TestIO() : TestFixture("TestIO") {

}

Settings settings;

void run() {

LOAD_LIB_2(settings.library, "std.cfg");

LOAD_LIB_2(settings.library, "windows.cfg");

TEST_CASE(coutCerrMisusage);

TEST_CASE(wrongMode_simple);

TEST_CASE(wrongMode_complex);

TEST_CASE(useClosedFile);

TEST_CASE(fileIOwithoutPositioning);

TEST_CASE(seekOnAppendedFile);

TEST_CASE(fflushOnInputStream);

TEST_CASE(testScanf1); // Scanf without field limiters

TEST_CASE(testScanf2);

TEST_CASE(testScanf4); // #ticket 2553

TEST_CASE(testScanfArgument);

TEST_CASE(testPrintfArgument);

TEST_CASE(testPosixPrintfScanfParameterPosition); // #4900

TEST_CASE(testMicrosoftPrintfArgument); // ticket #4902

TEST_CASE(testMicrosoftScanfArgument);

TEST_CASE(testMicrosoftCStringFormatArguments); // ticket #4920

TEST_CASE(testMicrosoftSecurePrintfArgument);

TEST_CASE(testMicrosoftSecureScanfArgument);

TEST_CASE(testTernary); // ticket #6182

TEST_CASE(testUnsignedConst); // ticket #6132

TEST_CASE(testAstType); // #7014

}

void check(const char code[], bool inconclusive = false, bool portability = false, Settings::PlatformType platform = Settings::Unspecified) {

// Clear the error buffer..

errout.str("");

settings.clearEnabled();

settings.addEnabled("warning");

settings.addEnabled("style");

if (portability)

settings.addEnabled("portability");

settings.inconclusive = inconclusive;

settings.platform(platform);

// Tokenize..

Tokenizer tokenizer(&settings, this);

std::istringstream istr(code);

tokenizer.tokenize(istr, "test.cpp");

// Check..

CheckIO checkIO(&tokenizer, &settings, this);

checkIO.checkWrongPrintfScanfArguments();

// Simplify token list..

tokenizer.simplifyTokenList2();

checkIO.checkCoutCerrMisusage();

checkIO.checkFileUsage();

checkIO.invalidScanf();

}

void coutCerrMisusage() {

check(

"void foo() {\n"

" std::cout << std::cout;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Invalid usage of output stream: '<< std::cout'.\n", errout.str());

check(

"void foo() {\n"

" std::cout << (std::cout);\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Invalid usage of output stream: '<< std::cout'.\n", errout.str());

check(

"void foo() {\n"

" std::cout << \"xyz\" << std::cout;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Invalid usage of output stream: '<< std::cout'.\n", errout.str());

check(

"void foo(int i) {\n"

" std::cout << i << std::cerr;\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) Invalid usage of output stream: '<< std::cerr'.\n", errout.str());

check(

"void foo() {\n"

" std::cout << \"xyz\";\n"

" std::cout << \"xyz\";\n"

"}");

ASSERT_EQUALS("", errout.str());

check(

"void foo() {\n"

" std::cout << std::cout.good();\n"

"}");

ASSERT_EQUALS("", errout.str());

check(

"void foo() {\n"

" unknownObject << std::cout;\n"

"}");

ASSERT_EQUALS("", errout.str());

check(

"void foo() {\n"

" MACRO(std::cout <<, << std::cout)\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void wrongMode_simple() {

// Read mode

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"r\");\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _wfopen(name, L\"r\");\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:5]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfopen(name, _T(\"r\"));\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32A);

ASSERT_EQUALS("[test.cpp:5]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfopen(name, _T(\"r\"));\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:5]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" _wfopen_s(&f, name, L\"r\");\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:5]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" _tfopen_s(&f, name, _T(\"r\"));\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32A);

ASSERT_EQUALS("[test.cpp:5]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" _tfopen_s(&f, name, _T(\"r\"));\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:5]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"r+\");\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" f = _wfopen(name, L\"r+\");\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfopen(name, _T(\"r+\"));\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32A);

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfopen(name, _T(\"r+\"));\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" _wfopen_s(&f, name, L\"r+\");\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" _tfopen_s(&f, name, _T(\"r+\"));\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32A);

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" _tfopen_s(&f, name, _T(\"r+\"));\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("", errout.str());

// Write mode

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"w\");\n"

" fwrite(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:5]: (error) Read operation on a file that was opened only for writing.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"w+\");\n"

" fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

// Append mode

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"a\");\n"

" fwrite(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (warning) Repositioning operation performed on a file opened in append mode has no effect.\n"

"[test.cpp:5]: (error) Read operation on a file that was opened only for writing.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"a+\");\n"

" fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

// Variable declared locally

check("void foo() {\n"

" FILE* f = fopen(name, \"r\");\n"

" fwrite(buffer, 5, 6, f);\n"

" fclose(f);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

// Call unknown function

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"a\");\n"

" fwrite(buffer, 5, 6, f);\n"

" bar(f);\n"

" fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

// freopen and tmpfile

check("void foo(FILE*& f) {\n"

" f = freopen(name, \"r\", f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _wfreopen(name, L\"r\", f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfreopen(name, _T(\"r\"), f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32A);

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfreopen(name, _T(\"r\"), f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _wfreopen_s(&f, name, L\"r\", f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfreopen_s(&f, name, _T(\"r\"), f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32A);

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = _tfreopen_s(&f, name, _T(\"r\"), f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}", false, false, Settings::Win32W);

ASSERT_EQUALS("[test.cpp:3]: (error) Write operation on a file that was opened only for reading.\n", errout.str());

// Crash tests

check("void foo(FILE*& f) {\n"

" f = fopen(name, mode);\n" // No assertion failure (#3830)

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void fopen(std::string const &filepath, std::string const &mode);"); // #3832

}

void wrongMode_complex() {

check("void foo(FILE* f) {\n"

" if(a) f = fopen(name, \"w\");\n"

" else f = fopen(name, \"r\");\n"

" if(a) fwrite(buffer, 5, 6, f);\n"

" else fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n"

" FILE* f;\n"

" if(a) f = fopen(name, \"w\");\n"

" else f = fopen(name, \"r\");\n"

" if(a) fwrite(buffer, 5, 6, f);\n"

" else fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n"

" FILE* f = fopen(name, \"w\");\n"

" if(a) fwrite(buffer, 5, 6, f);\n"

" else fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Read operation on a file that was opened only for writing.\n", errout.str());

}

void useClosedFile() {

check("void foo(FILE*& f) {\n"

" fclose(f);\n"

" fwrite(buffer, 5, 6, f);\n"

" clearerr(f);\n"

" fread(buffer, 5, 6, f);\n"

" ungetc('a', f);\n"

" ungetwc(L'a', f);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Used file that is not opened.\n"

"[test.cpp:4]: (error) Used file that is not opened.\n"

"[test.cpp:5]: (error) Used file that is not opened.\n"

"[test.cpp:6]: (error) Used file that is not opened.\n"

"[test.cpp:7]: (error) Used file that is not opened.\n", errout.str());

check("void foo(FILE*& f) {\n"

" if(!ferror(f)) {\n"

" fclose(f);\n"

" return;"

" }\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" fclose(f);\n"

" f = fopen(name, \"r\");\n"

" fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" f = fopen(name, \"r\");\n"

" f = g;\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n"

" FILE* f;\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Used file that is not opened.\n", errout.str());

check("void foo() {\n"

" FILE* f(stdout);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n" // #3965

" FILE* f[3];\n"

" f[0] = fopen(name, mode);\n"

" fclose(f[0]);\n"

"}");

ASSERT_EQUALS("", errout.str());

// #4368: multiple functions

check("static FILE *fp = NULL;\n"

"\n"

"void close()\n"

"{\n"

" fclose(fp);\n"

"}\n"

"\n"

"void dump()\n"

"{\n"

" if (fp == NULL) return;\n"

" fprintf(fp, \"Here's the output.\\n\");\n"

"}\n"

"\n"

"int main()\n"

"{\n"

" fp = fopen(\"test.txt\", \"w\");\n"

" dump();\n"

" close();\n"

" return 0;\n"

"}");

ASSERT_EQUALS("", errout.str());

check("static FILE *fp = NULL;\n"

"\n"

"void close()\n"

"{\n"

" fclose(fp);\n"

"}\n"

"\n"

"void dump()\n"

"{\n"

" fclose(fp);\n"

" fprintf(fp, \"Here's the output.\\n\");\n"

"}");

ASSERT_EQUALS("[test.cpp:11]: (error) Used file that is not opened.\n", errout.str());

// #4466

check("void chdcd_parse_nero(FILE *infile) {\n"

" switch (mode) {\n"

" case 0x0300:\n"

" fclose(infile);\n"

" return;\n"

" case 0x0500:\n"

" fclose(infile);\n"

" return;\n"

" }\n"

"}");

ASSERT_EQUALS("", errout.str());

// #4649

check("void foo() {\n"

" struct {FILE *f1; FILE *f2;} a;\n"

" a.f1 = fopen(name,mode);\n"

" a.f2 = fopen(name,mode);\n"

" fclose(a.f1);\n"

" fclose(a.f2);\n"

"}");

ASSERT_EQUALS("", errout.str());

// #1473

check("void foo() {\n"

" FILE *a = fopen(\"aa\", \"r\");\n"

" while (fclose(a)) {}\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Used file that is not opened.\n", errout.str());

// #6823

check("void foo() {\n"

" FILE f[2];\n"

" f[0] = fopen(\"1\", \"w\");\n"

" f[1] = fopen(\"2\", \"w\");\n"

" fclose(f[0]);\n"

" fclose(f[1]);\n"

"}");

ASSERT_EQUALS("", errout.str());

}

void fileIOwithoutPositioning() {

check("void foo(FILE* f) {\n"

" fwrite(buffer, 5, 6, f);\n"

" fread(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.\n", errout.str());

check("void foo(FILE* f) {\n"

" fread(buffer, 5, 6, f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (error) Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.\n", errout.str());

check("void foo(FILE* f, bool read) {\n"

" if(read)\n"

" fread(buffer, 5, 6, f);\n"

" else\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE* f) {\n"

" fread(buffer, 5, 6, f);\n"

" fflush(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE* f) {\n"

" fread(buffer, 5, 6, f);\n"

" rewind(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE* f) {\n"

" fread(buffer, 5, 6, f);\n"

" fsetpos(f, pos);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE* f) {\n"

" fread(buffer, 5, 6, f);\n"

" fseek(f, 0, SEEK_SET);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo(FILE* f) {\n"

" fread(buffer, 5, 6, f);\n"

" long pos = ftell(f);\n"

" fwrite(buffer, 5, 6, f);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.\n", errout.str());

// #6452 - member functions

check("class FileStream {\n"

" void insert(const ByteVector &data, ulong start);\n"

" void seek(long offset, Position p);\n"

" FileStreamPrivate *d;\n"

"};\n"

"void FileStream::insert(const ByteVector &data, ulong start) {\n"

" int bytesRead = fread(aboutToOverwrite.data(), 1, bufferLength, d->file);\n"

" seek(writePosition);\n"

" fwrite(buffer.data(), sizeof(char), buffer.size(), d->file);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("class FileStream {\n"

" void insert(const ByteVector &data, ulong start);\n"

" FileStreamPrivate *d;\n"

"};\n"

"void FileStream::insert(const ByteVector &data, ulong start) {\n"

" int bytesRead = fread(aboutToOverwrite.data(), 1, bufferLength, d->file);\n"

" unknown(writePosition);\n"

" fwrite(buffer.data(), sizeof(char), buffer.size(), d->file);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("class FileStream {\n"

" void insert(const ByteVector &data, ulong start);\n"

" FileStreamPrivate *d;\n"

"};\n"

"void known(int);\n"

"void FileStream::insert(const ByteVector &data, ulong start) {\n"

" int bytesRead = fread(aboutToOverwrite.data(), 1, bufferLength, d->file);\n"

" known(writePosition);\n"

" fwrite(buffer.data(), sizeof(char), buffer.size(), d->file);\n"

