{

if (_tokenizer->isC())

return;

const SymbolDatabase * const symbolDatabase = _tokenizer->getSymbolDatabase();

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t i = 0; i < functions; ++i) {

const Scope * scope = symbolDatabase->functionScopes[i];

for (const Token *tok = scope->classStart; tok && tok != scope->classEnd; tok = tok->next()) {

if (Token::Match(tok, "std :: cout|cerr !!.") && tok->next()->astParent() && tok->next()->astParent()->astOperand1() == tok->next()) {

const Token* tok2 = tok->next();

while (tok2->astParent() && tok2->astParent()->str() == "<<") {

tok2 = tok2->astParent();

if (tok2->astOperand2() && Token::Match(tok2->astOperand2()->previous(), "std :: cout|cerr"))

coutCerrMisusageError(tok, tok2->astOperand2()->strAt(1));

}

}

}

}

{

if (str.find('+', 1) != std::string::npos)

return RW_MODE;

else if (str.find('w') != std::string::npos || str.find('a') != std::string::npos)

return WRITE_MODE;

else if (str.find('r') != std::string::npos)

return READ_MODE;

return UNKNOWN_OM;

OpenMode mode;

unsigned int mode_indent;

enum Operation {NONE, UNIMPORTANT, READ, WRITE, POSITIONING, OPEN, CLOSE, UNKNOWN_OP} lastOperation;

unsigned int op_indent;

enum AppendMode { UNKNOWN_AM, APPEND, APPEND_EX };

AppendMode append_mode;

explicit Filepointer(OpenMode mode_ = UNKNOWN_OM)

: mode(mode_), mode_indent(0), lastOperation(NONE), op_indent(0), append_mode(UNKNOWN_AM) {

}

{

static const char* _whitelist[] = {

"clearerr", "feof", "ferror", "fgetpos", "ftell", "setbuf", "setvbuf", "ungetc", "ungetwc"

};

static const std::set<std::string> whitelist(_whitelist, _whitelist + sizeof(_whitelist)/sizeof(*_whitelist));

const bool windows = _settings->isWindowsPlatform();

std::map<unsigned int, Filepointer> filepointers;

const SymbolDatabase* symbolDatabase = _tokenizer->getSymbolDatabase();

std::size_t varListSize = symbolDatabase->getVariableListSize();

for (std::size_t i = 1; i < varListSize; ++i) {

const Variable* var = symbolDatabase->getVariableFromVarId(i);

if (!var || !var->declarationId() || var->isArray() || !Token::simpleMatch(var->typeStartToken(), "FILE *"))

continue;

if (var->isLocal()) {

if (var->nameToken()->strAt(1) == "(") // initialize by calling "ctor"

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(UNKNOWN_OM)));

else

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(CLOSED)));

} else {

filepointers.insert(std::make_pair(var->declarationId(), Filepointer(UNKNOWN_OM)));

// TODO: If all fopen calls we find open the file in the same type, we can set Filepointer::mode

}

}

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t j = 0; j < functions; ++j) {

const Scope * scope = symbolDatabase->functionScopes[j];

unsigned int indent = 0;

for (const Token *tok = scope->classStart; tok != scope->classEnd; tok = tok->next()) {

if (tok->str() == "{")

indent++;

else if (tok->str() == "}") {

indent--;

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

if (indent < i->second.mode_indent) {

i->second.mode_indent = 0;

i->second.mode = UNKNOWN_OM;

}

if (indent < i->second.op_indent) {

i->second.op_indent = 0;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

}

} else if (tok->str() == "return" || tok->str() == "continue" || tok->str() == "break") { // Reset upon return, continue or break

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

i->second.mode_indent = 0;

i->second.mode = UNKNOWN_OM;

i->second.op_indent = 0;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

} else if (Token::Match(tok, "%var% =") &&

(tok->strAt(2) != "fopen" && tok->strAt(2) != "freopen" && tok->strAt(2) != "tmpfile" &&

(windows ? (tok->str() != "_wfopen" && tok->str() != "_wfreopen") : true))) {

std::map<unsigned int, Filepointer>::iterator i = filepointers.find(tok->varId());

if (i != filepointers.end()) {

i->second.mode = UNKNOWN_OM;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

} else if (Token::Match(tok, "%name% (") && tok->previous() && (!tok->previous()->isName() || Token::Match(tok->previous(), "return|throw"))) {

std::string mode;

const Token* fileTok = 0;

Filepointer::Operation operation = Filepointer::NONE;

if ((tok->str() == "fopen" || tok->str() == "freopen" || tok->str() == "tmpfile" ||

(windows && (tok->str() == "_wfopen" || tok->str() == "_wfreopen"))) &&

tok->strAt(-1) == "=") {

if (tok->str() != "tmpfile") {

const Token* modeTok = tok->tokAt(2)->nextArgument();

if (modeTok && modeTok->type() == Token::eString)

mode = modeTok->strValue();

} else

mode = "wb+";

fileTok = tok->tokAt(-2);

operation = Filepointer::OPEN;

} else if (windows && Token::Match(tok, "fopen_s|freopen_s|_wfopen_s|_wfreopen_s ( & %name%")) {

const Token* modeTok = tok->tokAt(2)->nextArgument()->nextArgument();

if (modeTok && modeTok->type() == Token::eString)

mode = modeTok->strValue();

fileTok = tok->tokAt(3);

operation = Filepointer::OPEN;

} else if ((tok->str() == "rewind" || tok->str() == "fseek" || tok->str() == "fsetpos" || tok->str() == "fflush") ||

(windows && tok->str() == "_fseeki64")) {

if (_settings->isEnabled("portability") && tok->str() == "fflush") {

fileTok = tok->tokAt(2);

if (fileTok) {

if (fileTok->str() == "stdin")

fflushOnInputStreamError(tok, fileTok->str());

else {

Filepointer& f = filepointers[fileTok->varId()];

if (f.mode == READ_MODE)

fflushOnInputStreamError(tok, fileTok->str());

}

}

}

fileTok = tok->tokAt(2);

operation = Filepointer::POSITIONING;

} else if (tok->str() == "fgetc" || tok->str() == "fgetwc" ||

tok->str() == "fgets" || tok->str() == "fgetws" || tok->str() == "fread" ||

tok->str() == "fscanf" || tok->str() == "fwscanf" || tok->str() == "getc" ||

(windows && (tok->str() == "fscanf_s" || tok->str() == "fwscanf_s"))) {

if (tok->str().find("scanf") != std::string::npos)

fileTok = tok->tokAt(2);

else

fileTok = tok->linkAt(1)->previous();

operation = Filepointer::READ;

} else if (tok->str() == "fputc" || tok->str() == "fputwc" ||

tok->str() == "fputs" || tok->str() == "fputws" || tok->str() == "fwrite" ||

tok->str() == "fprintf" || tok->str() == "fwprintf" || tok->str() == "putcc" ||

(windows && (tok->str() == "fprintf_s" || tok->str() == "fwprintf_s"))) {

if (tok->str().find("printf") != std::string::npos)

fileTok = tok->tokAt(2);

else

fileTok = tok->linkAt(1)->previous();

operation = Filepointer::WRITE;

} else if (tok->str() == "fclose") {

fileTok = tok->tokAt(2);

operation = Filepointer::CLOSE;

} else if (whitelist.find(tok->str()) != whitelist.end()) {

fileTok = tok->tokAt(2);

if ((tok->str() == "ungetc" || tok->str() == "ungetwc") && fileTok)

fileTok = fileTok->nextArgument();

operation = Filepointer::UNIMPORTANT;

} else if (!Token::Match(tok, "if|for|while|catch|switch") && _settings->library.functionpure.find(tok->str()) == _settings->library.functionpure.end()) {

const Token* const end2 = tok->linkAt(1);

if (scope->functionOf && scope->functionOf->isClassOrStruct() && !scope->function->isStatic() && ((tok->strAt(-1) != "::" && tok->strAt(-1) != ".") || tok->strAt(-2) == "this")) {

if (!tok->function() || (tok->function()->nestedIn && tok->function()->nestedIn->isClassOrStruct())) {

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

const Variable* var = symbolDatabase->getVariableFromVarId(i->first);

if (!var || !(var->isLocal() || var->isGlobal() || var->isStatic())) {

i->second.mode = UNKNOWN_OM;

i->second.mode_indent = 0;

i->second.op_indent = indent;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

}

continue;

}

}

for (const Token* tok2 = tok->tokAt(2); tok2 != end2; tok2 = tok2->next()) {

if (tok2->varId() && filepointers.find(tok2->varId()) != filepointers.end()) {

fileTok = tok2;

operation = Filepointer::UNKNOWN_OP; // Assume that repositioning was last operation and that the file is opened now

break;

}

}

}

while (Token::Match(fileTok, "%name% ."))

fileTok = fileTok->tokAt(2);

if (!fileTok || !fileTok->varId())

continue;

if (filepointers.find(fileTok->varId()) == filepointers.end()) { // function call indicates: Its a File

filepointers.insert(std::make_pair(fileTok->varId(), Filepointer(UNKNOWN_OM)));

}

Filepointer& f = filepointers[fileTok->varId()];

switch (operation) {

case Filepointer::OPEN:

f.mode = getMode(mode);

if (mode.find('a') != std::string::npos) {

if (f.mode == RW_MODE)

f.append_mode = Filepointer::APPEND_EX;

else

f.append_mode = Filepointer::APPEND;

}

f.mode_indent = indent;

break;

case Filepointer::POSITIONING:

if (f.mode == CLOSED)

useClosedFileError(tok);

else if (f.append_mode == Filepointer::APPEND && tok->str() != "fflush" && _settings->isEnabled("warning"))

seekOnAppendedFileError(tok);

break;

case Filepointer::READ:

if (f.mode == CLOSED)

useClosedFileError(tok);

else if (f.mode == WRITE_MODE)

readWriteOnlyFileError(tok);

else if (f.lastOperation == Filepointer::WRITE)

ioWithoutPositioningError(tok);

break;

case Filepointer::WRITE:

if (f.mode == CLOSED)

useClosedFileError(tok);

else if (f.mode == READ_MODE)

writeReadOnlyFileError(tok);

else if (f.lastOperation == Filepointer::READ)

ioWithoutPositioningError(tok);

break;

case Filepointer::CLOSE:

if (f.mode == CLOSED)

useClosedFileError(tok);

else

f.mode = CLOSED;

f.mode_indent = indent;

break;

case Filepointer::UNIMPORTANT:

if (f.mode == CLOSED)

useClosedFileError(tok);

break;

case Filepointer::UNKNOWN_OP:

f.mode = UNKNOWN_OM;

f.mode_indent = 0;

break;

default:

break;

}

if (operation != Filepointer::NONE && operation != Filepointer::UNIMPORTANT) {

f.op_indent = indent;

f.lastOperation = operation;

}

}

}

for (std::map<unsigned int, Filepointer>::iterator i = filepointers.begin(); i != filepointers.end(); ++i) {

i->second.op_indent = 0;

i->second.mode = UNKNOWN_OM;

i->second.lastOperation = Filepointer::UNKNOWN_OP;

}

}

{

reportError(tok, Severity::portability,

"fflushOnInputStream", "fflush() called on input stream '" + varname + "' may result in undefined behaviour on non-linux systems.");

{

reportError(tok, Severity::error,

"IOWithoutPositioning", "Read and write operations without a call to a positioning function (fseek, fsetpos or rewind) or fflush in between result in undefined behaviour.");

{

reportError(tok, Severity::error,

"readWriteOnlyFile", "Read operation on a file that was opened only for writing.");

{

reportError(tok, Severity::error,

"writeReadOnlyFile", "Write operation on a file that was opened only for reading.");

{

reportError(tok, Severity::error,

"useClosedFile", "Used file that is not opened.");

{

reportError(tok, Severity::warning,

"seekOnAppendedFile", "Repositioning operation performed on a file opened in append mode has no effect.");

{

const bool warning = _settings->isEnabled("warning");

const bool portability = _settings->isEnabled("portability");

if (!warning && !portability)

return;

const bool windows = _settings->isWindowsPlatform();

const SymbolDatabase * const symbolDatabase = _tokenizer->getSymbolDatabase();

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t j = 0; j < functions; ++j) {

const Scope * scope = symbolDatabase->functionScopes[j];

for (const Token *tok = scope->classStart->next(); tok != scope->classEnd; tok = tok->next()) {

const Token *formatToken = nullptr;

if (Token::Match(tok, "scanf|vscanf ( %str% ,"))

formatToken = tok->tokAt(2);

else if (Token::Match(tok, "sscanf|vsscanf|fscanf|vfscanf (")) {

const Token* nextArg = tok->tokAt(2)->nextArgument();

if (nextArg && nextArg->type() == Token::eString)

formatToken = nextArg;

else

continue;

} else

continue;

bool format = false;

// scan the string backwards, so we do not need to keep states

const std::string &formatstr(formatToken->str());

for (std::size_t i = 1; i < formatstr.length(); i++) {

if (formatstr[i] == '%')

format = !format;

else if (!format)

continue;

else if (std::isdigit(formatstr[i]) || formatstr[i] == '*') {

format = false;

}

else if (std::isalpha((unsigned char)formatstr[i]) || formatstr[i] == '[') {

if (warning && (formatstr[i] == 's' || formatstr[i] == '[' || formatstr[i] == 'S' || (formatstr[i] == 'l' && formatstr[i+1] == 's'))) // #3490 - field width limits are only necessary for string input

invalidScanfError(tok, false);

else if (portability && formatstr[i] != 'n' && formatstr[i] != 'c' && !windows)

invalidScanfError(tok, true); // Warn about libc bug in versions prior to 2.13-25

format = false;

}

}

}

}

{

if (portability)

reportError(tok, Severity::portability,

"invalidscanf_libc", "scanf without field width limits can crash with huge input data on some versions of libc.\n"

"scanf without field width limits can crash with huge input data on libc versions older than 2.13-25. Add a field "

"width specifier to fix this problem:\n"

" %i => %3i\n"

"\n"

"Sample program that can crash:\n"

"\n"

"#include <stdio.h>\n"

"int main()\n"

"{\n"

" int a;\n"

" scanf(\"%i\", &a);\n"

" return 0;\n"

"}\n"

"\n"

"To make it crash:\n"

"perl -e 'print \"5\"x2100000' | ./a.out");

else

reportError(tok, Severity::warning,

"invalidscanf", "scanf without field width limits can crash with huge input data.\n"

"scanf without field width limits can crash with huge input data. Add a field width "

"specifier to fix this problem:\n"

" %s => %20s\n"

"\n"

"Sample program that can crash:\n"

"\n"

"#include <stdio.h>\n"

"int main()\n"

"{\n"

" char c[5];\n"

" scanf(\"%s\", c);\n"

" return 0;\n"

"}\n"

"\n"

"Typing in 5 or more characters may make the program crash. The correct usage "

"here is 'scanf(\"%4s\", c);', as the maximum field width does not include the "

"terminating null byte.\n"

"Source: http://linux.die.net/man/3/scanf\n"

"Source: http://www.opensource.apple.com/source/xnu/xnu-1456.1.26/libkern/stdio/scanf.c"

);

const Token **formatStringTok, const Token **formatArgTok)

{

const Token* argTok = firstArg;

for (unsigned int i = 0; i < arg && argTok; ++i)

argTok = argTok->nextArgument();

if (Token::Match(argTok, "%str% [,)]")) {

*formatArgTok = argTok->nextArgument();

*formatStringTok = argTok;

return true;

} else if (Token::Match(argTok, "%var% [,)]") &&

argTok->variable() &&

Token::Match(argTok->variable()->typeStartToken(), "char|wchar_t") &&

(argTok->variable()->isPointer() ||

(argTok->variable()->dimensions().size() == 1 &&

argTok->variable()->dimensionKnown(0) &&

argTok->variable()->dimension(0) != 0))) {

*formatArgTok = argTok->nextArgument();

*formatStringTok = nullptr;

if (argTok->variable()) {

const Token *varTok = argTok->variable()->nameToken();

if (Token::Match(varTok, "%name% ; %name% = %str% ;") &&

varTok->str() == varTok->strAt(2) &&

Token::Match(varTok->tokAt(-4), "const char|wchar_t * const")) {

*formatStringTok = varTok->tokAt(4);

} else if (Token::Match(varTok, "%name% [ %num% ] = %str% ;") &&

Token::Match(varTok->tokAt(-2), "const char|wchar_t")) {

*formatStringTok = varTok->tokAt(5);

}

}

return true;

}

return false;

{

const SymbolDatabase *symbolDatabase = _tokenizer->getSymbolDatabase();

const bool warning = _settings->isEnabled("warning");

const bool windows = _settings->isWindowsPlatform();

std::size_t functions = symbolDatabase->functionScopes.size();

for (std::size_t j = 0; j < functions; ++j) {

const Scope * scope = symbolDatabase->functionScopes[j];

for (const Token *tok = scope->classStart->next(); tok != scope->classEnd; tok = tok->next()) {

if (!tok->isName()) continue;

const Token* argListTok = 0; // Points to first va_list argument

const Token* formatStringTok = 0; // Points to format string token

std::string formatString;

bool scan = false;

bool scanf_s = false;

int formatStringArgNo = -1;

if (Token::Match(tok->next(), "( %any%") && _settings->library.formatstr_function(tok->str())) {

const std::map<int, Library::ArgumentChecks>& argumentChecks = _settings->library.argumentChecks.at(tok->str());

for (std::map<int, Library::ArgumentChecks>::const_iterator i = argumentChecks.begin(); i != argumentChecks.end(); ++i) {

if (i->second.formatstr) {

formatStringArgNo = i->first - 1;

break;

}

}

scan = _settings->library.formatstr_scan(tok->str());

scanf_s = _settings->library.formatstr_secure(tok->str());

}

if (formatStringArgNo >= 0) {

// formatstring found in library. Find format string and first argument belonging to format string.

if (!findFormat(static_cast<unsigned int>(formatStringArgNo), tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (windows && Token::Match(tok, "Format|AppendFormat (") &&

Token::Match(tok->tokAt(-2), "%var% .") && tok->tokAt(-2)->variable() &&

tok->tokAt(-2)->variable()->typeStartToken()->str() == "CString") {

// Find second parameter and format string

if (!findFormat(0, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (Token::simpleMatch(tok, "swprintf (") && Token::Match(tok->tokAt(2)->nextArgument(), "%str%")) {

// Find third parameter and format string

if (!findFormat(1, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (Token::simpleMatch(tok, "swprintf (") && !Token::Match(tok->tokAt(2)->nextArgument(), "%str%")) {

// Find forth parameter and format string

if (!findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok))

continue;

} else if (windows && Token::Match(tok, "sprintf_s|swprintf_s (")) {

// template <size_t size> int sprintf_s(char (&buffer)[size], const char *format, ...);

if (findFormat(1, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

// int sprintf_s(char *buffer, size_t sizeOfBuffer, const char *format, ...);

else if (findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

} else if (windows && Token::Match(tok, "_snprintf_s|_snwprintf_s (")) {

// template <size_t size> int _snprintf_s(char (&buffer)[size], size_t count, const char *format, ...);

if (findFormat(2, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

// int _snprintf_s(char *buffer, size_t sizeOfBuffer, size_t count, const char *format, ...);

else if (findFormat(3, tok->tokAt(2), &formatStringTok, &argListTok)) {

if (!formatStringTok)

continue;

}

} else {

continue;

}

if (formatStringTok)

formatString = formatStringTok->str();

else

continue;

// Count format string parameters..

unsigned int numFormat = 0;

unsigned int numSecure = 0;

bool percent = false;

const Token* argListTok2 = argListTok;

std::set<unsigned int> parameterPositionsUsed;

for (std::string::iterator i = formatString.begin(); i != formatString.end(); ++i) {

if (*i == '%') {

percent = !percent;

} else if (percent && *i == '[') {

while (i != formatString.end()) {

if (*i == ']') {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

percent = false;

break;

}

++i;

}

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

if (i == formatString.end())

break;

} else if (percent) {

percent = false;

bool _continue = false;

bool skip = false;

std::string width;

unsigned int parameterPosition = 0;

bool hasParameterPosition = false;

while (i != formatString.end() && *i != '[' && !std::isalpha((unsigned char)*i)) {

if (*i == '*') {

skip = true;

if (scan)

_continue = true;

else {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

}

} else if (std::isdigit(*i)) {

width += *i;

} else if (*i == '$') {

parameterPosition = static_cast<unsigned int>(std::atoi(width.c_str()));

hasParameterPosition = true;

width.clear();

}

++i;

}

if (i != formatString.end() && *i == '[') {

while (i != formatString.end()) {

if (*i == ']') {

if (!skip) {

numFormat++;

if (argListTok)

argListTok = argListTok->nextArgument();

}

break;

}

++i;

}

if (scanf_s && !skip) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

_continue = true;

}

if (i == formatString.end())

break;

if (_continue)

continue;

if (scan || *i != 'm') { // %m is a non-standard extension that requires no parameter on print functions.

++numFormat;

// Handle parameter positions (POSIX extension) - Ticket #4900

if (hasParameterPosition) {

if (parameterPositionsUsed.find(parameterPosition) == parameterPositionsUsed.end())

parameterPositionsUsed.insert(parameterPosition);

else // Parameter already referenced, hence don't consider it a new format

--numFormat;

}

// Perform type checks

ArgumentInfo argInfo(argListTok, _settings);

if (argInfo.typeToken && !argInfo.isLibraryType(_settings)) {

if (scan) {

std::string specifier;

bool done = false;

while (!done) {

switch (*i) {

case 's':

specifier += *i;

if (argInfo.variableInfo && argInfo.isKnownType() && argInfo.variableInfo->isArray() && (argInfo.variableInfo->dimensions().size() == 1) && argInfo.variableInfo->dimensions()[0].known) {

if (!width.empty()) {

int numWidth = std::atoi(width.c_str());

if (numWidth != (argInfo.variableInfo->dimension(0) - 1))

invalidScanfFormatWidthError(tok, numFormat, numWidth, argInfo.variableInfo);

