1 //= ScanfFormatString.cpp - Analysis of printf format strings --*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // Handling of format string in scanf and friends.  The structure of format
10 // strings for fscanf() are described in C99 7.19.6.2.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/AST/FormatString.h"
15 #include "FormatStringParsing.h"
16 #include "clang/Basic/TargetInfo.h"
17 
18 using clang::analyze_format_string::ArgType;
19 using clang::analyze_format_string::FormatStringHandler;
20 using clang::analyze_format_string::LengthModifier;
21 using clang::analyze_format_string::OptionalAmount;
22 using clang::analyze_format_string::ConversionSpecifier;
23 using clang::analyze_scanf::ScanfConversionSpecifier;
24 using clang::analyze_scanf::ScanfSpecifier;
25 using clang::UpdateOnReturn;
26 using namespace clang;
27 
28 typedef clang::analyze_format_string::SpecifierResult<ScanfSpecifier>
29         ScanfSpecifierResult;
30 
31 static bool ParseScanList(FormatStringHandler &H,
32                           ScanfConversionSpecifier &CS,
33                           const char *&Beg, const char *E) {
34   const char *I = Beg;
35   const char *start = I - 1;
36   UpdateOnReturn <const char*> UpdateBeg(Beg, I);
37 
38   // No more characters?
39   if (I == E) {
40     H.HandleIncompleteScanList(start, I);
41     return true;
42   }
43 
44   // Special case: ']' is the first character.
45   if (*I == ']') {
46     if (++I == E) {
47       H.HandleIncompleteScanList(start, I - 1);
48       return true;
49     }
50   }
51 
52   // Special case: "^]" are the first characters.
53   if (I + 1 != E && I[0] == '^' && I[1] == ']') {
54     I += 2;
55     if (I == E) {
56       H.HandleIncompleteScanList(start, I - 1);
57       return true;
58     }
59   }
60 
61   // Look for a ']' character which denotes the end of the scan list.
62   while (*I != ']') {
63     if (++I == E) {
64       H.HandleIncompleteScanList(start, I - 1);
65       return true;
66     }
67   }
68 
69   CS.setEndScanList(I);
70   return false;
71 }
72 
73 // FIXME: Much of this is copy-paste from ParsePrintfSpecifier.
74 // We can possibly refactor.
75 static ScanfSpecifierResult ParseScanfSpecifier(FormatStringHandler &H,
76                                                 const char *&Beg,
77                                                 const char *E,
78                                                 unsigned &argIndex,
79                                                 const LangOptions &LO,
80                                                 const TargetInfo &Target) {
81   using namespace clang::analyze_format_string;
82   using namespace clang::analyze_scanf;
83   const char *I = Beg;
84   const char *Start = nullptr;
85   UpdateOnReturn <const char*> UpdateBeg(Beg, I);
86 
87     // Look for a '%' character that indicates the start of a format specifier.
88   for ( ; I != E ; ++I) {
89     char c = *I;
90     if (c == '\0') {
91         // Detect spurious null characters, which are likely errors.
92       H.HandleNullChar(I);
93       return true;
94     }
95     if (c == '%') {
96       Start = I++;  // Record the start of the format specifier.
97       break;
98     }
99   }
100 
101     // No format specifier found?
102   if (!Start)
103     return false;
104 
105   if (I == E) {
106       // No more characters left?
107     H.HandleIncompleteSpecifier(Start, E - Start);
108     return true;
109   }
110 
111   ScanfSpecifier FS;
112   if (ParseArgPosition(H, FS, Start, I, E))
113     return true;
114 
115   if (I == E) {
116       // No more characters left?
117     H.HandleIncompleteSpecifier(Start, E - Start);
118     return true;
119   }
120 
121   // Look for '*' flag if it is present.
122   if (*I == '*') {
123     FS.setSuppressAssignment(I);
124     if (++I == E) {
125       H.HandleIncompleteSpecifier(Start, E - Start);
126       return true;
127     }
128   }
129 
130   // Look for the field width (if any).  Unlike printf, this is either
131   // a fixed integer or isn't present.
132   const OptionalAmount &Amt = clang::analyze_format_string::ParseAmount(I, E);
133   if (Amt.getHowSpecified() != OptionalAmount::NotSpecified) {
134     assert(Amt.getHowSpecified() == OptionalAmount::Constant);
135     FS.setFieldWidth(Amt);
136 
137     if (I == E) {
138       // No more characters left?
