1 | /* Copyright (C) 2016-2024 Free Software Foundation, Inc. |
2 | Contributed by Martin Sebor <msebor@redhat.com>. |
3 | |
4 | This file is part of GCC. |
5 | |
6 | GCC is free software; you can redistribute it and/or modify it under |
7 | the terms of the GNU General Public License as published by the Free |
8 | Software Foundation; either version 3, or (at your option) any later |
9 | version. |
10 | |
11 | GCC is distributed in the hope that it will be useful, but WITHOUT ANY |
12 | WARRANTY; without even the implied warranty of MERCHANTABILITY or |
13 | FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
14 | for more details. |
15 | |
16 | You should have received a copy of the GNU General Public License |
17 | along with GCC; see the file COPYING3. If not see |
18 | <http://www.gnu.org/licenses/>. */ |
19 | |
20 | /* This file implements the printf-return-value pass. The pass does |
21 | two things: 1) it analyzes calls to formatted output functions like |
22 | sprintf looking for possible buffer overflows and calls to bounded |
23 | functions like snprintf for early truncation (and under the control |
24 | of the -Wformat-length option issues warnings), and 2) under the |
25 | control of the -fprintf-return-value option it folds the return |
26 | value of safe calls into constants, making it possible to eliminate |
27 | code that depends on the value of those constants. |
28 | |
29 | For all functions (bounded or not) the pass uses the size of the |
30 | destination object. That means that it will diagnose calls to |
31 | snprintf not on the basis of the size specified by the function's |
32 | second argument but rather on the basis of the size the first |
33 | argument points to (if possible). For bound-checking built-ins |
34 | like __builtin___snprintf_chk the pass uses the size typically |
35 | determined by __builtin_object_size and passed to the built-in |
36 | by the Glibc inline wrapper. |
37 | |
38 | The pass handles all forms standard sprintf format directives, |
39 | including character, integer, floating point, pointer, and strings, |
40 | with the standard C flags, widths, and precisions. For integers |
41 | and strings it computes the length of output itself. For floating |
42 | point it uses MPFR to format known constants with up and down |
43 | rounding and uses the resulting range of output lengths. For |
44 | strings it uses the length of string literals and the sizes of |
45 | character arrays that a character pointer may point to as a bound |
46 | on the longest string. */ |
47 | |
48 | #include "config.h" |
49 | #include "system.h" |
50 | #include "coretypes.h" |
51 | #include "backend.h" |
52 | #include "tree.h" |
53 | #include "gimple.h" |
54 | #include "tree-pass.h" |
55 | #include "ssa.h" |
56 | #include "gimple-iterator.h" |
57 | #include "gimple-fold.h" |
58 | #include "gimple-pretty-print.h" |
59 | #include "diagnostic-core.h" |
60 | #include "fold-const.h" |
61 | #include "tree-ssa.h" |
62 | #include "tree-object-size.h" |
63 | #include "tree-cfg.h" |
64 | #include "tree-ssa-propagate.h" |
65 | #include "calls.h" |
66 | #include "cfgloop.h" |
67 | #include "tree-scalar-evolution.h" |
68 | #include "tree-ssa-loop.h" |
69 | #include "intl.h" |
70 | #include "langhooks.h" |
71 | |
72 | #include "attribs.h" |
73 | #include "builtins.h" |
74 | #include "pointer-query.h" |
75 | #include "stor-layout.h" |
76 | |
77 | #include "realmpfr.h" |
78 | #include "target.h" |
79 | |
80 | #include "cpplib.h" |
81 | #include "input.h" |
82 | #include "toplev.h" |
83 | #include "substring-locations.h" |
84 | #include "diagnostic.h" |
85 | #include "domwalk.h" |
86 | #include "alloc-pool.h" |
87 | #include "vr-values.h" |
88 | #include "tree-ssa-strlen.h" |
89 | #include "tree-dfa.h" |
90 | |
91 | /* The likely worst case value of MB_LEN_MAX for the target, large enough |
92 | for UTF-8. Ideally, this would be obtained by a target hook if it were |
93 | to be used for optimization but it's good enough as is for warnings. */ |
94 | #define target_mb_len_max() 6 |
95 | |
96 | /* The maximum number of bytes a single non-string directive can result |
97 | in. This is the result of printf("%.*Lf", INT_MAX, -LDBL_MAX) for |
98 | LDBL_MAX_10_EXP of 4932. */ |
99 | #define IEEE_MAX_10_EXP 4932 |
100 | #define target_dir_max() (target_int_max () + IEEE_MAX_10_EXP + 2) |
101 | |
102 | namespace { |
103 | |
104 | /* Set to the warning level for the current function which is equal |
105 | either to warn_format_trunc for bounded functions or to |
106 | warn_format_overflow otherwise. */ |
107 | |
108 | static int warn_level; |
109 | |
110 | /* The minimum, maximum, likely, and unlikely maximum number of bytes |
111 | of output either a formatting function or an individual directive |
112 | can result in. */ |
113 | |
114 | struct result_range |
115 | { |
116 | /* The absolute minimum number of bytes. The result of a successful |
117 | conversion is guaranteed to be no less than this. (An erroneous |
118 | conversion can be indicated by MIN > HOST_WIDE_INT_MAX.) */ |
119 | unsigned HOST_WIDE_INT min; |
120 | /* The likely maximum result that is used in diagnostics. In most |
121 | cases MAX is the same as the worst case UNLIKELY result. */ |
122 | unsigned HOST_WIDE_INT max; |
123 | /* The likely result used to trigger diagnostics. For conversions |
124 | that result in a range of bytes [MIN, MAX], LIKELY is somewhere |
125 | in that range. */ |
126 | unsigned HOST_WIDE_INT likely; |
127 | /* In rare cases (e.g., for multibyte characters) UNLIKELY gives |
128 | the worst cases maximum result of a directive. In most cases |
129 | UNLIKELY == MAX. UNLIKELY is used to control the return value |
130 | optimization but not in diagnostics. */ |
131 | unsigned HOST_WIDE_INT unlikely; |
132 | }; |
133 | |
134 | /* Return the value of INT_MIN for the target. */ |
135 | |
136 | static inline HOST_WIDE_INT |
137 | target_int_min () |
138 | { |
139 | return tree_to_shwi (TYPE_MIN_VALUE (integer_type_node)); |
140 | } |
141 | |
142 | /* Return the value of INT_MAX for the target. */ |
143 | |
144 | static inline unsigned HOST_WIDE_INT |
145 | target_int_max () |
146 | { |
147 | return tree_to_uhwi (TYPE_MAX_VALUE (integer_type_node)); |
148 | } |
149 | |
150 | /* Return the value of SIZE_MAX for the target. */ |
151 | |
152 | static inline unsigned HOST_WIDE_INT |
153 | target_size_max () |
154 | { |
155 | return tree_to_uhwi (TYPE_MAX_VALUE (size_type_node)); |
156 | } |
157 | |
158 | /* A straightforward mapping from the execution character set to the host |
159 | character set indexed by execution character. */ |
160 | |
161 | static char target_to_host_charmap[256]; |
162 | |
163 | /* Initialize a mapping from the execution character set to the host |
164 | character set. */ |
165 | |
166 | static bool |
167 | init_target_to_host_charmap () |
168 | { |
169 | /* If the percent sign is non-zero the mapping has already been |
170 | initialized. */ |
171 | if (target_to_host_charmap['%']) |
172 | return true; |
173 | |
174 | /* Initialize the target_percent character (done elsewhere). */ |
175 | if (!init_target_chars ()) |
176 | return false; |
177 | |
178 | /* The subset of the source character set used by printf conversion |
179 | specifications (strictly speaking, not all letters are used but |
180 | they are included here for the sake of simplicity). The dollar |
181 | sign must be included even though it's not in the basic source |
182 | character set. */ |
183 | const char srcset[] = " 0123456789!\"#%&'()*+,-./:;<=>?[\\]^_{|}~$" |
184 | "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" ; |
185 | |
186 | /* Set the mapping for all characters to some ordinary value (i,e., |
187 | not none used in printf conversion specifications) and overwrite |
188 | those that are used by conversion specifications with their |
189 | corresponding values. */ |
190 | memset (s: target_to_host_charmap + 1, c: '?', n: sizeof target_to_host_charmap - 1); |
191 | |
192 | /* Are the two sets of characters the same? */ |
193 | bool all_same_p = true; |
194 | |
195 | for (const char *pc = srcset; *pc; ++pc) |
196 | { |
197 | /* Slice off the high end bits in case target characters are |
198 | signed. All values are expected to be non-nul, otherwise |
199 | there's a problem. */ |
200 | if (unsigned char tc = lang_hooks.to_target_charset (*pc)) |
201 | { |
202 | target_to_host_charmap[tc] = *pc; |
203 | if (tc != *pc) |
204 | all_same_p = false; |
205 | } |
206 | else |
207 | return false; |
208 | |
209 | } |
210 | |
211 | /* Set the first element to a non-zero value if the mapping |
212 | is 1-to-1, otherwise leave it clear (NUL is assumed to be |
213 | the same in both character sets). */ |
214 | target_to_host_charmap[0] = all_same_p; |
215 | |
216 | return true; |
217 | } |
218 | |
219 | /* Return the host source character corresponding to the character |
220 | CH in the execution character set if one exists, or some innocuous |
221 | (non-special, non-nul) source character otherwise. */ |
222 | |
223 | static inline unsigned char |
224 | target_to_host (unsigned char ch) |
225 | { |
226 | return target_to_host_charmap[ch]; |
227 | } |
228 | |
229 | /* Convert an initial substring of the string TARGSTR consisting of |
230 | characters in the execution character set into a string in the |
231 | source character set on the host and store up to HOSTSZ characters |
232 | in the buffer pointed to by HOSTR. Return HOSTR. */ |
233 | |
234 | static const char* |
235 | target_to_host (char *hostr, size_t hostsz, const char *targstr) |
236 | { |
237 | /* Make sure the buffer is reasonably big. */ |
238 | gcc_assert (hostsz > 4); |
239 | |
240 | /* The interesting subset of source and execution characters are |
241 | the same so no conversion is necessary. However, truncate |
242 | overlong strings just like the translated strings are. */ |
243 | if (target_to_host_charmap['\0'] == 1) |
244 | { |
245 | size_t len = strlen (s: targstr); |
246 | if (len >= hostsz) |
247 | { |
248 | memcpy (dest: hostr, src: targstr, n: hostsz - 4); |
249 | strcpy (dest: hostr + hostsz - 4, src: "..." ); |
250 | } |
251 | else |
252 | memcpy (dest: hostr, src: targstr, n: len + 1); |
253 | return hostr; |
254 | } |
255 | |
256 | /* Convert the initial substring of TARGSTR to the corresponding |
257 | characters in the host set, appending "..." if TARGSTR is too |
258 | long to fit. Using the static buffer assumes the function is |
259 | not called in between sequence points (which it isn't). */ |
260 | for (char *ph = hostr; ; ++targstr) |
261 | { |
262 | *ph++ = target_to_host (ch: *targstr); |
263 | if (!*targstr) |
264 | break; |
265 | |
266 | if (size_t (ph - hostr) == hostsz) |
267 | { |
268 | strcpy (dest: ph - 4, src: "..." ); |
269 | break; |
270 | } |
271 | } |
272 | |
273 | return hostr; |
274 | } |
275 | |
276 | /* Convert the sequence of decimal digits in the execution character |
277 | starting at *PS to a HOST_WIDE_INT, analogously to strtol. Return |
278 | the result and set *PS to one past the last converted character. |
279 | On range error set ERANGE to the digit that caused it. */ |
280 | |
281 | static inline HOST_WIDE_INT |
282 | target_strtowi (const char **ps, const char **erange) |
283 | { |
284 | unsigned HOST_WIDE_INT val = 0; |
285 | for ( ; ; ++*ps) |
286 | { |
287 | unsigned char c = target_to_host (ch: **ps); |
288 | if (ISDIGIT (c)) |
289 | { |
290 | c -= '0'; |
291 | |
292 | /* Check for overflow. */ |
293 | if (val > ((unsigned HOST_WIDE_INT) HOST_WIDE_INT_MAX - c) / 10LU) |
294 | { |
295 | val = HOST_WIDE_INT_MAX; |
296 | *erange = *ps; |
297 | |
298 | /* Skip the remaining digits. */ |
299 | do |
300 | c = target_to_host (ch: *++*ps); |
301 | while (ISDIGIT (c)); |
302 | break; |
303 | } |
304 | else |
305 | val = val * 10 + c; |
306 | } |
307 | else |
308 | break; |
309 | } |
310 | |
311 | return val; |
312 | } |
313 | |
314 | /* Given FORMAT, set *PLOC to the source location of the format string |
315 | and return the format string if it is known or null otherwise. */ |
316 | |
317 | static const char* |
318 | get_format_string (tree format, location_t *ploc) |
319 | { |
320 | *ploc = EXPR_LOC_OR_LOC (format, input_location); |
321 | |
322 | return c_getstr (format); |
323 | } |
324 | |
325 | /* For convenience and brevity, shorter named entrypoints of |
326 | format_string_diagnostic_t::emit_warning_va and |
327 | format_string_diagnostic_t::emit_warning_n_va. |
328 | These have to be functions with the attribute so that exgettext |
329 | works properly. */ |
330 | |
331 | static bool |
332 | ATTRIBUTE_GCC_DIAG (5, 6) |
333 | fmtwarn (const substring_loc &fmt_loc, location_t param_loc, |
334 | const char *corrected_substring, opt_code opt, |
335 | const char *gmsgid, ...) |
336 | { |
337 | format_string_diagnostic_t diag (fmt_loc, NULL, param_loc, NULL, |
338 | corrected_substring); |
339 | va_list ap; |
340 | va_start (ap, gmsgid); |
341 | bool warned = diag.emit_warning_va (opt, gmsgid, ap: &ap); |
342 | va_end (ap); |
343 | |
344 | return warned; |
345 | } |
346 | |
347 | static bool |
348 | ATTRIBUTE_GCC_DIAG (6, 8) ATTRIBUTE_GCC_DIAG (7, 8) |
349 | fmtwarn_n (const substring_loc &fmt_loc, location_t param_loc, |
350 | const char *corrected_substring, opt_code opt, |
351 | unsigned HOST_WIDE_INT n, |
352 | const char *singular_gmsgid, const char *plural_gmsgid, ...) |
353 | { |
354 | format_string_diagnostic_t diag (fmt_loc, NULL, param_loc, NULL, |
355 | corrected_substring); |
356 | va_list ap; |
357 | va_start (ap, plural_gmsgid); |
358 | bool warned = diag.emit_warning_n_va (opt, n, singular_gmsgid, plural_gmsgid, |
359 | ap: &ap); |
360 | va_end (ap); |
361 | |
362 | return warned; |
363 | } |
364 | |
365 | /* Format length modifiers. */ |
366 | |
367 | enum format_lengths |
368 | { |
369 | FMT_LEN_none, |
370 | FMT_LEN_hh, // char argument |
371 | FMT_LEN_h, // short |
372 | FMT_LEN_l, // long |
373 | FMT_LEN_ll, // long long |
374 | FMT_LEN_L, // long double (and GNU long long) |
375 | FMT_LEN_z, // size_t |
376 | FMT_LEN_t, // ptrdiff_t |
377 | FMT_LEN_j // intmax_t |
378 | }; |
379 | |
380 | |
381 | /* Description of the result of conversion either of a single directive |
382 | or the whole format string. */ |
383 | |
384 | class fmtresult |
385 | { |
386 | public: |
387 | /* Construct a FMTRESULT object with all counters initialized |
388 | to MIN. KNOWNRANGE is set when MIN is valid. */ |
389 | fmtresult (unsigned HOST_WIDE_INT min = HOST_WIDE_INT_MAX) |
390 | : argmin (), argmax (), dst_offset (HOST_WIDE_INT_MIN), nonstr (), |
391 | knownrange (min < HOST_WIDE_INT_MAX), |
392 | mayfail (), nullp () |
393 | { |
394 | range.min = min; |
395 | range.max = min; |
396 | range.likely = min; |
397 | range.unlikely = min; |
398 | } |
399 | |
400 | /* Construct a FMTRESULT object with MIN, MAX, and LIKELY counters. |
401 | KNOWNRANGE is set when both MIN and MAX are valid. */ |
402 | fmtresult (unsigned HOST_WIDE_INT min, unsigned HOST_WIDE_INT max, |
403 | unsigned HOST_WIDE_INT likely = HOST_WIDE_INT_MAX) |
404 | : argmin (), argmax (), dst_offset (HOST_WIDE_INT_MIN), nonstr (), |
405 | knownrange (min < HOST_WIDE_INT_MAX && max < HOST_WIDE_INT_MAX), |
406 | mayfail (), nullp () |
407 | { |
408 | range.min = min; |
409 | range.max = max; |
410 | range.likely = max < likely ? min : likely; |
411 | range.unlikely = max; |
412 | } |
413 | |
414 | /* Adjust result upward to reflect the RANGE of values the specified |
415 | width or precision is known to be in. */ |
416 | fmtresult& adjust_for_width_or_precision (const HOST_WIDE_INT[2], |
417 | tree = NULL_TREE, |
418 | unsigned = 0, unsigned = 0); |
419 | |
420 | /* Return the maximum number of decimal digits a value of TYPE |
421 | formats as on output. */ |
422 | static unsigned type_max_digits (tree, int); |
423 | |
424 | /* The range a directive's argument is in. */ |
425 | tree argmin, argmax; |
426 | |
427 | /* The starting offset into the destination of the formatted function |
428 | call of the %s argument that points into (aliases with) the same |
429 | destination array. */ |
430 | HOST_WIDE_INT dst_offset; |
431 | |
432 | /* The minimum and maximum number of bytes that a directive |
433 | results in on output for an argument in the range above. */ |
434 | result_range range; |
435 | |
436 | /* Non-nul when the argument of a string directive is not a nul |
437 | terminated string. */ |
438 | tree nonstr; |
439 | |
440 | /* True when the range above is obtained from a known value of |
441 | a directive's argument or its bounds and not the result of |
442 | heuristics that depend on warning levels. */ |
443 | bool knownrange; |
444 | |
445 | /* True for a directive that may fail (such as wide character |
446 | directives). */ |
447 | bool mayfail; |
448 | |
449 | /* True when the argument is a null pointer. */ |
450 | bool nullp; |
451 | }; |
452 | |
453 | /* Adjust result upward to reflect the range ADJUST of values the |
454 | specified width or precision is known to be in. When non-null, |
455 | TYPE denotes the type of the directive whose result is being |
456 | adjusted, BASE gives the base of the directive (octal, decimal, |
457 | or hex), and ADJ denotes the additional adjustment to the LIKELY |
458 | counter that may need to be added when ADJUST is a range. */ |
459 | |
460 | fmtresult& |
461 | fmtresult::adjust_for_width_or_precision (const HOST_WIDE_INT adjust[2], |
462 | tree type /* = NULL_TREE */, |
463 | unsigned base /* = 0 */, |
464 | unsigned adj /* = 0 */) |
465 | { |
466 | bool minadjusted = false; |
467 | |
468 | /* Adjust the minimum and likely counters. */ |
469 | if (adjust[0] >= 0) |
470 | { |
471 | if (range.min < (unsigned HOST_WIDE_INT)adjust[0]) |
472 | { |
473 | range.min = adjust[0]; |
474 | minadjusted = true; |
475 | } |
476 | |
477 | /* Adjust the likely counter. */ |
478 | if (range.likely < range.min) |
479 | range.likely = range.min; |
480 | } |
481 | else if (adjust[0] == target_int_min () |
482 | && (unsigned HOST_WIDE_INT)adjust[1] == target_int_max ()) |
483 | knownrange = false; |
484 | |
485 | /* Adjust the maximum counter. */ |
486 | if (adjust[1] > 0) |
487 | { |
488 | if (range.max < (unsigned HOST_WIDE_INT)adjust[1]) |
489 | { |
490 | range.max = adjust[1]; |
491 | |
492 | /* Set KNOWNRANGE if both the minimum and maximum have been |
493 | adjusted. Otherwise leave it at what it was before. */ |
494 | knownrange = minadjusted; |
495 | } |
496 | } |
497 | |
498 | if (warn_level > 1 && type) |
499 | { |
500 | /* For large non-constant width or precision whose range spans |
501 | the maximum number of digits produced by the directive for |
502 | any argument, set the likely number of bytes to be at most |
503 | the number digits plus other adjustment determined by the |
504 | caller (one for sign or two for the hexadecimal "0x" |
505 | prefix). */ |
506 | unsigned dirdigs = type_max_digits (type, base); |
507 | if (adjust[0] < dirdigs && dirdigs < adjust[1] |
508 | && range.likely < dirdigs) |
509 | range.likely = dirdigs + adj; |
510 | } |
511 | else if (range.likely < (range.min ? range.min : 1)) |
512 | { |
513 | /* Conservatively, set LIKELY to at least MIN but no less than |
514 | 1 unless MAX is zero. */ |
515 | range.likely = (range.min |
516 | ? range.min |
517 | : range.max && (range.max < HOST_WIDE_INT_MAX |
518 | || warn_level > 1) ? 1 : 0); |
519 | } |
520 | |
521 | /* Finally adjust the unlikely counter to be at least as large as |
522 | the maximum. */ |
523 | if (range.unlikely < range.max) |
524 | range.unlikely = range.max; |
525 | |
526 | return *this; |
527 | } |
528 | |
529 | /* Return the maximum number of digits a value of TYPE formats in |
530 | BASE on output, not counting base prefix . */ |
531 | |
532 | unsigned |
533 | fmtresult::type_max_digits (tree type, int base) |
534 | { |
535 | unsigned prec = TYPE_PRECISION (type); |
536 | switch (base) |
537 | { |
538 | case 2: |
539 | return prec; |
540 | case 8: |
541 | return (prec + 2) / 3; |
542 | case 10: |
543 | /* Decimal approximation: yields 3, 5, 10, and 20 for precision |
544 | of 8, 16, 32, and 64 bits. */ |
545 | return prec * 301 / 1000 + 1; |
546 | case 16: |
547 | return prec / 4; |
548 | } |
549 | |
550 | gcc_unreachable (); |
551 | } |
552 | |
553 | static bool |
554 | get_int_range (tree, gimple *, HOST_WIDE_INT *, HOST_WIDE_INT *, |
555 | bool, HOST_WIDE_INT, range_query *); |
556 | |
557 | struct call_info; |
558 | |
559 | /* Description of a format directive. A directive is either a plain |
560 | string or a conversion specification that starts with '%'. */ |
561 | |
562 | struct directive |
563 | { |
564 | directive (const call_info *inf, unsigned dno) |
565 | : info (inf), dirno (dno), argno (), beg (), len (), flags (), |
566 | width (), prec (), modifier (), specifier (), arg (), fmtfunc () |
567 | { } |
568 | |
569 | /* Reference to the info structure describing the call that this |
570 | directive is a part of. */ |
571 | const call_info *info; |
572 | |
573 | /* The 1-based directive number (for debugging). */ |
574 | unsigned dirno; |
575 | |
576 | /* The zero-based argument number of the directive's argument ARG in |
577 | the function's argument list. */ |
578 | unsigned argno; |
579 | |
580 | /* The first character of the directive and its length. */ |
581 | const char *beg; |
582 | size_t len; |
583 | |
584 | /* A bitmap of flags, one for each character. */ |
585 | unsigned flags[256 / sizeof (int)]; |
586 | |
587 | /* The range of values of the specified width, or -1 if not specified. */ |
588 | HOST_WIDE_INT width[2]; |
589 | /* The range of values of the specified precision, or -1 if not |
590 | specified. */ |
591 | HOST_WIDE_INT prec[2]; |
592 | |
593 | /* Length modifier. */ |
594 | format_lengths modifier; |
595 | |
596 | /* Format specifier character. */ |
597 | char specifier; |
598 | |
599 | /* The argument of the directive or null when the directive doesn't |
600 | take one or when none is available (such as for vararg functions). */ |
601 | tree arg; |
602 | |
603 | /* Format conversion function that given a directive and an argument |
604 | returns the formatting result. */ |
605 | fmtresult (*fmtfunc) (const directive &, tree, pointer_query &); |
606 | |
607 | /* Return True when the format flag CHR has been used. */ |
608 | bool get_flag (char chr) const |
609 | { |
610 | unsigned char c = chr & 0xff; |
611 | return (flags[c / (CHAR_BIT * sizeof *flags)] |
612 | & (1U << (c % (CHAR_BIT * sizeof *flags)))); |
613 | } |
614 | |
615 | /* Make a record of the format flag CHR having been used. */ |
616 | void set_flag (char chr) |
617 | { |
618 | unsigned char c = chr & 0xff; |
619 | flags[c / (CHAR_BIT * sizeof *flags)] |
620 | |= (1U << (c % (CHAR_BIT * sizeof *flags))); |
621 | } |
622 | |
623 | /* Reset the format flag CHR. */ |
624 | void clear_flag (char chr) |
625 | { |
626 | unsigned char c = chr & 0xff; |
627 | flags[c / (CHAR_BIT * sizeof *flags)] |
628 | &= ~(1U << (c % (CHAR_BIT * sizeof *flags))); |
629 | } |
630 | |
631 | /* Set both bounds of the width range to VAL. */ |
632 | void set_width (HOST_WIDE_INT val) |
633 | { |
634 | width[0] = width[1] = val; |
635 | } |
636 | |
637 | /* Set the width range according to ARG, with both bounds being |
638 | no less than 0. For a constant ARG set both bounds to its value |
639 | or 0, whichever is greater. For a non-constant ARG in some range |
640 | set width to its range adjusting each bound to -1 if it's less. |
641 | For an indeterminate ARG set width to [0, INT_MAX]. */ |
642 | void set_width (tree arg, range_query *); |
643 | |
644 | /* Set both bounds of the precision range to VAL. */ |
645 | void set_precision (HOST_WIDE_INT val) |
646 | { |
647 | prec[0] = prec[1] = val; |
648 | } |
649 | |
650 | /* Set the precision range according to ARG, with both bounds being |
651 | no less than -1. For a constant ARG set both bounds to its value |
652 | or -1 whichever is greater. For a non-constant ARG in some range |
653 | set precision to its range adjusting each bound to -1 if it's less. |
654 | For an indeterminate ARG set precision to [-1, INT_MAX]. */ |
655 | void set_precision (tree arg, range_query *query); |
656 | |
657 | /* Return true if both width and precision are known to be |
658 | either constant or in some range, false otherwise. */ |
659 | bool known_width_and_precision () const |
660 | { |
661 | return ((width[1] < 0 |
662 | || (unsigned HOST_WIDE_INT)width[1] <= target_int_max ()) |
663 | && (prec[1] < 0 |
664 | || (unsigned HOST_WIDE_INT)prec[1] < target_int_max ())); |
665 | } |
666 | }; |
667 | |
668 | /* The result of a call to a formatted function. */ |
669 | |
670 | struct format_result |
671 | { |
672 | format_result () |
673 | : range (), aliases (), alias_count (), knownrange (), posunder4k (), |
674 | floating (), warned () { /* No-op. */ } |
675 | |
676 | ~format_result () |
677 | { |
678 | XDELETEVEC (aliases); |
679 | } |
680 | |
681 | /* Range of characters written by the formatted function. |
682 | Setting the minimum to HOST_WIDE_INT_MAX disables all |
683 | length tracking for the remainder of the format string. */ |
684 | result_range range; |
685 | |
686 | struct alias_info |
687 | { |
688 | directive dir; /* The directive that aliases the destination. */ |
689 | HOST_WIDE_INT offset; /* The offset at which it aliases it. */ |
690 | result_range range; /* The raw result of the directive. */ |
691 | }; |
692 | |
693 | /* An array of directives whose pointer argument aliases a part |
694 | of the destination object of the formatted function. */ |
695 | alias_info *aliases; |
696 | unsigned alias_count; |
697 | |
698 | /* True when the range above is obtained from known values of |
699 | directive arguments, or bounds on the amount of output such |
700 | as width and precision, and not the result of heuristics that |
701 | depend on warning levels. It's used to issue stricter diagnostics |
702 | in cases where strings of unknown lengths are bounded by the arrays |
703 | they are determined to refer to. KNOWNRANGE must not be used for |
704 | the return value optimization. */ |
705 | bool knownrange; |
706 | |
707 | /* True if no individual directive could fail or result in more than |
708 | 4095 bytes of output (the total NUMBER_CHARS_{MIN,MAX} might be |
709 | greater). Implementations are not required to handle directives |
710 | that produce more than 4K bytes (leading to undefined behavior) |
711 | and so when one is found it disables the return value optimization. |
712 | Similarly, directives that can fail (such as wide character |
713 | directives) disable the optimization. */ |
714 | bool posunder4k; |
715 | |
716 | /* True when a floating point directive has been seen in the format |
717 | string. */ |
718 | bool floating; |
719 | |
720 | /* True when an intermediate result has caused a warning. Used to |
721 | avoid issuing duplicate warnings while finishing the processing |
722 | of a call. WARNED also disables the return value optimization. */ |
723 | bool warned; |
724 | |
725 | /* Preincrement the number of output characters by 1. */ |
726 | format_result& operator++ () |
727 | { |
728 | return *this += 1; |
729 | } |
730 | |
731 | /* Postincrement the number of output characters by 1. */ |
732 | format_result operator++ (int) |
733 | { |
734 | format_result prev (*this); |
735 | *this += 1; |
736 | return prev; |
737 | } |
738 | |
739 | /* Increment the number of output characters by N. */ |
740 | format_result& operator+= (unsigned HOST_WIDE_INT); |
741 | |
742 | /* Add a directive to the sequence of those with potentially aliasing |
743 | arguments. */ |
744 | void append_alias (const directive &, HOST_WIDE_INT, const result_range &); |
745 | |
746 | private: |
747 | /* Not copyable or assignable. */ |
748 | format_result (format_result&); |
749 | void operator= (format_result&); |
750 | }; |
751 | |
752 | format_result& |
753 | format_result::operator+= (unsigned HOST_WIDE_INT n) |
754 | { |
755 | gcc_assert (n < HOST_WIDE_INT_MAX); |
756 | |
757 | if (range.min < HOST_WIDE_INT_MAX) |
758 | range.min += n; |
759 | |
760 | if (range.max < HOST_WIDE_INT_MAX) |
761 | range.max += n; |
762 | |
763 | if (range.likely < HOST_WIDE_INT_MAX) |
764 | range.likely += n; |
765 | |
766 | if (range.unlikely < HOST_WIDE_INT_MAX) |
767 | range.unlikely += n; |
768 | |
769 | return *this; |
770 | } |
771 | |
772 | void |
773 | format_result::append_alias (const directive &d, HOST_WIDE_INT off, |
774 | const result_range &resrng) |
775 | { |
776 | unsigned cnt = alias_count + 1; |
777 | alias_info *ar = XNEWVEC (alias_info, cnt); |
778 | |
779 | for (unsigned i = 0; i != alias_count; ++i) |
780 | ar[i] = aliases[i]; |
781 | |
782 | ar[alias_count].dir = d; |
783 | ar[alias_count].offset = off; |
784 | ar[alias_count].range = resrng; |
785 | |
786 | XDELETEVEC (aliases); |
787 | |
788 | alias_count = cnt; |
789 | aliases = ar; |
790 | } |
791 | |
792 | /* Return the logarithm of X in BASE. */ |
793 | |
794 | static int |
795 | ilog (unsigned HOST_WIDE_INT x, int base) |
796 | { |
797 | int res = 0; |
798 | do |
799 | { |
800 | ++res; |
801 | x /= base; |
802 | } while (x); |
803 | return res; |
804 | } |
805 | |
806 | /* Return the number of bytes resulting from converting into a string |
807 | the INTEGER_CST tree node X in BASE with a minimum of PREC digits. |
808 | PLUS indicates whether 1 for a plus sign should be added for positive |
809 | numbers, and PREFIX whether the length of an octal ('0') or hexadecimal |
810 | ('0x') or binary ('0b') prefix should be added for nonzero numbers. |
811 | Return -1 if X cannot be represented. */ |
812 | |
813 | static HOST_WIDE_INT |
814 | tree_digits (tree x, int base, HOST_WIDE_INT prec, bool plus, bool prefix) |
815 | { |
816 | unsigned HOST_WIDE_INT absval; |
817 | |
818 | HOST_WIDE_INT res; |
819 | |
820 | if (TYPE_UNSIGNED (TREE_TYPE (x))) |
821 | { |
822 | if (tree_fits_uhwi_p (x)) |
823 | { |
824 | absval = tree_to_uhwi (x); |
825 | res = plus; |
826 | } |
827 | else |
828 | return -1; |
829 | } |
830 | else |
831 | { |
832 | if (tree_fits_shwi_p (x)) |
833 | { |
834 | HOST_WIDE_INT i = tree_to_shwi (x); |
835 | if (HOST_WIDE_INT_MIN == i) |
836 | { |
837 | /* Avoid undefined behavior due to negating a minimum. */ |
838 | absval = HOST_WIDE_INT_MAX; |
839 | res = 1; |
840 | } |
841 | else if (i < 0) |
842 | { |
843 | absval = -i; |
844 | res = 1; |
845 | } |
846 | else |
847 | { |
848 | absval = i; |
849 | res = plus; |
850 | } |
851 | } |
852 | else |
853 | return -1; |
854 | } |
855 | |
856 | int ndigs = ilog (x: absval, base); |
857 | |
858 | res += prec < ndigs ? ndigs : prec; |
859 | |
860 | /* Adjust a non-zero value for the base prefix, either hexadecimal, |
861 | or, unless precision has resulted in a leading zero, also octal. */ |
862 | if (prefix && absval) |
863 | { |
864 | if (base == 8 && prec <= ndigs) |
865 | res += 1; |
866 | else if (base == 16 || base == 2) /* 0x...(0X...) or 0b...(0B...). */ |
867 | res += 2; |
868 | } |
869 | |
870 | return res; |
871 | } |
872 | |
873 | /* Description of a call to a formatted function. */ |
874 | |
875 | struct call_info |
876 | { |
877 | /* Function call statement. */ |
878 | gimple *callstmt; |
879 | |
880 | /* Function called. */ |
881 | tree func; |
882 | |
883 | /* Called built-in function code. */ |
884 | built_in_function fncode; |
885 | |
886 | /* The "origin" of the destination pointer argument, which is either |
887 | the DECL of the destination buffer being written into or a pointer |
888 | that points to it, plus some offset. */ |
889 | tree dst_origin; |
890 | |
891 | /* For a destination pointing to a struct array member, the offset of |
892 | the member. */ |
893 | HOST_WIDE_INT dst_field; |
894 | |
895 | /* The offset into the destination buffer. */ |
896 | HOST_WIDE_INT dst_offset; |
897 | |
898 | /* Format argument and format string extracted from it. */ |
899 | tree format; |
900 | const char *fmtstr; |
901 | |
902 | /* The location of the format argument. */ |
903 | location_t fmtloc; |
904 | |
905 | /* The destination object size for __builtin___xxx_chk functions |
906 | typically determined by __builtin_object_size, or -1 if unknown. */ |
907 | unsigned HOST_WIDE_INT objsize; |
908 | |
909 | /* Number of the first variable argument. */ |
910 | unsigned HOST_WIDE_INT argidx; |
911 | |
912 | /* True for functions like snprintf that specify the size of |
913 | the destination, false for others like sprintf that don't. */ |
914 | bool bounded; |
915 | |
916 | /* True for bounded functions like snprintf that specify a zero-size |
917 | buffer as a request to compute the size of output without actually |
918 | writing any. NOWRITE is cleared in response to the %n directive |
919 | which has side-effects similar to writing output. */ |
920 | bool nowrite; |
921 | |
922 | /* Return true if the called function's return value is used. */ |
923 | bool retval_used () const |
924 | { |
925 | return gimple_get_lhs (callstmt); |
926 | } |
927 | |
928 | /* Return the warning option corresponding to the called function. */ |
929 | opt_code warnopt () const |
930 | { |
931 | return bounded ? OPT_Wformat_truncation_ : OPT_Wformat_overflow_; |
932 | } |
933 | |
934 | /* Return true for calls to file formatted functions. */ |
935 | bool is_file_func () const |
936 | { |
937 | return (fncode == BUILT_IN_FPRINTF |
938 | || fncode == BUILT_IN_FPRINTF_CHK |
939 | || fncode == BUILT_IN_FPRINTF_UNLOCKED |
940 | || fncode == BUILT_IN_VFPRINTF |
941 | || fncode == BUILT_IN_VFPRINTF_CHK); |
942 | } |
943 | |
944 | /* Return true for calls to string formatted functions. */ |
945 | bool is_string_func () const |
946 | { |
947 | return (fncode == BUILT_IN_SPRINTF |
948 | || fncode == BUILT_IN_SPRINTF_CHK |
949 | || fncode == BUILT_IN_SNPRINTF |
950 | || fncode == BUILT_IN_SNPRINTF_CHK |
951 | || fncode == BUILT_IN_VSPRINTF |
952 | || fncode == BUILT_IN_VSPRINTF_CHK |
953 | || fncode == BUILT_IN_VSNPRINTF |
954 | || fncode == BUILT_IN_VSNPRINTF_CHK); |
955 | } |
956 | }; |
957 | |
958 | void |
959 | directive::set_width (tree arg, range_query *query) |
960 | { |
961 | get_int_range (arg, info->callstmt, width, width + 1, true, 0, query); |
962 | } |
963 | |
964 | void |
965 | directive::set_precision (tree arg, range_query *query) |
966 | { |
967 | get_int_range (arg, info->callstmt, prec, prec + 1, false, -1, query); |
968 | } |
969 | |
970 | /* Return the result of formatting a no-op directive (such as '%n'). */ |
971 | |
972 | static fmtresult |
973 | format_none (const directive &, tree, pointer_query &) |
974 | { |
975 | fmtresult res (0); |
976 | return res; |
977 | } |
978 | |
979 | /* Return the result of formatting the '%%' directive. */ |
980 | |
981 | static fmtresult |
982 | format_percent (const directive &, tree, pointer_query &) |
983 | { |
984 | fmtresult res (1); |
985 | return res; |
986 | } |
987 | |
988 | |
989 | /* Compute intmax_type_node and uintmax_type_node similarly to how |
990 | tree.cc builds size_type_node. */ |
991 | |
992 | static void |
993 | build_intmax_type_nodes (tree *pintmax, tree *puintmax) |
994 | { |
995 | if (strcmp (UINTMAX_TYPE, s2: "unsigned int" ) == 0) |
996 | { |
997 | *pintmax = integer_type_node; |
998 | *puintmax = unsigned_type_node; |
999 | } |
1000 | else if (strcmp (UINTMAX_TYPE, s2: "long unsigned int" ) == 0) |
1001 | { |
1002 | *pintmax = long_integer_type_node; |
1003 | *puintmax = long_unsigned_type_node; |
1004 | } |
1005 | else if (strcmp (UINTMAX_TYPE, s2: "long long unsigned int" ) == 0) |
1006 | { |
1007 | *pintmax = long_long_integer_type_node; |
1008 | *puintmax = long_long_unsigned_type_node; |
1009 | } |
1010 | else |
1011 | { |
1012 | for (int i = 0; i < NUM_INT_N_ENTS; i++) |
1013 | if (int_n_enabled_p[i]) |
1014 | { |
1015 | char name[50], altname[50]; |
1016 | sprintf (s: name, format: "__int%d unsigned" , int_n_data[i].bitsize); |
1017 | sprintf (s: altname, format: "__int%d__ unsigned" , int_n_data[i].bitsize); |
1018 | |
1019 | if (strcmp (s1: name, UINTMAX_TYPE) == 0 |
1020 | || strcmp (s1: altname, UINTMAX_TYPE) == 0) |
1021 | { |
1022 | *pintmax = int_n_trees[i].signed_type; |
1023 | *puintmax = int_n_trees[i].unsigned_type; |
1024 | return; |
1025 | } |
1026 | } |
1027 | gcc_unreachable (); |
1028 | } |
1029 | } |
1030 | |
1031 | /* Determine the range [*PMIN, *PMAX] that the expression ARG is |
1032 | in and that is representable in type int. |
1033 | Return true when the range is a subrange of that of int. |
1034 | When ARG is null it is as if it had the full range of int. |
1035 | When ABSOLUTE is true the range reflects the absolute value of |
1036 | the argument. When ABSOLUTE is false, negative bounds of |
1037 | the determined range are replaced with NEGBOUND. */ |
1038 | |
1039 | static bool |
1040 | get_int_range (tree arg, gimple *stmt, |
1041 | HOST_WIDE_INT *pmin, HOST_WIDE_INT *pmax, |
1042 | bool absolute, HOST_WIDE_INT negbound, |
1043 | range_query *query) |
1044 | { |
1045 | /* The type of the result. */ |
1046 | const_tree type = integer_type_node; |
1047 | |
1048 | bool knownrange = false; |
1049 | |
1050 | if (!arg) |
1051 | { |
1052 | *pmin = tree_to_shwi (TYPE_MIN_VALUE (type)); |
1053 | *pmax = tree_to_shwi (TYPE_MAX_VALUE (type)); |
1054 | } |
1055 | else if (TREE_CODE (arg) == INTEGER_CST |
1056 | && TYPE_PRECISION (TREE_TYPE (arg)) <= TYPE_PRECISION (type)) |
1057 | { |
1058 | /* For a constant argument return its value adjusted as specified |
1059 | by NEGATIVE and NEGBOUND and return true to indicate that the |
1060 | result is known. */ |
1061 | *pmin = tree_fits_shwi_p (arg) ? tree_to_shwi (arg) : tree_to_uhwi (arg); |
1062 | *pmax = *pmin; |
1063 | knownrange = true; |
1064 | } |
1065 | else |
1066 | { |
1067 | /* True if the argument's range cannot be determined. */ |
1068 | bool unknown = true; |
1069 | |
1070 | tree argtype = TREE_TYPE (arg); |
1071 | |
1072 | /* Ignore invalid arguments with greater precision that that |
1073 | of the expected type (e.g., in sprintf("%*i", 12LL, i)). |
1074 | They will have been detected and diagnosed by -Wformat and |
1075 | so it's not important to complicate this code to try to deal |
1076 | with them again. */ |
1077 | if (TREE_CODE (arg) == SSA_NAME |
1078 | && INTEGRAL_TYPE_P (argtype) |
1079 | && TYPE_PRECISION (argtype) <= TYPE_PRECISION (type)) |
1080 | { |
1081 | /* Try to determine the range of values of the integer argument. */ |
1082 | value_range vr; |
1083 | query->range_of_expr (r&: vr, expr: arg, stmt); |
1084 | |
1085 | if (!vr.undefined_p () && !vr.varying_p ()) |
1086 | { |
1087 | HOST_WIDE_INT type_min |
1088 | = (TYPE_UNSIGNED (argtype) |
1089 | ? tree_to_uhwi (TYPE_MIN_VALUE (argtype)) |
1090 | : tree_to_shwi (TYPE_MIN_VALUE (argtype))); |
1091 | |
1092 | HOST_WIDE_INT type_max = tree_to_uhwi (TYPE_MAX_VALUE (argtype)); |
1093 | |
1094 | tree type = TREE_TYPE (arg); |
1095 | tree tmin = wide_int_to_tree (type, cst: vr.lower_bound ()); |
1096 | tree tmax = wide_int_to_tree (type, cst: vr.upper_bound ()); |
1097 | *pmin = TREE_INT_CST_LOW (tmin); |
1098 | *pmax = TREE_INT_CST_LOW (tmax); |
1099 | |
1100 | if (*pmin < *pmax) |
1101 | { |
1102 | /* Return true if the adjusted range is a subrange of |
1103 | the full range of the argument's type. *PMAX may |
1104 | be less than *PMIN when the argument is unsigned |
1105 | and its upper bound is in excess of TYPE_MAX. In |
1106 | that (invalid) case disregard the range and use that |
1107 | of the expected type instead. */ |
1108 | knownrange = type_min < *pmin || *pmax < type_max; |
1109 | |
1110 | unknown = false; |
1111 | } |
1112 | } |
1113 | } |
1114 | |
1115 | /* Handle an argument with an unknown range as if none had been |
1116 | provided. */ |
1117 | if (unknown) |
1118 | return get_int_range (NULL_TREE, NULL, pmin, pmax, absolute, |
1119 | negbound, query); |
1120 | } |
1121 | |
1122 | /* Adjust each bound as specified by ABSOLUTE and NEGBOUND. */ |
1123 | if (absolute) |
1124 | { |
1125 | if (*pmin < 0) |
1126 | { |
1127 | if (*pmin == *pmax) |
1128 | *pmin = *pmax = -*pmin; |
1129 | else |
1130 | { |
1131 | /* Make sure signed overlow is avoided. */ |
1132 | gcc_assert (*pmin != HOST_WIDE_INT_MIN); |
1133 | |
1134 | HOST_WIDE_INT tmp = -*pmin; |
1135 | *pmin = 0; |
1136 | if (*pmax < tmp) |
1137 | *pmax = tmp; |
1138 | } |
1139 | } |
1140 | } |
1141 | else if (*pmin < negbound) |
1142 | *pmin = negbound; |
1143 | |
1144 | return knownrange; |
1145 | } |
1146 | |
1147 | /* With the range [*ARGMIN, *ARGMAX] of an integer directive's actual |
1148 | argument, due to the conversion from either *ARGMIN or *ARGMAX to |
1149 | the type of the directive's formal argument it's possible for both |
1150 | to result in the same number of bytes or a range of bytes that's |
1151 | less than the number of bytes that would result from formatting |
1152 | some other value in the range [*ARGMIN, *ARGMAX]. This can be |
1153 | determined by checking for the actual argument being in the range |
1154 | of the type of the directive. If it isn't it must be assumed to |
1155 | take on the full range of the directive's type. |
1156 | Return true when the range has been adjusted to the full range |
1157 | of DIRTYPE, and false otherwise. */ |
1158 | |
1159 | static bool |
1160 | adjust_range_for_overflow (tree dirtype, tree *argmin, tree *argmax) |
1161 | { |
1162 | tree argtype = TREE_TYPE (*argmin); |
1163 | unsigned argprec = TYPE_PRECISION (argtype); |
1164 | unsigned dirprec = TYPE_PRECISION (dirtype); |
1165 | |
1166 | /* If the actual argument and the directive's argument have the same |
1167 | precision and sign there can be no overflow and so there is nothing |
1168 | to adjust. */ |
1169 | if (argprec == dirprec && TYPE_SIGN (argtype) == TYPE_SIGN (dirtype)) |
1170 | return false; |
1171 | |
1172 | /* The logic below was inspired/lifted from the CONVERT_EXPR_CODE_P |
1173 | branch in the extract_range_from_unary_expr function in tree-vrp.cc. */ |
1174 | |
1175 | if (TREE_CODE (*argmin) == INTEGER_CST |
1176 | && TREE_CODE (*argmax) == INTEGER_CST |
1177 | && (dirprec >= argprec |
1178 | || integer_zerop (int_const_binop (RSHIFT_EXPR, |
1179 | int_const_binop (MINUS_EXPR, |
1180 | *argmax, |
1181 | *argmin), |
1182 | size_int (dirprec))))) |
1183 | { |
1184 | unsigned int maxprec = MAX (argprec, dirprec); |
1185 | *argmin = force_fit_type (dirtype, |
1186 | wide_int::from (x: wi::to_wide (t: *argmin), precision: maxprec, |
1187 | TYPE_SIGN (argtype)), |
1188 | 0, false); |
1189 | *argmax = force_fit_type (dirtype, |
1190 | wide_int::from (x: wi::to_wide (t: *argmax), precision: maxprec, |
1191 | TYPE_SIGN (argtype)), |
1192 | 0, false); |
1193 | |
1194 | /* If *ARGMIN is still less than *ARGMAX the conversion above |
1195 | is safe. Otherwise, it has overflowed and would be unsafe. */ |
1196 | if (tree_int_cst_le (t1: *argmin, t2: *argmax)) |
1197 | return false; |
1198 | } |
1199 | |
1200 | *argmin = TYPE_MIN_VALUE (dirtype); |
1201 | *argmax = TYPE_MAX_VALUE (dirtype); |
1202 | return true; |
1203 | } |
1204 | |
1205 | /* Return a range representing the minimum and maximum number of bytes |
1206 | that the format directive DIR will output for any argument given |
1207 | the WIDTH and PRECISION (extracted from DIR). This function is |
1208 | used when the directive argument or its value isn't known. */ |
1209 | |
1210 | static fmtresult |
1211 | format_integer (const directive &dir, tree arg, pointer_query &ptr_qry) |
1212 | { |
1213 | tree intmax_type_node; |
1214 | tree uintmax_type_node; |
1215 | |
1216 | /* Base to format the number in. */ |
1217 | int base; |
1218 | |
1219 | /* True when a conversion is preceded by a prefix indicating the base |
1220 | of the argument (octal or hexadecimal). */ |
1221 | const bool maybebase = dir.get_flag (chr: '#'); |
1222 | |
1223 | /* True when a signed conversion is preceded by a sign or space. */ |
1224 | bool maybesign = false; |
1225 | |
1226 | /* True for signed conversions (i.e., 'd' and 'i'). */ |
1227 | bool sign = false; |
1228 | |
1229 | switch (dir.specifier) |
1230 | { |
1231 | case 'd': |
1232 | case 'i': |
1233 | /* Space and '+' are only meaningful for signed conversions. */ |
1234 | maybesign = dir.get_flag (chr: ' ') | dir.get_flag (chr: '+'); |
1235 | sign = true; |
1236 | base = 10; |
1237 | break; |
1238 | case 'u': |
1239 | base = 10; |
1240 | break; |
1241 | case 'b': |
1242 | case 'B': |
1243 | base = 2; |
1244 | break; |
1245 | case 'o': |
1246 | base = 8; |
1247 | break; |
1248 | case 'X': |
1249 | case 'x': |
1250 | base = 16; |
1251 | break; |
1252 | default: |
1253 | gcc_unreachable (); |
1254 | } |
1255 | |
1256 | const unsigned adj = (sign | maybebase) + (base == 2 || base == 16); |
1257 | |
1258 | /* The type of the "formal" argument expected by the directive. */ |
1259 | tree dirtype = NULL_TREE; |
1260 | |
1261 | /* Determine the expected type of the argument from the length |
1262 | modifier. */ |
1263 | switch (dir.modifier) |
1264 | { |
1265 | case FMT_LEN_none: |
1266 | if (dir.specifier == 'p') |
1267 | dirtype = ptr_type_node; |
1268 | else |
1269 | dirtype = sign ? integer_type_node : unsigned_type_node; |
1270 | break; |
1271 | |
1272 | case FMT_LEN_h: |
1273 | dirtype = sign ? short_integer_type_node : short_unsigned_type_node; |
1274 | break; |
1275 | |
1276 | case FMT_LEN_hh: |
1277 | dirtype = sign ? signed_char_type_node : unsigned_char_type_node; |
1278 | break; |
1279 | |
1280 | case FMT_LEN_l: |
1281 | dirtype = sign ? long_integer_type_node : long_unsigned_type_node; |
1282 | break; |
1283 | |
1284 | case FMT_LEN_L: |
1285 | case FMT_LEN_ll: |
1286 | dirtype = (sign |
1287 | ? long_long_integer_type_node |
1288 | : long_long_unsigned_type_node); |
1289 | break; |
1290 | |
1291 | case FMT_LEN_z: |
1292 | dirtype = signed_or_unsigned_type_for (!sign, size_type_node); |
1293 | break; |
1294 | |
1295 | case FMT_LEN_t: |
1296 | dirtype = signed_or_unsigned_type_for (!sign, ptrdiff_type_node); |
1297 | break; |
1298 | |
1299 | case FMT_LEN_j: |
1300 | build_intmax_type_nodes (pintmax: &intmax_type_node, puintmax: &uintmax_type_node); |
1301 | dirtype = sign ? intmax_type_node : uintmax_type_node; |
1302 | break; |
1303 | |
1304 | default: |
1305 | return fmtresult (); |
1306 | } |
1307 | |
1308 | /* The type of the argument to the directive, either deduced from |
1309 | the actual non-constant argument if one is known, or from |
1310 | the directive itself when none has been provided because it's |
1311 | a va_list. */ |
1312 | tree argtype = NULL_TREE; |
1313 | |
1314 | if (!arg) |
1315 | { |
1316 | /* When the argument has not been provided, use the type of |
1317 | the directive's argument as an approximation. This will |
1318 | result in false positives for directives like %i with |
1319 | arguments with smaller precision (such as short or char). */ |
1320 | argtype = dirtype; |
1321 | } |
1322 | else if (TREE_CODE (arg) == INTEGER_CST) |
1323 | { |
1324 | /* When a constant argument has been provided use its value |
1325 | rather than type to determine the length of the output. */ |
1326 | fmtresult res; |
1327 | |
1328 | if ((dir.prec[0] <= 0 && dir.prec[1] >= 0) && integer_zerop (arg)) |
1329 | { |
1330 | /* As a special case, a precision of zero with a zero argument |
1331 | results in zero bytes except in base 8 when the '#' flag is |
1332 | specified, and for signed conversions in base 8 and 10 when |
1333 | either the space or '+' flag has been specified and it results |
1334 | in just one byte (with width having the normal effect). This |
1335 | must extend to the case of a specified precision with |
1336 | an unknown value because it can be zero. */ |
1337 | res.range.min = ((base == 8 && dir.get_flag (chr: '#')) || maybesign); |
1338 | if (res.range.min == 0 && dir.prec[0] != dir.prec[1]) |
1339 | { |
1340 | res.range.max = 1; |
1341 | res.range.likely = 1; |
1342 | } |
1343 | else |
1344 | { |
1345 | res.range.max = res.range.min; |
1346 | res.range.likely = res.range.min; |
1347 | } |
1348 | } |
1349 | else |
1350 | { |
1351 | /* Convert the argument to the type of the directive. */ |
1352 | arg = fold_convert (dirtype, arg); |
1353 | |
1354 | res.range.min = tree_digits (x: arg, base, prec: dir.prec[0], |
1355 | plus: maybesign, prefix: maybebase); |
1356 | if (dir.prec[0] == dir.prec[1]) |
1357 | res.range.max = res.range.min; |
1358 | else |
1359 | res.range.max = tree_digits (x: arg, base, prec: dir.prec[1], |
1360 | plus: maybesign, prefix: maybebase); |
1361 | res.range.likely = res.range.min; |
1362 | res.knownrange = true; |
1363 | } |
1364 | |
1365 | res.range.unlikely = res.range.max; |
1366 | |
1367 | /* Bump up the counters if WIDTH is greater than LEN. */ |
1368 | res.adjust_for_width_or_precision (adjust: dir.width, type: dirtype, base, adj); |
1369 | /* Bump up the counters again if PRECision is greater still. */ |
1370 | res.adjust_for_width_or_precision (adjust: dir.prec, type: dirtype, base, adj); |
1371 | |
1372 | return res; |
1373 | } |
1374 | else if (INTEGRAL_TYPE_P (TREE_TYPE (arg)) |
1375 | || TREE_CODE (TREE_TYPE (arg)) == POINTER_TYPE) |
1376 | /* Determine the type of the provided non-constant argument. */ |
1377 | argtype = TREE_TYPE (arg); |
1378 | else |
1379 | /* Don't bother with invalid arguments since they likely would |
1380 | have already been diagnosed, and disable any further checking |
1381 | of the format string by returning [-1, -1]. */ |
1382 | return fmtresult (); |
1383 | |
1384 | fmtresult res; |
1385 | |
1386 | /* Using either the range the non-constant argument is in, or its |
1387 | type (either "formal" or actual), create a range of values that |
1388 | constrain the length of output given the warning level. */ |
1389 | tree argmin = NULL_TREE; |
1390 | tree argmax = NULL_TREE; |
1391 | |
1392 | if (arg |
1393 | && TREE_CODE (arg) == SSA_NAME |
1394 | && INTEGRAL_TYPE_P (argtype)) |
1395 | { |
1396 | /* Try to determine the range of values of the integer argument |
1397 | (range information is not available for pointers). */ |
1398 | value_range vr; |
1399 | ptr_qry.rvals->range_of_expr (r&: vr, expr: arg, dir.info->callstmt); |
1400 | |
1401 | if (!vr.varying_p () && !vr.undefined_p ()) |
1402 | { |
1403 | argmin = wide_int_to_tree (TREE_TYPE (arg), cst: vr.lower_bound ()); |
1404 | argmax = wide_int_to_tree (TREE_TYPE (arg), cst: vr.upper_bound ()); |
1405 | |
1406 | /* Set KNOWNRANGE if the argument is in a known subrange |
1407 | of the directive's type and neither width nor precision |
1408 | is unknown. (KNOWNRANGE may be reset below). */ |
1409 | res.knownrange |
1410 | = ((!tree_int_cst_equal (TYPE_MIN_VALUE (dirtype), argmin) |
1411 | || !tree_int_cst_equal (TYPE_MAX_VALUE (dirtype), argmax)) |
1412 | && dir.known_width_and_precision ()); |
1413 | |
1414 | res.argmin = argmin; |
1415 | res.argmax = argmax; |
1416 | } |
1417 | else |
1418 | { |
1419 | /* The argument here may be the result of promoting the actual |
1420 | argument to int. Try to determine the type of the actual |
1421 | argument before promotion and narrow down its range that |
1422 | way. */ |
1423 | gimple *def = SSA_NAME_DEF_STMT (arg); |
1424 | if (is_gimple_assign (gs: def)) |
1425 | { |
1426 | tree_code code = gimple_assign_rhs_code (gs: def); |
1427 | if (code == INTEGER_CST) |
1428 | { |
1429 | arg = gimple_assign_rhs1 (gs: def); |
1430 | return format_integer (dir, arg, ptr_qry); |
1431 | } |
1432 | |
1433 | if (code == NOP_EXPR) |
1434 | { |
1435 | tree type = TREE_TYPE (gimple_assign_rhs1 (def)); |
1436 | if (INTEGRAL_TYPE_P (type) |
1437 | || TREE_CODE (type) == POINTER_TYPE) |
1438 | argtype = type; |
1439 | } |
1440 | } |
1441 | } |
1442 | } |
1443 | |
1444 | if (!argmin) |
1445 | { |
1446 | if (TREE_CODE (argtype) == POINTER_TYPE) |
1447 | { |
1448 | argmin = build_int_cst (pointer_sized_int_node, 0); |
1449 | argmax = build_all_ones_cst (pointer_sized_int_node); |
1450 | } |
1451 | else |
1452 | { |
1453 | argmin = TYPE_MIN_VALUE (argtype); |
1454 | argmax = TYPE_MAX_VALUE (argtype); |
1455 | } |
1456 | } |
1457 | |
1458 | /* Clear KNOWNRANGE if the range has been adjusted to the maximum |
1459 | of the directive. If it has been cleared then since ARGMIN and/or |
1460 | ARGMAX have been adjusted also adjust the corresponding ARGMIN and |
1461 | ARGMAX in the result to include in diagnostics. */ |
1462 | if (adjust_range_for_overflow (dirtype, argmin: &argmin, argmax: &argmax)) |
1463 | { |
1464 | res.knownrange = false; |
1465 | res.argmin = argmin; |
1466 | res.argmax = argmax; |
1467 | } |
1468 | |
1469 | /* Recursively compute the minimum and maximum from the known range. */ |
1470 | if (TYPE_UNSIGNED (dirtype) || tree_int_cst_sgn (argmin) >= 0) |
1471 | { |
1472 | /* For unsigned conversions/directives or signed when |
1473 | the minimum is positive, use the minimum and maximum to compute |
1474 | the shortest and longest output, respectively. */ |
1475 | res.range.min = format_integer (dir, arg: argmin, ptr_qry).range.min; |
1476 | res.range.max = format_integer (dir, arg: argmax, ptr_qry).range.max; |
1477 | } |
1478 | else if (tree_int_cst_sgn (argmax) < 0) |
1479 | { |
1480 | /* For signed conversions/directives if maximum is negative, |
1481 | use the minimum as the longest output and maximum as the |
1482 | shortest output. */ |
1483 | res.range.min = format_integer (dir, arg: argmax, ptr_qry).range.min; |
1484 | res.range.max = format_integer (dir, arg: argmin, ptr_qry).range.max; |
1485 | } |
1486 | else |
1487 | { |
1488 | /* Otherwise, 0 is inside of the range and minimum negative. Use 0 |
1489 | as the shortest output and for the longest output compute the |
1490 | length of the output of both minimum and maximum and pick the |
1491 | longer. */ |
1492 | unsigned HOST_WIDE_INT max1 |
1493 | = format_integer (dir, arg: argmin, ptr_qry).range.max; |
1494 | unsigned HOST_WIDE_INT max2 |
1495 | = format_integer (dir, arg: argmax, ptr_qry).range.max; |
1496 | res.range.min |
1497 | = format_integer (dir, integer_zero_node, ptr_qry).range.min; |
1498 | res.range.max = MAX (max1, max2); |
1499 | } |
1500 | |
1501 | /* If the range is known, use the maximum as the likely length. */ |
1502 | if (res.knownrange) |
1503 | res.range.likely = res.range.max; |
1504 | else |
1505 | { |
1506 | /* Otherwise, use the minimum. Except for the case where for %#x or |
1507 | %#o the minimum is just for a single value in the range (0) and |
1508 | for all other values it is something longer, like 0x1 or 01. |
1509 | Use the length for value 1 in that case instead as the likely |
1510 | length. */ |
1511 | res.range.likely = res.range.min; |
1512 | if (maybebase |
1513 | && base != 10 |
1514 | && (tree_int_cst_sgn (argmin) < 0 || tree_int_cst_sgn (argmax) > 0)) |
1515 | { |
1516 | if (res.range.min == 1) |
1517 | res.range.likely += base == 8 ? 1 : 2; |
1518 | else if (res.range.min == 2 |
1519 | && (base == 16 || base == 2) |
1520 | && (dir.width[0] == 2 || dir.prec[0] == 2)) |
1521 | ++res.range.likely; |
1522 | } |
1523 | } |
1524 | |
1525 | res.range.unlikely = res.range.max; |
1526 | res.adjust_for_width_or_precision (adjust: dir.width, type: dirtype, base, adj); |
1527 | res.adjust_for_width_or_precision (adjust: dir.prec, type: dirtype, base, adj); |
1528 | |
1529 | return res; |
1530 | } |
1531 | |
1532 | /* Return the number of bytes that a format directive consisting of FLAGS, |
1533 | PRECision, format SPECification, and MPFR rounding specifier RNDSPEC, |
1534 | would result for argument X under ideal conditions (i.e., if PREC |
1535 | weren't excessive). MPFR 3.1 allocates large amounts of memory for |
1536 | values of PREC with large magnitude and can fail (see MPFR bug #21056). |
1537 | This function works around those problems. */ |
1538 | |
1539 | static unsigned HOST_WIDE_INT |
1540 | get_mpfr_format_length (mpfr_ptr x, const char *flags, HOST_WIDE_INT prec, |
1541 | char spec, char rndspec) |
1542 | { |
1543 | char fmtstr[40]; |
1544 | |
1545 | HOST_WIDE_INT len = strlen (s: flags); |
1546 | |
1547 | fmtstr[0] = '%'; |
1548 | memcpy (dest: fmtstr + 1, src: flags, n: len); |
1549 | memcpy (dest: fmtstr + 1 + len, src: ".*R" , n: 3); |
1550 | fmtstr[len + 4] = rndspec; |
1551 | fmtstr[len + 5] = spec; |
1552 | fmtstr[len + 6] = '\0'; |
1553 | |
1554 | spec = TOUPPER (spec); |
1555 | if (spec == 'E' || spec == 'F') |
1556 | { |
1557 | /* For %e, specify the precision explicitly since mpfr_sprintf |
1558 | does its own thing just to be different (see MPFR bug 21088). */ |
1559 | if (prec < 0) |
1560 | prec = 6; |
1561 | } |
1562 | else |
1563 | { |
1564 | /* Avoid passing negative precisions with larger magnitude to MPFR |
1565 | to avoid exposing its bugs. (A negative precision is supposed |
1566 | to be ignored.) */ |
1567 | if (prec < 0) |
1568 | prec = -1; |
1569 | } |
1570 | |
1571 | HOST_WIDE_INT p = prec; |
1572 | |
1573 | if (spec == 'G' && !strchr (s: flags, c: '#')) |
1574 | { |
1575 | /* For G/g without the pound flag, precision gives the maximum number |
1576 | of significant digits which is bounded by LDBL_MAX_10_EXP, or, for |
1577 | a 128 bit IEEE extended precision, 4932. Using twice as much here |
1578 | should be more than sufficient for any real format. */ |
1579 | if ((IEEE_MAX_10_EXP * 2) < prec) |
1580 | prec = IEEE_MAX_10_EXP * 2; |
1581 | p = prec; |
1582 | } |
1583 | else |
1584 | { |
1585 | /* Cap precision arbitrarily at 1KB and add the difference |
1586 | (if any) to the MPFR result. */ |
1587 | if (prec > 1024) |
1588 | p = 1024; |
1589 | } |
1590 | |
1591 | len = mpfr_snprintf (NULL, 0, fmtstr, (int)p, x); |
1592 | |
1593 | /* Handle the unlikely (impossible?) error by returning more than |
1594 | the maximum dictated by the function's return type. */ |
1595 | if (len < 0) |
1596 | return target_dir_max () + 1; |
1597 | |
1598 | /* Adjust the return value by the difference. */ |
1599 | if (p < prec) |
1600 | len += prec - p; |
1601 | |
1602 | return len; |
1603 | } |
1604 | |
1605 | /* Return the number of bytes to format using the format specifier |
1606 | SPEC and the precision PREC the largest value in the real floating |
1607 | TYPE. */ |
1608 | |
1609 | static unsigned HOST_WIDE_INT |
1610 | format_floating_max (tree type, char spec, HOST_WIDE_INT prec) |
1611 | { |
1612 | machine_mode mode = TYPE_MODE (type); |
1613 | |
1614 | /* IBM Extended mode. */ |
1615 | if (MODE_COMPOSITE_P (mode)) |
1616 | mode = DFmode; |
1617 | |
1618 | /* Get the real type format description for the target. */ |
1619 | const real_format *rfmt = REAL_MODE_FORMAT (mode); |
1620 | REAL_VALUE_TYPE rv; |
1621 | |
1622 | real_maxval (&rv, 0, mode); |
1623 | |
1624 | /* Convert the GCC real value representation with the precision |
1625 | of the real type to the mpfr_t format with the GCC default |
1626 | round-to-nearest mode. */ |
1627 | mpfr_t x; |
1628 | mpfr_init2 (x, rfmt->p); |
1629 | mpfr_from_real (x, &rv, MPFR_RNDN); |
1630 | |
1631 | /* Return a value one greater to account for the leading minus sign. */ |
1632 | unsigned HOST_WIDE_INT r |
1633 | = 1 + get_mpfr_format_length (x, flags: "" , prec, spec, rndspec: 'D'); |
1634 | mpfr_clear (x); |
1635 | return r; |
1636 | } |
1637 | |
1638 | /* Return a range representing the minimum and maximum number of bytes |
1639 | that the directive DIR will output for any argument. PREC gives |
1640 | the adjusted precision range to account for negative precisions |
1641 | meaning the default 6. This function is used when the directive |
1642 | argument or its value isn't known. */ |
1643 | |
1644 | static fmtresult |
1645 | format_floating (const directive &dir, const HOST_WIDE_INT prec[2]) |
1646 | { |
1647 | tree type; |
1648 | |
1649 | switch (dir.modifier) |
1650 | { |
1651 | case FMT_LEN_l: |
1652 | case FMT_LEN_none: |
1653 | type = double_type_node; |
1654 | break; |
1655 | |
1656 | case FMT_LEN_L: |
1657 | type = long_double_type_node; |
1658 | break; |
1659 | |
1660 | case FMT_LEN_ll: |
1661 | type = long_double_type_node; |
1662 | break; |
1663 | |
1664 | default: |
1665 | return fmtresult (); |
1666 | } |
1667 | |
1668 | /* The minimum and maximum number of bytes produced by the directive. */ |
1669 | fmtresult res; |
1670 | |
1671 | /* The minimum output as determined by flags. It's always at least 1. |
1672 | When plus or space are set the output is preceded by either a sign |
1673 | or a space. */ |
1674 | unsigned flagmin = (1 /* for the first digit */ |
1675 | + (dir.get_flag (chr: '+') | dir.get_flag (chr: ' '))); |
1676 | |
1677 | /* The minimum is 3 for "inf" and "nan" for all specifiers, plus 1 |
1678 | for the plus sign/space with the '+' and ' ' flags, respectively, |
1679 | unless reduced below. */ |
1680 | res.range.min = 2 + flagmin; |
1681 | |
1682 | /* When the pound flag is set the decimal point is included in output |
1683 | regardless of precision. Whether or not a decimal point is included |
1684 | otherwise depends on the specification and precision. */ |
1685 | bool radix = dir.get_flag (chr: '#'); |
1686 | |
1687 | switch (dir.specifier) |
1688 | { |
1689 | case 'A': |
1690 | case 'a': |
1691 | { |
1692 | HOST_WIDE_INT minprec = 6 + !radix /* decimal point */; |
1693 | if (dir.prec[0] <= 0) |
1694 | minprec = 0; |
1695 | else if (dir.prec[0] > 0) |
1696 | minprec = dir.prec[0] + !radix /* decimal point */; |
1697 | |
1698 | res.range.likely = (2 /* 0x */ |
1699 | + flagmin |
1700 | + radix |
1701 | + minprec |
1702 | + 3 /* p+0 */); |
1703 | |
1704 | res.range.max = format_floating_max (type, spec: 'a', prec: prec[1]); |
1705 | |
1706 | /* The unlikely maximum accounts for the longest multibyte |
1707 | decimal point character. */ |
1708 | res.range.unlikely = res.range.max; |
1709 | if (dir.prec[1] > 0) |
1710 | res.range.unlikely += target_mb_len_max () - 1; |
1711 | |
1712 | break; |
1713 | } |
1714 | |
1715 | case 'E': |
1716 | case 'e': |
1717 | { |
1718 | /* Minimum output attributable to precision and, when it's |
1719 | non-zero, decimal point. */ |
1720 | HOST_WIDE_INT minprec = prec[0] ? prec[0] + !radix : 0; |
1721 | |
1722 | /* The likely minimum output is "[-+]1.234567e+00" regardless |
1723 | of the value of the actual argument. */ |
1724 | res.range.likely = (flagmin |
1725 | + radix |
1726 | + minprec |
1727 | + 2 /* e+ */ + 2); |
1728 | |
1729 | res.range.max = format_floating_max (type, spec: 'e', prec: prec[1]); |
1730 | |
1731 | /* The unlikely maximum accounts for the longest multibyte |
1732 | decimal point character. */ |
1733 | if (dir.prec[0] != dir.prec[1] |
1734 | || dir.prec[0] == -1 || dir.prec[0] > 0) |
1735 | res.range.unlikely = res.range.max + target_mb_len_max () -1; |
1736 | else |
1737 | res.range.unlikely = res.range.max; |
1738 | break; |
1739 | } |
1740 | |
1741 | case 'F': |
1742 | case 'f': |
1743 | { |
1744 | /* Minimum output attributable to precision and, when it's non-zero, |
1745 | decimal point. */ |
1746 | HOST_WIDE_INT minprec = prec[0] ? prec[0] + !radix : 0; |
1747 | |
1748 | /* For finite numbers (i.e., not infinity or NaN) the lower bound |
1749 | when precision isn't specified is 8 bytes ("1.23456" since |
1750 | precision is taken to be 6). When precision is zero, the lower |
1751 | bound is 1 byte (e.g., "1"). Otherwise, when precision is greater |
1752 | than zero, then the lower bound is 2 plus precision (plus flags). |
1753 | But in all cases, the lower bound is no greater than 3. */ |
1754 | unsigned HOST_WIDE_INT min = flagmin + radix + minprec; |
1755 | if (min < res.range.min) |
1756 | res.range.min = min; |
1757 | |
1758 | /* Compute the upper bound for -TYPE_MAX. */ |
1759 | res.range.max = format_floating_max (type, spec: 'f', prec: prec[1]); |
1760 | |
1761 | /* The minimum output with unknown precision is a single byte |
1762 | (e.g., "0") but the more likely output is 3 bytes ("0.0"). */ |
1763 | if (dir.prec[0] < 0 && dir.prec[1] > 0) |
1764 | res.range.likely = 3; |
1765 | else |
1766 | res.range.likely = min; |
1767 | |
1768 | /* The unlikely maximum accounts for the longest multibyte |
1769 | decimal point character. */ |
1770 | if (dir.prec[0] != dir.prec[1] |
1771 | || dir.prec[0] == -1 || dir.prec[0] > 0) |
1772 | res.range.unlikely = res.range.max + target_mb_len_max () - 1; |
1773 | break; |
1774 | } |
1775 | |
1776 | case 'G': |
1777 | case 'g': |
1778 | { |
1779 | /* The %g output depends on precision and the exponent of |
1780 | the argument. Since the value of the argument isn't known |
1781 | the lower bound on the range of bytes (not counting flags |
1782 | or width) is 1 plus radix (i.e., either "0" or "0." for |
1783 | "%g" and "%#g", respectively, with a zero argument). */ |
1784 | unsigned HOST_WIDE_INT min = flagmin + radix; |
1785 | if (min < res.range.min) |
1786 | res.range.min = min; |
1787 | |
1788 | char spec = 'g'; |
1789 | HOST_WIDE_INT maxprec = dir.prec[1]; |
1790 | if (radix && maxprec) |
1791 | { |
1792 | /* When the pound flag (radix) is set, trailing zeros aren't |
1793 | trimmed and so the longest output is the same as for %e, |
1794 | except with precision minus 1 (as specified in C11). */ |
1795 | spec = 'e'; |
1796 | if (maxprec > 0) |
1797 | --maxprec; |
1798 | else if (maxprec < 0) |
1799 | maxprec = 5; |
1800 | } |
1801 | else |
1802 | maxprec = prec[1]; |
1803 | |
1804 | res.range.max = format_floating_max (type, spec, prec: maxprec); |
1805 | |
1806 | /* The likely output is either the maximum computed above |
1807 | minus 1 (assuming the maximum is positive) when precision |
1808 | is known (or unspecified), or the same minimum as for %e |
1809 | (which is computed for a non-negative argument). Unlike |
1810 | for the other specifiers above the likely output isn't |
1811 | the minimum because for %g that's 1 which is unlikely. */ |
1812 | if (dir.prec[1] < 0 |
1813 | || (unsigned HOST_WIDE_INT)dir.prec[1] < target_int_max ()) |
1814 | res.range.likely = res.range.max - 1; |
1815 | else |
1816 | { |
1817 | HOST_WIDE_INT minprec = 6 + !radix /* decimal point */; |
1818 | res.range.likely = (flagmin |
1819 | + radix |
1820 | + minprec |
1821 | + 2 /* e+ */ + 2); |
1822 | } |
1823 | |
1824 | /* The unlikely maximum accounts for the longest multibyte |
1825 | decimal point character. */ |
1826 | res.range.unlikely = res.range.max + target_mb_len_max () - 1; |
1827 | break; |
1828 | } |
1829 | |
1830 | default: |
1831 | return fmtresult (); |
1832 | } |
1833 | |
1834 | /* Bump up the byte counters if WIDTH is greater. */ |
1835 | res.adjust_for_width_or_precision (adjust: dir.width); |
1836 | return res; |
1837 | } |
1838 | |
1839 | /* Return a range representing the minimum and maximum number of bytes |
1840 | that the directive DIR will write on output for the floating argument |
1841 | ARG. */ |
1842 | |
1843 | static fmtresult |
1844 | format_floating (const directive &dir, tree arg, pointer_query &) |
1845 | { |
1846 | HOST_WIDE_INT prec[] = { dir.prec[0], dir.prec[1] }; |
1847 | tree type = (dir.modifier == FMT_LEN_L || dir.modifier == FMT_LEN_ll |
1848 | ? long_double_type_node : double_type_node); |
1849 | |
1850 | /* For an indeterminate precision the lower bound must be assumed |
1851 | to be zero. */ |
1852 | if (TOUPPER (dir.specifier) == 'A') |
1853 | { |
1854 | /* Get the number of fractional decimal digits needed to represent |
1855 | the argument without a loss of accuracy. */ |
1856 | unsigned fmtprec |
1857 | = REAL_MODE_FORMAT (TYPE_MODE (type))->p; |
1858 | |
1859 | /* The precision of the IEEE 754 double format is 53. |
1860 | The precision of all other GCC binary double formats |
1861 | is 56 or less. */ |
1862 | unsigned maxprec = fmtprec <= 56 ? 13 : 15; |
1863 | |
1864 | /* For %a, leave the minimum precision unspecified to let |
1865 | MFPR trim trailing zeros (as it and many other systems |
1866 | including Glibc happen to do) and set the maximum |
1867 | precision to reflect what it would be with trailing zeros |
1868 | present (as Solaris and derived systems do). */ |
1869 | if (dir.prec[1] < 0) |
1870 | { |
1871 | /* Both bounds are negative implies that precision has |
1872 | not been specified. */ |
1873 | prec[0] = maxprec; |
1874 | prec[1] = -1; |
1875 | } |
1876 | else if (dir.prec[0] < 0) |
1877 | { |
1878 | /* With a negative lower bound and a non-negative upper |
1879 | bound set the minimum precision to zero and the maximum |
1880 | to the greater of the maximum precision (i.e., with |
1881 | trailing zeros present) and the specified upper bound. */ |
1882 | prec[0] = 0; |
1883 | prec[1] = dir.prec[1] < maxprec ? maxprec : dir.prec[1]; |
1884 | } |
1885 | } |
1886 | else if (dir.prec[0] < 0) |
1887 | { |
1888 | if (dir.prec[1] < 0) |
1889 | { |
1890 | /* A precision in a strictly negative range is ignored and |
1891 | the default of 6 is used instead. */ |
1892 | prec[0] = prec[1] = 6; |
1893 | } |
1894 | else |
1895 | { |
1896 | /* For a precision in a partly negative range, the lower bound |
1897 | must be assumed to be zero and the new upper bound is the |
1898 | greater of 6 (the default precision used when the specified |
1899 | precision is negative) and the upper bound of the specified |
1900 | range. */ |
1901 | prec[0] = 0; |
1902 | prec[1] = dir.prec[1] < 6 ? 6 : dir.prec[1]; |
1903 | } |
1904 | } |
1905 | |
1906 | if (!arg |
1907 | || TREE_CODE (arg) != REAL_CST |
1908 | || !useless_type_conversion_p (type, TREE_TYPE (arg))) |
1909 | return format_floating (dir, prec); |
1910 | |
1911 | /* The minimum and maximum number of bytes produced by the directive. */ |
1912 | fmtresult res; |
1913 | |
1914 | /* Get the real type format description for the target. */ |
1915 | const REAL_VALUE_TYPE *rvp = TREE_REAL_CST_PTR (arg); |
1916 | const real_format *rfmt = REAL_MODE_FORMAT (TYPE_MODE (TREE_TYPE (arg))); |
1917 | |
1918 | if (!real_isfinite (rvp)) |
1919 | { |
1920 | /* The format for Infinity and NaN is "[-]inf"/"[-]infinity" |
1921 | and "[-]nan" with the choice being implementation-defined |
1922 | but not locale dependent. */ |
1923 | bool sign = dir.get_flag (chr: '+') || real_isneg (rvp); |
1924 | res.range.min = 3 + sign; |
1925 | |
1926 | res.range.likely = res.range.min; |
1927 | res.range.max = res.range.min; |
1928 | /* The unlikely maximum is "[-/+]infinity" or "[-/+][qs]nan". |
1929 | For NaN, the C/POSIX standards specify two formats: |
1930 | "[-/+]nan" |
1931 | and |
1932 | "[-/+]nan(n-char-sequence)" |
1933 | No known printf implementation outputs the latter format but AIX |
1934 | outputs QNaN and SNaN for quiet and signalling NaN, respectively, |
1935 | so the unlikely maximum reflects that. */ |
1936 | res.range.unlikely = sign + (real_isinf (rvp) ? 8 : 4); |
1937 | |
1938 | /* The range for infinity and NaN is known unless either width |
1939 | or precision is unknown. Width has the same effect regardless |
1940 | of whether the argument is finite. Precision is either ignored |
1941 | (e.g., Glibc) or can have an effect on the short vs long format |
1942 | such as inf/infinity (e.g., Solaris). */ |
1943 | res.knownrange = dir.known_width_and_precision (); |
1944 | |
1945 | /* Adjust the range for width but ignore precision. */ |
1946 | res.adjust_for_width_or_precision (adjust: dir.width); |
1947 | |
1948 | return res; |
1949 | } |
1950 | |
1951 | char fmtstr [40]; |
1952 | char *pfmt = fmtstr; |
1953 | |
1954 | /* Append flags. */ |
1955 | for (const char *pf = "-+ #0" ; *pf; ++pf) |
1956 | if (dir.get_flag (chr: *pf)) |
1957 | *pfmt++ = *pf; |
1958 | |
1959 | *pfmt = '\0'; |
1960 | |
1961 | { |
1962 | /* Set up an array to easily iterate over. */ |
1963 | unsigned HOST_WIDE_INT* const minmax[] = { |
1964 | &res.range.min, &res.range.max |
1965 | }; |
1966 | |
1967 | for (int i = 0; i != ARRAY_SIZE (minmax); ++i) |
1968 | { |
1969 | /* Convert the GCC real value representation with the precision |
1970 | of the real type to the mpfr_t format rounding down in the |
1971 | first iteration that computes the minimum and up in the second |
1972 | that computes the maximum. This order is arbitrary because |
1973 | rounding in either direction can result in longer output. */ |
1974 | mpfr_t mpfrval; |
1975 | mpfr_init2 (mpfrval, rfmt->p); |
1976 | mpfr_from_real (mpfrval, rvp, i ? MPFR_RNDU : MPFR_RNDD); |
1977 | |
1978 | /* Use the MPFR rounding specifier to round down in the first |
1979 | iteration and then up. In most but not all cases this will |
1980 | result in the same number of bytes. */ |
1981 | char rndspec = "DU" [i]; |
1982 | |
1983 | /* Format it and store the result in the corresponding member |
1984 | of the result struct. */ |
1985 | *minmax[i] = get_mpfr_format_length (x: mpfrval, flags: fmtstr, prec: prec[i], |
1986 | spec: dir.specifier, rndspec); |
1987 | mpfr_clear (mpfrval); |
1988 | } |
1989 | } |
1990 | |
1991 | /* Make sure the minimum is less than the maximum (MPFR rounding |
1992 | in the call to mpfr_snprintf can result in the reverse. */ |
1993 | if (res.range.max < res.range.min) |
1994 | { |
1995 | unsigned HOST_WIDE_INT tmp = res.range.min; |
1996 | res.range.min = res.range.max; |
1997 | res.range.max = tmp; |
1998 | } |
1999 | |
2000 | /* The range is known unless either width or precision is unknown. */ |
2001 | res.knownrange = dir.known_width_and_precision (); |
2002 | |
2003 | /* For the same floating point constant, unless width or precision |
2004 | is unknown, use the longer output as the likely maximum since |
2005 | with round to nearest either is equally likely. Otherwise, when |
2006 | precision is unknown, use the greater of the minimum and 3 as |
2007 | the likely output (for "0.0" since zero precision is unlikely). */ |
2008 | if (res.knownrange) |
2009 | res.range.likely = res.range.max; |
2010 | else if (res.range.min < 3 |
2011 | && dir.prec[0] < 0 |
2012 | && (unsigned HOST_WIDE_INT)dir.prec[1] == target_int_max ()) |
2013 | res.range.likely = 3; |
2014 | else |
2015 | res.range.likely = res.range.min; |
2016 | |
2017 | res.range.unlikely = res.range.max; |
2018 | |
2019 | if (res.range.max > 2 && (prec[0] != 0 || prec[1] != 0)) |
2020 | { |
2021 | /* Unless the precision is zero output longer than 2 bytes may |
2022 | include the decimal point which must be a single character |
2023 | up to MB_LEN_MAX in length. This is overly conservative |
2024 | since in some conversions some constants result in no decimal |
2025 | point (e.g., in %g). */ |
2026 | res.range.unlikely += target_mb_len_max () - 1; |
2027 | } |
2028 | |
2029 | res.adjust_for_width_or_precision (adjust: dir.width); |
2030 | return res; |
2031 | } |
2032 | |
2033 | /* Return a FMTRESULT struct set to the lengths of the shortest and longest |
2034 | strings referenced by the expression STR, or (-1, -1) when not known. |
2035 | Used by the format_string function below. */ |
2036 | |
2037 | static fmtresult |
2038 | get_string_length (tree str, gimple *stmt, unsigned HOST_WIDE_INT max_size, |
2039 | unsigned eltsize, pointer_query &ptr_qry) |
2040 | { |
2041 | if (!str) |
2042 | return fmtresult (); |
2043 | |
2044 | /* Try to determine the dynamic string length first. |
2045 | Set MAXBOUND to an arbitrary non-null non-integer node as a request |
2046 | to have it set to the length of the longest string in a PHI. */ |
2047 | c_strlen_data lendata = { }; |
2048 | lendata.maxbound = str; |
2049 | if (eltsize == 1) |
2050 | get_range_strlen_dynamic (str, stmt, &lendata, ptr_qry); |
2051 | else |
2052 | { |
2053 | /* Determine the length of the shortest and longest string referenced |
2054 | by STR. Strings of unknown lengths are bounded by the sizes of |
2055 | arrays that subexpressions of STR may refer to. Pointers that |
2056 | aren't known to point any such arrays result in LENDATA.MAXLEN |
2057 | set to SIZE_MAX. */ |
2058 | get_range_strlen (str, &lendata, eltsize); |
2059 | } |
2060 | |
2061 | /* If LENDATA.MAXBOUND is not equal to .MINLEN it corresponds to the bound |
2062 | of the largest array STR refers to, if known, or it's set to SIZE_MAX |
2063 | otherwise. */ |
2064 | |
2065 | /* Return the default result when nothing is known about the string. */ |
2066 | if ((lendata.maxbound && !tree_fits_uhwi_p (lendata.maxbound)) |
2067 | || !tree_fits_uhwi_p (lendata.maxlen)) |
2068 | { |
2069 | fmtresult res; |
2070 | res.nonstr = lendata.decl; |
2071 | return res; |
2072 | } |
2073 | |
2074 | unsigned HOST_WIDE_INT lenmax = tree_to_uhwi (max_object_size ()) - 2; |
2075 | if (integer_zerop (lendata.minlen) |
2076 | && (!lendata.maxbound || lenmax <= tree_to_uhwi (lendata.maxbound)) |
2077 | && lenmax <= tree_to_uhwi (lendata.maxlen)) |
2078 | { |
2079 | if (max_size > 0 && max_size < HOST_WIDE_INT_MAX) |
2080 | { |
2081 | /* Adjust the conservative unknown/unbounded result if MAX_SIZE |
2082 | is valid. Set UNLIKELY to maximum in case MAX_SIZE refers |
2083 | to a subobject. |
2084 | TODO: This is overly conservative. Set UNLIKELY to the size |
2085 | of the outermost enclosing declared object. */ |
2086 | fmtresult res (0, max_size - 1); |
2087 | res.nonstr = lendata.decl; |
2088 | res.range.likely = res.range.max; |
2089 | res.range.unlikely = HOST_WIDE_INT_MAX; |
2090 | return res; |
2091 | } |
2092 | |
2093 | fmtresult res; |
2094 | res.nonstr = lendata.decl; |
2095 | return res; |
2096 | } |
2097 | |
2098 | /* The minimum length of the string. */ |
2099 | HOST_WIDE_INT min |
2100 | = (tree_fits_uhwi_p (lendata.minlen) |
2101 | ? tree_to_uhwi (lendata.minlen) |
2102 | : 0); |
2103 | |
2104 | /* The maximum length of the string; initially set to MAXBOUND which |
2105 | may be less than MAXLEN, but may be adjusted up below. */ |
2106 | HOST_WIDE_INT max |
2107 | = (lendata.maxbound && tree_fits_uhwi_p (lendata.maxbound) |
2108 | ? tree_to_uhwi (lendata.maxbound) |
2109 | : HOST_WIDE_INT_M1U); |
2110 | |
2111 | /* True if either the maximum length is unknown or (conservatively) |
2112 | the array bound is less than the maximum length. That can happen |
2113 | when the length of the string is unknown but the array in which |
2114 | the string is stored is a member of a struct. The warning uses |
2115 | the size of the member as the upper bound but the optimization |
2116 | doesn't. The optimization could still use the size of |
2117 | enclosing object as the upper bound but that's not done here. */ |
2118 | const bool unbounded |
2119 | = (integer_all_onesp (lendata.maxlen) |
2120 | || (lendata.maxbound |
2121 | && tree_int_cst_lt (t1: lendata.maxbound, t2: lendata.maxlen))); |
2122 | |
2123 | /* Set the max/likely counters to unbounded when a minimum is known |
2124 | but the maximum length isn't bounded. This implies that STR is |
2125 | a conditional expression involving a string of known length and |
2126 | an expression of unknown/unbounded length. */ |
2127 | if (min |
2128 | && (unsigned HOST_WIDE_INT)min < HOST_WIDE_INT_M1U |
2129 | && unbounded) |
2130 | max = HOST_WIDE_INT_M1U; |
2131 | |
2132 | /* get_range_strlen() returns the target value of SIZE_MAX for |
2133 | strings of unknown length. Bump it up to HOST_WIDE_INT_M1U |
2134 | which may be bigger. */ |
2135 | if ((unsigned HOST_WIDE_INT)min == target_size_max ()) |
2136 | min = HOST_WIDE_INT_M1U; |
2137 | if ((unsigned HOST_WIDE_INT)max == target_size_max ()) |
2138 | max = HOST_WIDE_INT_M1U; |
2139 | |
2140 | fmtresult res (min, max); |
2141 | res.nonstr = lendata.decl; |
2142 | |
2143 | /* Set RES.KNOWNRANGE to true if and only if all strings referenced |
2144 | by STR are known to be bounded (though not necessarily by their |
2145 | actual length but perhaps by their maximum possible length). */ |
2146 | if (res.range.max < target_int_max ()) |
2147 | { |
2148 | res.knownrange = true; |
2149 | /* When the length of the longest string is known and not |
2150 | excessive use it as the likely length of the string(s). */ |
2151 | res.range.likely = res.range.max; |
2152 | } |
2153 | else |
2154 | { |
2155 | /* When the upper bound is unknown (it can be zero or excessive) |
2156 | set the likely length to the greater of 1. If MAXBOUND is |
2157 | known, also reset the length of the lower bound to zero. */ |
2158 | res.range.likely = res.range.min ? res.range.min : warn_level > 1; |
2159 | if (lendata.maxbound && !integer_all_onesp (lendata.maxbound)) |
2160 | res.range.min = 0; |
2161 | } |
2162 | |
2163 | res.range.unlikely = unbounded ? HOST_WIDE_INT_MAX : res.range.max; |
2164 | |
2165 | return res; |
2166 | } |
2167 | |
2168 | /* Return the minimum and maximum number of characters formatted |
2169 | by the '%c' format directives and its wide character form for |
2170 | the argument ARG. ARG can be null (for functions such as |
2171 | vsprinf). */ |
2172 | |
2173 | static fmtresult |
2174 | format_character (const directive &dir, tree arg, pointer_query &ptr_qry) |
2175 | { |
2176 | fmtresult res; |
2177 | |
2178 | res.knownrange = true; |
2179 | |
2180 | if (dir.specifier == 'C' |
2181 | || dir.modifier == FMT_LEN_l) |
2182 | { |
2183 | /* A wide character can result in as few as zero bytes. */ |
2184 | res.range.min = 0; |
2185 | |
2186 | HOST_WIDE_INT min, max; |
2187 | if (get_int_range (arg, stmt: dir.info->callstmt, pmin: &min, pmax: &max, absolute: false, negbound: 0, |
2188 | query: ptr_qry.rvals)) |
2189 | { |
2190 | if (min == 0 && max == 0) |
2191 | { |
2192 | /* The NUL wide character results in no bytes. */ |
2193 | res.range.max = 0; |
2194 | res.range.likely = 0; |
2195 | res.range.unlikely = 0; |
2196 | } |
2197 | else if (min >= 0 && min < 128) |
2198 | { |
2199 | /* Be conservative if the target execution character set |
2200 | is not a 1-to-1 mapping to the source character set or |
2201 | if the source set is not ASCII. */ |
2202 | bool one_2_one_ascii |
2203 | = (target_to_host_charmap[0] == 1 && target_to_host (ch: 'a') == 97); |
2204 | |
2205 | /* A wide character in the ASCII range most likely results |
2206 | in a single byte, and only unlikely in up to MB_LEN_MAX. */ |
2207 | res.range.max = one_2_one_ascii ? 1 : target_mb_len_max ();; |
2208 | res.range.likely = 1; |
2209 | res.range.unlikely = target_mb_len_max (); |
2210 | res.mayfail = !one_2_one_ascii; |
2211 | } |
2212 | else |
2213 | { |
2214 | /* A wide character outside the ASCII range likely results |
2215 | in up to two bytes, and only unlikely in up to MB_LEN_MAX. */ |
2216 | res.range.max = target_mb_len_max (); |
2217 | res.range.likely = 2; |
2218 | res.range.unlikely = res.range.max; |
2219 | /* Converting such a character may fail. */ |
2220 | res.mayfail = true; |
2221 | } |
2222 | } |
2223 | else |
2224 | { |
2225 | /* An unknown wide character is treated the same as a wide |
2226 | character outside the ASCII range. */ |
2227 | res.range.max = target_mb_len_max (); |
2228 | res.range.likely = 2; |
2229 | res.range.unlikely = res.range.max; |
2230 | res.mayfail = true; |
2231 | } |
2232 | } |
2233 | else |
2234 | { |
2235 | /* A plain '%c' directive. Its output is exactly 1. */ |
2236 | res.range.min = res.range.max = 1; |
2237 | res.range.likely = res.range.unlikely = 1; |
2238 | res.knownrange = true; |
2239 | } |
2240 | |
2241 | /* Bump up the byte counters if WIDTH is greater. */ |
2242 | return res.adjust_for_width_or_precision (adjust: dir.width); |
2243 | } |
2244 | |
2245 | /* If TYPE is an array or struct or union, increment *FLDOFF by the starting |
2246 | offset of the member that *OFF points into if one can be determined and |
2247 | set *FLDSIZE to its size in bytes and decrement *OFF by the same. |
2248 | Otherwise do nothing. */ |
2249 | |
2250 | static void |
2251 | set_aggregate_size_and_offset (tree type, HOST_WIDE_INT *fldoff, |
2252 | HOST_WIDE_INT *fldsize, HOST_WIDE_INT *off) |
2253 | { |
2254 | /* The byte offset of the most basic struct member the byte |
2255 | offset *OFF corresponds to, or for a (multidimensional) |
2256 | array member, the byte offset of the array element. */ |
2257 | if (TREE_CODE (type) == ARRAY_TYPE |
2258 | && TREE_CODE (TREE_TYPE (type)) == ARRAY_TYPE) |
2259 | { |
2260 | HOST_WIDE_INT index = 0, arrsize = 0; |
2261 | if (array_elt_at_offset (type, *off, &index, &arrsize)) |
2262 | { |
2263 | *fldoff += index; |
2264 | *fldsize = arrsize; |
2265 | } |
2266 | /* Otherwise leave *FLDOFF et al. unchanged. */ |
2267 | } |
2268 | else if (RECORD_OR_UNION_TYPE_P (type)) |
2269 | { |
2270 | HOST_WIDE_INT index = 0; |
2271 | tree sub = field_at_offset (type, NULL_TREE, *off, &index); |
2272 | if (sub) |
2273 | { |
2274 | tree subsize = DECL_SIZE_UNIT (sub); |
2275 | if (*fldsize < HOST_WIDE_INT_MAX |
2276 | && subsize |
2277 | && tree_fits_uhwi_p (subsize)) |
2278 | *fldsize = tree_to_uhwi (subsize); |
2279 | else |
2280 | *fldsize = HOST_WIDE_INT_MAX; |
2281 | *fldoff += index; |
2282 | *off -= index; |
2283 | } |
2284 | /* Otherwise leave *FLDOFF et al. unchanged. */ |
2285 | } |
2286 | } |
2287 | |
2288 | /* For an expression X of pointer type, recursively try to find its origin |
2289 | (either object DECL or pointer such as PARM_DECL) Y and return such a Y. |
2290 | When X refers to an array element or struct member, set *FLDOFF to |
2291 | the offset of the element or member from the beginning of the "most |
2292 | derived" object and *FLDSIZE to its size. When nonnull, set *OFF to |
2293 | the overall offset from the beginning of the object so that |
2294 | *FLDOFF <= *OFF. */ |
2295 | |
2296 | static tree |
2297 | get_origin_and_offset_r (tree x, HOST_WIDE_INT *fldoff, HOST_WIDE_INT *fldsize, |
2298 | HOST_WIDE_INT *off) |
2299 | { |
2300 | HOST_WIDE_INT sizebuf = -1; |
2301 | if (!fldsize) |
2302 | fldsize = &sizebuf; |
2303 | |
2304 | if (DECL_P (x)) |
2305 | { |
2306 | /* Set the size if it hasn't been set yet. */ |
2307 | if (tree size = DECL_SIZE_UNIT (x)) |
2308 | if (*fldsize < 0 && tree_fits_shwi_p (size)) |
2309 | *fldsize = tree_to_shwi (size); |
2310 | return x; |
2311 | } |
2312 | |
2313 | switch (TREE_CODE (x)) |
2314 | { |
2315 | case ADDR_EXPR: |
2316 | x = TREE_OPERAND (x, 0); |
2317 | return get_origin_and_offset_r (x, fldoff, fldsize, off); |
2318 | |
2319 | case ARRAY_REF: |
2320 | { |
2321 | tree sub = TREE_OPERAND (x, 1); |
2322 | unsigned HOST_WIDE_INT idx = |
2323 | tree_fits_uhwi_p (sub) ? tree_to_uhwi (sub) : HOST_WIDE_INT_MAX; |
2324 | |
2325 | tree elsz = array_ref_element_size (x); |
2326 | unsigned HOST_WIDE_INT elbytes = |
2327 | tree_fits_shwi_p (elsz) ? tree_to_shwi (elsz) : HOST_WIDE_INT_MAX; |
2328 | |
2329 | unsigned HOST_WIDE_INT byteoff = idx * elbytes; |
2330 | |
2331 | if (byteoff < HOST_WIDE_INT_MAX |
2332 | && elbytes < HOST_WIDE_INT_MAX |
2333 | && (elbytes == 0 || byteoff / elbytes == idx)) |
2334 | { |
2335 | /* For in-bounds constant offsets into constant-sized arrays |
2336 | bump up *OFF, and for what's likely arrays or structs of |
2337 | arrays, also *FLDOFF, as necessary. */ |
2338 | if (off) |
2339 | *off += byteoff; |
2340 | if (elbytes > 1) |
2341 | *fldoff += byteoff; |
2342 | } |
2343 | else |
2344 | *fldoff = HOST_WIDE_INT_MAX; |
2345 | |
2346 | x = TREE_OPERAND (x, 0); |
2347 | return get_origin_and_offset_r (x, fldoff, fldsize, off); |
2348 | } |
2349 | |
2350 | case MEM_REF: |
2351 | if (off) |
2352 | { |
2353 | tree offset = TREE_OPERAND (x, 1); |
2354 | *off = (tree_fits_uhwi_p (offset) |
2355 | ? tree_to_uhwi (offset) : HOST_WIDE_INT_MAX); |
2356 | } |
2357 | |
2358 | x = TREE_OPERAND (x, 0); |
2359 | |
2360 | if (off) |
2361 | { |
2362 | tree xtype |
2363 | = (TREE_CODE (x) == ADDR_EXPR |
2364 | ? TREE_TYPE (TREE_OPERAND (x, 0)) : TREE_TYPE (TREE_TYPE (x))); |
2365 | |
2366 | set_aggregate_size_and_offset (type: xtype, fldoff, fldsize, off); |
2367 | } |
2368 | |
2369 | return get_origin_and_offset_r (x, fldoff, fldsize, off: nullptr); |
2370 | |
2371 | case COMPONENT_REF: |
2372 | { |
2373 | tree foff = component_ref_field_offset (x); |
2374 | tree fld = TREE_OPERAND (x, 1); |
2375 | if (!tree_fits_shwi_p (foff) |
2376 | || !tree_fits_shwi_p (DECL_FIELD_BIT_OFFSET (fld))) |
2377 | return x; |
2378 | *fldoff += (tree_to_shwi (foff) |
2379 | + (tree_to_shwi (DECL_FIELD_BIT_OFFSET (fld)) |
2380 | / BITS_PER_UNIT)); |
2381 | |
2382 | get_origin_and_offset_r (x: fld, fldoff, fldsize, off); |
2383 | x = TREE_OPERAND (x, 0); |
2384 | return get_origin_and_offset_r (x, fldoff, fldsize: nullptr, off); |
2385 | } |
2386 | |
2387 | case SSA_NAME: |
2388 | { |
2389 | gimple *def = SSA_NAME_DEF_STMT (x); |
2390 | if (is_gimple_assign (gs: def)) |
2391 | { |
2392 | tree_code code = gimple_assign_rhs_code (gs: def); |
2393 | if (code == ADDR_EXPR) |
2394 | { |
2395 | x = gimple_assign_rhs1 (gs: def); |
2396 | return get_origin_and_offset_r (x, fldoff, fldsize, off); |
2397 | } |
2398 | |
2399 | if (code == POINTER_PLUS_EXPR) |
2400 | { |
2401 | tree offset = gimple_assign_rhs2 (gs: def); |
2402 | if (off && tree_fits_uhwi_p (offset)) |
2403 | *off = tree_to_uhwi (offset); |
2404 | |
2405 | x = gimple_assign_rhs1 (gs: def); |
2406 | x = get_origin_and_offset_r (x, fldoff, fldsize, off); |
2407 | if (off && !tree_fits_uhwi_p (offset)) |
2408 | *off = HOST_WIDE_INT_MAX; |
2409 | if (off) |
2410 | { |
2411 | tree xtype = TREE_TYPE (x); |
2412 | set_aggregate_size_and_offset (type: xtype, fldoff, fldsize, off); |
2413 | } |
2414 | return x; |
2415 | } |
2416 | else if (code == VAR_DECL) |
2417 | { |
2418 | x = gimple_assign_rhs1 (gs: def); |
2419 | return get_origin_and_offset_r (x, fldoff, fldsize, off); |
2420 | } |
