/*

* Cppcheck - A tool for static C/C++ code analysis

* Copyright (C) 2007-2016 Cppcheck team.

*

* This program is free software: you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation, either version 3 of the License, or

* (at your option) any later version.

*

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

*

* You should have received a copy of the GNU General Public License

* along with this program. If not, see <http://www.gnu.org/licenses/>.

*/

//---------------------------------------------------------------------------

#include "checkio.h"

#include "tokenize.h"

#include "symboldatabase.h"

#include "utils.h"

#include <cctype>

#include <cstdlib>

//---------------------------------------------------------------------------

// Register CheckIO..

namespace {

CheckIO instance;

}

static const CWE CWE664(664U);

static const CWE CWE685(685U);

static const CWE CWE687(687U);

static const CWE CWE910(910U);

//---------------------------------------------------------------------------

// std::cout << std::cout;

//---------------------------------------------------------------------------

void CheckIO::checkCoutCerrMisusage()

{

if (_tokenizer->isC())

return;

const SymbolDatabase * const symbolDatabase = _tokenizer->getSymbolDatabase();

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t i = 0; i < functions; ++i) {

const Scope * scope = symbolDatabase->functionScopes[i];

for (const Token *tok = scope->classStart; tok && tok != scope->classEnd; tok = tok->next()) {

if (Token::Match(tok, "std :: cout|cerr !!.") && tok->next()->astParent() && tok->next()->astParent()->astOperand1() == tok->next()) {

const Token* tok2 = tok->next();

while (tok2->astParent() && tok2->astParent()->str() == "<<") {

tok2 = tok2->astParent();

if (tok2->astOperand2() && Token::Match(tok2->astOperand2()->previous(), "std :: cout|cerr"))

coutCerrMisusageError(tok, tok2->astOperand2()->strAt(1));

}

}

}

}

}

void CheckIO::coutCerrMisusageError(const Token* tok, const std::string& streamName)

{

reportError(tok, Severity::error, "coutCerrMisusage", "Invalid usage of output stream: '<< std::" + streamName + "'.");

}

//---------------------------------------------------------------------------

// fflush(stdin) <- fflush only applies to output streams in ANSI C

// fread(); fwrite(); <- consecutive read/write statements require repositioning in between

// fopen("","r"); fwrite(); <- write to read-only file (or vice versa)

// fclose(); fread(); <- Use closed file

//---------------------------------------------------------------------------

enum OpenMode { CLOSED, READ_MODE, WRITE_MODE, RW_MODE, UNKNOWN_OM };

static OpenMode getMode(const std::string& str)

{

if (str.find('+', 1) != std::string::npos)

return RW_MODE;

else if (str.find('w') != std::string::npos || str.find('a') != std::string::npos)

return WRITE_MODE;

else if (str.find('r') != std::string::npos)

return READ_MODE;

return UNKNOWN_OM;

}

struct Filepointer {

OpenMode mode;

unsigned int mode_indent;

enum Operation {NONE, UNIMPORTANT, READ, WRITE, POSITIONING, OPEN, CLOSE, UNKNOWN_OP} lastOperation;

unsigned int op_indent;

enum AppendMode { UNKNOWN_AM, APPEND, APPEND_EX };

AppendMode append_mode;

explicit Filepointer(OpenMode mode_ = UNKNOWN_OM)

: mode(mode_), mode_indent(0), lastOperation(NONE), op_indent(0), append_mode(UNKNOWN_AM) {

}

};

namespace {

const std::set<std::string> whitelist = make_container< std::set<std::string> > ()

<< "clearerr" << "feof" << "ferror" << "fgetpos" << "ftell" << "setbuf" << "setvbuf" << "ungetc" << "ungetwc";

}

void CheckIO::checkFileUsage()

{

const bool windows = _settings->isWindowsPlatform();

const bool printPortability = _settings->isEnabled("portability");

const bool printWarnings = _settings->isEnabled("warning");

std::map<unsigned int, Filepointer> filepointers;

const SymbolDatabase* symbolDatabase = _tokenizer->getSymbolDatabase();

std::size_t varListSize = symbolDatabase->getVariableListSize();

for (std::size_t i = 1; i < varListSize; ++i) {

const Variable* var = symbolDatabase->getVariableFromVarId(i);

if (!var || !var->declarationId() || var->isArray() || !Token::simpleMatch(var->typeStartToken(), "FILE *"))

continue;

if (var->isLocal()) {

if (var->nameToken()->strAt(1) == "(") // initialize by calling "ctor"