139       H.HandleIncompleteSpecifier(Start, E - Start);
140       return true;
141     }
142   }
143 
144   // Look for the length modifier.
145   if (ParseLengthModifier(FS, I, E, LO, /*scanf=*/true) && I == E) {
146       // No more characters left?
147     H.HandleIncompleteSpecifier(Start, E - Start);
148     return true;
149   }
150 
151   // Detect spurious null characters, which are likely errors.
152   if (*I == '\0') {
153     H.HandleNullChar(I);
154     return true;
155   }
156 
157   // Finally, look for the conversion specifier.
158   const char *conversionPosition = I++;
159   ScanfConversionSpecifier::Kind k = ScanfConversionSpecifier::InvalidSpecifier;
160   switch (*conversionPosition) {
161     default:
162       break;
163     case '%': k = ConversionSpecifier::PercentArg;   break;
164     case 'A': k = ConversionSpecifier::AArg; break;
165     case 'E': k = ConversionSpecifier::EArg; break;
166     case 'F': k = ConversionSpecifier::FArg; break;
167     case 'G': k = ConversionSpecifier::GArg; break;
168     case 'X': k = ConversionSpecifier::XArg; break;
169     case 'a': k = ConversionSpecifier::aArg; break;
170     case 'd': k = ConversionSpecifier::dArg; break;
171     case 'e': k = ConversionSpecifier::eArg; break;
172     case 'f': k = ConversionSpecifier::fArg; break;
173     case 'g': k = ConversionSpecifier::gArg; break;
174     case 'i': k = ConversionSpecifier::iArg; break;
175     case 'n': k = ConversionSpecifier::nArg; break;
176     case 'c': k = ConversionSpecifier::cArg; break;
177     case 'C': k = ConversionSpecifier::CArg; break;
178     case 'S': k = ConversionSpecifier::SArg; break;
179     case '[': k = ConversionSpecifier::ScanListArg; break;
180     case 'u': k = ConversionSpecifier::uArg; break;
181     case 'x': k = ConversionSpecifier::xArg; break;
182     case 'o': k = ConversionSpecifier::oArg; break;
183     case 's': k = ConversionSpecifier::sArg; break;
184     case 'p': k = ConversionSpecifier::pArg; break;
185     // Apple extensions
186       // Apple-specific
187     case 'D':
188       if (Target.getTriple().isOSDarwin())
189         k = ConversionSpecifier::DArg;
190       break;
191     case 'O':
192       if (Target.getTriple().isOSDarwin())
193         k = ConversionSpecifier::OArg;
194       break;
195     case 'U':
196       if (Target.getTriple().isOSDarwin())
197         k = ConversionSpecifier::UArg;
198       break;
199   }
200   ScanfConversionSpecifier CS(conversionPosition, k);
201   if (k == ScanfConversionSpecifier::ScanListArg) {
202     if (ParseScanList(H, CS, I, E))
203       return true;
204   }
205   FS.setConversionSpecifier(CS);
206   if (CS.consumesDataArgument() && !FS.getSuppressAssignment()
207       && !FS.usesPositionalArg())
208     FS.setArgIndex(argIndex++);
209 
210   // FIXME: '%' and '*' doesn't make sense.  Issue a warning.
211   // FIXME: 'ConsumedSoFar' and '*' doesn't make sense.
212 
213   if (k == ScanfConversionSpecifier::InvalidSpecifier) {
214     unsigned Len = I - Beg;
215     if (ParseUTF8InvalidSpecifier(Beg, E, Len)) {
216       CS.setEndScanList(Beg + Len);
217       FS.setConversionSpecifier(CS);
218     }
219     // Assume the conversion takes one argument.
220     return !H.HandleInvalidScanfConversionSpecifier(FS, Beg, Len);
221   }
222   return ScanfSpecifierResult(Start, FS);
223 }
224 
225 ArgType ScanfSpecifier::getArgType(ASTContext &Ctx) const {
226   const ScanfConversionSpecifier &CS = getConversionSpecifier();
227 
228   if (!CS.consumesDataArgument())
229     return ArgType::Invalid();
230 
231   switch(CS.getKind()) {
232     // Signed int.