2421 | } |
2422 | else if (gimple_nop_p (g: def) && SSA_NAME_VAR (x)) |
2423 | x = SSA_NAME_VAR (x); |
2424 | |
2425 | tree xtype = TREE_TYPE (x); |
2426 | if (POINTER_TYPE_P (xtype)) |
2427 | xtype = TREE_TYPE (xtype); |
2428 | |
2429 | if (off) |
2430 | set_aggregate_size_and_offset (type: xtype, fldoff, fldsize, off); |
2431 | } |
2432 | |
2433 | default: |
2434 | break; |
2435 | } |
2436 | |
2437 | return x; |
2438 | } |
2439 | |
2440 | /* Nonrecursive version of the above. |
2441 | The function never returns null unless X is null to begin with. */ |
2442 | |
2443 | static tree |
2444 | get_origin_and_offset (tree x, HOST_WIDE_INT *fldoff, HOST_WIDE_INT *off, |
2445 | HOST_WIDE_INT *fldsize = nullptr) |
2446 | { |
2447 | if (!x) |
2448 | return NULL_TREE; |
2449 | |
2450 | HOST_WIDE_INT sizebuf; |
2451 | if (!fldsize) |
2452 | fldsize = &sizebuf; |
2453 | |
2454 | /* Invalidate *FLDSIZE. */ |
2455 | *fldsize = -1; |
2456 | *fldoff = *off = 0; |
2457 | |
2458 | return get_origin_and_offset_r (x, fldoff, fldsize, off); |
2459 | } |
2460 | |
2461 | /* If ARG refers to the same (sub)object or array element as described |
2462 | by DST and DST_FLD, return the byte offset into the struct member or |
2463 | array element referenced by ARG and set *ARG_SIZE to the size of |
2464 | the (sub)object. Otherwise return HOST_WIDE_INT_MIN to indicate |
2465 | that ARG and DST do not refer to the same object. */ |
2466 | |
2467 | static HOST_WIDE_INT |
2468 | alias_offset (tree arg, HOST_WIDE_INT *arg_size, |
2469 | tree dst, HOST_WIDE_INT dst_fld) |
2470 | { |
2471 | /* See if the argument refers to the same base object as the destination |
2472 | of the formatted function call, and if so, try to determine if they |
2473 | can alias. */ |
2474 | if (!arg || !dst || !ptr_derefs_may_alias_p (arg, dst)) |
2475 | return HOST_WIDE_INT_MIN; |
2476 | |
2477 | /* The two arguments may refer to the same object. If they both refer |
2478 | to a struct member, see if the members are one and the same. If so, |
2479 | return the offset into the member. */ |
2480 | HOST_WIDE_INT arg_off = 0, arg_fld = 0; |
2481 | |
2482 | tree arg_orig = get_origin_and_offset (x: arg, fldoff: &arg_fld, off: &arg_off, fldsize: arg_size); |
2483 | |
2484 | if (arg_orig == dst && arg_fld == dst_fld) |
2485 | return arg_off; |
2486 | |
2487 | return HOST_WIDE_INT_MIN; |
2488 | } |
2489 | |
2490 | /* Return the minimum and maximum number of characters formatted |
2491 | by the '%s' format directive and its wide character form for |
2492 | the argument ARG. ARG can be null (for functions such as |
2493 | vsprinf). */ |
2494 | |
2495 | static fmtresult |
2496 | format_string (const directive &dir, tree arg, pointer_query &ptr_qry) |
2497 | { |
2498 | fmtresult res; |
2499 | |
2500 | /* The size of the (sub)object ARG refers to. Used to adjust |
2501 | the conservative get_string_length() result. */ |
2502 | HOST_WIDE_INT arg_size = 0; |
2503 | |
2504 | if (warn_restrict) |
2505 | { |
2506 | /* See if ARG might alias the destination of the call with |
2507 | DST_ORIGIN and DST_FIELD. If so, store the starting offset |
2508 | so that the overlap can be determined for certain later, |
2509 | when the amount of output of the call (including subsequent |
2510 | directives) has been computed. Otherwise, store HWI_MIN. */ |
2511 | res.dst_offset = alias_offset (arg, arg_size: &arg_size, dst: dir.info->dst_origin, |
2512 | dst_fld: dir.info->dst_field); |
2513 | if (res.dst_offset >= 0 && res.dst_offset <= arg_size) |
2514 | arg_size -= res.dst_offset; |
2515 | else |
2516 | arg_size = 0; |
2517 | } |
2518 | |
2519 | /* Compute the range the argument's length can be in. */ |
2520 | int count_by = 1; |
2521 | if (dir.specifier == 'S' || dir.modifier == FMT_LEN_l) |
2522 | { |
2523 | /* Get a node for a C type that will be the same size |
2524 | as a wchar_t on the target. */ |
2525 | tree node = get_typenode_from_name (MODIFIED_WCHAR_TYPE); |
2526 | |
2527 | /* Now that we have a suitable node, get the number of |
2528 | bytes it occupies. */ |
2529 | count_by = int_size_in_bytes (node); |
2530 | gcc_checking_assert (count_by == 2 || count_by == 4); |
2531 | } |
2532 | |
2533 | fmtresult slen = |
2534 | get_string_length (str: arg, stmt: dir.info->callstmt, max_size: arg_size, eltsize: count_by, ptr_qry); |
2535 | if (slen.range.min == slen.range.max |
2536 | && slen.range.min < HOST_WIDE_INT_MAX) |
2537 | { |
2538 | /* The argument is either a string constant or it refers |
2539 | to one of a number of strings of the same length. */ |
2540 | |
2541 | /* A '%s' directive with a string argument with constant length. */ |
2542 | res.range = slen.range; |
2543 | |
2544 | if (dir.specifier == 'S' |
2545 | || dir.modifier == FMT_LEN_l) |
2546 | { |
2547 | /* In the worst case the length of output of a wide string S |
2548 | is bounded by MB_LEN_MAX * wcslen (S). */ |
2549 | res.range.max *= target_mb_len_max (); |
2550 | res.range.unlikely = res.range.max; |
2551 | /* It's likely that the total length is not more that |
2552 | 2 * wcslen (S).*/ |
2553 | res.range.likely = res.range.min * 2; |
2554 | |
2555 | if (dir.prec[1] >= 0 |
2556 | && (unsigned HOST_WIDE_INT)dir.prec[1] < res.range.max) |
2557 | { |
2558 | res.range.max = dir.prec[1]; |
2559 | res.range.likely = dir.prec[1]; |
2560 | res.range.unlikely = dir.prec[1]; |
2561 | } |
2562 | |
2563 | if (dir.prec[0] < 0 && dir.prec[1] > -1) |
2564 | res.range.min = 0; |
2565 | else if (dir.prec[0] >= 0) |
2566 | res.range.likely = dir.prec[0]; |
2567 | |
2568 | /* Even a non-empty wide character string need not convert into |
2569 | any bytes. */ |
2570 | res.range.min = 0; |
2571 | |
2572 | /* A non-empty wide character conversion may fail. */ |
2573 | if (slen.range.max > 0) |
2574 | res.mayfail = true; |
2575 | } |
2576 | else |
2577 | { |
2578 | res.knownrange = true; |
2579 | |
2580 | if (dir.prec[0] < 0 && dir.prec[1] > -1) |
2581 | res.range.min = 0; |
2582 | else if ((unsigned HOST_WIDE_INT)dir.prec[0] < res.range.min) |
2583 | res.range.min = dir.prec[0]; |
2584 | |
2585 | if ((unsigned HOST_WIDE_INT)dir.prec[1] < res.range.max) |
2586 | { |
2587 | res.range.max = dir.prec[1]; |
2588 | res.range.likely = dir.prec[1]; |
2589 | res.range.unlikely = dir.prec[1]; |
2590 | } |
2591 | } |
2592 | } |
2593 | else if (arg && integer_zerop (arg)) |
2594 | { |
2595 | /* Handle null pointer argument. */ |
2596 | |
2597 | fmtresult res (0); |
2598 | res.nullp = true; |
2599 | return res; |
2600 | } |
2601 | else |
2602 | { |
2603 | /* For a '%s' and '%ls' directive with a non-constant string (either |
2604 | one of a number of strings of known length or an unknown string) |
2605 | the minimum number of characters is lesser of PRECISION[0] and |
2606 | the length of the shortest known string or zero, and the maximum |
2607 | is the lesser of the length of the longest known string or |
2608 | PTRDIFF_MAX and PRECISION[1]. The likely length is either |
2609 | the minimum at level 1 and the greater of the minimum and 1 |
2610 | at level 2. This result is adjust upward for width (if it's |
2611 | specified). */ |
2612 | |
2613 | if (dir.specifier == 'S' |
2614 | || dir.modifier == FMT_LEN_l) |
2615 | { |
2616 | /* A wide character converts to as few as zero bytes. */ |
2617 | slen.range.min = 0; |
2618 | if (slen.range.max < target_int_max ()) |
2619 | slen.range.max *= target_mb_len_max (); |
2620 | |
2621 | if (slen.range.likely < target_int_max ()) |
2622 | slen.range.likely *= 2; |
2623 | |
2624 | if (slen.range.likely < target_int_max ()) |
2625 | slen.range.unlikely *= target_mb_len_max (); |
2626 | |
2627 | /* A non-empty wide character conversion may fail. */ |
2628 | if (slen.range.max > 0) |
2629 | res.mayfail = true; |
2630 | } |
2631 | |
2632 | res.range = slen.range; |
2633 | |
2634 | if (dir.prec[0] >= 0) |
2635 | { |
2636 | /* Adjust the minimum to zero if the string length is unknown, |
2637 | or at most the lower bound of the precision otherwise. */ |
2638 | if (slen.range.min >= target_int_max ()) |
2639 | res.range.min = 0; |
2640 | else if ((unsigned HOST_WIDE_INT)dir.prec[0] < slen.range.min) |
2641 | res.range.min = dir.prec[0]; |
2642 | |
2643 | /* Make both maxima no greater than the upper bound of precision. */ |
2644 | if ((unsigned HOST_WIDE_INT)dir.prec[1] < slen.range.max |
2645 | || slen.range.max >= target_int_max ()) |
2646 | { |
2647 | res.range.max = dir.prec[1]; |
2648 | res.range.unlikely = dir.prec[1]; |
2649 | } |
2650 | |
2651 | /* If precision is constant, set the likely counter to the lesser |
2652 | of it and the maximum string length. Otherwise, if the lower |
2653 | bound of precision is greater than zero, set the likely counter |
2654 | to the minimum. Otherwise set it to zero or one based on |
2655 | the warning level. */ |
2656 | if (dir.prec[0] == dir.prec[1]) |
2657 | res.range.likely |
2658 | = ((unsigned HOST_WIDE_INT)dir.prec[0] < slen.range.max |
2659 | ? dir.prec[0] : slen.range.max); |
2660 | else if (dir.prec[0] > 0) |
2661 | res.range.likely = res.range.min; |
2662 | else |
2663 | res.range.likely = warn_level > 1; |
2664 | } |
2665 | else if (dir.prec[1] >= 0) |
2666 | { |
2667 | res.range.min = 0; |
2668 | if ((unsigned HOST_WIDE_INT)dir.prec[1] < slen.range.max) |
2669 | res.range.max = dir.prec[1]; |
2670 | res.range.likely = dir.prec[1] ? warn_level > 1 : 0; |
2671 | if ((unsigned HOST_WIDE_INT)dir.prec[1] < slen.range.unlikely) |
2672 | res.range.unlikely = dir.prec[1]; |
2673 | } |
2674 | else if (slen.range.min >= target_int_max ()) |
2675 | { |
2676 | res.range.min = 0; |
2677 | res.range.max = HOST_WIDE_INT_MAX; |
2678 | /* At level 1 strings of unknown length are assumed to be |
2679 | empty, while at level 1 they are assumed to be one byte |
2680 | long. */ |
2681 | res.range.likely = warn_level > 1; |
2682 | res.range.unlikely = HOST_WIDE_INT_MAX; |
2683 | } |
2684 | else |
2685 | { |
2686 | /* A string of unknown length unconstrained by precision is |
2687 | assumed to be empty at level 1 and just one character long |
2688 | at higher levels. */ |
2689 | if (res.range.likely >= target_int_max ()) |
2690 | res.range.likely = warn_level > 1; |
2691 | } |
2692 | } |
2693 | |
2694 | /* If the argument isn't a nul-terminated string and the number |
2695 | of bytes on output isn't bounded by precision, set NONSTR. */ |
2696 | if (slen.nonstr && slen.range.min < (unsigned HOST_WIDE_INT)dir.prec[0]) |
2697 | res.nonstr = slen.nonstr; |
2698 | |
2699 | /* Bump up the byte counters if WIDTH is greater. */ |
2700 | return res.adjust_for_width_or_precision (adjust: dir.width); |
2701 | } |
2702 | |
2703 | /* Format plain string (part of the format string itself). */ |
2704 | |
2705 | static fmtresult |
2706 | format_plain (const directive &dir, tree, pointer_query &) |
2707 | { |
2708 | fmtresult res (dir.len); |
2709 | return res; |
2710 | } |
2711 | |
2712 | /* Return true if the RESULT of a directive in a call describe by INFO |
2713 | should be diagnosed given the AVAILable space in the destination. */ |
2714 | |
2715 | static bool |
2716 | should_warn_p (const call_info &info, |
2717 | const result_range &avail, const result_range &result) |
2718 | { |
2719 | if (result.max <= avail.min) |
2720 | { |
2721 | /* The least amount of space remaining in the destination is big |
2722 | enough for the longest output. */ |
2723 | return false; |
2724 | } |
2725 | |
2726 | if (info.bounded) |
2727 | { |
2728 | if (warn_format_trunc == 1 && result.min <= avail.max |
2729 | && info.retval_used ()) |
2730 | { |
2731 | /* The likely amount of space remaining in the destination is big |
2732 | enough for the least output and the return value is used. */ |
2733 | return false; |
2734 | } |
2735 | |
2736 | if (warn_format_trunc == 1 && result.likely <= avail.likely |
2737 | && !info.retval_used ()) |
2738 | { |
2739 | /* The likely amount of space remaining in the destination is big |
2740 | enough for the likely output and the return value is unused. */ |
2741 | return false; |
2742 | } |
2743 | |
2744 | if (warn_format_trunc == 2 |
2745 | && result.likely <= avail.min |
2746 | && (result.max <= avail.min |
2747 | || result.max > HOST_WIDE_INT_MAX)) |
2748 | { |
2749 | /* The minimum amount of space remaining in the destination is big |
2750 | enough for the longest output. */ |
2751 | return false; |
2752 | } |
2753 | } |
2754 | else |
2755 | { |
2756 | if (warn_level == 1 && result.likely <= avail.likely) |
2757 | { |
2758 | /* The likely amount of space remaining in the destination is big |
2759 | enough for the likely output. */ |
2760 | return false; |
2761 | } |
2762 | |
2763 | if (warn_level == 2 |
2764 | && result.likely <= avail.min |
2765 | && (result.max <= avail.min |
2766 | || result.max > HOST_WIDE_INT_MAX)) |
2767 | { |
2768 | /* The minimum amount of space remaining in the destination is big |
2769 | enough for the longest output. */ |
2770 | return false; |
2771 | } |
2772 | } |
2773 | |
2774 | return true; |
2775 | } |
2776 | |
2777 | /* At format string location describe by DIRLOC in a call described |
2778 | by INFO, issue a warning for a directive DIR whose output may be |
2779 | in excess of the available space AVAIL_RANGE in the destination |
2780 | given the formatting result FMTRES. This function does nothing |
2781 | except decide whether to issue a warning for a possible write |
2782 | past the end or truncation and, if so, format the warning. |
2783 | Return true if a warning has been issued. */ |
2784 | |
2785 | static bool |
2786 | maybe_warn (substring_loc &dirloc, location_t argloc, |
2787 | const call_info &info, |
2788 | const result_range &avail_range, const result_range &res, |
2789 | const directive &dir) |
2790 | { |
2791 | if (!should_warn_p (info, avail: avail_range, result: res)) |
2792 | return false; |
2793 | |
2794 | /* A warning will definitely be issued below. */ |
2795 | |
2796 | /* The maximum byte count to reference in the warning. Larger counts |
2797 | imply that the upper bound is unknown (and could be anywhere between |
2798 | RES.MIN + 1 and SIZE_MAX / 2) are printed as "N or more bytes" rather |
2799 | than "between N and X" where X is some huge number. */ |
2800 | unsigned HOST_WIDE_INT maxbytes = target_dir_max (); |
2801 | |
2802 | /* True when there is enough room in the destination for the least |
2803 | amount of a directive's output but not enough for its likely or |
2804 | maximum output. */ |
2805 | bool maybe = (res.min <= avail_range.max |
2806 | && (avail_range.min < res.likely |
2807 | || (res.max < HOST_WIDE_INT_MAX |
2808 | && avail_range.min < res.max))); |
2809 | |
2810 | /* Buffer for the directive in the host character set (used when |
2811 | the source character set is different). */ |
2812 | char hostdir[32]; |
2813 | |
2814 | if (avail_range.min == avail_range.max) |
2815 | { |
2816 | /* The size of the destination region is exact. */ |
2817 | unsigned HOST_WIDE_INT navail = avail_range.max; |
2818 | |
2819 | if (target_to_host (ch: *dir.beg) != '%') |
2820 | { |
2821 | /* For plain character directives (i.e., the format string itself) |
2822 | but not others, point the caret at the first character that's |
2823 | past the end of the destination. */ |
2824 | if (navail < dir.len) |
2825 | dirloc.set_caret_index (dirloc.get_caret_idx () + navail); |
2826 | } |
2827 | |
2828 | if (*dir.beg == '\0') |
2829 | { |
2830 | /* This is the terminating nul. */ |
2831 | gcc_assert (res.min == 1 && res.min == res.max); |
2832 | |
2833 | return fmtwarn (fmt_loc: dirloc, UNKNOWN_LOCATION, NULL, opt: info.warnopt (), |
2834 | gmsgid: info.bounded |
2835 | ? (maybe |
2836 | ? G_("%qE output may be truncated before the " |
2837 | "last format character" ) |
2838 | : G_("%qE output truncated before the last " |
2839 | "format character" )) |
2840 | : (maybe |
2841 | ? G_("%qE may write a terminating nul past the " |
2842 | "end of the destination" ) |
2843 | : G_("%qE writing a terminating nul past the " |
2844 | "end of the destination" )), |
2845 | info.func); |
2846 | } |
2847 | |
2848 | if (res.min == res.max) |
2849 | { |
2850 | const char *d = target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg); |
2851 | if (!info.bounded) |
2852 | return fmtwarn_n (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), n: res.min, |
2853 | singular_gmsgid: "%<%.*s%> directive writing %wu byte into a " |
2854 | "region of size %wu" , |
2855 | plural_gmsgid: "%<%.*s%> directive writing %wu bytes into a " |
2856 | "region of size %wu" , |
2857 | (int) dir.len, d, res.min, navail); |
2858 | else if (maybe) |
2859 | return fmtwarn_n (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), n: res.min, |
2860 | singular_gmsgid: "%<%.*s%> directive output may be truncated " |
2861 | "writing %wu byte into a region of size %wu" , |
2862 | plural_gmsgid: "%<%.*s%> directive output may be truncated " |
2863 | "writing %wu bytes into a region of size %wu" , |
2864 | (int) dir.len, d, res.min, navail); |
2865 | else |
2866 | return fmtwarn_n (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), n: res.min, |
2867 | singular_gmsgid: "%<%.*s%> directive output truncated writing " |
2868 | "%wu byte into a region of size %wu" , |
2869 | plural_gmsgid: "%<%.*s%> directive output truncated writing " |
2870 | "%wu bytes into a region of size %wu" , |
2871 | (int) dir.len, d, res.min, navail); |
2872 | } |
2873 | if (res.min == 0 && res.max < maxbytes) |
2874 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, |
2875 | opt: info.warnopt (), |
2876 | gmsgid: info.bounded |
2877 | ? (maybe |
2878 | ? G_("%<%.*s%> directive output may be truncated " |
2879 | "writing up to %wu bytes into a region of " |
2880 | "size %wu" ) |
2881 | : G_("%<%.*s%> directive output truncated writing " |
2882 | "up to %wu bytes into a region of size %wu" )) |
2883 | : G_("%<%.*s%> directive writing up to %wu bytes " |
2884 | "into a region of size %wu" ), (int) dir.len, |
2885 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
2886 | res.max, navail); |
2887 | |
2888 | if (res.min == 0 && maxbytes <= res.max) |
2889 | /* This is a special case to avoid issuing the potentially |
2890 | confusing warning: |
2891 | writing 0 or more bytes into a region of size 0. */ |
2892 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
2893 | gmsgid: info.bounded |
2894 | ? (maybe |
2895 | ? G_("%<%.*s%> directive output may be truncated " |
2896 | "writing likely %wu or more bytes into a " |
2897 | "region of size %wu" ) |
2898 | : G_("%<%.*s%> directive output truncated writing " |
2899 | "likely %wu or more bytes into a region of " |
2900 | "size %wu" )) |
2901 | : G_("%<%.*s%> directive writing likely %wu or more " |
2902 | "bytes into a region of size %wu" ), (int) dir.len, |
2903 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
2904 | res.likely, navail); |
2905 | |
2906 | if (res.max < maxbytes) |
2907 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
2908 | gmsgid: info.bounded |
2909 | ? (maybe |
2910 | ? G_("%<%.*s%> directive output may be truncated " |
2911 | "writing between %wu and %wu bytes into a " |
2912 | "region of size %wu" ) |
2913 | : G_("%<%.*s%> directive output truncated " |
2914 | "writing between %wu and %wu bytes into a " |
2915 | "region of size %wu" )) |
2916 | : G_("%<%.*s%> directive writing between %wu and " |
2917 | "%wu bytes into a region of size %wu" ), |
2918 | (int) dir.len, |
2919 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
2920 | res.min, res.max, navail); |
2921 | |
2922 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
2923 | gmsgid: info.bounded |
2924 | ? (maybe |
2925 | ? G_("%<%.*s%> directive output may be truncated " |
2926 | "writing %wu or more bytes into a region of " |
2927 | "size %wu" ) |
2928 | : G_("%<%.*s%> directive output truncated writing " |
2929 | "%wu or more bytes into a region of size %wu" )) |
2930 | : G_("%<%.*s%> directive writing %wu or more bytes " |
2931 | "into a region of size %wu" ), (int) dir.len, |
2932 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
2933 | res.min, navail); |
2934 | } |
2935 | |
2936 | /* The size of the destination region is a range. */ |
2937 | |
2938 | if (target_to_host (ch: *dir.beg) != '%') |
2939 | { |
2940 | unsigned HOST_WIDE_INT navail = avail_range.max; |
2941 | |
2942 | /* For plain character directives (i.e., the format string itself) |
2943 | but not others, point the caret at the first character that's |
2944 | past the end of the destination. */ |
2945 | if (navail < dir.len) |
2946 | dirloc.set_caret_index (dirloc.get_caret_idx () + navail); |
2947 | } |
2948 | |
2949 | if (*dir.beg == '\0') |
2950 | { |
2951 | gcc_assert (res.min == 1 && res.min == res.max); |
2952 | |
2953 | return fmtwarn (fmt_loc: dirloc, UNKNOWN_LOCATION, NULL, opt: info.warnopt (), |
2954 | gmsgid: info.bounded |
2955 | ? (maybe |
2956 | ? G_("%qE output may be truncated before the last " |
2957 | "format character" ) |
2958 | : G_("%qE output truncated before the last format " |
2959 | "character" )) |
2960 | : (maybe |
2961 | ? G_("%qE may write a terminating nul past the end " |
2962 | "of the destination" ) |
2963 | : G_("%qE writing a terminating nul past the end " |
2964 | "of the destination" )), info.func); |
2965 | } |
2966 | |
2967 | if (res.min == res.max) |
2968 | { |
2969 | const char *d = target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg); |
2970 | if (!info.bounded) |
2971 | return fmtwarn_n (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), n: res.min, |
2972 | singular_gmsgid: "%<%.*s%> directive writing %wu byte into a region " |
2973 | "of size between %wu and %wu" , |
2974 | plural_gmsgid: "%<%.*s%> directive writing %wu bytes into a region " |
2975 | "of size between %wu and %wu" , (int) dir.len, d, |
2976 | res.min, avail_range.min, avail_range.max); |
2977 | else if (maybe) |
2978 | return fmtwarn_n (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), n: res.min, |
2979 | singular_gmsgid: "%<%.*s%> directive output may be truncated writing " |
2980 | "%wu byte into a region of size between %wu and %wu" , |
2981 | plural_gmsgid: "%<%.*s%> directive output may be truncated writing " |
2982 | "%wu bytes into a region of size between %wu and " |
2983 | "%wu" , (int) dir.len, d, res.min, avail_range.min, |
2984 | avail_range.max); |
