{

if (mTokenizer->isC())

return;

const SymbolDatabase * const symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token *tok = scope->bodyStart; tok && tok != scope->bodyEnd; tok = tok->next()) {

if (Token::Match(tok, "std :: cout|cerr !!.") && tok->next()->astParent() && tok->next()->astParent()->astOperand1() == tok->next()) {

const Token* tok2 = tok->next();

while (tok2->astParent() && tok2->astParent()->str() == "<<") {

tok2 = tok2->astParent();

if (tok2->astOperand2() && Token::Match(tok2->astOperand2()->previous(), "std :: cout|cerr"))

coutCerrMisusageError(tok, tok2->astOperand2()->strAt(1));

}

}

}

}

{

if (str.find('+', 1) != std::string::npos)

return OpenMode::RW_MODE;

else if (str.find('w') != std::string::npos || str.find('a') != std::string::npos)

return OpenMode::WRITE_MODE;

else if (str.find('r') != std::string::npos)

return OpenMode::READ_MODE;

return OpenMode::UNKNOWN_OM;

OpenMode mode;

nonneg int mode_indent;

enum class Operation {NONE, UNIMPORTANT, READ, WRITE, POSITIONING, OPEN, CLOSE, UNKNOWN_OP} lastOperation;

nonneg int op_indent;

enum class AppendMode { UNKNOWN_AM, APPEND, APPEND_EX };

AppendMode append_mode;

std::string filename;

explicit Filepointer(OpenMode mode_ = OpenMode::UNKNOWN_OM)

: mode(mode_), mode_indent(0), lastOperation(Operation::NONE), op_indent(0), append_mode(AppendMode::UNKNOWN_AM) {}

{

const bool windows = mSettings->isWindowsPlatform();

const bool printPortability = mSettings->severity.isEnabled(Severity::portability);

const bool printWarnings = mSettings->severity.isEnabled(Severity::warning);

std::map<int, Filepointer> filepointers;

const SymbolDatabase* symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Variable* var : symbolDatabase->variableList()) {

if (!var || !var->declarationId() || var->isArray() || !Token::simpleMatch(var->typeStartToken(), "FILE *"))

continue;

if (var->isLocal()) {

if (var->nameToken()->strAt(1) == "(") // initialize by calling "ctor"

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(OpenMode::UNKNOWN_OM)));

else

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(OpenMode::CLOSED)));

} else {

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(OpenMode::UNKNOWN_OM)));

// TODO: If all fopen calls we find open the file in the same type, we can set Filepointer::mode

}

}

for (const Scope * scope : symbolDatabase->functionScopes) {

int indent = 0;

for (const Token *tok = scope->bodyStart; tok != scope->bodyEnd; tok = tok->next()) {

if (tok->str() == "{")

indent++;

else if (tok->str() == "}") {

indent--;

for (std::pair<const int, Filepointer>& filepointer : filepointers) {

if (indent < filepointer.second.mode_indent) {

filepointer.second.mode_indent = 0;

filepointer.second.mode = OpenMode::UNKNOWN_OM;

}

if (indent < filepointer.second.op_indent) {

filepointer.second.op_indent = 0;

filepointer.second.lastOperation = Filepointer::Operation::UNKNOWN_OP;

}

}

} else if (tok->str() == "return" || tok->str() == "continue" || tok->str() == "break" || mSettings->library.isnoreturn(tok)) { // Reset upon return, continue or break

for (std::pair<const int, Filepointer>& filepointer : filepointers) {

filepointer.second.mode_indent = 0;

filepointer.second.mode = OpenMode::UNKNOWN_OM;

filepointer.second.op_indent = 0;

filepointer.second.lastOperation = Filepointer::Operation::UNKNOWN_OP;

}

} else if (Token::Match(tok, "%var% =") &&

(tok->strAt(2) != "fopen" && tok->strAt(2) != "freopen" && tok->strAt(2) != "tmpfile" &&

(windows ? (tok->str() != "_wfopen" && tok->str() != "_wfreopen") : true))) {

std::map<int, Filepointer>::iterator i = filepointers.find(tok->varId());

if (i != filepointers.end()) {

i->second.mode = OpenMode::UNKNOWN_OM;

i->second.lastOperation = Filepointer::Operation::UNKNOWN_OP;

}

} else if (Token::Match(tok, "%name% (") && tok->previous() && (!tok->previous()->isName() || Token::Match(tok->previous(), "return|throw"))) {

std::string mode;

const Token* fileTok = nullptr;

const Token* fileNameTok = nullptr;

Filepointer::Operation operation = Filepointer::Operation::NONE;

if ((tok->str() == "fopen" || tok->str() == "freopen" || tok->str() == "tmpfile" ||

(windows && (tok->str() == "_wfopen" || tok->str() == "_wfreopen"))) &&

tok->strAt(-1) == "=") {

if (tok->str() != "tmpfile") {

const Token* modeTok = tok->tokAt(2)->nextArgument();

if (modeTok && modeTok->tokType() == Token::eString)

mode = modeTok->strValue();

} else

mode = "wb+";

fileTok = tok->tokAt(-2);

operation = Filepointer::Operation::OPEN;

if (Token::Match(tok, "fopen ( %str% ,"))

fileNameTok = tok->tokAt(2);

} else if (windows && Token::Match(tok, "fopen_s|freopen_s|_wfopen_s|_wfreopen_s ( & %name%")) {

const Token* modeTok = tok->tokAt(2)->nextArgument()->nextArgument();

if (modeTok && modeTok->tokType() == Token::eString)

mode = modeTok->strValue();

fileTok = tok->tokAt(3);

operation = Filepointer::Operation::OPEN;

} else if ((tok->str() == "rewind" || tok->str() == "fseek" || tok->str() == "fsetpos" || tok->str() == "fflush") ||

(windows && tok->str() == "_fseeki64")) {

fileTok = tok->tokAt(2);

if (printPortability && fileTok && tok->str() == "fflush") {

if (fileTok->str() == "stdin")

fflushOnInputStreamError(tok, fileTok->str());

else {

const Filepointer& f = filepointers[fileTok->varId()];

if (f.mode == OpenMode::READ_MODE)

fflushOnInputStreamError(tok, fileTok->str());

}

}

operation = Filepointer::Operation::POSITIONING;

} else if (tok->str() == "fgetc" || tok->str() == "fgetwc" ||

tok->str() == "fgets" || tok->str() == "fgetws" || tok->str() == "fread" ||

tok->str() == "fscanf" || tok->str() == "fwscanf" || tok->str() == "getc" ||

(windows && (tok->str() == "fscanf_s" || tok->str() == "fwscanf_s"))) {

if (tok->str().find("scanf") != std::string::npos)

fileTok = tok->tokAt(2);

else

fileTok = tok->linkAt(1)->previous();

operation = Filepointer::Operation::READ;

} else if (tok->str() == "fputc" || tok->str() == "fputwc" ||

tok->str() == "fputs" || tok->str() == "fputws" || tok->str() == "fwrite" ||

tok->str() == "fprintf" || tok->str() == "fwprintf" || tok->str() == "putcc" ||

(windows && (tok->str() == "fprintf_s" || tok->str() == "fwprintf_s"))) {

if (tok->str().find("printf") != std::string::npos)

fileTok = tok->tokAt(2);

else

fileTok = tok->linkAt(1)->previous();

operation = Filepointer::Operation::WRITE;

} else if (tok->str() == "fclose") {

fileTok = tok->tokAt(2);

operation = Filepointer::Operation::CLOSE;

} else if (whitelist.find(tok->str()) != whitelist.end()) {

fileTok = tok->tokAt(2);

if ((tok->str() == "ungetc" || tok->str() == "ungetwc") && fileTok)

fileTok = fileTok->nextArgument();

operation = Filepointer::Operation::UNIMPORTANT;

} else if (!Token::Match(tok, "if|for|while|catch|switch") && !mSettings->library.isFunctionConst(tok->str(), true)) {

const Token* const end2 = tok->linkAt(1);

if (scope->functionOf && scope->functionOf->isClassOrStruct() && !scope->function->isStatic() && ((tok->strAt(-1) != "::" && tok->strAt(-1) != ".") || tok->strAt(-2) == "this")) {

if (!tok->function() || (tok->function()->nestedIn && tok->function()->nestedIn->isClassOrStruct())) {

for (std::pair<const int, Filepointer>& filepointer : filepointers) {

const Variable* var = symbolDatabase->getVariableFromVarId(filepointer.first);

if (!var || !(var->isLocal() || var->isGlobal() || var->isStatic())) {

filepointer.second.mode = OpenMode::UNKNOWN_OM;

filepointer.second.mode_indent = 0;

filepointer.second.op_indent = indent;

filepointer.second.lastOperation = Filepointer::Operation::UNKNOWN_OP;

}

}

continue;

}

}

for (const Token* tok2 = tok->tokAt(2); tok2 != end2; tok2 = tok2->next()) {

if (tok2->varId() && filepointers.find(tok2->varId()) != filepointers.end()) {

fileTok = tok2;

operation = Filepointer::Operation::UNKNOWN_OP; // Assume that repositioning was last operation and that the file is opened now

break;

}

}

}

while (Token::Match(fileTok, "%name% ."))

fileTok = fileTok->tokAt(2);

if (!fileTok || !fileTok->varId() || fileTok->strAt(1) == "[")

continue;

if (filepointers.find(fileTok->varId()) == filepointers.end()) { // function call indicates: Its a File

filepointers.insert(std::make_pair(fileTok->varId(), Filepointer(OpenMode::UNKNOWN_OM)));

}

Filepointer& f = filepointers[fileTok->varId()];

switch (operation) {

case Filepointer::Operation::OPEN:

if (fileNameTok) {

for (std::map<int, Filepointer>::const_iterator it = filepointers.cbegin(); it != filepointers.cend(); ++it) {

const Filepointer &fptr = it->second;

if (fptr.filename == fileNameTok->str() && (fptr.mode == OpenMode::RW_MODE || fptr.mode == OpenMode::WRITE_MODE))

incompatibleFileOpenError(tok, fileNameTok->str());

}

f.filename = fileNameTok->str();

}

f.mode = getMode(mode);

if (mode.find('a') != std::string::npos) {

if (f.mode == OpenMode::RW_MODE)

f.append_mode = Filepointer::AppendMode::APPEND_EX;

else

f.append_mode = Filepointer::AppendMode::APPEND;

} else

f.append_mode = Filepointer::AppendMode::UNKNOWN_AM;

f.mode_indent = indent;

break;

case Filepointer::Operation::POSITIONING:

if (f.mode == OpenMode::CLOSED)

useClosedFileError(tok);

else if (f.append_mode == Filepointer::AppendMode::APPEND && tok->str() != "fflush" && printWarnings)

seekOnAppendedFileError(tok);

break;

case Filepointer::Operation::READ:

if (f.mode == OpenMode::CLOSED)

useClosedFileError(tok);

else if (f.mode == OpenMode::WRITE_MODE)

readWriteOnlyFileError(tok);

else if (f.lastOperation == Filepointer::Operation::WRITE)

ioWithoutPositioningError(tok);

break;

case Filepointer::Operation::WRITE:

if (f.mode == OpenMode::CLOSED)

useClosedFileError(tok);

else if (f.mode == OpenMode::READ_MODE)

writeReadOnlyFileError(tok);

else if (f.lastOperation == Filepointer::Operation::READ)

ioWithoutPositioningError(tok);

break;

case Filepointer::Operation::CLOSE:

if (f.mode == OpenMode::CLOSED)

useClosedFileError(tok);

else

f.mode = OpenMode::CLOSED;

f.mode_indent = indent;

break;

case Filepointer::Operation::UNIMPORTANT:

if (f.mode == OpenMode::CLOSED)

useClosedFileError(tok);

break;

case Filepointer::Operation::UNKNOWN_OP:

f.mode = OpenMode::UNKNOWN_OM;

f.mode_indent = 0;

break;

default:

break;

}

if (operation != Filepointer::Operation::NONE && operation != Filepointer::Operation::UNIMPORTANT) {

f.op_indent = indent;

f.lastOperation = operation;

}

}

}

for (std::pair<const int, Filepointer>& filepointer : filepointers) {

filepointer.second.op_indent = 0;

filepointer.second.mode = OpenMode::UNKNOWN_OM;

filepointer.second.lastOperation = Filepointer::Operation::UNKNOWN_OP;

}

}

{

reportError(tok, Severity::portability,

"fflushOnInputStream", "fflush() called on input stream '" + varname + "' may result in undefined behaviour on non-linux systems.", CWE398, Certainty::normal);

{

reportError(tok, Severity::error,

"IOWithoutPositioning", "Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.", CWE664, Certainty::normal);

{

reportError(tok, Severity::error,

"readWriteOnlyFile", "Read operation on a file that was opened only for writing.", CWE664, Certainty::normal);

{

reportError(tok, Severity::error,

"writeReadOnlyFile", "Write operation on a file that was opened only for reading.", CWE664, Certainty::normal);

{

reportError(tok, Severity::error,

"useClosedFile", "Used file that is not opened.", CWE910, Certainty::normal);