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(UNKNOWN_OM)));

else

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(CLOSED)));

} else {

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(UNKNOWN_OM)));

// TODO: If all fopen calls we find open the file in the same type, we can set Filepointer::mode

}

}

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t j = 0; j < functions; ++j) {

const Scope * scope = symbolDatabase->functionScopes[j];

unsigned int indent = 0;

for (const Token *tok = scope->classStart; tok != scope->classEnd; tok = tok->next()) {

if (tok->str() == "{")

indent++;

else if (tok->str() == "}") {

indent--;

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

if (indent < i->second.mode_indent) {

i->second.mode_indent = 0;

i->second.mode = UNKNOWN_OM;

}

if (indent < i->second.op_indent) {

i->second.op_indent = 0;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

}

} else if (tok->str() == "return" || tok->str() == "continue" || tok->str() == "break" || _settings->library.isnoreturn(tok)) { // Reset upon return, continue or break

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

i->second.mode_indent = 0;

i->second.mode = UNKNOWN_OM;

i->second.op_indent = 0;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

} else if (Token::Match(tok, "%var% =") &&

(tok->strAt(2) != "fopen" && tok->strAt(2) != "freopen" && tok->strAt(2) != "tmpfile" &&

(windows ? (tok->str() != "_wfopen" && tok->str() != "_wfreopen") : true))) {

std::map<unsigned int, Filepointer>::iterator i = filepointers.find(tok->varId());

if (i != filepointers.end()) {

i->second.mode = UNKNOWN_OM;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

} else if (Token::Match(tok, "%name% (") && tok->previous() && (!tok->previous()->isName() || Token::Match(tok->previous(), "return|throw"))) {

std::string mode;

const Token* fileTok = 0;

Filepointer::Operation operation = Filepointer::NONE;

if ((tok->str() == "fopen" || tok->str() == "freopen" || tok->str() == "tmpfile" ||

(windows && (tok->str() == "_wfopen" || tok->str() == "_wfreopen"))) &&

tok->strAt(-1) == "=") {

if (tok->str() != "tmpfile") {

const Token* modeTok = tok->tokAt(2)->nextArgument();

if (modeTok && modeTok->tokType() == Token::eString)

mode = modeTok->strValue();

} else

mode = "wb+";

fileTok = tok->tokAt(-2);

operation = Filepointer::OPEN;

} else if (windows && Token::Match(tok, "fopen_s|freopen_s|_wfopen_s|_wfreopen_s ( & %name%")) {

const Token* modeTok = tok->tokAt(2)->nextArgument()->nextArgument();

if (modeTok && modeTok->tokType() == Token::eString)

mode = modeTok->strValue();

fileTok = tok->tokAt(3);

operation = Filepointer::OPEN;

} else if ((tok->str() == "rewind" || tok->str() == "fseek" || tok->str() == "fsetpos" || tok->str() == "fflush") ||

(windows && tok->str() == "_fseeki64")) {

if (printPortability && tok->str() == "fflush") {

fileTok = tok->tokAt(2);

if (fileTok) {

if (fileTok->str() == "stdin")

fflushOnInputStreamError(tok, fileTok->str());

else {

Filepointer& f = filepointers[fileTok->varId()];

if (f.mode == READ_MODE)

fflushOnInputStreamError(tok, fileTok->str());

}

}

}

fileTok = tok->tokAt(2);

operation = Filepointer::POSITIONING;

} else if (tok->str() == "fgetc" || tok->str() == "fgetwc" ||

tok->str() == "fgets" || tok->str() == "fgetws" || tok->str() == "fread" ||

tok->str() == "fscanf" || tok->str() == "fwscanf" || tok->str() == "getc" ||

(windows && (tok->str() == "fscanf_s" || tok->str() == "fwscanf_s"))) {

if (tok->str().find("scanf") != std::string::npos)

fileTok = tok->tokAt(2);

else

fileTok = tok->linkAt(1)->previous();

operation = Filepointer::READ;

} else if (tok->str() == "fputc" || tok->str() == "fputwc" ||

tok->str() == "fputs" || tok->str() == "fputws" || tok->str() == "fwrite" ||

tok->str() == "fprintf" || tok->str() == "fwprintf" || tok->str() == "putcc" ||

(windows && (tok->str() == "fprintf_s" || tok->str() == "fwprintf_s"))) {

if (tok->str().find("printf") != std::string::npos)

fileTok = tok->tokAt(2);

else

fileTok = tok->linkAt(1)->previous();

operation = Filepointer::WRITE;