2985 | else |
2986 | return fmtwarn_n (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), n: res.min, |
2987 | singular_gmsgid: "%<%.*s%> directive output truncated writing %wu " |
2988 | "byte into a region of size between %wu and %wu" , |
2989 | plural_gmsgid: "%<%.*s%> directive output truncated writing %wu " |
2990 | "bytes into a region of size between %wu and %wu" , |
2991 | (int) dir.len, d, res.min, avail_range.min, |
2992 | avail_range.max); |
2993 | } |
2994 | |
2995 | if (res.min == 0 && res.max < maxbytes) |
2996 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
2997 | gmsgid: info.bounded |
2998 | ? (maybe |
2999 | ? G_("%<%.*s%> directive output may be truncated " |
3000 | "writing up to %wu bytes into a region of size " |
3001 | "between %wu and %wu" ) |
3002 | : G_("%<%.*s%> directive output truncated writing " |
3003 | "up to %wu bytes into a region of size between " |
3004 | "%wu and %wu" )) |
3005 | : G_("%<%.*s%> directive writing up to %wu bytes " |
3006 | "into a region of size between %wu and %wu" ), |
3007 | (int) dir.len, |
3008 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3009 | res.max, avail_range.min, avail_range.max); |
3010 | |
3011 | if (res.min == 0 && maxbytes <= res.max) |
3012 | /* This is a special case to avoid issuing the potentially confusing |
3013 | warning: |
3014 | writing 0 or more bytes into a region of size between 0 and N. */ |
3015 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3016 | gmsgid: info.bounded |
3017 | ? (maybe |
3018 | ? G_("%<%.*s%> directive output may be truncated " |
3019 | "writing likely %wu or more bytes into a region " |
3020 | "of size between %wu and %wu" ) |
3021 | : G_("%<%.*s%> directive output truncated writing " |
3022 | "likely %wu or more bytes into a region of size " |
3023 | "between %wu and %wu" )) |
3024 | : G_("%<%.*s%> directive writing likely %wu or more bytes " |
3025 | "into a region of size between %wu and %wu" ), |
3026 | (int) dir.len, |
3027 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3028 | res.likely, avail_range.min, avail_range.max); |
3029 | |
3030 | if (res.max < maxbytes) |
3031 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3032 | gmsgid: info.bounded |
3033 | ? (maybe |
3034 | ? G_("%<%.*s%> directive output may be truncated " |
3035 | "writing between %wu and %wu bytes into a region " |
3036 | "of size between %wu and %wu" ) |
3037 | : G_("%<%.*s%> directive output truncated writing " |
3038 | "between %wu and %wu bytes into a region of size " |
3039 | "between %wu and %wu" )) |
3040 | : G_("%<%.*s%> directive writing between %wu and " |
3041 | "%wu bytes into a region of size between %wu and " |
3042 | "%wu" ), (int) dir.len, |
3043 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3044 | res.min, res.max, avail_range.min, avail_range.max); |
3045 | |
3046 | return fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3047 | gmsgid: info.bounded |
3048 | ? (maybe |
3049 | ? G_("%<%.*s%> directive output may be truncated writing " |
3050 | "%wu or more bytes into a region of size between " |
3051 | "%wu and %wu" ) |
3052 | : G_("%<%.*s%> directive output truncated writing " |
3053 | "%wu or more bytes into a region of size between " |
3054 | "%wu and %wu" )) |
3055 | : G_("%<%.*s%> directive writing %wu or more bytes " |
3056 | "into a region of size between %wu and %wu" ), |
3057 | (int) dir.len, |
3058 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3059 | res.min, avail_range.min, avail_range.max); |
3060 | } |
3061 | |
3062 | /* Given the formatting result described by RES and NAVAIL, the number |
3063 | of available bytes in the destination, return the range of bytes |
3064 | remaining in the destination. */ |
3065 | |
3066 | static inline result_range |
3067 | bytes_remaining (unsigned HOST_WIDE_INT navail, const format_result &res) |
3068 | { |
3069 | result_range range; |
3070 | |
3071 | if (HOST_WIDE_INT_MAX <= navail) |
3072 | { |
3073 | range.min = range.max = range.likely = range.unlikely = navail; |
3074 | return range; |
3075 | } |
3076 | |
3077 | /* The lower bound of the available range is the available size |
3078 | minus the maximum output size, and the upper bound is the size |
3079 | minus the minimum. */ |
3080 | range.max = res.range.min < navail ? navail - res.range.min : 0; |
3081 | |
3082 | range.likely = res.range.likely < navail ? navail - res.range.likely : 0; |
3083 | |
3084 | if (res.range.max < HOST_WIDE_INT_MAX) |
3085 | range.min = res.range.max < navail ? navail - res.range.max : 0; |
3086 | else |
3087 | range.min = range.likely; |
3088 | |
3089 | range.unlikely = (res.range.unlikely < navail |
3090 | ? navail - res.range.unlikely : 0); |
3091 | |
3092 | return range; |
3093 | } |
3094 | |
3095 | /* Compute the length of the output resulting from the directive DIR |
3096 | in a call described by INFO and update the overall result of the call |
3097 | in *RES. Return true if the directive has been handled. */ |
3098 | |
3099 | static bool |
3100 | format_directive (const call_info &info, |
3101 | format_result *res, const directive &dir, |
3102 | pointer_query &ptr_qry) |
3103 | { |
3104 | /* Offset of the beginning of the directive from the beginning |
3105 | of the format string. */ |
3106 | size_t offset = dir.beg - info.fmtstr; |
3107 | size_t start = offset; |
3108 | size_t length = offset + dir.len - !!dir.len; |
3109 | |
3110 | /* Create a location for the whole directive from the % to the format |
3111 | specifier. */ |
3112 | substring_loc dirloc (info.fmtloc, TREE_TYPE (info.format), |
3113 | offset, start, length); |
3114 | |
3115 | /* Also get the location of the argument if possible. |
3116 | This doesn't work for integer literals or function calls. */ |
3117 | location_t argloc = UNKNOWN_LOCATION; |
3118 | if (dir.arg) |
3119 | argloc = EXPR_LOCATION (dir.arg); |
3120 | |
3121 | /* Bail when there is no function to compute the output length, |
3122 | or when minimum length checking has been disabled. */ |
3123 | if (!dir.fmtfunc || res->range.min >= HOST_WIDE_INT_MAX) |
3124 | return false; |
3125 | |
3126 | /* Compute the range of lengths of the formatted output. */ |
3127 | fmtresult fmtres = dir.fmtfunc (dir, dir.arg, ptr_qry); |
3128 | |
3129 | /* Record whether the output of all directives is known to be |
3130 | bounded by some maximum, implying that their arguments are |
3131 | either known exactly or determined to be in a known range |
3132 | or, for strings, limited by the upper bounds of the arrays |
3133 | they refer to. */ |
3134 | res->knownrange &= fmtres.knownrange; |
3135 | |
3136 | if (!fmtres.knownrange) |
3137 | { |
3138 | /* Only when the range is known, check it against the host value |
3139 | of INT_MAX + (the number of bytes of the "%.*Lf" directive with |
3140 | INT_MAX precision, which is the longest possible output of any |
3141 | single directive). That's the largest valid byte count (though |
3142 | not valid call to a printf-like function because it can never |
3143 | return such a count). Otherwise, the range doesn't correspond |
3144 | to known values of the argument. */ |
3145 | if (fmtres.range.max > target_dir_max ()) |
3146 | { |
3147 | /* Normalize the MAX counter to avoid having to deal with it |
3148 | later. The counter can be less than HOST_WIDE_INT_M1U |
3149 | when compiling for an ILP32 target on an LP64 host. */ |
3150 | fmtres.range.max = HOST_WIDE_INT_M1U; |
3151 | /* Disable exact and maximum length checking after a failure |
3152 | to determine the maximum number of characters (for example |
3153 | for wide characters or wide character strings) but continue |
3154 | tracking the minimum number of characters. */ |
3155 | res->range.max = HOST_WIDE_INT_M1U; |
3156 | } |
3157 | |
3158 | if (fmtres.range.min > target_dir_max ()) |
3159 | { |
3160 | /* Disable exact length checking after a failure to determine |
3161 | even the minimum number of characters (it shouldn't happen |
3162 | except in an error) but keep tracking the minimum and maximum |
3163 | number of characters. */ |
3164 | return true; |
3165 | } |
3166 | } |
3167 | |
3168 | /* Buffer for the directive in the host character set (used when |
3169 | the source character set is different). */ |
3170 | char hostdir[32]; |
3171 | |
3172 | int dirlen = dir.len; |
3173 | |
3174 | if (fmtres.nullp) |
3175 | { |
3176 | fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3177 | gmsgid: "%<%.*s%> directive argument is null" , |
3178 | dirlen, target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg)); |
3179 | |
3180 | /* Don't bother processing the rest of the format string. */ |
3181 | res->warned = true; |
3182 | res->range.min = HOST_WIDE_INT_M1U; |
3183 | res->range.max = HOST_WIDE_INT_M1U; |
3184 | return false; |
3185 | } |
3186 | |
3187 | /* Compute the number of available bytes in the destination. There |
3188 | must always be at least one byte of space for the terminating |
3189 | NUL that's appended after the format string has been processed. */ |
3190 | result_range avail_range = bytes_remaining (navail: info.objsize, res: *res); |
3191 | |
3192 | /* If the argument aliases a part of the destination of the formatted |
3193 | call at offset FMTRES.DST_OFFSET append the directive and its result |
3194 | to the set of aliases for later processing. */ |
3195 | if (fmtres.dst_offset != HOST_WIDE_INT_MIN) |
3196 | res->append_alias (d: dir, off: fmtres.dst_offset, resrng: fmtres.range); |
3197 | |
3198 | bool warned = res->warned; |
3199 | |
3200 | if (!warned) |
3201 | warned = maybe_warn (dirloc, argloc, info, avail_range, |
3202 | res: fmtres.range, dir); |
3203 | |
3204 | /* Bump up the total maximum if it isn't too big. */ |
3205 | if (res->range.max < HOST_WIDE_INT_MAX |
3206 | && fmtres.range.max < HOST_WIDE_INT_MAX) |
3207 | res->range.max += fmtres.range.max; |
3208 | |
3209 | /* Raise the total unlikely maximum by the larger of the maximum |
3210 | and the unlikely maximum. */ |
3211 | unsigned HOST_WIDE_INT save = res->range.unlikely; |
3212 | if (fmtres.range.max < fmtres.range.unlikely) |
3213 | res->range.unlikely += fmtres.range.unlikely; |
3214 | else |
3215 | res->range.unlikely += fmtres.range.max; |
3216 | |
3217 | if (res->range.unlikely < save) |
3218 | res->range.unlikely = HOST_WIDE_INT_M1U; |
3219 | |
3220 | res->range.min += fmtres.range.min; |
3221 | res->range.likely += fmtres.range.likely; |
3222 | |
3223 | /* Has the minimum directive output length exceeded the maximum |
3224 | of 4095 bytes required to be supported? */ |
3225 | bool minunder4k = fmtres.range.min < 4096; |
3226 | bool maxunder4k = fmtres.range.max < 4096; |
3227 | /* Clear POSUNDER4K in the overall result if the maximum has exceeded |
3228 | the 4k (this is necessary to avoid the return value optimization |
3229 | that may not be safe in the maximum case). */ |
3230 | if (!maxunder4k) |
3231 | res->posunder4k = false; |
3232 | /* Also clear POSUNDER4K if the directive may fail. */ |
3233 | if (fmtres.mayfail) |
3234 | res->posunder4k = false; |
3235 | |
3236 | if (!warned |
3237 | /* Only warn at level 2. */ |
3238 | && warn_level > 1 |
3239 | /* Only warn for string functions. */ |
3240 | && info.is_string_func () |
3241 | && (!minunder4k |
3242 | || (!maxunder4k && fmtres.range.max < HOST_WIDE_INT_MAX))) |
3243 | { |
3244 | /* The directive output may be longer than the maximum required |
3245 | to be handled by an implementation according to 7.21.6.1, p15 |
3246 | of C11. Warn on this only at level 2 but remember this and |
3247 | prevent folding the return value when done. This allows for |
3248 | the possibility of the actual libc call failing due to ENOMEM |
3249 | (like Glibc does with very large precision or width). |
3250 | Issue the "may exceed" warning only for string functions and |
3251 | not for fprintf or printf. */ |
3252 | |
3253 | if (fmtres.range.min == fmtres.range.max) |
3254 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3255 | gmsgid: "%<%.*s%> directive output of %wu bytes exceeds " |
3256 | "minimum required size of 4095" , dirlen, |
3257 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3258 | fmtres.range.min); |
3259 | else if (!minunder4k) |
3260 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3261 | gmsgid: "%<%.*s%> directive output between %wu and %wu " |
3262 | "bytes exceeds minimum required size of 4095" , |
3263 | dirlen, |
3264 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3265 | fmtres.range.min, fmtres.range.max); |
3266 | else if (!info.retval_used () && info.is_string_func ()) |
3267 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3268 | gmsgid: "%<%.*s%> directive output between %wu and %wu " |
3269 | "bytes may exceed minimum required size of " |
3270 | "4095" , |
3271 | dirlen, |
3272 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3273 | fmtres.range.min, fmtres.range.max); |
3274 | } |
3275 | |
3276 | /* Has the likely and maximum directive output exceeded INT_MAX? */ |
3277 | bool likelyximax = *dir.beg && res->range.likely > target_int_max (); |
3278 | /* Don't consider the maximum to be in excess when it's the result |
3279 | of a string of unknown length (i.e., whose maximum has been set |
3280 | to be greater than or equal to HOST_WIDE_INT_MAX. */ |
3281 | bool maxximax = (*dir.beg |
3282 | && res->range.max > target_int_max () |
3283 | && res->range.max < HOST_WIDE_INT_MAX); |
3284 | |
3285 | if (!warned |
3286 | /* Warn for the likely output size at level 1. */ |
3287 | && (likelyximax |
3288 | /* But only warn for the maximum at level 2. */ |
3289 | || (warn_level > 1 |
3290 | && maxximax |
3291 | && fmtres.range.max < HOST_WIDE_INT_MAX))) |
3292 | { |
3293 | if (fmtres.range.min > target_int_max ()) |
3294 | { |
3295 | /* The directive output exceeds INT_MAX bytes. */ |
3296 | if (fmtres.range.min == fmtres.range.max) |
3297 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3298 | gmsgid: "%<%.*s%> directive output of %wu bytes exceeds " |
3299 | "%<INT_MAX%>" , dirlen, |
3300 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3301 | fmtres.range.min); |
3302 | else |
3303 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3304 | gmsgid: "%<%.*s%> directive output between %wu and " |
3305 | "%wu bytes exceeds %<INT_MAX%>" , dirlen, |
3306 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3307 | fmtres.range.min, fmtres.range.max); |
3308 | } |
3309 | else if (res->range.min > target_int_max ()) |
3310 | { |
3311 | /* The directive output is under INT_MAX but causes the result |
3312 | to exceed INT_MAX bytes. */ |
3313 | if (fmtres.range.min == fmtres.range.max) |
3314 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3315 | gmsgid: "%<%.*s%> directive output of %wu bytes causes " |
3316 | "result to exceed %<INT_MAX%>" , dirlen, |
3317 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3318 | fmtres.range.min); |
3319 | else |
3320 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3321 | gmsgid: "%<%.*s%> directive output between %wu and " |
3322 | "%wu bytes causes result to exceed %<INT_MAX%>" , |
3323 | dirlen, |
3324 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3325 | fmtres.range.min, fmtres.range.max); |
3326 | } |
3327 | else if ((!info.retval_used () || !info.bounded) |
3328 | && (info.is_string_func ())) |
3329 | /* Warn for calls to string functions that either aren't bounded |
3330 | (sprintf) or whose return value isn't used. */ |
3331 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3332 | gmsgid: "%<%.*s%> directive output between %wu and " |
3333 | "%wu bytes may cause result to exceed " |
3334 | "%<INT_MAX%>" , dirlen, |
3335 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg), |
3336 | fmtres.range.min, fmtres.range.max); |
3337 | } |
3338 | |
3339 | if (!warned && fmtres.nonstr) |
3340 | { |
3341 | warned = fmtwarn (fmt_loc: dirloc, param_loc: argloc, NULL, opt: info.warnopt (), |
3342 | gmsgid: "%<%.*s%> directive argument is not a nul-terminated " |
3343 | "string" , |
3344 | dirlen, |
3345 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg)); |
3346 | if (warned && DECL_P (fmtres.nonstr)) |
3347 | inform (DECL_SOURCE_LOCATION (fmtres.nonstr), |
3348 | "referenced argument declared here" ); |
3349 | return false; |
3350 | } |
3351 | |
3352 | if (warned && fmtres.range.min < fmtres.range.likely |
3353 | && fmtres.range.likely < fmtres.range.max) |
3354 | inform_n (info.fmtloc, fmtres.range.likely, |
3355 | "assuming directive output of %wu byte" , |
3356 | "assuming directive output of %wu bytes" , |
3357 | fmtres.range.likely); |
3358 | |
3359 | if (warned && fmtres.argmin) |
3360 | { |
3361 | if (fmtres.argmin == fmtres.argmax) |
3362 | inform (info.fmtloc, "directive argument %qE" , fmtres.argmin); |
3363 | else if (fmtres.knownrange) |
3364 | inform (info.fmtloc, "directive argument in the range [%E, %E]" , |
3365 | fmtres.argmin, fmtres.argmax); |
3366 | else |
3367 | inform (info.fmtloc, |
3368 | "using the range [%E, %E] for directive argument" , |
3369 | fmtres.argmin, fmtres.argmax); |
3370 | } |
3371 | |
3372 | res->warned |= warned; |
3373 | |
3374 | if (!dir.beg[0] && res->warned) |
3375 | { |
3376 | location_t callloc = gimple_location (g: info.callstmt); |
3377 | |
3378 | unsigned HOST_WIDE_INT min = res->range.min; |
3379 | unsigned HOST_WIDE_INT max = res->range.max; |
3380 | |
3381 | if (info.objsize < HOST_WIDE_INT_MAX) |
3382 | { |
3383 | /* If a warning has been issued for buffer overflow or truncation |
3384 | help the user figure out how big a buffer they need. */ |
3385 | |
3386 | if (min == max) |
3387 | inform_n (callloc, min, |
3388 | "%qE output %wu byte into a destination of size %wu" , |
3389 | "%qE output %wu bytes into a destination of size %wu" , |
3390 | info.func, min, info.objsize); |
3391 | else if (max < HOST_WIDE_INT_MAX) |
3392 | inform (callloc, |
3393 | "%qE output between %wu and %wu bytes into " |
3394 | "a destination of size %wu" , |
3395 | info.func, min, max, info.objsize); |
3396 | else if (min < res->range.likely && res->range.likely < max) |
3397 | inform (callloc, |
3398 | "%qE output %wu or more bytes (assuming %wu) into " |
3399 | "a destination of size %wu" , |
3400 | info.func, min, res->range.likely, info.objsize); |
3401 | else |
3402 | inform (callloc, |
3403 | "%qE output %wu or more bytes into a destination of size " |
3404 | "%wu" , |
3405 | info.func, min, info.objsize); |
3406 | } |
3407 | else if (!info.is_string_func ()) |
3408 | { |
3409 | /* If the warning is for a file function like fprintf |
3410 | of printf with no destination size just print the computed |
3411 | result. */ |
3412 | if (min == max) |
3413 | inform_n (callloc, min, |
3414 | "%qE output %wu byte" , "%qE output %wu bytes" , |
3415 | info.func, min); |
3416 | else if (max < HOST_WIDE_INT_MAX) |
3417 | inform (callloc, |
3418 | "%qE output between %wu and %wu bytes" , |
3419 | info.func, min, max); |
3420 | else if (min < res->range.likely && res->range.likely < max) |
3421 | inform (callloc, |
3422 | "%qE output %wu or more bytes (assuming %wu)" , |
3423 | info.func, min, res->range.likely); |
3424 | else |
3425 | inform (callloc, |
3426 | "%qE output %wu or more bytes" , |
3427 | info.func, min); |
3428 | } |
3429 | } |
3430 | |
3431 | if (dump_file && *dir.beg) |
3432 | { |
3433 | fprintf (stream: dump_file, |
3434 | format: " Result: " |
3435 | HOST_WIDE_INT_PRINT_DEC ", " HOST_WIDE_INT_PRINT_DEC ", " |
3436 | HOST_WIDE_INT_PRINT_DEC ", " HOST_WIDE_INT_PRINT_DEC " (" |
3437 | HOST_WIDE_INT_PRINT_DEC ", " HOST_WIDE_INT_PRINT_DEC ", " |
3438 | HOST_WIDE_INT_PRINT_DEC ", " HOST_WIDE_INT_PRINT_DEC ")\n" , |
3439 | fmtres.range.min, fmtres.range.likely, |
3440 | fmtres.range.max, fmtres.range.unlikely, |
3441 | res->range.min, res->range.likely, |
3442 | res->range.max, res->range.unlikely); |
3443 | } |
3444 | |
3445 | return true; |
3446 | } |
3447 | |
3448 | /* Parse a format directive in function call described by INFO starting |
3449 | at STR and populate DIR structure. Bump up *ARGNO by the number of |
3450 | arguments extracted for the directive. Return the length of |
3451 | the directive. */ |
3452 | |
3453 | static size_t |
3454 | parse_directive (call_info &info, |
3455 | directive &dir, format_result *res, |
3456 | const char *str, unsigned *argno, |
3457 | range_query *query) |
3458 | { |
3459 | const char *pcnt = strchr (s: str, c: target_percent); |
3460 | dir.beg = str; |
3461 | |
3462 | if (size_t len = pcnt ? pcnt - str : *str ? strlen (s: str) : 1) |
3463 | { |
3464 | /* This directive is either a plain string or the terminating nul |
3465 | (which isn't really a directive but it simplifies things to |
3466 | handle it as if it were). */ |
3467 | dir.len = len; |
3468 | dir.fmtfunc = format_plain; |
3469 | |
3470 | if (dump_file) |
3471 | { |
3472 | fprintf (stream: dump_file, format: " Directive %u at offset " |
3473 | HOST_WIDE_INT_PRINT_UNSIGNED ": \"%.*s\", " |
3474 | "length = " HOST_WIDE_INT_PRINT_UNSIGNED "\n" , |
3475 | dir.dirno, |
3476 | (unsigned HOST_WIDE_INT)(size_t)(dir.beg - info.fmtstr), |
3477 | (int)dir.len, dir.beg, (unsigned HOST_WIDE_INT) dir.len); |
3478 | } |
3479 | |
3480 | return len - !*str; |
3481 | } |
3482 | |
3483 | /* Set the directive argument's number to correspond to its position |
3484 | in the formatted function call's argument list. */ |
3485 | dir.argno = *argno; |
3486 | |
3487 | const char *pf = pcnt + 1; |
3488 | |
3489 | /* POSIX numbered argument index or zero when none. */ |
3490 | HOST_WIDE_INT dollar = 0; |
3491 | |
3492 | /* With and precision. -1 when not specified, HOST_WIDE_INT_MIN |
3493 | when given by a va_list argument, and a non-negative value |
3494 | when specified in the format string itself. */ |
3495 | HOST_WIDE_INT width = -1; |
3496 | HOST_WIDE_INT precision = -1; |
3497 | |
3498 | /* Pointers to the beginning of the width and precision decimal |
3499 | string (if any) within the directive. */ |
3500 | const char *pwidth = 0; |
3501 | const char *pprec = 0; |
3502 | |
3503 | /* When the value of the decimal string that specifies width or |
3504 | precision is out of range, points to the digit that causes |
3505 | the value to exceed the limit. */ |
3506 | const char *werange = NULL; |
3507 | const char *perange = NULL; |
3508 | |
3509 | /* Width specified via the asterisk. Need not be INTEGER_CST. |
