serge-sans-paille created this revision. Herald added a project: All. serge-sans-paille requested review of this revision. Herald added a project: clang. Herald added a subscriber: cfe-commits.
When parsing a format string with less argument than specified, one should check argument access because there may be no such argument. This fixes #57517 Repository: rG LLVM Github Monorepo https://reviews.llvm.org/D133197 Files: clang/lib/Sema/SemaChecking.cpp clang/test/Sema/format-strings-scanf.c Index: clang/test/Sema/format-strings-scanf.c =================================================================== --- clang/test/Sema/format-strings-scanf.c +++ clang/test/Sema/format-strings-scanf.c @@ -69,6 +69,11 @@ scanf("%#.2Lf", ld); // expected-warning{{invalid conversion specifier '#'}} } +void missing_argument_with_length_modifier() { + char buf[30]; + scanf("%s:%900s", buf); // expected-warning{{more '%' conversions than data arguments}} +} + // Test that the scanf call site is where the warning is attached. If the // format string is somewhere else, point to it in a note. void pr9751(void) { Index: clang/lib/Sema/SemaChecking.cpp =================================================================== --- clang/lib/Sema/SemaChecking.cpp +++ clang/lib/Sema/SemaChecking.cpp @@ -1066,6 +1066,9 @@ return llvm::None; unsigned NewIndex = *IndexOptional; + if (NewIndex >= TheCall->getNumArgs()) + return llvm::None; + const Expr *ObjArg = TheCall->getArg(NewIndex); uint64_t Result; if (!ObjArg->tryEvaluateObjectSize(Result, getASTContext(), BOSType))
Index: clang/test/Sema/format-strings-scanf.c =================================================================== --- clang/test/Sema/format-strings-scanf.c +++ clang/test/Sema/format-strings-scanf.c @@ -69,6 +69,11 @@ scanf("%#.2Lf", ld); // expected-warning{{invalid conversion specifier '#'}} } +void missing_argument_with_length_modifier() { + char buf[30]; + scanf("%s:%900s", buf); // expected-warning{{more '%' conversions than data arguments}} +} + // Test that the scanf call site is where the warning is attached. If the // format string is somewhere else, point to it in a note. void pr9751(void) { Index: clang/lib/Sema/SemaChecking.cpp =================================================================== --- clang/lib/Sema/SemaChecking.cpp +++ clang/lib/Sema/SemaChecking.cpp @@ -1066,6 +1066,9 @@ return llvm::None; unsigned NewIndex = *IndexOptional; + if (NewIndex >= TheCall->getNumArgs()) + return llvm::None; + const Expr *ObjArg = TheCall->getArg(NewIndex); uint64_t Result; if (!ObjArg->tryEvaluateObjectSize(Result, getASTContext(), BOSType))
_______________________________________________ cfe-commits mailing list cfe-commits@lists.llvm.org https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits