Make -Wformat check the argument type for %n.

This makes Clang check that the corresponding argument for "%n" in a
format string is a pointer to int.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@160966 91177308-0d34-0410-b5e6-96231b3b80d8

3 files changed, 13 insertions, 2 deletions

diff --git a/lib/Analysis/PrintfFormatString.cpp b/lib/Analysis/PrintfFormatString.cpp
index 2a9644a353..ed87c92101 100644
--- a/lib/Analysis/PrintfFormatString.cpp
+++ b/lib/Analysis/PrintfFormatString.cpp
@@ -330,6 +330,8 @@ ArgTypeResult PrintfSpecifier::getArgType(ASTContext &Ctx,
       return ArgTypeResult(Ctx.WCharTy, "wchar_t");
     case ConversionSpecifier::pArg:
       return ArgTypeResult::CPointerTy;
+    case ConversionSpecifier::nArg:
+      return Ctx.getPointerType(Ctx.IntTy);
     case ConversionSpecifier::ObjCObjArg:
       return ArgTypeResult::ObjCPointerTy;
     default:
@@ -342,6 +344,10 @@ ArgTypeResult PrintfSpecifier::getArgType(ASTContext &Ctx,
 
 bool PrintfSpecifier::fixType(QualType QT, const LangOptions &LangOpt,
                               ASTContext &Ctx, bool IsObjCLiteral) {
+  // %n is different from other conversion specifiers; don't try to fix it.
+  if (CS.getKind() == ConversionSpecifier::nArg)
+    return false;
+
   // Handle Objective-C objects first. Note that while the '%@' specifier will
   // not warn for structure pointer or void pointer arguments (because that's
   // how CoreFoundation objects are implemented), we only show a fixit for '%@'
diff --git a/lib/Analysis/ScanfFormatString.cpp b/lib/Analysis/ScanfFormatString.cpp
index 5c7e6ef8f2..3c848f1f09 100644
--- a/lib/Analysis/ScanfFormatString.cpp
+++ b/lib/Analysis/ScanfFormatString.cpp
@@ -303,6 +303,9 @@ ScanfArgTypeResult ScanfSpecifier::getArgType(ASTContext &Ctx) const {
     case ConversionSpecifier::pArg:
       return ScanfArgTypeResult(ArgTypeResult(ArgTypeResult::CPointerTy));
 
+    case ConversionSpecifier::nArg:
+      return ArgTypeResult(Ctx.IntTy);
+
     default:
       break;
   }
@@ -315,6 +318,10 @@ bool ScanfSpecifier::fixType(QualType QT, const LangOptions &LangOpt,
   if (!QT->isPointerType())
     return false;
 
+  // %n is different from other conversion specifiers; don't try to fix it.
+  if (CS.getKind() == ConversionSpecifier::nArg)
+    return false;
+
   QualType PT = QT->getPointeeType();
 
   // If it's an enum, get its underlying type.
diff --git a/lib/Sema/SemaChecking.cpp b/lib/Sema/SemaChecking.cpp
index 73f9b01594..200b9439a6 100644
--- a/lib/Sema/SemaChecking.cpp
+++ b/lib/Sema/SemaChecking.cpp
@@ -2568,8 +2568,6 @@ CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
                          getLocationOfByte(CS.getStart()),
                          /*IsStringLocation*/true,
                          getSpecifierRange(startSpecifier, specifierLen));
-    // Continue checking the other format specifiers.
-    return true;
   }
 
   // The remaining checks depend on the data arguments.