"}");

ASSERT_EQUALS("[test.cpp:9]: (error) Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.\n", errout.str());

check("class FileStream {\n"

" void insert(const ByteVector &data, ulong start);\n"

" FileStreamPrivate *d;\n"

"};\n"

"void known(int);\n"

"void FileStream::insert(const ByteVector &data, ulong start) {\n"

" int bytesRead = fread(X::data(), 1, bufferLength, d->file);\n"

" known(writePosition);\n"

" fwrite(X::data(), sizeof(char), buffer.size(), d->file);\n"

"}");

ASSERT_EQUALS("[test.cpp:9]: (error) Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.\n", errout.str());

}

void seekOnAppendedFile() {

check("void foo() {\n"

" FILE* f = fopen(\"\", \"a+\");\n"

" fseek(f, 0, SEEK_SET);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n"

" FILE* f = fopen(\"\", \"w\");\n"

" fseek(f, 0, SEEK_SET);\n"

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n"

" FILE* f = fopen(\"\", \"a\");\n"

" fseek(f, 0, SEEK_SET);\n"

"}");

ASSERT_EQUALS("[test.cpp:3]: (warning) Repositioning operation performed on a file opened in append mode has no effect.\n", errout.str());

check("void foo() {\n"

" FILE* f = fopen(\"\", \"a\");\n"

" fflush(f);\n"

"}");

ASSERT_EQUALS("", errout.str()); // #5578

check("void foo() {\n"

" FILE* f = fopen(\"\", \"a\");\n"

" fclose(f);\n"

" f = fopen(\"\", \"r\");\n"

" fseek(f, 0, SEEK_SET);\n"

"}");

ASSERT_EQUALS("", errout.str()); // #6566

}

void fflushOnInputStream() {

check("void foo()\n"

"{\n"

" fflush(stdin);\n"

"}", false, true);

ASSERT_EQUALS("[test.cpp:3]: (portability) fflush() called on input stream 'stdin' may result in undefined behaviour on non-linux systems.\n", errout.str());

check("void foo()\n"

"{\n"

" fflush(stdout);\n"

"}", false, true);

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" f = fopen(path, \"r\");\n"

" fflush(f);\n"

"}", false, true);

ASSERT_EQUALS("[test.cpp:3]: (portability) fflush() called on input stream 'f' may result in undefined behaviour on non-linux systems.\n", errout.str());

check("void foo(FILE*& f) {\n"

" f = fopen(path, \"w\");\n"

" fflush(f);\n"

"}", false, true);

ASSERT_EQUALS("", errout.str());

check("void foo(FILE*& f) {\n"

" fflush(f);\n"

"}", false, true);

ASSERT_EQUALS("", errout.str());

}

void testScanf1() {

check("void foo() {\n"

" int a, b;\n"

" FILE *file = fopen(\"test\", \"r\");\n"

" a = fscanf(file, \"aa %s\", bar);\n"

" b = scanf(\"aa %S\", bar);\n"

" b = scanf(\"aa %ls\", bar);\n"

" sscanf(foo, \"%[^~]\", bar);\n"

" scanf(\"%dx%s\", &b, bar);\n"

" fclose(file);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (warning) scanf without field width limits can crash with huge input data.\n"

"[test.cpp:5]: (warning) scanf without field width limits can crash with huge input data.\n"

"[test.cpp:6]: (warning) scanf without field width limits can crash with huge input data.\n"

"[test.cpp:7]: (warning) scanf without field width limits can crash with huge input data.\n"

"[test.cpp:8]: (warning) scanf without field width limits can crash with huge input data.\n", errout.str());

}

void testScanf2() {

check("void foo() {\n"

" scanf(\"%5s\", bar);\n" // Width specifier given

" scanf(\"%5[^~]\", bar);\n" // Width specifier given

" scanf(\"aa%%s\", bar);\n" // No %s

" scanf(\"aa%d\", &a);\n" // No %s

" scanf(\"aa%ld\", &a);\n" // No %s

" scanf(\"%*[^~]\");\n" // Ignore input

"}");