}

}

if (argListTok && argListTok->type() != Token::eString &&

argInfo.isKnownType() && argInfo.isArrayOrPointer() &&

(!Token::Match(argInfo.typeToken, "char|wchar_t") ||

argInfo.typeToken->strAt(-1) == "const")) {

if (!(argInfo.isArrayOrPointer() && argInfo.element && !argInfo.typeToken->isStandardType()))

invalidScanfArgTypeError_s(tok, numFormat, specifier, &argInfo);

}

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

done = true;

break;

case 'c':

if (scanf_s) {

numSecure++;

if (argListTok) {

argListTok = argListTok->nextArgument();

}

}

done = true;

break;

case 'x':

case 'X':

case 'o':

specifier += *i;

if (argInfo.typeToken->type() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t", "u"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t", "u"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") &&

!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'j':

if (argInfo.typeToken->originalName() != "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'z':

if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

default:

if (argInfo.typeToken->str() != "int")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

typesMatch(argInfo.typeToken->originalName(), "intmax_t", "u"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

}

}

}

done = true;

break;

case 'n':

case 'd':

case 'i':

specifier += *i;

if (argInfo.typeToken->type() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->isUnsigned() ||

!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

argInfo.typeToken->originalName() == "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

argInfo.typeToken->originalName() == "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

} else if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'j':

if (argInfo.typeToken->originalName() != "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'z':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") &&

!typesMatch(argInfo.typeToken->originalName(), "ssize_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

default:

if (argInfo.typeToken->str() != "int")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

else if (typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t") ||

argInfo.typeToken->originalName() == "intmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, false);

break;

}

}

}

done = true;

break;

case 'u':

specifier += *i;

if (argInfo.typeToken->type() == Token::eString)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "char|short|int|long")) {

if (argInfo.typeToken->isStandardType() || !argInfo.element)

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!argInfo.typeToken->isUnsigned() ||

!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else {

switch (specifier[0]) {

case 'h':

if (specifier[1] == 'h') {

if (argInfo.typeToken->str() != "char")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "short")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (argInfo.typeToken->str() != "long" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'I':

if (specifier.find("I64") != std::string::npos) {

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (specifier.find("I32") != std::string::npos) {

if (argInfo.typeToken->str() != "int" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

} else if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'j':

if (argInfo.typeToken->originalName() != "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'z':

if (!typesMatch(argInfo.typeToken->originalName(), "size_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 't':

if (!typesMatch(argInfo.typeToken->originalName(), "ptrdiff_t"))

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

case 'L':

if (argInfo.typeToken->str() != "long" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

default:

if (argInfo.typeToken->str() != "int")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

else if (typesMatch(argInfo.typeToken->originalName(), "size_t") ||

typesMatch(argInfo.typeToken->originalName(), "ssize_t") ||

argInfo.typeToken->originalName() == "uintmax_t")

invalidScanfArgTypeError_int(tok, numFormat, specifier, &argInfo, true);

break;

}

}

}

done = true;

break;

case 'e':

case 'E':

case 'f':

case 'g':

case 'G':

case 'a':

specifier += *i;

if (argInfo.typeToken->type() == Token::eString)

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

else if (argInfo.isKnownType()) {

if (!Token::Match(argInfo.typeToken, "float|double")) {

if (argInfo.typeToken->isStandardType())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else if (!argInfo.isArrayOrPointer() ||

argInfo.typeToken->strAt(-1) == "const") {

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else {

switch (specifier[0]) {

case 'l':

if (specifier[1] == 'l') {

if (argInfo.typeToken->str() != "double" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

} else if (argInfo.typeToken->str() != "double" || argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

case 'L':

if (argInfo.typeToken->str() != "double" || !argInfo.typeToken->isLong())

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

default:

if (argInfo.typeToken->str() != "float")

invalidScanfArgTypeError_float(tok, numFormat, specifier, &argInfo);

break;

}

}

}

done = true;

break;

case 'I':

if ((i+1 != formatString.end() && *(i+1) == '6' &&

i+2 != formatString.end() && *(i+2) == '4') ||

(i+1 != formatString.end() && *(i+1) == '3' &&

i+2 != formatString.end() && *(i+2) == '2')) {

specifier += *i++;

specifier += *i++;

if ((i+1) != formatString.end() && !isalpha(*(i+1))) {