{

reportError(tok, Severity::warning,

"seekOnAppendedFile", "Repositioning operation performed on a file opened in append mode has no effect.", CWE398, Certainty::normal);

{

reportError(tok, Severity::warning,

"incompatibleFileOpen", "The file '" + filename + "' is opened for read and write access at the same time on different streams", CWE664, Certainty::normal);

{

if (!mSettings->severity.isEnabled(Severity::warning))

return;

const SymbolDatabase * const symbolDatabase = mTokenizer->getSymbolDatabase();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token *tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

const Token *formatToken = nullptr;

if (Token::Match(tok, "scanf|vscanf ( %str% ,"))

formatToken = tok->tokAt(2);

else if (Token::Match(tok, "sscanf|vsscanf|fscanf|vfscanf (")) {

const Token* nextArg = tok->tokAt(2)->nextArgument();

if (nextArg && nextArg->tokType() == Token::eString)

formatToken = nextArg;

else

continue;

} else

continue;

bool format = false;

// scan the string backwards, so we do not need to keep states

const std::string &formatstr(formatToken->str());

for (std::size_t i = 1; i < formatstr.length(); i++) {

if (formatstr[i] == '%')

format = !format;

else if (!format)

continue;

else if (std::isdigit(formatstr[i]) || formatstr[i] == '*') {

format = false;

}

else if (std::isalpha((unsigned char)formatstr[i]) || formatstr[i] == '[') {

if (formatstr[i] == 's' || formatstr[i] == '[' || formatstr[i] == 'S' || (formatstr[i] == 'l' && formatstr[i+1] == 's')) // #3490 - field width limits are only necessary for string input

invalidScanfError(tok);

format = false;

}

}

}

}

{

const std::string fname = (tok ? tok->str() : std::string("scanf"));

reportError(tok, Severity::warning,

"invalidscanf", fname + "() without field width limits can crash with huge input data.\n" +

fname + "() without field width limits can crash with huge input data. Add a field width "

"specifier to fix this problem.\n"

"\n"

"Sample program that can crash:\n"

"\n"

"#include <stdio.h>\n"

"int main()\n"

"{\n"

" char c[5];\n"

" scanf(\"%s\", c);\n"

" return 0;\n"

"}\n"

"\n"

"Typing in 5 or more characters may make the program crash. The correct usage "

"here is 'scanf(\"%4s\", c);', as the maximum field width does not include the "

"terminating null byte.\n"

"Source: http://linux.die.net/man/3/scanf\n"

"Source: http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/libkern/stdio/scanf.c",

CWE119, Certainty::normal);

const Token **formatStringTok, const Token **formatArgTok)

{

const Token* argTok = firstArg;

for (int i = 0; i < arg && argTok; ++i)

argTok = argTok->nextArgument();

if (Token::Match(argTok, "%str% [,)]")) {

*formatArgTok = argTok->nextArgument();

*formatStringTok = argTok;

return true;

} else if (Token::Match(argTok, "%var% [,)]") &&

argTok->variable() &&

Token::Match(argTok->variable()->typeStartToken(), "char|wchar_t") &&

(argTok->variable()->isPointer() ||

(argTok->variable()->dimensions().size() == 1 &&

argTok->variable()->dimensionKnown(0) &&

argTok->variable()->dimension(0) != 0))) {

*formatArgTok = argTok->nextArgument();

if (!argTok->values().empty()) {

std::list<ValueFlow::Value>::const_iterator value = std::find_if(

argTok->values().begin(), argTok->values().end(), std::mem_fn(&ValueFlow::Value::isTokValue));

if (value != argTok->values().end() && value->isTokValue() && value->tokvalue &&

value->tokvalue->tokType() == Token::eString) {

*formatStringTok = value->tokvalue;

}

}

return true;

}

return false;

{

const SymbolDatabase *symbolDatabase = mTokenizer->getSymbolDatabase();

const bool isWindows = mSettings->isWindowsPlatform();

for (const Scope * scope : symbolDatabase->functionScopes) {

for (const Token *tok = scope->bodyStart->next(); tok != scope->bodyEnd; tok = tok->next()) {

if (!tok->isName()) continue;

const Token* argListTok = nullptr; // Points to first va_list argument

const Token* formatStringTok = nullptr; // Points to format string token

bool scan = false;

bool scanf_s = false;

int formatStringArgNo = -1;

if (tok->strAt(1) == "(" && mSettings->library.formatstr_function(tok)) {

formatStringArgNo = mSettings->library.formatstr_argno(tok);

scan = mSettings->library.formatstr_scan(tok);

scanf_s = mSettings->library.formatstr_secure(tok);

