Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

C++: Remove potential FPs for cpp/wrong-type-format-argument in BMN #18581

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
+22 −4
Draft

C++: Remove potential FPs for cpp/wrong-type-format-argument in BMN #18581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
231e3c2
C++: Tests for cpp/wrong-type-format-argument
calumgrant Jan 23, 2025
9b53a39
C++: Remove potential FPs in cpp/wrong-type-format-argument in BMN
calumgrant Jan 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion cpp/ql/src/Likely Bugs/Format/WrongTypeFormatArguments.ql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,12 @@ predicate trivialConversion(ExpectedType expected, Type actual) {
*/
int sizeof_IntType() { exists(IntType it | result = it.getSize()) }

predicate buildModeNoneIntLongConversion(IntType formatType, LongType argumentType) {
exists(formatType) and
exists(argumentType) and
exists(Compilation c | c.buildModeNone())
}

from FormattingFunctionCall ffc, int n, Expr arg, Type expected, Type actual
where
(
Expand All @@ -171,7 +177,8 @@ where
not arg.isAffectedByMacro() and
not arg.isFromUninstantiatedTemplate(_) and
not actual.stripType() instanceof ErroneousType and
not arg.(Call).mayBeFromImplicitlyDeclaredFunction()
not arg.(Call).mayBeFromImplicitlyDeclaredFunction() and
not buildModeNoneIntLongConversion(expected, actual.getUnspecifiedType())
select arg,
"This format specifier for type '" + expected.getName() + "' does not match the argument type '" +
actual.getUnspecifiedType().getName() + "'."
8 changes: 8 additions & 0 deletions ...s/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/WrongTypeFormatArguments.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,9 @@
| tests.c:7:18:7:18 | 1 | This format specifier for type 'char *' does not match the argument type 'int'. |
| tests.c:13:27:13:30 | 42 | This format specifier for type 'int' does not match the argument type 'long long'. |
| tests.c:13:33:13:37 | 42 | This format specifier for type 'int' does not match the argument type 'unsigned long long'. |
| tests.c:13:40:13:43 | 42 | This format specifier for type 'unsigned int' does not match the argument type 'long long'. |
| tests.c:13:46:13:50 | 42 | This format specifier for type 'unsigned int' does not match the argument type 'unsigned long long'. |
| tests.c:14:31:14:32 | 42 | This format specifier for type 'long' does not match the argument type 'int'. |
| tests.c:14:35:14:37 | 42 | This format specifier for type 'long' does not match the argument type 'unsigned int'. |
| tests.c:14:40:14:41 | 42 | This format specifier for type 'unsigned long' does not match the argument type 'int'. |
| tests.c:14:44:14:46 | 42 | This format specifier for type 'unsigned long' does not match the argument type 'unsigned int'. |
9 changes: 6 additions & 3 deletions cpp/ql/test/query-tests/Likely Bugs/Format/WrongTypeFormatArguments/Buildless/tests.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,15 @@
// semmle-extractor-options: --expect_errors
// semmle-extractor-options: --expect_errors --build-mode none

int printf(const char * format, ...);
int fprintf();

void f(UNKNOWN_CHAR * str) {
printf("%s", 1); // BAD
printf("%s", implicit_function()); // GOOD - we should ignore the type
printf("%s", implicit_function()); // GOOD: we should ignore the type
sprintf(0, "%s", ""); // GOOD
fprintf(0, "%s", ""); // GOOD
printf("%s", str); // GOOD - erroneous type is ignored
printf("%s", str); // GOOD: erroneous type is ignored
printf("%d %d %u %u", 42l, 42ul, 42l, 42ul); // GOOD: build mode none
printf("%d %d %u %u", 42ll, 42ull, 42ll, 42ull); // BAD
printf("%ld %ld %lu %lu", 42, 42u, 42, 42u); // BAD
}