233     case ConversionSpecifier::dArg:
234     case ConversionSpecifier::DArg:
235     case ConversionSpecifier::iArg:
236       switch (LM.getKind()) {
237         case LengthModifier::None:
238           return ArgType::PtrTo(Ctx.IntTy);
239         case LengthModifier::AsChar:
240           return ArgType::PtrTo(ArgType::AnyCharTy);
241         case LengthModifier::AsShort:
242           return ArgType::PtrTo(Ctx.ShortTy);
243         case LengthModifier::AsLong:
244           return ArgType::PtrTo(Ctx.LongTy);
245         case LengthModifier::AsLongLong:
246         case LengthModifier::AsQuad:
247           return ArgType::PtrTo(Ctx.LongLongTy);
248         case LengthModifier::AsInt64:
249           return ArgType::PtrTo(ArgType(Ctx.LongLongTy, "__int64"));
250         case LengthModifier::AsIntMax:
251           return ArgType::PtrTo(ArgType(Ctx.getIntMaxType(), "intmax_t"));
252         case LengthModifier::AsSizeT:
253           return ArgType::PtrTo(ArgType(Ctx.getSignedSizeType(), "ssize_t"));
254         case LengthModifier::AsPtrDiff:
255           return ArgType::PtrTo(ArgType(Ctx.getPointerDiffType(), "ptrdiff_t"));
256         case LengthModifier::AsLongDouble:
257           // GNU extension.
258           return ArgType::PtrTo(Ctx.LongLongTy);
259         case LengthModifier::AsAllocate:
260         case LengthModifier::AsMAllocate:
261         case LengthModifier::AsInt32:
262         case LengthModifier::AsInt3264:
263         case LengthModifier::AsWide:
264           return ArgType::Invalid();
265       }
266       llvm_unreachable("Unsupported LenghtModifier Type");
267 
268     // Unsigned int.
269     case ConversionSpecifier::oArg:
270     case ConversionSpecifier::OArg:
271     case ConversionSpecifier::uArg:
272     case ConversionSpecifier::UArg:
273     case ConversionSpecifier::xArg:
274     case ConversionSpecifier::XArg:
275       switch (LM.getKind()) {
276         case LengthModifier::None:
277           return ArgType::PtrTo(Ctx.UnsignedIntTy);
278         case LengthModifier::AsChar:
279           return ArgType::PtrTo(Ctx.UnsignedCharTy);
280         case LengthModifier::AsShort:
281           return ArgType::PtrTo(Ctx.UnsignedShortTy);
282         case LengthModifier::AsLong:
283           return ArgType::PtrTo(Ctx.UnsignedLongTy);
284         case LengthModifier::AsLongLong:
285         case LengthModifier::AsQuad:
286           return ArgType::PtrTo(Ctx.UnsignedLongLongTy);
287         case LengthModifier::AsInt64:
288           return ArgType::PtrTo(ArgType(Ctx.UnsignedLongLongTy, "unsigned __int64"));
289         case LengthModifier::AsIntMax:
290           return ArgType::PtrTo(ArgType(Ctx.getUIntMaxType(), "uintmax_t"));
291         case LengthModifier::AsSizeT:
292           return ArgType::PtrTo(ArgType(Ctx.getSizeType(), "size_t"));
293         case LengthModifier::AsPtrDiff:
294           return ArgType::PtrTo(
295               ArgType(Ctx.getUnsignedPointerDiffType(), "unsigned ptrdiff_t"));
296         case LengthModifier::AsLongDouble:
297           // GNU extension.
298           return ArgType::PtrTo(Ctx.UnsignedLongLongTy);
299         case LengthModifier::AsAllocate:
300         case LengthModifier::AsMAllocate:
301         case LengthModifier::AsInt32:
302         case LengthModifier::AsInt3264:
303         case LengthModifier::AsWide:
304           return ArgType::Invalid();
305       }
306       llvm_unreachable("Unsupported LenghtModifier Type");
307 
308     // Float.
309     case ConversionSpecifier::aArg:
310     case ConversionSpecifier::AArg:
311     case ConversionSpecifier::eArg:
312     case ConversionSpecifier::EArg:
313     case ConversionSpecifier::fArg:
314     case ConversionSpecifier::FArg:
315     case ConversionSpecifier::gArg:
316     case ConversionSpecifier::GArg:
317       switch (LM.getKind()) {
318         case LengthModifier::None:
319           return ArgType::PtrTo(Ctx.FloatTy);
320         case LengthModifier::AsLong:
321           return ArgType::PtrTo(Ctx.DoubleTy);
322         case LengthModifier::AsLongDouble:
323           return ArgType::PtrTo(Ctx.LongDoubleTy);
324         default:
325           return ArgType::Invalid();
326       }
327 
328     // Char, string and scanlist.