}

if (formatStringArgNo >= 0) {

// formatstring found in library. Find format string and first argument belonging to format string.

if (!findFormat(formatStringArgNo, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (Token::simpleMatch(tok, "swprintf (")) {

if (Token::Match(tok->tokAt(2)->nextArgument(), "%str%")) {

// Find third parameter and format string

if (!findFormat(1, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else {

// Find fourth parameter and format string

if (!findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

}

} else if (isWindows && Token::Match(tok, "sprintf_s|swprintf_s (")) {

// template <size_t size> int sprintf_s(char (&buffer)[size], const char *format, ...);

if (findFormat(1, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

// int sprintf_s(char *buffer, size_t sizeOfBuffer, const char *format, ...);

else if (findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

} else if (isWindows && Token::Match(tok, "_snprintf_s|_snwprintf_s (")) {

// template <size_t size> int _snprintf_s(char (&buffer)[size], size_t count, const char *format, ...);

if (findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

// int _snprintf_s(char *buffer, size_t sizeOfBuffer, size_t count, const char *format, ...);

else if (findFormat(3, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

} else {

continue;

}

if (!formatStringTok)

continue;

checkFormatString(tok, formatStringTok, argListTok, scan, scanf_s);

}

}

const Token * const formatStringTok,

const Token * argListTok,

const bool scan,

const bool scanf_s)

{

const bool isWindows = mSettings->isWindowsPlatform();

const bool printWarning = mSettings->severity.isEnabled(Severity::warning);

const std::string &formatString = formatStringTok->str();

// Count format string parameters..

int numFormat = 0;

int numSecure = 0;

bool percent = false;

const Token* argListTok2 = argListTok;

std::set<int> parameterPositionsUsed;

for (std::string::const_iterator i = formatString.begin(); i != formatString.end(); ++i) {

if (*i == '%') {

percent = !percent;

} else if (percent && *i == '[') {

while (i != formatString.end()) {

if (*i == ']') {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

percent = false;

break;

}

++i;

}

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

if (i == formatString.end())

break;

} else if (percent) {

percent = false;

bool _continue = false;

bool skip = false;

std::string width;

int parameterPosition = 0;

bool hasParameterPosition = false;

while (i != formatString.end() && *i != '[' && !std::isalpha((unsigned char)*i)) {

if (*i == '*') {

skip = true;

if (scan)

_continue = true;

else {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

}

} else if (std::isdigit(*i)) {

width += *i;

} else if (*i == '$') {

parameterPosition = std::atoi(width.c_str());

hasParameterPosition = true;

width.clear();

}

++i;

}

if (i != formatString.end() && *i == '[') {

while (i != formatString.end()) {

if (*i == ']') {

if (!skip) {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

}

break;

}

++i;

}

if (scanf_s && !skip) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

_continue = true;

}

if (i == formatString.end())

break;

if (_continue)

continue;

if (scan || *i != 'm') { // %m is a non-standard extension that requires no parameter on print functions.

++numFormat;

// Handle parameter positions (POSIX extension) - Ticket #4900

if (hasParameterPosition) {

if (parameterPositionsUsed.find(parameterPosition) == parameterPositionsUsed.end())

parameterPositionsUsed.insert(parameterPosition);

else // Parameter already referenced, hence don't consider it a new format

--numFormat;

}

// Perform type checks

ArgumentInfo argInfo(argListTok, mSettings, mTokenizer->isCPP());

if (argInfo.typeToken && !argInfo.isLibraryType(mSettings)) {

if (scan) {

std::string specifier;

bool done = false;

while (!done) {

switch (*i) {

case 's':

specifier += *i;

if (argInfo.variableInfo && argInfo.isKnownType() && argInfo.variableInfo->isArray() && (argInfo.variableInfo->dimensions().size() == 1) && argInfo.variableInfo->dimensions()[0].known) {

if (!width.empty()) {

const int numWidth = std::atoi(width.c_str());

if (numWidth != (argInfo.variableInfo->dimension(0) - 1))

invalidScanfFormatWidthError(tok, numFormat, numWidth, argInfo.variableInfo, 's');