ASSERT_EQUALS("[test.cpp:4]: (warning) scanf format string requires 0 parameters but 1 is given.\n", errout.str());

}

void testScanf4() { // ticket #2553

check("void f()\n"

"{\n"

" char str [8];\n"

" scanf (\"%70s\",str);\n"

"}");

ASSERT_EQUALS("[test.cpp:4]: (error) Width 70 given in format string (no. 1) is larger than destination buffer 'str[8]', use %7s to prevent overflowing it.\n", errout.str());

}

void testScanfArgument() {

check("void foo() {\n"

" scanf(\"%1d\", &foo);\n"

" sscanf(bar, \"%1d\", &foo);\n"

" scanf(\"%1u%1u\", &foo, bar());\n"

" scanf(\"%*1x %1x %29s\", &count, KeyName);\n" // #3373

" fscanf(f, \"%7ms\", &ref);\n" // #3461

" sscanf(ip_port, \"%*[^:]:%4d\", &port);\n" // #3468

"}");

ASSERT_EQUALS("", errout.str());

check("void foo() {\n"

" scanf(\"\", &foo);\n"

" scanf(\"%1d\", &foo, &bar);\n"

" fscanf(bar, \"%1d\", &foo, &bar);\n"

" scanf(\"%*1x %1x %29s\", &count, KeyName, foo);\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (warning) scanf format string requires 0 parameters but 1 is given.\n"

"[test.cpp:3]: (warning) scanf format string requires 1 parameter but 2 are given.\n"

"[test.cpp:4]: (warning) fscanf format string requires 1 parameter but 2 are given.\n"

"[test.cpp:5]: (warning) scanf format string requires 2 parameters but 3 are given.\n", errout.str());

check("void foo() {\n"

" scanf(\"%1d\");\n"

" scanf(\"%1u%1u\", bar());\n"

" sscanf(bar, \"%1d%1d\", &foo);\n"

" scanf(\"%*1x %1x %29s\", &count);\n"

"}");

ASSERT_EQUALS("[test.cpp:2]: (error) scanf format string requires 1 parameter but only 0 are given.\n"

"[test.cpp:3]: (error) scanf format string requires 2 parameters but only 1 is given.\n"

"[test.cpp:4]: (error) sscanf format string requires 2 parameters but only 1 is given.\n"

"[test.cpp:5]: (error) scanf format string requires 2 parameters but only 1 is given.\n", errout.str());

check("void foo() {\n"

" char input[10];\n"

" char output[5];\n"

" sscanf(input, \"%3s\", output);\n"

" sscanf(input, \"%4s\", output);\n"

" sscanf(input, \"%5s\", output);\n"

"}", false);

ASSERT_EQUALS("[test.cpp:6]: (error) Width 5 given in format string (no. 1) is larger than destination buffer 'output[5]', use %4s to prevent overflowing it.\n", errout.str());

check("void foo() {\n"

" char input[10];\n"

" char output[5];\n"

" sscanf(input, \"%s\", output);\n"

" sscanf(input, \"%3s\", output);\n"

" sscanf(input, \"%4s\", output);\n"

" sscanf(input, \"%5s\", output);\n"

"}", true);

ASSERT_EQUALS("[test.cpp:5]: (warning, inconclusive) Width 3 given in format string (no. 1) is smaller than destination buffer 'output[5]'.\n"

"[test.cpp:7]: (error) Width 5 given in format string (no. 1) is larger than destination buffer 'output[5]', use %4s to prevent overflowing it.\n"

"[test.cpp:4]: (warning) scanf without field width limits can crash with huge input data.\n", errout.str());

check("void foo() {\n"

" const size_t BUFLENGTH(2048);\n"

" typedef char bufT[BUFLENGTH];\n"

" bufT line= {0};\n"

" bufT projectId= {0};\n"

" const int scanrc=sscanf(line, \"Project(\\\"{%36s}\\\")\", projectId);\n"

" sscanf(input, \"%5s\", output);\n"

"}", true);

ASSERT_EQUALS("", errout.str());

{

const char * code = "const unsigned int * foo() { }\n"

"void foo() {\n"