329     case ConversionSpecifier::cArg:
330     case ConversionSpecifier::sArg:
331     case ConversionSpecifier::ScanListArg:
332       switch (LM.getKind()) {
333         case LengthModifier::None:
334           return ArgType::PtrTo(ArgType::AnyCharTy);
335         case LengthModifier::AsLong:
336         case LengthModifier::AsWide:
337           return ArgType::PtrTo(ArgType(Ctx.getWideCharType(), "wchar_t"));
338         case LengthModifier::AsAllocate:
339         case LengthModifier::AsMAllocate:
340           return ArgType::PtrTo(ArgType::CStrTy);
341         case LengthModifier::AsShort:
342           if (Ctx.getTargetInfo().getTriple().isOSMSVCRT())
343             return ArgType::PtrTo(ArgType::AnyCharTy);
344           LLVM_FALLTHROUGH;
345         default:
346           return ArgType::Invalid();
347       }
348     case ConversionSpecifier::CArg:
349     case ConversionSpecifier::SArg:
350       // FIXME: Mac OS X specific?
351       switch (LM.getKind()) {
352         case LengthModifier::None:
353         case LengthModifier::AsWide:
354           return ArgType::PtrTo(ArgType(Ctx.getWideCharType(), "wchar_t"));
355         case LengthModifier::AsAllocate:
356         case LengthModifier::AsMAllocate:
357           return ArgType::PtrTo(ArgType(ArgType::WCStrTy, "wchar_t *"));
358         case LengthModifier::AsShort:
359           if (Ctx.getTargetInfo().getTriple().isOSMSVCRT())
360             return ArgType::PtrTo(ArgType::AnyCharTy);
361           LLVM_FALLTHROUGH;
362         default:
363           return ArgType::Invalid();
364       }
365 
366     // Pointer.
367     case ConversionSpecifier::pArg:
368       return ArgType::PtrTo(ArgType::CPointerTy);
369 
370     // Write-back.
371     case ConversionSpecifier::nArg:
372       switch (LM.getKind()) {
373         case LengthModifier::None:
374           return ArgType::PtrTo(Ctx.IntTy);
375         case LengthModifier::AsChar:
376           return ArgType::PtrTo(Ctx.SignedCharTy);
377         case LengthModifier::AsShort:
378           return ArgType::PtrTo(Ctx.ShortTy);
379         case LengthModifier::AsLong:
380           return ArgType::PtrTo(Ctx.LongTy);
381         case LengthModifier::AsLongLong:
382         case LengthModifier::AsQuad:
383           return ArgType::PtrTo(Ctx.LongLongTy);
384         case LengthModifier::AsInt64:
385           return ArgType::PtrTo(ArgType(Ctx.LongLongTy, "__int64"));
386         case LengthModifier::AsIntMax:
387           return ArgType::PtrTo(ArgType(Ctx.getIntMaxType(), "intmax_t"));
388         case LengthModifier::AsSizeT:
389           return ArgType::PtrTo(ArgType(Ctx.getSignedSizeType(), "ssize_t"));
390         case LengthModifier::AsPtrDiff:
391           return ArgType::PtrTo(ArgType(Ctx.getPointerDiffType(), "ptrdiff_t"));
392         case LengthModifier::AsLongDouble:
393           return ArgType(); // FIXME: Is this a known extension?
394         case LengthModifier::AsAllocate:
395         case LengthModifier::AsMAllocate:
396         case LengthModifier::AsInt32:
397         case LengthModifier::AsInt3264:
398         case LengthModifier::AsWide:
399           return ArgType::Invalid();
400         }
401 
402     default:
403       break;
404   }
405 
406   return ArgType();
407 }
408 
409 bool ScanfSpecifier::fixType(QualType QT, QualType RawQT,
410                              const LangOptions &LangOpt,
411                              ASTContext &Ctx) {
412 
413   // %n is different from other conversion specifiers; don't try to fix it.
414   if (CS.getKind() == ConversionSpecifier::nArg)
415     return false;
416 
417   if (!QT->isPointerType())
418     return false;
419 
420   QualType PT = QT->getPointeeType();
421 
422   // If it's an enum, get its underlying type.
423   if (const EnumType *ETy = PT->getAs<EnumType>()) {
424     // Don't try to fix incomplete enums.
425     if (!ETy->getDecl()->isComplete())
426       return false;
427     PT = ETy->getDecl()->getIntegerType();
428   }
429 
430   const BuiltinType *BT = PT->getAs<BuiltinType>();
431   if (!BT)
432     return false;
433 
434   // Pointer to a character.