}

}

if (argListTok && argListTok->tokType() != Token::eString &&

argInfo.isKnownType() && argInfo.isArrayOrPointer() &&

(!Token::Match(argInfo.typeToken, "char|wchar_t") ||

argInfo.typeToken->strAt(-1) == "const")) {

if (!(argInfo.isArrayOrPointer() && argInfo.element && !argInfo.typeToken->isStandardType()))

invalidScanfArgTypeError_s(tok, numFormat, specifier, &argInfo);

}

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

done = true;

break;

case 'c':

if (argInfo.variableInfo && argInfo.isKnownType() && argInfo.variableInfo->isArray() && (argInfo.variableInfo->dimensions().size() == 1) && argInfo.variableInfo->dimensions()[0].known) {

if (!width.empty()) {

const int numWidth = std::atoi(width.c_str());

if (numWidth > argInfo.variableInfo->dimension(0))

invalidScanfFormatWidthError(tok, numFormat, numWidth, argInfo.variableInfo, 'c');

}

}

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

done = true;

break;

case 'x':

case 'X':

case 'u':

case 'o':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!argInfo.typeToken->isUnsigned() ||

!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "uintmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "uintmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'j':

if (!typesMatch(argInfo.typeToken->originalName(), "uintmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'z':

if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "uintmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

default:

if (argInfo.typeToken->str() != "int")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "uintmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

}

}

}

done = true;

break;

case 'n':

case 'd':

case 'i':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->isUnsigned() ||

!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'j':

if (!typesMatch(argInfo.typeToken->originalName(), "intmax_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'z':

if (!(typesMatch(argInfo.typeToken->originalName(), "ssize_t") ||

(isWindows && typesMatch(argInfo.typeToken->originalName(), "SSIZE_T"))))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

default:

if (argInfo.typeToken->str() != "int")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

argInfo.typeToken->originalName() == "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

}

}

}

done = true;

break;

case 'e':

case 'E':

case 'f':

case 'g':

case 'G':

case 'a':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "float|double")) {

if (argInfo.typeToken->isStandardType())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else if (!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else {

switch (specifier[0]) {

case 'l':

if (argInfo.typeToken->str() != "double" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

case 'L':

if (argInfo.typeToken->str() != "double" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

default:

if (argInfo.typeToken->str() != "float")

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

}

}

}

done = true;

break;

case 'I':

if ((i+1 != formatString.end() && *(i+1) == '6' &&

i+2 != formatString.end() && *(i+2) == '4') ||

(i+1 != formatString.end() && *(i+1) == '3' &&

i+2 != formatString.end() && *(i+2) == '2')) {

specifier += *i++;

specifier += *i++;

if ((i+1) != formatString.end() && !isalpha(*(i+1))) {

specifier += *i;

invalidLengthModifierError(tok, numFormat, specifier);

done = true;

} else {

specifier += *i++;

}

} else {

if ((i+1) != formatString.end() && !isalpha(*(i+1))) {

specifier += *i;

invalidLengthModifierError(tok, numFormat, specifier);

done = true;

} else {

specifier += *i++;

}

}

break;

case 'h':

case 'l':

if (i+1 != formatString.end() && *(i+1) == *i)

specifier += *i++;

FALLTHROUGH;

case 'j':

case 'q':

case 't':

case 'z':

case 'L':

// Expect an alphabetical character after these specifiers

if ((i + 1) != formatString.end() && !isalpha(*(i+1))) {

specifier += *i;

invalidLengthModifierError(tok, numFormat, specifier);

done = true;

} else {

specifier += *i++;

}

break;

default:

done = true;

break;

}

}

} else if (printWarning) {

std::string specifier;

bool done = false;

while (!done) {

switch (*i) {

case 's':

if (argListTok->tokType() != Token::eString &&

argInfo.isKnownType() && !argInfo.isArrayOrPointer()) {

if (!Token::Match(argInfo.typeToken, "char|wchar_t")) {

if (!argInfo.element)

invalidPrintfArgTypeError_s(tok, numFormat, &argInfo);

}

}

done = true;

break;

case 'n':

if ((argInfo.isKnownType() && (!argInfo.isArrayOrPointer() || argInfo.typeToken->strAt(-1) == "const")) || argListTok->tokType() == Token::eString)

invalidPrintfArgTypeError_n(tok, numFormat, &argInfo);

done = true;

break;

case 'c':

case 'x':

case 'X':

case 'o':

specifier += *i;

if (argInfo.typeToken->tokType() == Token::eString)

invalidPrintfArgTypeError_uint(tok, numFormat, specifier, &argInfo);

else if (argInfo.isArrayOrPointer() && !argInfo.element) {

// use %p on pointers and arrays