" bool b;\n"

" char c;\n"

" signed char sc;\n"

" unsigned char uc;\n"

" short s;\n"

" unsigned short us;\n"

" int i;\n"

" unsigned int ui;\n"

" long l;\n"

" unsigned long ul;\n"

" long long ll;\n"

" unsigned long long ull;\n"

" float f;\n"

" double d;\n"

" long double ld;\n"

" size_t st;\n"

" ssize_t sst;\n"

" ptrdiff_t pt;\n"

" intmax_t it;\n"

" uintmax_t ut;\n"

" void * vp;\n"

" std::size_t stdst;\n"

" std::ssize_t stdsst;\n"

" std::ptrdiff_t stdpt;\n"

" std::intptr_t stdipt;\n"

" std::uintptr_t stduipt;\n"

" scanf(\"%u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u %u\",\n"

" &b, &c, &sc, &uc, &s, &us, &i, &ui, &l, &ul, &ll, &ull, &f, &d, &ld, &st, &sst, &pt, &it, &ut, &vp, vp,\n"

" \"str\", L\"str\", foo(), &unknown, unknown, &stdst, &stdsst, &stdpt, &stdipt, &stduipt);\n"

"}\n";

std::string result("[test.cpp:29]: (warning) %u in format string (no. 1) requires 'unsigned int *' but the argument type is 'bool *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 2) requires 'unsigned int *' but the argument type is 'char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 3) requires 'unsigned int *' but the argument type is 'signed char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 4) requires 'unsigned int *' but the argument type is 'unsigned char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 5) requires 'unsigned int *' but the argument type is 'short *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 6) requires 'unsigned int *' but the argument type is 'unsigned short *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 7) requires 'unsigned int *' but the argument type is 'int *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 9) requires 'unsigned int *' but the argument type is 'long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 10) requires 'unsigned int *' but the argument type is 'unsigned long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 11) requires 'unsigned int *' but the argument type is 'long long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 12) requires 'unsigned int *' but the argument type is 'unsigned long long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 13) requires 'unsigned int *' but the argument type is 'float *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 14) requires 'unsigned int *' but the argument type is 'double *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 15) requires 'unsigned int *' but the argument type is 'long double *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 16) requires 'unsigned int *' but the argument type is 'size_t * {aka unsigned long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 17) requires 'unsigned int *' but the argument type is 'ssize_t * {aka long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 18) requires 'unsigned int *' but the argument type is 'ptrdiff_t * {aka long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 19) requires 'unsigned int *' but the argument type is 'intmax_t * {aka long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 20) requires 'unsigned int *' but the argument type is 'uintmax_t * {aka unsigned long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 21) requires 'unsigned int *' but the argument type is 'void * *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 22) requires 'unsigned int *' but the argument type is 'void *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 23) requires 'unsigned int *' but the argument type is 'const char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 24) requires 'unsigned int *' but the argument type is 'const wchar_t *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 25) requires 'unsigned int *' but the argument type is 'const unsigned int *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 28) requires 'unsigned int *' but the argument type is 'std::size_t * {aka unsigned long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 29) requires 'unsigned int *' but the argument type is 'std::ssize_t * {aka long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 30) requires 'unsigned int *' but the argument type is 'std::ptrdiff_t * {aka long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 31) requires 'unsigned int *' but the argument type is 'std::intptr_t * {aka long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 32) requires 'unsigned int *' but the argument type is 'std::uintptr_t * {aka unsigned long *}'.\n");

std::string result_win64("[test.cpp:29]: (warning) %u in format string (no. 1) requires 'unsigned int *' but the argument type is 'bool *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 2) requires 'unsigned int *' but the argument type is 'char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 3) requires 'unsigned int *' but the argument type is 'signed char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 4) requires 'unsigned int *' but the argument type is 'unsigned char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 5) requires 'unsigned int *' but the argument type is 'short *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 6) requires 'unsigned int *' but the argument type is 'unsigned short *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 7) requires 'unsigned int *' but the argument type is 'int *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 9) requires 'unsigned int *' but the argument type is 'long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 10) requires 'unsigned int *' but the argument type is 'unsigned long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 11) requires 'unsigned int *' but the argument type is 'long long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 12) requires 'unsigned int *' but the argument type is 'unsigned long long *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 13) requires 'unsigned int *' but the argument type is 'float *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 14) requires 'unsigned int *' but the argument type is 'double *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 15) requires 'unsigned int *' but the argument type is 'long double *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 16) requires 'unsigned int *' but the argument type is 'size_t * {aka unsigned long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 17) requires 'unsigned int *' but the argument type is 'ssize_t * {aka long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 18) requires 'unsigned int *' but the argument type is 'ptrdiff_t * {aka long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 19) requires 'unsigned int *' but the argument type is 'intmax_t * {aka long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 20) requires 'unsigned int *' but the argument type is 'uintmax_t * {aka unsigned long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 21) requires 'unsigned int *' but the argument type is 'void * *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 22) requires 'unsigned int *' but the argument type is 'void *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 23) requires 'unsigned int *' but the argument type is 'const char *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 24) requires 'unsigned int *' but the argument type is 'const wchar_t *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 25) requires 'unsigned int *' but the argument type is 'const unsigned int *'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 28) requires 'unsigned int *' but the argument type is 'std::size_t * {aka unsigned long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 29) requires 'unsigned int *' but the argument type is 'std::ssize_t * {aka long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 30) requires 'unsigned int *' but the argument type is 'std::ptrdiff_t * {aka long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 31) requires 'unsigned int *' but the argument type is 'std::intptr_t * {aka long long *}'.\n"

"[test.cpp:29]: (warning) %u in format string (no. 32) requires 'unsigned int *' but the argument type is 'std::uintptr_t * {aka unsigned long long *}'.\n");

check(code, true, false, Settings::Unix32);

ASSERT_EQUALS(result, errout.str());

check(code, true, false, Settings::Unix64);

ASSERT_EQUALS(result, errout.str());

check(code, true, false, Settings::Win32A);

ASSERT_EQUALS(result, errout.str());

check(code, true, false, Settings::Win64);

ASSERT_EQUALS(result_win64, errout.str());

}

{

const char * code = "void foo() {\n"

" bool b;\n"

" char c;\n"

" signed char sc;\n"

" unsigned char uc;\n"

" short s;\n"

" unsigned short us;\n"

" int i;\n"

" unsigned int ui;\n"

" long l;\n"

" unsigned long ul;\n"

" long long ll;\n"

" unsigned long long ull;\n"

" float f;\n"

" double d;\n"

" long double ld;\n"

" size_t st;\n"

" ssize_t sst;\n"

" ptrdiff_t pt;\n"

" intmax_t it;\n"

" uintmax_t ut;\n"

" void * vp;\n"

" std::size_t stdst;\n"

" std::ssize_t stdsst;\n"

" std::ptrdiff_t stdpt;\n"

" std::intptr_t stdipt;\n"

" std::uintptr_t stduipt;\n"

" scanf(\"%lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu %lu\",\n"

" &b, &c, &sc, &uc, &s, &us, &i, &ui, &l, &ul, &ll, &ull, &f, &d, &ld, &st, &sst, &pt, &it, &ut, &vp, vp,\n"

" &unknown, unknown, &stdst, &stdsst, &stdpt, &stdipt, &stduipt);\n"

"}\n";