435   if (PT->isAnyCharacterType()) {
436     CS.setKind(ConversionSpecifier::sArg);
437     if (PT->isWideCharType())
438       LM.setKind(LengthModifier::AsWideChar);
439     else
440       LM.setKind(LengthModifier::None);
441 
442     // If we know the target array length, we can use it as a field width.
443     if (const ConstantArrayType *CAT = Ctx.getAsConstantArrayType(RawQT)) {
444       if (CAT->getSizeModifier() == ArrayType::Normal)
445         FieldWidth = OptionalAmount(OptionalAmount::Constant,
446                                     CAT->getSize().getZExtValue() - 1,
447                                     "", 0, false);
448 
449     }
450     return true;
451   }
452 
453   // Figure out the length modifier.
454   switch (BT->getKind()) {
455     // no modifier
456     case BuiltinType::UInt:
457     case BuiltinType::Int:
458     case BuiltinType::Float:
459       LM.setKind(LengthModifier::None);
460       break;
461 
462     // hh
463     case BuiltinType::Char_U:
464     case BuiltinType::UChar:
465     case BuiltinType::Char_S:
466     case BuiltinType::SChar:
467       LM.setKind(LengthModifier::AsChar);
468       break;
469 
470     // h
471     case BuiltinType::Short:
472     case BuiltinType::UShort:
473       LM.setKind(LengthModifier::AsShort);
474       break;
475 
476     // l
477     case BuiltinType::Long:
478     case BuiltinType::ULong:
479     case BuiltinType::Double:
480       LM.setKind(LengthModifier::AsLong);
481       break;
482 
483     // ll
484     case BuiltinType::LongLong:
485     case BuiltinType::ULongLong:
486       LM.setKind(LengthModifier::AsLongLong);
487       break;
488 
489     // L
490     case BuiltinType::LongDouble:
491       LM.setKind(LengthModifier::AsLongDouble);
492       break;
493 
494     // Don't know.
495     default:
496       return false;
497   }
498 
499   // Handle size_t, ptrdiff_t, etc. that have dedicated length modifiers in C99.
500   if (isa<TypedefType>(PT) && (LangOpt.C99 || LangOpt.CPlusPlus11))
501     namedTypeToLengthModifier(PT, LM);
502 
503   // If fixing the length modifier was enough, we are done.
504   if (hasValidLengthModifier(Ctx.getTargetInfo())) {
505     const analyze_scanf::ArgType &AT = getArgType(Ctx);
506     if (AT.isValid() && AT.matchesType(Ctx, QT))
507       return true;
508   }
509 
510   // Figure out the conversion specifier.
511   if (PT->isRealFloatingType())
512     CS.setKind(ConversionSpecifier::fArg);
513   else if (PT->isSignedIntegerType())
514     CS.setKind(ConversionSpecifier::dArg);
515   else if (PT->isUnsignedIntegerType())
516     CS.setKind(ConversionSpecifier::uArg);
517   else
518     llvm_unreachable("Unexpected type");
519 
520   return true;
521 }
522 
523 void ScanfSpecifier::toString(raw_ostream &os) const {
524   os << "%";
525 
526   if (usesPositionalArg())
527     os << getPositionalArgIndex() << "$";
528   if (SuppressAssignment)
529     os << "*";
530 
531   FieldWidth.toString(os);
532   os << LM.toString();
533   os << CS.toString();
534 }
535 
536 bool clang::analyze_format_string::ParseScanfString(FormatStringHandler &H,
537                                                     const char *I,
538                                                     const char *E,
539                                                     const LangOptions &LO,
540                                                     const TargetInfo &Target) {
541 
542   unsigned argIndex = 0;
543 
544   // Keep looking for a format specifier until we have exhausted the string.
545   while (I != E) {
546     const ScanfSpecifierResult &FSR = ParseScanfSpecifier(H, I, E, argIndex,
547                                                           LO, Target);
548     // Did a fail-stop error of any kind occur when parsing the specifier?
549     // If so, don't do any more processing.
550     if (FSR.shouldStop())
551       return true;
552       // Did we exhaust the string or encounter an error that
553       // we can recover from?
554     if (!FSR.hasValue())
555       continue;
556       // We have a format specifier.  Pass it to the callback.
557     if (!H.HandleScanfSpecifier(FSR.getValue(), FSR.getStart(),
558                                 I - FSR.getStart())) {
559       return true;
560     }
561   }
562   assert(I == E && "Format string not exhausted");
563   return false;
564 }
565