} else if (tok->str() == "fclose") {

fileTok = tok->tokAt(2);

operation = Filepointer::CLOSE;

} else if (whitelist.find(tok->str()) != whitelist.end()) {

fileTok = tok->tokAt(2);

if ((tok->str() == "ungetc" || tok->str() == "ungetwc") && fileTok)

fileTok = fileTok->nextArgument();

operation = Filepointer::UNIMPORTANT;

} else if (!Token::Match(tok, "if|for|while|catch|switch") && _settings->library.functionpure.find(tok->str()) == _settings->library.functionpure.end()) {

const Token* const end2 = tok->linkAt(1);

if (scope->functionOf && scope->functionOf->isClassOrStruct() && !scope->function->isStatic() && ((tok->strAt(-1) != "::" && tok->strAt(-1) != ".") || tok->strAt(-2) == "this")) {

if (!tok->function() || (tok->function()->nestedIn && tok->function()->nestedIn->isClassOrStruct())) {

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

const Variable* var = symbolDatabase->getVariableFromVarId(i->first);

if (!var || !(var->isLocal() || var->isGlobal() || var->isStatic())) {

i->second.mode = UNKNOWN_OM;

i->second.mode_indent = 0;

i->second.op_indent = indent;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

}

continue;

}

}

for (const Token* tok2 = tok->tokAt(2); tok2 != end2; tok2 = tok2->next()) {

if (tok2->varId() && filepointers.find(tok2->varId()) != filepointers.end()) {

fileTok = tok2;

operation = Filepointer::UNKNOWN_OP; // Assume that repositioning was last operation and that the file is opened now

break;

}

}

}

while (Token::Match(fileTok, "%name% ."))

fileTok = fileTok->tokAt(2);

if (!fileTok || !fileTok->varId() || fileTok->strAt(1) == "[")

continue;

if (filepointers.find(fileTok->varId()) == filepointers.end()) { // function call indicates: Its a File

filepointers.insert(std::make_pair(fileTok->varId(), Filepointer(UNKNOWN_OM)));

}

Filepointer& f = filepointers[fileTok->varId()];

switch (operation) {

case Filepointer::OPEN:

f.mode = getMode(mode);

if (mode.find('a') != std::string::npos) {

if (f.mode == RW_MODE)

f.append_mode = Filepointer::APPEND_EX;

else

f.append_mode = Filepointer::APPEND;

} else

f.append_mode = Filepointer::UNKNOWN_AM;

f.mode_indent = indent;

break;

case Filepointer::POSITIONING:

if (f.mode == CLOSED)

useClosedFileError(tok);

else if (f.append_mode == Filepointer::APPEND && tok->str() != "fflush" && printWarnings)

seekOnAppendedFileError(tok);

break;

case Filepointer::READ:

if (f.mode == CLOSED)

useClosedFileError(tok);

else if (f.mode == WRITE_MODE)

readWriteOnlyFileError(tok);

else if (f.lastOperation == Filepointer::WRITE)

ioWithoutPositioningError(tok);

break;

case Filepointer::WRITE:

if (f.mode == CLOSED)

useClosedFileError(tok);

else if (f.mode == READ_MODE)

writeReadOnlyFileError(tok);

else if (f.lastOperation == Filepointer::READ)

ioWithoutPositioningError(tok);

break;

case Filepointer::CLOSE:

if (f.mode == CLOSED)

useClosedFileError(tok);

else

f.mode = CLOSED;

f.mode_indent = indent;

break;

case Filepointer::UNIMPORTANT:

if (f.mode == CLOSED)

useClosedFileError(tok);

break;

case Filepointer::UNKNOWN_OP:

f.mode = UNKNOWN_OM;

f.mode_indent = 0;

break;

default:

break;

}

if (operation != Filepointer::NONE && operation != Filepointer::UNIMPORTANT) {

f.op_indent = indent;

f.lastOperation = operation;

}

}

}

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

i->second.op_indent = 0;

i->second.mode = UNKNOWN_OM;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

}

}

void CheckIO::fflushOnInputStreamError(const Token *tok, const std::string &varname)

{

reportError(tok, Severity::portability,

"fflushOnInputStream", "fflush() called on input stream '" + varname + "' may result in undefined behaviour on non-linux systems.");

}

void CheckIO::ioWithoutPositioningError(const Token *tok)

{

reportError(tok, Severity::error,

"IOWithoutPositioning", "Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.", CWE664, false);

}

void CheckIO::readWriteOnlyFileError(const Token *tok)