3510 | For vararg functions set to void_node. */ |
3511 | tree star_width = NULL_TREE; |
3512 | |
3513 | /* Width specified via the asterisk. Need not be INTEGER_CST. |
3514 | For vararg functions set to void_node. */ |
3515 | tree star_precision = NULL_TREE; |
3516 | |
3517 | if (ISDIGIT (target_to_host (*pf))) |
3518 | { |
3519 | /* This could be either a POSIX positional argument, the '0' |
3520 | flag, or a width, depending on what follows. Store it as |
3521 | width and sort it out later after the next character has |
3522 | been seen. */ |
3523 | pwidth = pf; |
3524 | width = target_strtowi (ps: &pf, erange: &werange); |
3525 | } |
3526 | else if (target_to_host (ch: *pf) == '*') |
3527 | { |
3528 | /* Similarly to the block above, this could be either a POSIX |
3529 | positional argument or a width, depending on what follows. */ |
3530 | if (*argno < gimple_call_num_args (gs: info.callstmt)) |
3531 | star_width = gimple_call_arg (gs: info.callstmt, index: (*argno)++); |
3532 | else |
3533 | star_width = void_node; |
3534 | ++pf; |
3535 | } |
3536 | |
3537 | if (target_to_host (ch: *pf) == '$') |
3538 | { |
3539 | /* Handle the POSIX dollar sign which references the 1-based |
3540 | positional argument number. */ |
3541 | if (width != -1) |
3542 | dollar = width + info.argidx; |
3543 | else if (star_width |
3544 | && TREE_CODE (star_width) == INTEGER_CST |
3545 | && (TYPE_PRECISION (TREE_TYPE (star_width)) |
3546 | <= TYPE_PRECISION (integer_type_node))) |
3547 | dollar = width + tree_to_shwi (star_width); |
3548 | |
3549 | /* Bail when the numbered argument is out of range (it will |
3550 | have already been diagnosed by -Wformat). */ |
3551 | if (dollar == 0 |
3552 | || dollar == (int)info.argidx |
3553 | || dollar > gimple_call_num_args (gs: info.callstmt)) |
3554 | return false; |
3555 | |
3556 | --dollar; |
3557 | |
3558 | star_width = NULL_TREE; |
3559 | width = -1; |
3560 | ++pf; |
3561 | } |
3562 | |
3563 | if (dollar || !star_width) |
3564 | { |
3565 | if (width != -1) |
3566 | { |
3567 | if (width == 0) |
3568 | { |
3569 | /* The '0' that has been interpreted as a width above is |
3570 | actually a flag. Reset HAVE_WIDTH, set the '0' flag, |
3571 | and continue processing other flags. */ |
3572 | width = -1; |
3573 | dir.set_flag ('0'); |
3574 | } |
3575 | else if (!dollar) |
3576 | { |
3577 | /* (Non-zero) width has been seen. The next character |
3578 | is either a period or a digit. */ |
3579 | goto start_precision; |
3580 | } |
3581 | } |
3582 | /* When either '$' has been seen, or width has not been seen, |
3583 | the next field is the optional flags followed by an optional |
3584 | width. */ |
3585 | for ( ; ; ) { |
3586 | switch (target_to_host (ch: *pf)) |
3587 | { |
3588 | case ' ': |
3589 | case '0': |
3590 | case '+': |
3591 | case '-': |
3592 | case '#': |
3593 | dir.set_flag (target_to_host (ch: *pf++)); |
3594 | break; |
3595 | |
3596 | default: |
3597 | goto start_width; |
3598 | } |
3599 | } |
3600 | |
3601 | start_width: |
3602 | if (ISDIGIT (target_to_host (*pf))) |
3603 | { |
3604 | werange = 0; |
3605 | pwidth = pf; |
3606 | width = target_strtowi (ps: &pf, erange: &werange); |
3607 | } |
3608 | else if (target_to_host (ch: *pf) == '*') |
3609 | { |
3610 | if (*argno < gimple_call_num_args (gs: info.callstmt)) |
3611 | star_width = gimple_call_arg (gs: info.callstmt, index: (*argno)++); |
3612 | else |
3613 | { |
3614 | /* This is (likely) a va_list. It could also be an invalid |
3615 | call with insufficient arguments. */ |
3616 | star_width = void_node; |
3617 | } |
3618 | ++pf; |
3619 | } |
3620 | else if (target_to_host (ch: *pf) == '\'') |
3621 | { |
3622 | /* The POSIX apostrophe indicating a numeric grouping |
3623 | in the current locale. Even though it's possible to |
3624 | estimate the upper bound on the size of the output |
3625 | based on the number of digits it probably isn't worth |
3626 | continuing. */ |
3627 | return 0; |
3628 | } |
3629 | } |
3630 | |
3631 | start_precision: |
3632 | if (target_to_host (ch: *pf) == '.') |
3633 | { |
3634 | ++pf; |
3635 | |
3636 | if (ISDIGIT (target_to_host (*pf))) |
3637 | { |
3638 | pprec = pf; |
3639 | precision = target_strtowi (ps: &pf, erange: &perange); |
3640 | } |
3641 | else if (target_to_host (ch: *pf) == '*') |
3642 | { |
3643 | if (*argno < gimple_call_num_args (gs: info.callstmt)) |
3644 | star_precision = gimple_call_arg (gs: info.callstmt, index: (*argno)++); |
3645 | else |
3646 | { |
3647 | /* This is (likely) a va_list. It could also be an invalid |
3648 | call with insufficient arguments. */ |
3649 | star_precision = void_node; |
3650 | } |
3651 | ++pf; |
3652 | } |
3653 | else |
3654 | { |
3655 | /* The decimal precision or the asterisk are optional. |
3656 | When neither is specified it's taken to be zero. */ |
3657 | precision = 0; |
3658 | } |
3659 | } |
3660 | |
3661 | switch (target_to_host (ch: *pf)) |
3662 | { |
3663 | case 'h': |
3664 | if (target_to_host (ch: pf[1]) == 'h') |
3665 | { |
3666 | ++pf; |
3667 | dir.modifier = FMT_LEN_hh; |
3668 | } |
3669 | else |
3670 | dir.modifier = FMT_LEN_h; |
3671 | ++pf; |
3672 | break; |
3673 | |
3674 | case 'j': |
3675 | dir.modifier = FMT_LEN_j; |
3676 | ++pf; |
3677 | break; |
3678 | |
3679 | case 'L': |
3680 | dir.modifier = FMT_LEN_L; |
3681 | ++pf; |
3682 | break; |
3683 | |
3684 | case 'l': |
3685 | if (target_to_host (ch: pf[1]) == 'l') |
3686 | { |
3687 | ++pf; |
3688 | dir.modifier = FMT_LEN_ll; |
3689 | } |
3690 | else |
3691 | dir.modifier = FMT_LEN_l; |
3692 | ++pf; |
3693 | break; |
3694 | |
3695 | case 't': |
3696 | dir.modifier = FMT_LEN_t; |
3697 | ++pf; |
3698 | break; |
3699 | |
3700 | case 'z': |
3701 | dir.modifier = FMT_LEN_z; |
3702 | ++pf; |
3703 | break; |
3704 | } |
3705 | |
3706 | switch (target_to_host (ch: *pf)) |
3707 | { |
3708 | /* Handle a sole '%' character the same as "%%" but since it's |
3709 | undefined prevent the result from being folded. */ |
3710 | case '\0': |
3711 | --pf; |
3712 | res->range.min = res->range.max = HOST_WIDE_INT_M1U; |
3713 | /* FALLTHRU */ |
3714 | case '%': |
3715 | dir.fmtfunc = format_percent; |
3716 | break; |
3717 | |
3718 | case 'a': |
3719 | case 'A': |
3720 | case 'e': |
3721 | case 'E': |
3722 | case 'f': |
3723 | case 'F': |
3724 | case 'g': |
3725 | case 'G': |
3726 | res->floating = true; |
3727 | dir.fmtfunc = format_floating; |
3728 | break; |
3729 | |
3730 | case 'd': |
3731 | case 'i': |
3732 | case 'o': |
3733 | case 'u': |
3734 | case 'x': |
3735 | case 'X': |
3736 | dir.fmtfunc = format_integer; |
3737 | break; |
3738 | |
3739 | case 'b': |
3740 | case 'B': |
3741 | dir.fmtfunc = format_integer; |
3742 | break; |
3743 | |
3744 | case 'p': |
3745 | /* The %p output is implementation-defined. It's possible |
3746 | to determine this format but due to extensions (especially |
3747 | those of the Linux kernel -- see bug 78512) the first %p |
3748 | in the format string disables any further processing. */ |
3749 | return false; |
3750 | |
3751 | case 'n': |
3752 | /* %n has side-effects even when nothing is actually printed to |
3753 | any buffer. */ |
3754 | info.nowrite = false; |
3755 | dir.fmtfunc = format_none; |
3756 | break; |
3757 | |
3758 | case 'C': |
3759 | case 'c': |
3760 | /* POSIX wide character and C/POSIX narrow character. */ |
3761 | dir.fmtfunc = format_character; |
3762 | break; |
3763 | |
3764 | case 'S': |
3765 | case 's': |
3766 | /* POSIX wide string and C/POSIX narrow character string. */ |
3767 | dir.fmtfunc = format_string; |
3768 | break; |
3769 | |
3770 | default: |
3771 | /* Unknown conversion specification. */ |
3772 | return 0; |
3773 | } |
3774 | |
3775 | dir.specifier = target_to_host (ch: *pf++); |
3776 | |
3777 | /* Store the length of the format directive. */ |
3778 | dir.len = pf - pcnt; |
3779 | |
3780 | /* Buffer for the directive in the host character set (used when |
3781 | the source character set is different). */ |
3782 | char hostdir[32]; |
3783 | |
3784 | if (star_width) |
3785 | { |
3786 | if (INTEGRAL_TYPE_P (TREE_TYPE (star_width))) |
3787 | dir.set_width (arg: star_width, query); |
3788 | else |
3789 | { |
3790 | /* Width specified by a va_list takes on the range [0, -INT_MIN] |
3791 | (width is the absolute value of that specified). */ |
3792 | dir.width[0] = 0; |
3793 | dir.width[1] = target_int_max () + 1; |
3794 | } |
3795 | } |
3796 | else |
3797 | { |
3798 | if (width == HOST_WIDE_INT_MAX && werange) |
3799 | { |
3800 | size_t begin = dir.beg - info.fmtstr + (pwidth - pcnt); |
3801 | size_t caret = begin + (werange - pcnt); |
3802 | size_t end = pf - info.fmtstr - 1; |
3803 | |
3804 | /* Create a location for the width part of the directive, |
3805 | pointing the caret at the first out-of-range digit. */ |
3806 | substring_loc dirloc (info.fmtloc, TREE_TYPE (info.format), |
3807 | caret, begin, end); |
3808 | |
3809 | fmtwarn (fmt_loc: dirloc, UNKNOWN_LOCATION, NULL, opt: info.warnopt (), |
3810 | gmsgid: "%<%.*s%> directive width out of range" , (int) dir.len, |
3811 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg)); |
3812 | } |
3813 | |
3814 | dir.set_width (width); |
3815 | } |
3816 | |
3817 | if (star_precision) |
3818 | { |
3819 | if (INTEGRAL_TYPE_P (TREE_TYPE (star_precision))) |
3820 | dir.set_precision (arg: star_precision, query); |
3821 | else |
3822 | { |
3823 | /* Precision specified by a va_list takes on the range [-1, INT_MAX] |
3824 | (unlike width, negative precision is ignored). */ |
3825 | dir.prec[0] = -1; |
3826 | dir.prec[1] = target_int_max (); |
3827 | } |
3828 | } |
3829 | else |
3830 | { |
3831 | if (precision == HOST_WIDE_INT_MAX && perange) |
3832 | { |
3833 | size_t begin = dir.beg - info.fmtstr + (pprec - pcnt) - 1; |
3834 | size_t caret = dir.beg - info.fmtstr + (perange - pcnt) - 1; |
3835 | size_t end = pf - info.fmtstr - 2; |
3836 | |
3837 | /* Create a location for the precision part of the directive, |
3838 | including the leading period, pointing the caret at the first |
3839 | out-of-range digit . */ |
3840 | substring_loc dirloc (info.fmtloc, TREE_TYPE (info.format), |
3841 | caret, begin, end); |
3842 | |
3843 | fmtwarn (fmt_loc: dirloc, UNKNOWN_LOCATION, NULL, opt: info.warnopt (), |
3844 | gmsgid: "%<%.*s%> directive precision out of range" , (int) dir.len, |
3845 | target_to_host (hostr: hostdir, hostsz: sizeof hostdir, targstr: dir.beg)); |
3846 | } |
3847 | |
3848 | dir.set_precision (precision); |
3849 | } |
3850 | |
3851 | /* Extract the argument if the directive takes one and if it's |
3852 | available (e.g., the function doesn't take a va_list). Treat |
3853 | missing arguments the same as va_list, even though they will |
3854 | have likely already been diagnosed by -Wformat. */ |
3855 | if (dir.specifier != '%' |
3856 | && *argno < gimple_call_num_args (gs: info.callstmt)) |
3857 | dir.arg = gimple_call_arg (gs: info.callstmt, index: dollar ? dollar : (*argno)++); |
3858 | |
3859 | if (dump_file) |
3860 | { |
3861 | fprintf (stream: dump_file, |
3862 | format: " Directive %u at offset " HOST_WIDE_INT_PRINT_UNSIGNED |
3863 | ": \"%.*s\"" , |
3864 | dir.dirno, |
3865 | (unsigned HOST_WIDE_INT)(size_t)(dir.beg - info.fmtstr), |
3866 | (int)dir.len, dir.beg); |
3867 | if (star_width) |
3868 | { |
3869 | if (dir.width[0] == dir.width[1]) |
3870 | fprintf (stream: dump_file, format: ", width = " HOST_WIDE_INT_PRINT_DEC, |
3871 | dir.width[0]); |
3872 | else |
3873 | fprintf (stream: dump_file, |
3874 | format: ", width in range [" HOST_WIDE_INT_PRINT_DEC |
3875 | ", " HOST_WIDE_INT_PRINT_DEC "]" , |
3876 | dir.width[0], dir.width[1]); |
3877 | } |
3878 | |
3879 | if (star_precision) |
3880 | { |
3881 | if (dir.prec[0] == dir.prec[1]) |
3882 | fprintf (stream: dump_file, format: ", precision = " HOST_WIDE_INT_PRINT_DEC, |
3883 | dir.prec[0]); |
3884 | else |
3885 | fprintf (stream: dump_file, |
3886 | format: ", precision in range [" HOST_WIDE_INT_PRINT_DEC |
3887 | HOST_WIDE_INT_PRINT_DEC "]" , |
3888 | dir.prec[0], dir.prec[1]); |
3889 | } |
3890 | fputc (c: '\n', stream: dump_file); |
3891 | } |
3892 | |
3893 | return dir.len; |
3894 | } |
3895 | |
3896 | /* Diagnose overlap between destination and %s directive arguments. */ |
3897 | |
3898 | static void |
3899 | maybe_warn_overlap (call_info &info, format_result *res) |
3900 | { |
3901 | /* Two vectors of 1-based indices corresponding to either certainly |
3902 | or possibly aliasing arguments. */ |
3903 | auto_vec<int, 16> aliasarg[2]; |
3904 | |
3905 | /* Go through the array of potentially aliasing directives and collect |
3906 | argument numbers of those that do or may overlap the destination |
3907 | object given the full result. */ |
3908 | for (unsigned i = 0; i != res->alias_count; ++i) |
3909 | { |
3910 | const format_result::alias_info &alias = res->aliases[i]; |
3911 | |
3912 | enum { possible = -1, none = 0, certain = 1 } overlap = none; |
3913 | |
3914 | /* If the precision is zero there is no overlap. (This only |
3915 | considers %s directives and ignores %n.) */ |
3916 | if (alias.dir.prec[0] == 0 && alias.dir.prec[1] == 0) |
3917 | continue; |
3918 | |
3919 | if (alias.offset == HOST_WIDE_INT_MAX |
3920 | || info.dst_offset == HOST_WIDE_INT_MAX) |
3921 | overlap = possible; |
3922 | else if (alias.offset == info.dst_offset) |
3923 | overlap = alias.dir.prec[0] == 0 ? possible : certain; |
3924 | else |
3925 | { |
3926 | /* Determine overlap from the range of output and offsets |
3927 | into the same destination as the source, and rule out |
3928 | impossible overlap. */ |
3929 | unsigned HOST_WIDE_INT albeg = alias.offset; |
3930 | unsigned HOST_WIDE_INT dstbeg = info.dst_offset; |
3931 | |
3932 | unsigned HOST_WIDE_INT alend = albeg + alias.range.min; |
3933 | unsigned HOST_WIDE_INT dstend = dstbeg + res->range.min - 1; |
3934 | |
3935 | if ((albeg <= dstbeg && alend > dstbeg) |
3936 | || (albeg >= dstbeg && albeg < dstend)) |
3937 | overlap = certain; |
3938 | else |
3939 | { |
3940 | alend = albeg + alias.range.max; |
3941 | if (alend < albeg) |
3942 | alend = HOST_WIDE_INT_M1U; |
3943 | |
3944 | dstend = dstbeg + res->range.max - 1; |
3945 | if (dstend < dstbeg) |
3946 | dstend = HOST_WIDE_INT_M1U; |
3947 | |
3948 | if ((albeg >= dstbeg && albeg <= dstend) |
3949 | || (alend >= dstbeg && alend <= dstend)) |
3950 | overlap = possible; |
3951 | } |
3952 | } |
3953 | |
3954 | if (overlap == none) |
3955 | continue; |
3956 | |
3957 | /* Append the 1-based argument number. */ |
3958 | aliasarg[overlap != certain].safe_push (obj: alias.dir.argno + 1); |
3959 | |
3960 | /* Disable any kind of optimization. */ |
3961 | res->range.unlikely = HOST_WIDE_INT_M1U; |
3962 | } |
3963 | |
3964 | tree arg0 = gimple_call_arg (gs: info.callstmt, index: 0); |
3965 | location_t loc = gimple_location (g: info.callstmt); |
3966 | |
3967 | bool aliaswarn = false; |
3968 | |
3969 | unsigned ncertain = aliasarg[0].length (); |
3970 | unsigned npossible = aliasarg[1].length (); |
3971 | if (ncertain && npossible) |
3972 | { |
3973 | /* If there are multiple arguments that overlap, some certainly |
3974 | and some possibly, handle both sets in a single diagnostic. */ |
3975 | aliaswarn |
3976 | = warning_at (loc, OPT_Wrestrict, |
3977 | "%qE arguments %Z and maybe %Z overlap destination " |
3978 | "object %qE" , |
3979 | info.func, aliasarg[0].address (), ncertain, |
3980 | aliasarg[1].address (), npossible, |
3981 | info.dst_origin); |
3982 | } |
3983 | else if (ncertain) |
3984 | { |
3985 | /* There is only one set of two or more arguments and they all |
3986 | certainly overlap the destination. */ |
3987 | aliaswarn |
3988 | = warning_n (loc, OPT_Wrestrict, ncertain, |
3989 | "%qE argument %Z overlaps destination object %qE" , |
3990 | "%qE arguments %Z overlap destination object %qE" , |
3991 | info.func, aliasarg[0].address (), ncertain, |
3992 | info.dst_origin); |
3993 | } |
3994 | else if (npossible) |
3995 | { |
3996 | /* There is only one set of two or more arguments and they all |
3997 | may overlap (but need not). */ |
3998 | aliaswarn |
3999 | = warning_n (loc, OPT_Wrestrict, npossible, |
4000 | "%qE argument %Z may overlap destination object %qE" , |
4001 | "%qE arguments %Z may overlap destination object %qE" , |
4002 | info.func, aliasarg[1].address (), npossible, |
4003 | info.dst_origin); |
4004 | } |
4005 | |
4006 | if (aliaswarn) |
4007 | { |
4008 | res->warned = true; |
4009 | |
4010 | if (info.dst_origin != arg0) |
4011 | { |
4012 | /* If its location is different from the first argument of the call |
4013 | point either at the destination object itself or at the expression |
4014 | that was used to determine the overlap. */ |
4015 | loc = (DECL_P (info.dst_origin) |
4016 | ? DECL_SOURCE_LOCATION (info.dst_origin) |
4017 | : EXPR_LOCATION (info.dst_origin)); |
4018 | if (loc != UNKNOWN_LOCATION) |
4019 | inform (loc, |
4020 | "destination object referenced by %<restrict%>-qualified " |
4021 | "argument 1 was declared here" ); |
4022 | } |
4023 | } |
4024 | } |
4025 | |
4026 | /* Compute the length of the output resulting from the call to a formatted |
4027 | output function described by INFO and store the result of the call in |
4028 | *RES. Issue warnings for detected past the end writes. Return true |
4029 | if the complete format string has been processed and *RES can be relied |
4030 | on, false otherwise (e.g., when a unknown or unhandled directive was seen |
4031 | that caused the processing to be terminated early). */ |
4032 | |
4033 | static bool |
4034 | compute_format_length (call_info &info, format_result *res, |
4035 | pointer_query &ptr_qry) |
4036 | { |
4037 | if (dump_file) |
4038 | { |
4039 | location_t callloc = gimple_location (g: info.callstmt); |
4040 | fprintf (stream: dump_file, format: "%s:%i: " , |
4041 | LOCATION_FILE (callloc), LOCATION_LINE (callloc)); |
4042 | print_generic_expr (dump_file, info.func, dump_flags); |
4043 | |
4044 | fprintf (stream: dump_file, |
4045 | format: ": objsize = " HOST_WIDE_INT_PRINT_UNSIGNED |
4046 | ", fmtstr = \"%s\"\n" , |
4047 | info.objsize, info.fmtstr); |
4048 | } |
4049 | |
4050 | /* Reset the minimum and maximum byte counters. */ |
4051 | res->range.min = res->range.max = 0; |
4052 | |
4053 | /* No directive has been seen yet so the length of output is bounded |
4054 | by the known range [0, 0] (with no conversion resulting in a failure |
4055 | or producing more than 4K bytes) until determined otherwise. */ |
4056 | res->knownrange = true; |
4057 | res->floating = false; |
4058 | res->warned = false; |
4059 | |
4060 | /* 1-based directive counter. */ |
4061 | unsigned dirno = 1; |
4062 | |
4063 | /* The variadic argument counter. */ |
4064 | unsigned argno = info.argidx; |
4065 | |
4066 | bool success = true; |
4067 | |
4068 | for (const char *pf = info.fmtstr; ; ++dirno) |
4069 | { |
4070 | directive dir (&info, dirno); |
4071 | |
4072 | size_t n = parse_directive (info, dir, res, str: pf, argno: &argno, query: ptr_qry.rvals); |
4073 | |
4074 | /* Return failure if the format function fails. */ |
4075 | if (!format_directive (info, res, dir, ptr_qry)) |
4076 | return false; |
4077 | |
4078 | /* Return success when the directive is zero bytes long and it's |
4079 | the last thing in the format string (i.e., it's the terminating |
4080 | nul, which isn't really a directive but handling it as one makes |
4081 | things simpler). */ |
4082 | if (!n) |
4083 | { |
4084 | success = *pf == '\0'; |
4085 | break; |
4086 | } |
4087 | |
4088 | pf += n; |
4089 | } |
4090 | |
4091 | maybe_warn_overlap (info, res); |
4092 | |
4093 | /* The complete format string was processed (with or without warnings). */ |
4094 | return success; |
4095 | } |
4096 | |
4097 | /* Return the size of the object referenced by the expression DEST in |
4098 | statement STMT, if available, or the maximum possible size otherwise. */ |
4099 | |
4100 | static unsigned HOST_WIDE_INT |
4101 | get_destination_size (tree dest, gimple *stmt, pointer_query &ptr_qry) |
4102 | { |
4103 | /* When there is no destination return the maximum. */ |
4104 | if (!dest) |
4105 | return HOST_WIDE_INT_MAX; |
4106 | |
4107 | /* Use compute_objsize to determine the size of the destination object. */ |
4108 | access_ref aref; |
4109 | if (!ptr_qry.get_ref (dest, stmt, &aref)) |
4110 | return HOST_WIDE_INT_MAX; |
4111 | |
4112 | offset_int remsize = aref.size_remaining (); |
4113 | if (!wi::fits_uhwi_p (x: remsize)) |
4114 | return HOST_WIDE_INT_MAX; |
4115 | |
4116 | return remsize.to_uhwi (); |
4117 | } |
4118 | |
4119 | /* Return true if the call described by INFO with result RES safe to |
4120 | optimize (i.e., no undefined behavior), and set RETVAL to the range |
4121 | of its return values. */ |
4122 | |
4123 | static bool |
4124 | is_call_safe (const call_info &info, |
4125 | const format_result &res, bool under4k, |
4126 | unsigned HOST_WIDE_INT retval[2]) |
4127 | { |
4128 | if (under4k && !res.posunder4k) |
4129 | return false; |
4130 | |
4131 | /* The minimum return value. */ |
4132 | retval[0] = res.range.min; |
4133 | |
4134 | /* The maximum return value is in most cases bounded by RES.RANGE.MAX |
4135 | but in cases involving multibyte characters could be as large as |
4136 | RES.RANGE.UNLIKELY. */ |
4137 | retval[1] |
4138 | = res.range.unlikely < res.range.max ? res.range.max : res.range.unlikely; |
4139 | |
4140 | /* Adjust the number of bytes which includes the terminating nul |
4141 | to reflect the return value of the function which does not. |
4142 | Because the valid range of the function is [INT_MIN, INT_MAX], |
4143 | a valid range before the adjustment below is [0, INT_MAX + 1] |
4144 | (the functions only return negative values on error or undefined |
4145 | behavior). */ |
4146 | if (retval[0] <= target_int_max () + 1) |
4147 | --retval[0]; |
4148 | if (retval[1] <= target_int_max () + 1) |
4149 | --retval[1]; |
4150 | |
4151 | /* Avoid the return value optimization when the behavior of the call |
4152 | is undefined either because any directive may have produced 4K or |
4153 | more of output, or the return value exceeds INT_MAX, or because |
4154 | the output overflows the destination object (but leave it enabled |
4155 | when the function is bounded because then the behavior is well- |
4156 | defined). */ |
4157 | if (retval[0] == retval[1] |
