call (gimple_stmt_iterator *gsi)
3433 call_info info = call_info ();
3435 info.callstmt = gsi_stmt (*gsi);
3436 if (!gimple_call_builtin_p (info.callstmt, BUILT_IN_NORMAL))
3437 return false;
3439 info.func = gimple_call_fndecl (info.callstmt);
3440 info.fncode = DECL_FUNCTION_CODE (info.func);
3442 /* The size of the destination as in snprintf(dest, size, ...). */
3443 unsigned HOST_WIDE_INT dstsize = HOST_WIDE_INT_M1U;
3445 /* The size of the destination determined by __builtin_object_size. */
3446 unsigned HOST_WIDE_INT objsize = HOST_WIDE_INT_M1U;
3448 /* Buffer size argument number (snprintf and vsnprintf). */
3449 unsigned HOST_WIDE_INT idx_dstsize = HOST_WIDE_INT_M1U;
3451 /* Object size argument number (snprintf_chk and vsnprintf_chk). */
3452 unsigned HOST_WIDE_INT idx_objsize = HOST_WIDE_INT_M1U;
3454 /* Format string argument number (valid for all functions). */
3455 unsigned idx_format;
3457 switch (info.fncode)
3459 case BUILT_IN_SPRINTF:
3460 // Signature:
3461 // __builtin_sprintf (dst, format, ...)
3462 idx_format = 1;
3463 info.argidx = 2;
3464 break;
3466 case BUILT_IN_SPRINTF_CHK:
3467 // Signature:
3468 // __builtin___sprintf_chk (dst, ost, objsize, format, ...)
3469 idx_objsize = 2;
3470 idx_format = 3;
3471 info.argidx = 4;
3472 break;
3474 case BUILT_IN_SNPRINTF:
3475 // Signature:
3476 // __builtin_snprintf (dst, size, format, ...)
3477 idx_dstsize = 1;
3478 idx_format = 2;
3479 info.argidx = 3;
3480 info.bounded = true;
3481 break;
3483 case BUILT_IN_SNPRINTF_CHK:
3484 // Signature:
3485 // __builtin___snprintf_chk (dst, size, ost, objsize, format, ...)
3486 idx_dstsize = 1;
3487 idx_objsize = 3;
3488 idx_format = 4;
3489 info.argidx = 5;
3490 info.bounded = true;
3491 break;
3493 case BUILT_IN_VSNPRINTF:
3494 // Signature:
3495 // __builtin_vsprintf (dst, size, format, va)
3496 idx_dstsize = 1;
3497 idx_format = 2;
3498 info.argidx = -1;
3499 info.bounded = true;
3500 break;
3502 case BUILT_IN_VSNPRINTF_CHK:
3503 // Signature:
3504 // __builtin___vsnprintf_chk (dst, size, ost, objsize, format, va)
3505 idx_dstsize = 1;
3506 idx_objsize = 3;
3507 idx_format = 4;
3508 info.argidx = -1;
3509 info.bounded = true;
3510 break;
3512 case BUILT_IN_VSPRINTF:
3513 // Signature:
3514 // __builtin_vsprintf (dst, format, va)
3515 idx_format = 1;
3516 info.argidx = -1;
3517 break;
3519 case BUILT_IN_VSPRINTF_CHK:
3520 // Signature:
3521 // __builtin___vsprintf_chk (dst, ost, objsize, format, va)
3522 idx_format = 3;
3523 idx_objsize = 2;
3524 info.argidx = -1;
3525 break;
3527 default:
3528 return false;
3531 /* Set the global warning level for this function. */
3532 warn_level = info.bounded ? warn_format_trunc : warn_format_overflow;
3534 /* The first argument is a pointer to the destination. */
3535 tree dstptr = gimple_call_arg (info.callstmt, 0);
3537 info.format = gimple_call_arg (info.callstmt, idx_format);
3539 /* True when the destination size is constant as opposed to the lower
3540 or upper bound of a range. */
3541 bool dstsize_cst_p = true;
3543 if (idx_dstsize == HOST_WIDE_INT_M1U)
3545 /* For non-bounded functions like sprintf, determine the size
3546 of the destination from the object or pointer passed to it
3547 as the first argument. */
3548 dstsize = get_destination_size (dstptr);
3550 else if (tree size = gimple_call_arg (info.callstmt, idx_dstsize))
3552 /* For bounded functions try to get the size argument. */
3554 if (TREE_CODE (size) == INTEGER_CST)
3556 dstsize = tree_to_uhwi (size);
3557 /* No object can be larger than SIZE_MAX bytes (half the address
3558 space) on the target.
3559 The functions are defined only for output of at most INT_MAX
3560 bytes. Specifying a bound in excess of that limit effectively
3561 defeats the bounds checking (and on some implementations such
3562 as Solaris cause the function to fail with EINVAL). */
3563 if (dstsize > target_size_max () / 2)
3565 /* Avoid warning if -Wstringop-overflow is specified since
3566 it also warns for the same thing though only for the
3567 checking built-ins. */
3568 if ((idx_objsize == HOST_WIDE_INT_M1U
3569 || !warn_stringop_overflow))
3570 warning_at (gimple_location (info.callstmt), info.warnopt (),
3571 "specified bound %wu exceeds maximum object size "
3572 "%wu",
3573 dstsize, target_size_max () / 2);
3575 else if (dstsize > target_int_max ())
3576 warning_at (gimple_location (info.callstmt), info.warnopt (),
3577 "specified bound %wu exceeds %<INT_MAX %>",
3578 dstsize);
3580 else if (TREE_CODE (size) == SSA_NAME)
3582 /* Try to determine the range of values of the argument
3583 and use the greater of the two at level 1 and the smaller
3584 of them at level 2. */
3585 wide_int min, max;
3586 enum value_range_type range_type
3587 = get_range_info (size, &min, &max);
3588 if (range_type == VR_RANGE)
3590 dstsize
3591 = (warn_level < 2
3592 ? wi::fits_uhwi_p (max) ? max.to_uhwi () : max.to_shwi ()
3593 : wi::fits_uhwi_p (min) ? min.to_uhwi () : min.to_shwi ());
3596 /* The destination size is not constant. If the function is
3597 bounded (e.g., snprintf) a lower bound of zero doesn't
3598 necessarily imply it can be eliminated. */
3599 dstsize_cst_p = false;
3603 if (idx_objsize != HOST_WIDE_INT_M1U)
3604 if (tree size = gimple_call_arg (info.callstmt, idx_objsize))
3605 if (tree_fits_uhwi_p (size))
3606 objsize = tree_to_uhwi (size);
3608 if (info.bounded && !dstsize)
3610 /* As a special case, when the explicitly specified destination
3611 size argument (to a bounded function like snprintf) is zero
3612 it is a request to determine the number of bytes on output
3613 without actually producing any. Pretend the size is
3614 unlimited in this case. */
3615 info.objsize = HOST_WIDE_INT_MAX;
3616 info.nowrite = dstsize_cst_p;
3618 else
3620 /* For calls to non-bounded functions or to those of bounded
3621 functions with a non-zero size, warn if the destination
3622 pointer is null. */
3623 if (integer_zerop (dstptr))
3625 /* This is diagnosed with -Wformat only when the null is a constant
3626 pointer. The warning here diagnoses instances where the pointer
3627 is not constant. */
3628 location_t loc = gimple_location (info.callstmt);
3629 warning_at (EXPR_LOC_OR_LOC (dstptr, loc),
3630 info.warnopt (), "null destination pointer");
3631 return false;
3634 /* Set the object size to the smaller of the two arguments
3635 of both have been specified and they're not equal. */
3636 info.objsize = dstsize < objsize ? dstsize : objsize;
3638 if (info.bounded
3639 && dstsize < target_size_max () / 2 && objsize < dstsize
3640 /* Avoid warning if -Wstringop-overflow is specified since
3641 it also warns for the same thing though only for the
3642 checking built-ins. */
3643 && (idx_objsize == HOST_WIDE_INT_M1U
3644 || !warn_stringop_overflow))
3646 warning_at (gimple_location (info.callstmt), info.warnopt (),
3647 "specified bound %wu exceeds the size %wu "
3648 "of the destination object", dstsize, objsize);
3652 if (integer_zerop (info.format))
3654 /* This is diagnosed with -Wformat only when the null is a constant
3655 pointer. The warning here diagnoses instances where the pointer
3656 is not constant. */
3657 location_t loc = gimple_location (info.callstmt);
3658 warning_at (EXPR_LOC_OR_LOC (info.format, loc),
3659 info.warnopt (), "null format string");
3660 return false;
3663 info.fmtstr = get_format_string (info.format, &info.fmtloc);
3664 if (!info.fmtstr)
3665 return false;
3667 /* The result is the number of bytes output by the formatted function,
3668 including the terminating NUL. */
3669 format_result res = format_result ();
3671 bool success = compute_format_length (info, &res);
3673 /* When optimizing and the printf return value optimization is enabled,
3674 attempt to substitute the computed result for the return value of
3675 the call. Avoid this optimization when -frounding-math is in effect
3676 and the format string contains a floating point directive. */
3677 if (success
3678 && optimize > 0
3679 && flag_printf_return_value
3680 && (!flag_rounding_math || !res.floating))
3681 return try_substitute_return_value (gsi, info, res);
3683 return false;
3686 /* Execute the pass for function FUN. */
3688 unsigned int
3689 pass_sprintf_length::execute (function *fun)
3691 basic_block bb;
3692 FOR_EACH_BB_FN (bb, fun)
3694 for (gimple_stmt_iterator si = gsi_start_bb (bb); !gsi_end_p (si); )
3696 /* Iterate over statements, looking for function calls. */
3697 gimple *stmt = gsi_stmt (si);
3699 if (is_gimple_call (stmt) && handle_gimple_call (&si))
3700 /* If handle_gimple_call returns true, the iterator is
3701 already pointing to the next statement. */
3702 continue;
3704 gsi_next (&si);
3708 /* Clean up object size info. */
3709 fini_object_sizes ();
3711 return 0;
3714 } /* Unnamed namespace. */
3716 /* Return a pointer to a pass object newly constructed from the context
3717 CTXT. */
3719 gimple_opt_pass *
3720 make_pass_sprintf_length (gcc::context *ctxt)
3722 return new pass_sprintf_length (ctxt);