std::string result("[test.cpp:28]: (warning) %lu in format string (no. 1) requires 'unsigned long *' but the argument type is 'bool *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 2) requires 'unsigned long *' but the argument type is 'char *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 3) requires 'unsigned long *' but the argument type is 'signed char *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 4) requires 'unsigned long *' but the argument type is 'unsigned char *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 5) requires 'unsigned long *' but the argument type is 'short *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 6) requires 'unsigned long *' but the argument type is 'unsigned short *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 7) requires 'unsigned long *' but the argument type is 'int *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 8) requires 'unsigned long *' but the argument type is 'unsigned int *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 9) requires 'unsigned long *' but the argument type is 'long *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 11) requires 'unsigned long *' but the argument type is 'long long *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 12) requires 'unsigned long *' but the argument type is 'unsigned long long *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 13) requires 'unsigned long *' but the argument type is 'float *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 14) requires 'unsigned long *' but the argument type is 'double *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 15) requires 'unsigned long *' but the argument type is 'long double *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 16) requires 'unsigned long *' but the argument type is 'size_t * {aka unsigned long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 17) requires 'unsigned long *' but the argument type is 'ssize_t * {aka long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 18) requires 'unsigned long *' but the argument type is 'ptrdiff_t * {aka long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 19) requires 'unsigned long *' but the argument type is 'intmax_t * {aka long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 20) requires 'unsigned long *' but the argument type is 'uintmax_t * {aka unsigned long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 21) requires 'unsigned long *' but the argument type is 'void * *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 22) requires 'unsigned long *' but the argument type is 'void *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 25) requires 'unsigned long *' but the argument type is 'std::size_t * {aka unsigned long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 26) requires 'unsigned long *' but the argument type is 'std::ssize_t * {aka long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 27) requires 'unsigned long *' but the argument type is 'std::ptrdiff_t * {aka long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 28) requires 'unsigned long *' but the argument type is 'std::intptr_t * {aka long *}'.\n");

std::string result_win64("[test.cpp:28]: (warning) %lu in format string (no. 1) requires 'unsigned long *' but the argument type is 'bool *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 2) requires 'unsigned long *' but the argument type is 'char *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 3) requires 'unsigned long *' but the argument type is 'signed char *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 4) requires 'unsigned long *' but the argument type is 'unsigned char *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 5) requires 'unsigned long *' but the argument type is 'short *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 6) requires 'unsigned long *' but the argument type is 'unsigned short *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 7) requires 'unsigned long *' but the argument type is 'int *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 8) requires 'unsigned long *' but the argument type is 'unsigned int *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 9) requires 'unsigned long *' but the argument type is 'long *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 11) requires 'unsigned long *' but the argument type is 'long long *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 12) requires 'unsigned long *' but the argument type is 'unsigned long long *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 13) requires 'unsigned long *' but the argument type is 'float *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 14) requires 'unsigned long *' but the argument type is 'double *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 15) requires 'unsigned long *' but the argument type is 'long double *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 16) requires 'unsigned long *' but the argument type is 'size_t * {aka unsigned long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 17) requires 'unsigned long *' but the argument type is 'ssize_t * {aka long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 18) requires 'unsigned long *' but the argument type is 'ptrdiff_t * {aka long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 19) requires 'unsigned long *' but the argument type is 'intmax_t * {aka long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 20) requires 'unsigned long *' but the argument type is 'uintmax_t * {aka unsigned long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 21) requires 'unsigned long *' but the argument type is 'void * *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 22) requires 'unsigned long *' but the argument type is 'void *'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 25) requires 'unsigned long *' but the argument type is 'std::size_t * {aka unsigned long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 26) requires 'unsigned long *' but the argument type is 'std::ssize_t * {aka long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 27) requires 'unsigned long *' but the argument type is 'std::ptrdiff_t * {aka long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 28) requires 'unsigned long *' but the argument type is 'std::intptr_t * {aka long long *}'.\n"

"[test.cpp:28]: (warning) %lu in format string (no. 29) requires 'unsigned long *' but the argument type is 'std::uintptr_t * {aka unsigned long long *}'.\n");

check(code, true, false, Settings::Unix32);

ASSERT_EQUALS(result, errout.str());

check(code, true, false, Settings::Unix64);

ASSERT_EQUALS(result, errout.str());

check(code, true, false, Settings::Win32A);

ASSERT_EQUALS(result, errout.str());

check(code, true, false, Settings::Win64);

ASSERT_EQUALS(result_win64, errout.str());

}

{

const char * code = "void foo() {\n"

" bool b;\n"

" char c;\n"

" signed char sc;\n"

" unsigned char uc;\n"

" short s;\n"

" unsigned short us;\n"

" int i;\n"

" unsigned int ui;\n"

" long l;\n"

" unsigned long ul;\n"

" long long ll;\n"

" unsigned long long ull;\n"

" float f;\n"