{

reportError(tok, Severity::error,

"readWriteOnlyFile", "Read operation on a file that was opened only for writing.", CWE664, false);

}

void CheckIO::writeReadOnlyFileError(const Token *tok)

{

reportError(tok, Severity::error,

"writeReadOnlyFile", "Write operation on a file that was opened only for reading.", CWE664, false);

}

void CheckIO::useClosedFileError(const Token *tok)

{

reportError(tok, Severity::error,

"useClosedFile", "Used file that is not opened.", CWE910, false);

}

void CheckIO::seekOnAppendedFileError(const Token *tok)

{

reportError(tok, Severity::warning,

"seekOnAppendedFile", "Repositioning operation performed on a file opened in append mode has no effect.");

}

//---------------------------------------------------------------------------

// scanf without field width limits can crash with huge input data

//---------------------------------------------------------------------------

void CheckIO::invalidScanf()

{

if (!_settings->isEnabled("warning"))

return;

const SymbolDatabase * const symbolDatabase = _tokenizer->getSymbolDatabase();

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t j = 0; j < functions; ++j) {

const Scope * scope = symbolDatabase->functionScopes[j];

for (const Token *tok = scope->classStart->next(); tok != scope->classEnd; tok = tok->next()) {

const Token *formatToken = nullptr;

if (Token::Match(tok, "scanf|vscanf ( %str% ,"))

formatToken = tok->tokAt(2);

else if (Token::Match(tok, "sscanf|vsscanf|fscanf|vfscanf (")) {

const Token* nextArg = tok->tokAt(2)->nextArgument();

if (nextArg && nextArg->tokType() == Token::eString)

formatToken = nextArg;

else

continue;

} else

continue;

bool format = false;

// scan the string backwards, so we do not need to keep states

const std::string &formatstr(formatToken->str());

for (std::size_t i = 1; i < formatstr.length(); i++) {

if (formatstr[i] == '%')

format = !format;

else if (!format)

continue;

else if (std::isdigit(formatstr[i]) || formatstr[i] == '*') {

format = false;

}

else if (std::isalpha((unsigned char)formatstr[i]) || formatstr[i] == '[') {

if (formatstr[i] == 's' || formatstr[i] == '[' || formatstr[i] == 'S' || (formatstr[i] == 'l' && formatstr[i+1] == 's')) // #3490 - field width limits are only necessary for string input

invalidScanfError(tok);

format = false;

}

}

}

}

}

void CheckIO::invalidScanfError(const Token *tok)

{

reportError(tok, Severity::warning,

"invalidscanf", "scanf without field width limits can crash with huge input data.\n"

"scanf without field width limits can crash with huge input data. Add a field width "

"specifier to fix this problem:\n"

" %s => %20s\n"

"\n"

"Sample program that can crash:\n"

"\n"

"#include <stdio.h>\n"

"int main()\n"

"{\n"

" char c[5];\n"

" scanf(\"%s\", c);\n"

" return 0;\n"

"}\n"

"\n"

"Typing in 5 or more characters may make the program crash. The correct usage "

"here is 'scanf(\"%4s\", c);', as the maximum field width does not include the "

"terminating null byte.\n"

"Source: http://linux.die.net/man/3/scanf\n"

"Source: http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/libkern/stdio/scanf.c"

);

}

//---------------------------------------------------------------------------

// printf("%u", "xyz"); // Wrong argument type

// printf("%u%s", 1); // Too few arguments

// printf("", 1); // Too much arguments

//---------------------------------------------------------------------------

static bool findFormat(unsigned int arg, const Token *firstArg,

const Token **formatStringTok, const Token **formatArgTok)

{

const Token* argTok = firstArg;

for (unsigned int i = 0; i < arg && argTok; ++i)

argTok = argTok->nextArgument();

if (Token::Match(argTok, "%str% [,)]")) {

*formatArgTok = argTok->nextArgument();

*formatStringTok = argTok;

return true;

} else if (Token::Match(argTok, "%var% [,)]") &&

argTok->variable() &&

Token::Match(argTok->variable()->typeStartToken(), "char|wchar_t") &&

(argTok->variable()->isPointer() ||

(argTok->variable()->dimensions().size() == 1 &&

argTok->variable()->dimensionKnown(0) &&

argTok->variable()->dimension(0) != 0))) {

*formatArgTok = argTok->nextArgument();

if (argTok->values.size() >= 1 && argTok->values.front().tokvalue && argTok->values.front().tokvalue->tokType() == Token::eString)

*formatStringTok = argTok->values.front().tokvalue;

return true;

}

return false;

}

// Utility function returning whether iToTest equals iTypename or iOptionalPrefix+iTypename

static inline bool typesMatch(const std::string& iToTest, const std::string& iTypename, const std::string& iOptionalPrefix = "std::")

{

return (iToTest == iTypename) || (iToTest == iOptionalPrefix + iTypename);

}

void CheckIO::checkWrongPrintfScanfArguments()

{

const SymbolDatabase *symbolDatabase = _tokenizer->getSymbolDatabase();

const bool isWindows = _settings->isWindowsPlatform();

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t j = 0; j < functions; ++j) {

const Scope * scope = symbolDatabase->functionScopes[j];

for (const Token *tok = scope->classStart->next(); tok != scope->classEnd; tok = tok->next()) {

if (!tok->isName()) continue;

const Token* argListTok = 0; // Points to first va_list argument

const Token* formatStringTok = 0; // Points to format string token

bool scan = false;

bool scanf_s = false;

int formatStringArgNo = -1;

if (tok->strAt(1) == "(" && _settings->library.formatstr_function(tok->str())) {

const std::map<int, Library::ArgumentChecks>& argumentChecks = _settings->library.argumentChecks.at(tok->str());

for (std::map<int, Library::ArgumentChecks>::const_iterator i = argumentChecks.cbegin(); i != argumentChecks.cend(); ++i) {

if (i->second.formatstr) {

formatStringArgNo = i->first - 1;

break;

}

}

scan = _settings->library.formatstr_scan(tok->str());

scanf_s = _settings->library.formatstr_secure(tok->str());

}

if (formatStringArgNo >= 0) {

// formatstring found in library. Find format string and first argument belonging to format string.

if (!findFormat(static_cast<unsigned int>(formatStringArgNo), tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (isWindows && Token::Match(tok, "Format|AppendFormat (") &&

Token::Match(tok->tokAt(-2), "%var% .") && tok->tokAt(-2)->variable() &&

tok->tokAt(-2)->variable()->typeStartToken()->str() == "CString") {

// Find second parameter and format string

if (!findFormat(0, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (Token::simpleMatch(tok, "swprintf (") && Token::Match(tok->tokAt(2)->nextArgument(), "%str%")) {

// Find third parameter and format string

if (!findFormat(1, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (Token::simpleMatch(tok, "swprintf (") && !Token::Match(tok->tokAt(2)->nextArgument(), "%str%")) {

// Find forth parameter and format string

if (!findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (isWindows && Token::Match(tok, "sprintf_s|swprintf_s (")) {

// template <size_t size> int sprintf_s(char (&buffer)[size], const char *format, ...);

if (findFormat(1, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

// int sprintf_s(char *buffer, size_t sizeOfBuffer, const char *format, ...);

else if (findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

} else if (isWindows && Token::Match(tok, "_snprintf_s|_snwprintf_s (")) {

// template <size_t size> int _snprintf_s(char (&buffer)[size], size_t count, const char *format, ...);

if (findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

// int _snprintf_s(char *buffer, size_t sizeOfBuffer, size_t count, const char *format, ...);

else if (findFormat(3, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

} else {

continue;

}

if (!formatStringTok)

continue;

checkFormatString(tok, formatStringTok, argListTok, scan, scanf_s);

}

}

}

void CheckIO::checkFormatString(const Token * const tok,

const Token * const formatStringTok,

const Token * argListTok,

const bool scan,

const bool scanf_s)

{

const bool printWarning = _settings->isEnabled("warning");

const std::string &formatString = formatStringTok->str();

// Count format string parameters..

unsigned int numFormat = 0;

unsigned int numSecure = 0;

bool percent = false;

const Token* argListTok2 = argListTok;

std::set<unsigned int> parameterPositionsUsed;

for (std::string::const_iterator i = formatString.begin(); i != formatString.end(); ++i) {

if (*i == '%') {

percent = !percent;

} else if (percent && *i == '[') {

while (i != formatString.end()) {

if (*i == ']') {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

percent = false;

break;

}

++i;

}

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

if (i == formatString.end())

break;

} else if (percent) {

percent = false;

bool _continue = false;

bool skip = false;

std::string width;

unsigned int parameterPosition = 0;

bool hasParameterPosition = false;

while (i != formatString.end() && *i != '[' && !std::isalpha((unsigned char)*i)) {

if (*i == '*') {

skip = true;

if (scan)

_continue = true;

else {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

}

} else if (std::isdigit(*i)) {

width += *i;

} else if (*i == '$') {

parameterPosition = static_cast<unsigned int>(std::atoi(width.c_str()));

hasParameterPosition = true;

width.clear();

}

++i;

}

if (i != formatString.end() && *i == '[') {

while (i != formatString.end()) {

if (*i == ']') {

if (!skip) {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

}

break;

}

++i;

}

if (scanf_s && !skip) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

_continue = true;

}

if (i == formatString.end())

break;

if (_continue)

continue;

if (scan || *i != 'm') { // %m is a non-standard extension that requires no parameter on print functions.

++numFormat;

// Handle parameter positions (POSIX extension) - Ticket #4900

if (hasParameterPosition) {

if (parameterPositionsUsed.find(parameterPosition) == parameterPositionsUsed.end())

parameterPositionsUsed.insert(parameterPosition);

else // Parameter already referenced, hence don't consider it a new format

--numFormat;

}

// Perform type checks

ArgumentInfo argInfo(argListTok, _settings, _tokenizer->isCPP());

if (argInfo.typeToken && !argInfo.isLibraryType(_settings)) {

if (scan) {

std::string specifier;

bool done = false;

while (!done) {

switch (*i) {

case 's':

specifier += *i;

if (argInfo.variableInfo && argInfo.isKnownType() && argInfo.variableInfo->isArray() && (argInfo.variableInfo->dimensions().size() == 1) && argInfo.variableInfo->dimensions()[0].known) {

if (!width.empty()) {

int numWidth = std::atoi(width.c_str());

if (numWidth != (argInfo.variableInfo->dimension(0) - 1))

invalidScanfFormatWidthError(tok, numFormat, numWidth, argInfo.variableInfo);

}

}

if (argListTok && argListTok->tokType() != Token::eString &&

argInfo.isKnownType() && argInfo.isArrayOrPointer() &&

(!Token::Match(argInfo.typeToken, "char|wchar_t") ||

argInfo.typeToken->strAt(-1) == "const")) {

if (!(argInfo.isArrayOrPointer() && argInfo.element && !argInfo.typeToken->isStandardType()))

invalidScanfArgTypeError_s(tok, numFormat, specifier, &argInfo);

}

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

done = true;

break;

case 'c':

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

done = true;

break;

case 'x':

case 'X':

case 'o':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t", "u"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t", "u"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") &&

!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'j':

if (argInfo.typeToken->originalName() != "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'z':

if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

default:

if (argInfo.typeToken->str() != "int" || !argInfo.typeToken->isUnsigned())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t", "u"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

}

}

}

done = true;

break;

case 'n':

case 'd':

case 'i':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->isUnsigned() ||

!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

argInfo.typeToken->originalName() == "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

argInfo.typeToken->originalName() == "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'j':

if (argInfo.typeToken->originalName() != "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'z':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") &&

!typesMatch(argInfo.typeToken->originalName(), "ssize_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

default:

if (argInfo.typeToken->str() != "int")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

argInfo.typeToken->originalName() == "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

}

}

}

done = true;

break;

case 'u':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!argInfo.typeToken->isUnsigned() ||

!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'j':

if (argInfo.typeToken->originalName() != "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'z':

if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

default:

if (argInfo.typeToken->str() != "int")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ssize_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

}

}

}

done = true;

break;

case 'e':

case 'E':

case 'f':

case 'g':

case 'G':

case 'a':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "float|double")) {

if (argInfo.typeToken->isStandardType())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else if (!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else {

switch (specifier[0]) {

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "double" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else if (argInfo.typeToken->str() != "double" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

case 'L':

if (argInfo.typeToken->str() != "double" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

default:

if (argInfo.typeToken->str() != "float")

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

}

}

}

done = true;

break;

case 'I':

if ((i+1 != formatString.end() && *(i+1) == '6' &&

i+2 != formatString.end() && *(i+2) == '4') ||

(i+1 != formatString.end() && *(i+1) == '3' &&

i+2 != formatString.end() && *(i+2) == '2')) {

specifier += *i++;

specifier += *i++;

if ((i+1) != formatString.end() && !isalpha(*(i+1))) {

specifier += *i;

invalidLengthModifierError(tok, numFormat, specifier);

done = true;

} else {

specifier += *i++;

}

} else {

if ((i+1) != formatString.end() && !isalpha(*(i+1))) {

specifier += *i;

invalidLengthModifierError(tok, numFormat, specifier);

done = true;

} else {

specifier += *i++;

}

}