4158 | && (info.bounded || retval[0] < info.objsize) |
4159 | && retval[0] <= target_int_max ()) |
4160 | return true; |
4161 | |
4162 | if ((info.bounded || retval[1] < info.objsize) |
4163 | && (retval[0] < target_int_max () |
4164 | && retval[1] < target_int_max ())) |
4165 | return true; |
4166 | |
4167 | if (!under4k && (info.bounded || retval[0] < info.objsize)) |
4168 | return true; |
4169 | |
4170 | return false; |
4171 | } |
4172 | |
4173 | /* Given a suitable result RES of a call to a formatted output function |
4174 | described by INFO, substitute the result for the return value of |
4175 | the call. The result is suitable if the number of bytes it represents |
4176 | is known and exact. A result that isn't suitable for substitution may |
4177 | have its range set to the range of return values, if that is known. |
4178 | Return true if the call is removed and gsi_next should not be performed |
4179 | in the caller. */ |
4180 | |
4181 | static bool |
4182 | try_substitute_return_value (gimple_stmt_iterator *gsi, |
4183 | const call_info &info, |
4184 | const format_result &res) |
4185 | { |
4186 | tree lhs = gimple_get_lhs (info.callstmt); |
4187 | |
4188 | /* Set to true when the entire call has been removed. */ |
4189 | bool removed = false; |
4190 | |
4191 | /* The minimum and maximum return value. */ |
4192 | unsigned HOST_WIDE_INT retval[2] = {0}; |
4193 | bool safe = is_call_safe (info, res, under4k: true, retval); |
4194 | |
4195 | if (safe |
4196 | && retval[0] == retval[1] |
4197 | /* Not prepared to handle possibly throwing calls here; they shouldn't |
4198 | appear in non-artificial testcases, except when the __*_chk routines |
4199 | are badly declared. */ |
4200 | && !stmt_ends_bb_p (info.callstmt)) |
4201 | { |
4202 | tree cst = build_int_cst (lhs ? TREE_TYPE (lhs) : integer_type_node, |
4203 | retval[0]); |
4204 | |
4205 | if (lhs == NULL_TREE && info.nowrite) |
4206 | { |
4207 | /* Remove the call to the bounded function with a zero size |
4208 | (e.g., snprintf(0, 0, "%i", 123)) if there is no lhs. */ |
4209 | unlink_stmt_vdef (info.callstmt); |
4210 | gsi_remove (gsi, true); |
4211 | removed = true; |
4212 | } |
4213 | else if (info.nowrite) |
4214 | { |
4215 | /* Replace the call to the bounded function with a zero size |
4216 | (e.g., snprintf(0, 0, "%i", 123) with the constant result |
4217 | of the function. */ |
4218 | gimplify_and_update_call_from_tree (gsi, cst); |
4219 | gimple *callstmt = gsi_stmt (i: *gsi); |
4220 | update_stmt (s: callstmt); |
4221 | } |
4222 | else if (lhs) |
4223 | { |
4224 | /* Replace the left-hand side of the call with the constant |
4225 | result of the formatted function. */ |
4226 | gimple_call_set_lhs (gs: info.callstmt, NULL_TREE); |
4227 | gimple *g = gimple_build_assign (lhs, cst); |
4228 | gsi_insert_after (gsi, g, GSI_NEW_STMT); |
4229 | update_stmt (s: info.callstmt); |
4230 | } |
4231 | |
4232 | if (dump_file) |
4233 | { |
4234 | if (removed) |
4235 | fprintf (stream: dump_file, format: " Removing call statement." ); |
4236 | else |
4237 | { |
4238 | fprintf (stream: dump_file, format: " Substituting " ); |
4239 | print_generic_expr (dump_file, cst, dump_flags); |
4240 | fprintf (stream: dump_file, format: " for %s.\n" , |
4241 | info.nowrite ? "statement" : "return value" ); |
4242 | } |
4243 | } |
4244 | } |
4245 | else if (lhs && types_compatible_p (TREE_TYPE (lhs), integer_type_node)) |
4246 | { |
4247 | bool setrange = false; |
4248 | |
4249 | if (safe |
4250 | && (info.bounded || retval[1] < info.objsize) |
4251 | && (retval[0] < target_int_max () |
4252 | && retval[1] < target_int_max ())) |
4253 | { |
4254 | /* If the result is in a valid range bounded by the size of |
4255 | the destination set it so that it can be used for subsequent |
4256 | optimizations. */ |
4257 | int prec = TYPE_PRECISION (integer_type_node); |
4258 | |
4259 | wide_int min = wi::shwi (val: retval[0], precision: prec); |
4260 | wide_int max = wi::shwi (val: retval[1], precision: prec); |
4261 | value_range r (TREE_TYPE (lhs), min, max); |
4262 | set_range_info (lhs, r); |
4263 | |
4264 | setrange = true; |
4265 | } |
4266 | |
4267 | if (dump_file) |
4268 | { |
4269 | const char *inbounds |
4270 | = (retval[0] < info.objsize |
4271 | ? (retval[1] < info.objsize |
4272 | ? "in" : "potentially out-of" ) |
4273 | : "out-of" ); |
4274 | |
4275 | const char *what = setrange ? "Setting" : "Discarding" ; |
4276 | if (retval[0] != retval[1]) |
4277 | fprintf (stream: dump_file, |
4278 | format: " %s %s-bounds return value range [" |
4279 | HOST_WIDE_INT_PRINT_UNSIGNED ", " |
4280 | HOST_WIDE_INT_PRINT_UNSIGNED "].\n" , |
4281 | what, inbounds, retval[0], retval[1]); |
4282 | else |
4283 | fprintf (stream: dump_file, format: " %s %s-bounds return value " |
4284 | HOST_WIDE_INT_PRINT_UNSIGNED ".\n" , |
4285 | what, inbounds, retval[0]); |
4286 | } |
4287 | } |
4288 | |
4289 | if (dump_file) |
4290 | fputc (c: '\n', stream: dump_file); |
4291 | |
4292 | return removed; |
4293 | } |
4294 | |
4295 | /* Try to simplify a s{,n}printf call described by INFO with result |
4296 | RES by replacing it with a simpler and presumably more efficient |
4297 | call (such as strcpy). */ |
4298 | |
4299 | static bool |
4300 | try_simplify_call (gimple_stmt_iterator *gsi, |
4301 | const call_info &info, |
4302 | const format_result &res) |
4303 | { |
4304 | unsigned HOST_WIDE_INT dummy[2]; |
4305 | if (!is_call_safe (info, res, under4k: info.retval_used (), retval: dummy)) |
4306 | return false; |
4307 | |
4308 | switch (info.fncode) |
4309 | { |
4310 | case BUILT_IN_SNPRINTF: |
4311 | return gimple_fold_builtin_snprintf (gsi); |
4312 | |
4313 | case BUILT_IN_SPRINTF: |
4314 | return gimple_fold_builtin_sprintf (gsi); |
4315 | |
4316 | default: |
4317 | ; |
4318 | } |
4319 | |
4320 | return false; |
4321 | } |
4322 | |
4323 | /* Return the zero-based index of the format string argument of a printf |
4324 | like function and set *IDX_ARGS to the first format argument. When |
4325 | no such index exists return UINT_MAX. */ |
4326 | |
4327 | static unsigned |
4328 | get_user_idx_format (tree fndecl, unsigned *idx_args) |
4329 | { |
4330 | tree attrs = lookup_attribute (attr_name: "format" , DECL_ATTRIBUTES (fndecl)); |
4331 | if (!attrs) |
4332 | attrs = lookup_attribute (attr_name: "format" , TYPE_ATTRIBUTES (TREE_TYPE (fndecl))); |
4333 | |
4334 | if (!attrs) |
4335 | return UINT_MAX; |
4336 | |
4337 | attrs = TREE_VALUE (attrs); |
4338 | |
4339 | tree archetype = TREE_VALUE (attrs); |
4340 | if (strcmp (s1: "printf" , IDENTIFIER_POINTER (archetype))) |
4341 | return UINT_MAX; |
4342 | |
4343 | attrs = TREE_CHAIN (attrs); |
4344 | tree fmtarg = TREE_VALUE (attrs); |
4345 | |
4346 | attrs = TREE_CHAIN (attrs); |
4347 | tree elliparg = TREE_VALUE (attrs); |
4348 | |
4349 | /* Attribute argument indices are 1-based but we use zero-based. */ |
4350 | *idx_args = tree_to_uhwi (elliparg) - 1; |
4351 | return tree_to_uhwi (fmtarg) - 1; |
4352 | } |
4353 | |
4354 | } /* Unnamed namespace. */ |
4355 | |
4356 | /* Determine if a GIMPLE call at *GSI is to one of the sprintf-like built-in |
4357 | functions and if so, handle it. Return true if the call is removed and |
4358 | gsi_next should not be performed in the caller. */ |
4359 | |
4360 | bool |
4361 | handle_printf_call (gimple_stmt_iterator *gsi, pointer_query &ptr_qry) |
4362 | { |
4363 | init_target_to_host_charmap (); |
4364 | |
4365 | call_info info = call_info (); |
4366 | |
4367 | info.callstmt = gsi_stmt (i: *gsi); |
4368 | info.func = gimple_call_fndecl (gs: info.callstmt); |
4369 | if (!info.func) |
4370 | return false; |
4371 | |
4372 | /* Format string argument number (valid for all functions). */ |
4373 | unsigned idx_format = UINT_MAX; |
4374 | if (gimple_call_builtin_p (info.callstmt, BUILT_IN_NORMAL)) |
4375 | info.fncode = DECL_FUNCTION_CODE (decl: info.func); |
4376 | else |
4377 | { |
4378 | unsigned idx_args; |
4379 | idx_format = get_user_idx_format (fndecl: info.func, idx_args: &idx_args); |
4380 | if (idx_format == UINT_MAX |
4381 | || idx_format >= gimple_call_num_args (gs: info.callstmt) |
4382 | || idx_args > gimple_call_num_args (gs: info.callstmt) |
4383 | || !POINTER_TYPE_P (TREE_TYPE (gimple_call_arg (info.callstmt, |
4384 | idx_format)))) |
4385 | return false; |
4386 | info.fncode = BUILT_IN_NONE; |
4387 | info.argidx = idx_args; |
4388 | } |
4389 | |
4390 | /* The size of the destination as in snprintf(dest, size, ...). */ |
4391 | unsigned HOST_WIDE_INT dstsize = HOST_WIDE_INT_M1U; |
4392 | |
4393 | /* The size of the destination determined by __builtin_object_size. */ |
4394 | unsigned HOST_WIDE_INT objsize = HOST_WIDE_INT_M1U; |
4395 | |
4396 | /* Zero-based buffer size argument number (snprintf and vsnprintf). */ |
4397 | unsigned idx_dstsize = UINT_MAX; |
4398 | |
4399 | /* Object size argument number (snprintf_chk and vsnprintf_chk). */ |
4400 | unsigned idx_objsize = UINT_MAX; |
4401 | |
4402 | /* Destinaton argument number (valid for sprintf functions only). */ |
4403 | unsigned idx_dstptr = 0; |
4404 | |
4405 | switch (info.fncode) |
4406 | { |
4407 | case BUILT_IN_NONE: |
4408 | // User-defined function with attribute format (printf). |
4409 | idx_dstptr = -1; |
4410 | break; |
4411 | |
4412 | case BUILT_IN_FPRINTF: |
4413 | // Signature: |
4414 | // __builtin_fprintf (FILE*, format, ...) |
4415 | idx_format = 1; |
4416 | info.argidx = 2; |
4417 | idx_dstptr = -1; |
4418 | break; |
4419 | |
4420 | case BUILT_IN_FPRINTF_CHK: |
4421 | // Signature: |
4422 | // __builtin_fprintf_chk (FILE*, ost, format, ...) |
4423 | idx_format = 2; |
4424 | info.argidx = 3; |
4425 | idx_dstptr = -1; |
4426 | break; |
4427 | |
4428 | case BUILT_IN_FPRINTF_UNLOCKED: |
4429 | // Signature: |
4430 | // __builtin_fprintf_unnlocked (FILE*, format, ...) |
4431 | idx_format = 1; |
4432 | info.argidx = 2; |
4433 | idx_dstptr = -1; |
4434 | break; |
4435 | |
4436 | case BUILT_IN_PRINTF: |
4437 | // Signature: |
4438 | // __builtin_printf (format, ...) |
4439 | idx_format = 0; |
4440 | info.argidx = 1; |
4441 | idx_dstptr = -1; |
4442 | break; |
4443 | |
4444 | case BUILT_IN_PRINTF_CHK: |
4445 | // Signature: |
4446 | // __builtin_printf_chk (ost, format, ...) |
4447 | idx_format = 1; |
4448 | info.argidx = 2; |
4449 | idx_dstptr = -1; |
4450 | break; |
4451 | |
4452 | case BUILT_IN_PRINTF_UNLOCKED: |
4453 | // Signature: |
4454 | // __builtin_printf (format, ...) |
4455 | idx_format = 0; |
4456 | info.argidx = 1; |
4457 | idx_dstptr = -1; |
4458 | break; |
4459 | |
4460 | case BUILT_IN_SPRINTF: |
4461 | // Signature: |
4462 | // __builtin_sprintf (dst, format, ...) |
4463 | idx_format = 1; |
4464 | info.argidx = 2; |
4465 | break; |
4466 | |
4467 | case BUILT_IN_SPRINTF_CHK: |
4468 | // Signature: |
4469 | // __builtin___sprintf_chk (dst, ost, objsize, format, ...) |
4470 | idx_objsize = 2; |
4471 | idx_format = 3; |
4472 | info.argidx = 4; |
4473 | break; |
4474 | |
4475 | case BUILT_IN_SNPRINTF: |
4476 | // Signature: |
4477 | // __builtin_snprintf (dst, size, format, ...) |
4478 | idx_dstsize = 1; |
4479 | idx_format = 2; |
4480 | info.argidx = 3; |
4481 | info.bounded = true; |
4482 | break; |
4483 | |
4484 | case BUILT_IN_SNPRINTF_CHK: |
4485 | // Signature: |
4486 | // __builtin___snprintf_chk (dst, size, ost, objsize, format, ...) |
4487 | idx_dstsize = 1; |
4488 | idx_objsize = 3; |
4489 | idx_format = 4; |
4490 | info.argidx = 5; |
4491 | info.bounded = true; |
4492 | break; |
4493 | |
4494 | case BUILT_IN_VFPRINTF: |
4495 | // Signature: |
4496 | // __builtin_vprintf (FILE*, format, va_list) |
4497 | idx_format = 1; |
4498 | info.argidx = -1; |
4499 | idx_dstptr = -1; |
4500 | break; |
4501 | |
4502 | case BUILT_IN_VFPRINTF_CHK: |
4503 | // Signature: |
4504 | // __builtin___vfprintf_chk (FILE*, ost, format, va_list) |
4505 | idx_format = 2; |
4506 | info.argidx = -1; |
4507 | idx_dstptr = -1; |
4508 | break; |
4509 | |
4510 | case BUILT_IN_VPRINTF: |
4511 | // Signature: |
4512 | // __builtin_vprintf (format, va_list) |
4513 | idx_format = 0; |
4514 | info.argidx = -1; |
4515 | idx_dstptr = -1; |
4516 | break; |
4517 | |
4518 | case BUILT_IN_VPRINTF_CHK: |
4519 | // Signature: |
4520 | // __builtin___vprintf_chk (ost, format, va_list) |
4521 | idx_format = 1; |
4522 | info.argidx = -1; |
4523 | idx_dstptr = -1; |
4524 | break; |
4525 | |
4526 | case BUILT_IN_VSNPRINTF: |
4527 | // Signature: |
4528 | // __builtin_vsprintf (dst, size, format, va) |
4529 | idx_dstsize = 1; |
4530 | idx_format = 2; |
4531 | info.argidx = -1; |
4532 | info.bounded = true; |
4533 | break; |
4534 | |
4535 | case BUILT_IN_VSNPRINTF_CHK: |
4536 | // Signature: |
4537 | // __builtin___vsnprintf_chk (dst, size, ost, objsize, format, va) |
4538 | idx_dstsize = 1; |
4539 | idx_objsize = 3; |
4540 | idx_format = 4; |
4541 | info.argidx = -1; |
4542 | info.bounded = true; |
4543 | break; |
4544 | |
4545 | case BUILT_IN_VSPRINTF: |
4546 | // Signature: |
4547 | // __builtin_vsprintf (dst, format, va) |
4548 | idx_format = 1; |
4549 | info.argidx = -1; |
4550 | break; |
4551 | |
4552 | case BUILT_IN_VSPRINTF_CHK: |
4553 | // Signature: |
4554 | // __builtin___vsprintf_chk (dst, ost, objsize, format, va) |
4555 | idx_format = 3; |
4556 | idx_objsize = 2; |
4557 | info.argidx = -1; |
4558 | break; |
4559 | |
4560 | default: |
4561 | return false; |
4562 | } |
4563 | |
4564 | /* Set the global warning level for this function. */ |
4565 | warn_level = info.bounded ? warn_format_trunc : warn_format_overflow; |
4566 | |
4567 | /* For all string functions the first argument is a pointer to |
4568 | the destination. */ |
4569 | tree dstptr = (idx_dstptr < gimple_call_num_args (gs: info.callstmt) |
4570 | ? gimple_call_arg (gs: info.callstmt, index: 0) : NULL_TREE); |
4571 | |
4572 | info.format = gimple_call_arg (gs: info.callstmt, index: idx_format); |
4573 | |
4574 | /* True when the destination size is constant as opposed to the lower |
4575 | or upper bound of a range. */ |
4576 | bool dstsize_cst_p = true; |
4577 | bool posunder4k = true; |
4578 | |
4579 | if (idx_dstsize == UINT_MAX) |
4580 | { |
4581 | /* For non-bounded functions like sprintf, determine the size |
4582 | of the destination from the object or pointer passed to it |
4583 | as the first argument. */ |
4584 | dstsize = get_destination_size (dest: dstptr, stmt: info.callstmt, ptr_qry); |
4585 | } |
4586 | else if (tree size = gimple_call_arg (gs: info.callstmt, index: idx_dstsize)) |
4587 | { |
4588 | /* For bounded functions try to get the size argument. */ |
4589 | |
4590 | if (TREE_CODE (size) == INTEGER_CST) |
4591 | { |
4592 | dstsize = tree_to_uhwi (size); |
4593 | /* No object can be larger than SIZE_MAX bytes (half the address |
4594 | space) on the target. |
4595 | The functions are defined only for output of at most INT_MAX |
4596 | bytes. Specifying a bound in excess of that limit effectively |
4597 | defeats the bounds checking (and on some implementations such |
4598 | as Solaris cause the function to fail with EINVAL). */ |
4599 | if (dstsize > target_size_max () / 2) |
4600 | { |
4601 | /* Avoid warning if -Wstringop-overflow is specified since |
4602 | it also warns for the same thing though only for the |
4603 | checking built-ins. */ |
4604 | if ((idx_objsize == UINT_MAX |
4605 | || !warn_stringop_overflow)) |
4606 | warning_at (gimple_location (g: info.callstmt), info.warnopt (), |
4607 | "specified bound %wu exceeds maximum object size " |
4608 | "%wu" , |
4609 | dstsize, target_size_max () / 2); |
4610 | /* POSIX requires snprintf to fail if DSTSIZE is greater |
4611 | than INT_MAX. Even though not all POSIX implementations |
4612 | conform to the requirement, avoid folding in this case. */ |
4613 | posunder4k = false; |
4614 | } |
4615 | else if (dstsize > target_int_max ()) |
4616 | { |
4617 | warning_at (gimple_location (g: info.callstmt), info.warnopt (), |
4618 | "specified bound %wu exceeds %<INT_MAX%>" , |
4619 | dstsize); |
4620 | /* POSIX requires snprintf to fail if DSTSIZE is greater |
4621 | than INT_MAX. Avoid folding in that case. */ |
4622 | posunder4k = false; |
4623 | } |
4624 | } |
4625 | else if (TREE_CODE (size) == SSA_NAME) |
4626 | { |
4627 | /* Try to determine the range of values of the argument |
4628 | and use the greater of the two at level 1 and the smaller |
4629 | of them at level 2. */ |
4630 | value_range vr; |
4631 | ptr_qry.rvals->range_of_expr (r&: vr, expr: size, info.callstmt); |
4632 | |
4633 | if (!vr.undefined_p ()) |
4634 | { |
4635 | tree type = TREE_TYPE (size); |
4636 | tree tmin = wide_int_to_tree (type, cst: vr.lower_bound ()); |
4637 | tree tmax = wide_int_to_tree (type, cst: vr.upper_bound ()); |
4638 | unsigned HOST_WIDE_INT minsize = TREE_INT_CST_LOW (tmin); |
4639 | unsigned HOST_WIDE_INT maxsize = TREE_INT_CST_LOW (tmax); |
4640 | dstsize = warn_level < 2 ? maxsize : minsize; |
4641 | |
4642 | if (minsize > target_int_max ()) |
4643 | warning_at (gimple_location (g: info.callstmt), info.warnopt (), |
4644 | "specified bound range [%wu, %wu] exceeds " |
4645 | "%<INT_MAX%>" , |
4646 | minsize, maxsize); |
4647 | |
4648 | /* POSIX requires snprintf to fail if DSTSIZE is greater |
4649 | than INT_MAX. Avoid folding if that's possible. */ |
4650 | if (maxsize > target_int_max ()) |
4651 | posunder4k = false; |
4652 | } |
4653 | |
4654 | /* The destination size is not constant. If the function is |
4655 | bounded (e.g., snprintf) a lower bound of zero doesn't |
4656 | necessarily imply it can be eliminated. */ |
4657 | dstsize_cst_p = false; |
4658 | } |
4659 | } |
4660 | |
4661 | if (idx_objsize != UINT_MAX) |
4662 | if (tree size = gimple_call_arg (gs: info.callstmt, index: idx_objsize)) |
4663 | if (tree_fits_uhwi_p (size)) |
4664 | objsize = tree_to_uhwi (size); |
4665 | |
4666 | if (info.bounded && !dstsize) |
4667 | { |
4668 | /* As a special case, when the explicitly specified destination |
4669 | size argument (to a bounded function like snprintf) is zero |
4670 | it is a request to determine the number of bytes on output |
4671 | without actually producing any. Pretend the size is |
4672 | unlimited in this case. */ |
4673 | info.objsize = HOST_WIDE_INT_MAX; |
4674 | info.nowrite = dstsize_cst_p; |
4675 | } |
4676 | else |
4677 | { |
4678 | /* For calls to non-bounded functions or to those of bounded |
4679 | functions with a non-zero size, warn if the destination |
4680 | pointer is null. */ |
4681 | if (dstptr && integer_zerop (dstptr)) |
4682 | { |
4683 | /* This is diagnosed with -Wformat only when the null is a constant |
4684 | pointer. The warning here diagnoses instances where the pointer |
4685 | is not constant. */ |
4686 | location_t loc = gimple_location (g: info.callstmt); |
4687 | warning_at (EXPR_LOC_OR_LOC (dstptr, loc), |
4688 | info.warnopt (), "null destination pointer" ); |
4689 | return false; |
4690 | } |
4691 | |
4692 | /* Set the object size to the smaller of the two arguments |
4693 | of both have been specified and they're not equal. */ |
4694 | info.objsize = dstsize < objsize ? dstsize : objsize; |
4695 | |
4696 | if (info.bounded |
4697 | && dstsize < target_size_max () / 2 && objsize < dstsize |
4698 | /* Avoid warning if -Wstringop-overflow is specified since |
4699 | it also warns for the same thing though only for the |
4700 | checking built-ins. */ |
4701 | && (idx_objsize == UINT_MAX |
4702 | || !warn_stringop_overflow)) |
4703 | { |
4704 | warning_at (gimple_location (g: info.callstmt), info.warnopt (), |
4705 | "specified bound %wu exceeds the size %wu " |
4706 | "of the destination object" , dstsize, objsize); |
4707 | } |
4708 | } |
4709 | |
4710 | /* Determine if the format argument may be null and warn if not |
4711 | and if the argument is null. */ |
4712 | if (integer_zerop (info.format) |
4713 | && gimple_call_builtin_p (info.callstmt, BUILT_IN_NORMAL)) |
4714 | { |
4715 | location_t loc = gimple_location (g: info.callstmt); |
4716 | warning_at (EXPR_LOC_OR_LOC (info.format, loc), |
4717 | info.warnopt (), "null format string" ); |
4718 | return false; |
4719 | } |
4720 | |
4721 | info.fmtstr = get_format_string (format: info.format, ploc: &info.fmtloc); |
4722 | if (!info.fmtstr) |
4723 | return false; |
4724 | |
4725 | if (warn_restrict) |
4726 | { |
4727 | /* Compute the origin of the destination pointer and its offset |
4728 | from the base object/pointer if possible. */ |
4729 | info.dst_offset = 0; |
4730 | info.dst_origin = get_origin_and_offset (x: dstptr, fldoff: &info.dst_field, |
4731 | off: &info.dst_offset); |
4732 | } |
4733 | |
4734 | /* The result is the number of bytes output by the formatted function, |
4735 | including the terminating NUL. */ |
4736 | format_result res; |
4737 | |
4738 | /* I/O functions with no destination argument (i.e., all forms of fprintf |
4739 | and printf) may fail under any conditions. Others (i.e., all forms of |
4740 | sprintf) may only fail under specific conditions determined for each |
4741 | directive. Clear POSUNDER4K for the former set of functions and set |
4742 | it to true for the latter (it can only be cleared later, but it is |
4743 | never set to true again). */ |
4744 | res.posunder4k = posunder4k && dstptr; |
4745 | |
4746 | bool success = compute_format_length (info, res: &res, ptr_qry); |
4747 | if (res.warned) |
4748 | suppress_warning (info.callstmt, info.warnopt ()); |
4749 | |
4750 | /* When optimizing and the printf return value optimization is enabled, |
4751 | attempt to substitute the computed result for the return value of |
4752 | the call. Avoid this optimization when -frounding-math is in effect |
4753 | and the format string contains a floating point directive. */ |
4754 | bool call_removed = false; |
4755 | if (success && optimize > 0) |
4756 | { |
4757 | /* Save a copy of the iterator pointing at the call. The iterator |
4758 | may change to point past the call in try_substitute_return_value |
4759 | but the original value is needed in try_simplify_call. */ |
4760 | gimple_stmt_iterator gsi_call = *gsi; |
4761 | |
4762 | if (flag_printf_return_value |
4763 | && (!flag_rounding_math || !res.floating)) |
4764 | call_removed = try_substitute_return_value (gsi, info, res); |
4765 | |
4766 | if (!call_removed) |
4767 | try_simplify_call (gsi: &gsi_call, info, res); |
4768 | } |
4769 | |
4770 | return call_removed; |
4771 | } |
4772 | |