[PATCH] Add format attribute to some function declarations

[PATCH] Add format attribute to some function declarations

[Hauke Mehrtens]

GCC and Clang are able to check the format arguments given to a
function and warn the user if there is a error in the format arguments
or if there is a potential uncontrolled format string security problem
in the code. GCC does this automatically for some functions like
printf(), but it is also possible to annotate other functions in a way
that it will check them too. This feature is used by glibc for many
functions. This patch adds the attribute to the some functions of musl
expect for these functions where gcc automatically adds it.

The documentation from gcc is here:
https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-g_t_0040code_007bformat_007d-function-attribute-3170

The documentation from Clang is here:
http://clang.llvm.org/docs/AttributeReference.html#format-gnu-format

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
---
 include/err.h      | 58 +++++++++++++++++++++++++++++++++++++++++++++---------
 include/monetary.h | 12 +++++++++--
 include/stdio.h    | 54 +++++++++++++++++++++++++++++++++++++++++---------
 include/syslog.h   | 12 +++++++++--
 4 files changed, 114 insertions(+), 22 deletions(-)

diff --git a/include/err.h b/include/err.h
index 9f5cb6b..b7c6f85 100644
--- a/include/err.h
+++ b/include/err.h
@@ -8,15 +8,55 @@
 extern "C" {
 #endif
 
-void warn(const char *, ...);
-void vwarn(const char *, va_list);
-void warnx(const char *, ...);
-void vwarnx(const char *, va_list);
-
-_Noreturn void err(int, const char *, ...);
-_Noreturn void verr(int, const char *, va_list);
-_Noreturn void errx(int, const char *, ...);
-_Noreturn void verrx(int, const char *, va_list);
+void warn(const char *, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 1, 2)))
+#endif
+;
+
+void vwarn(const char *, va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 1, 0)))
+#endif
+;
+
+void warnx(const char *, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 1, 2)))
+#endif
+;
+
+void vwarnx(const char *, va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 1, 0)))
+#endif
+;
+
+
+_Noreturn void err(int, const char *, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 3)))
+#endif
+;
+
+_Noreturn void verr(int, const char *, va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 0)))
+#endif
+;
+
+_Noreturn void errx(int, const char *, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 3)))
+#endif
+;
+
+_Noreturn void verrx(int, const char *, va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 0)))
+#endif
+;
+
 
 #ifdef __cplusplus
 }
diff --git a/include/monetary.h b/include/monetary.h
index a91fa56..f7f6fc8 100644
--- a/include/monetary.h
+++ b/include/monetary.h
@@ -13,8 +13,16 @@ extern "C" {
 
 #include <bits/alltypes.h>
 
-ssize_t strfmon(char *__restrict, size_t, const char *__restrict, ...);
-ssize_t strfmon_l(char *__restrict, size_t, locale_t, const char *__restrict, ...);
+ssize_t strfmon(char *__restrict, size_t, const char *__restrict, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__strfmon__, 3, 4)))
+#endif
+;
+ssize_t strfmon_l(char *__restrict, size_t, locale_t, const char *__restrict, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__strfmon__, 4, 5)))
+#endif
+;
 
 #ifdef __cplusplus
 }
diff --git a/include/stdio.h b/include/stdio.h
index 884d2e6..a2e8e60 100644
--- a/include/stdio.h
+++ b/include/stdio.h
@@ -102,19 +102,39 @@ int puts(const char *);
 int printf(const char *__restrict, ...);
 int fprintf(FILE *__restrict, const char *__restrict, ...);
 int sprintf(char *__restrict, const char *__restrict, ...);
-int snprintf(char *__restrict, size_t, const char *__restrict, ...);
+int snprintf(char *__restrict, size_t, const char *__restrict, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 3, 4)))
+#endif
+;
 
 int vprintf(const char *__restrict, __isoc_va_list);
 int vfprintf(FILE *__restrict, const char *__restrict, __isoc_va_list);
 int vsprintf(char *__restrict, const char *__restrict, __isoc_va_list);
-int vsnprintf(char *__restrict, size_t, const char *__restrict, __isoc_va_list);
+int vsnprintf(char *__restrict, size_t, const char *__restrict, __isoc_va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 3, 0)))
+#endif
+;
 
 int scanf(const char *__restrict, ...);
 int fscanf(FILE *__restrict, const char *__restrict, ...);
 int sscanf(const char *__restrict, const char *__restrict, ...);
-int vscanf(const char *__restrict, __isoc_va_list);
-int vfscanf(FILE *__restrict, const char *__restrict, __isoc_va_list);
-int vsscanf(const char *__restrict, const char *__restrict, __isoc_va_list);
+int vscanf(const char *__restrict, __isoc_va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__scanf__, 1, 0)))
+#endif
+;
+int vfscanf(FILE *__restrict, const char *__restrict, __isoc_va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__scanf__, 2, 0)))
+#endif
+;
+int vsscanf(const char *__restrict, const char *__restrict, __isoc_va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__scanf__, 2, 0)))
+#endif
+;
 
 void perror(const char *);
 
@@ -135,8 +155,16 @@ int pclose(FILE *);
 int fileno(FILE *);
 int fseeko(FILE *, off_t, int);
 off_t ftello(FILE *);
-int dprintf(int, const char *__restrict, ...);
-int vdprintf(int, const char *__restrict, __isoc_va_list);
+int dprintf(int, const char *__restrict, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 3)))
+#endif
+;
+int vdprintf(int, const char *__restrict, __isoc_va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 0)))
+#endif
+;
 void flockfile(FILE *);
 int ftrylockfile(FILE *);
 void funlockfile(FILE *);
@@ -175,8 +203,16 @@ int fileno_unlocked(FILE *);
 int getw(FILE *);
 int putw(int, FILE *);
 char *fgetln(FILE *, size_t *);
-int asprintf(char **, const char *, ...);
-int vasprintf(char **, const char *, __isoc_va_list);
+int asprintf(char **, const char *, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 3)))
+#endif
+;
+int vasprintf(char **, const char *, __isoc_va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 0)))
+#endif
+;
 #endif
 
 #ifdef _GNU_SOURCE
diff --git a/include/syslog.h b/include/syslog.h
index 5b4d296..928795b 100644
--- a/include/syslog.h
+++ b/include/syslog.h
@@ -59,13 +59,21 @@ extern "C" {
 void closelog (void);
 void openlog (const char *, int, int);
 int setlogmask (int);
-void syslog (int, const char *, ...);
+void syslog (int, const char *, ...)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 3)))
+#endif
+;
 
 #if defined(_GNU_SOURCE) || defined(_BSD_SOURCE)
 #define _PATH_LOG "/dev/log"
 #define __NEED_va_list
 #include <bits/alltypes.h>
-void vsyslog (int, const char *, va_list);
+void vsyslog (int, const char *, va_list)
+#if __GNUC__ >= 3
+__attribute__ ((__format__ (__printf__, 2, 0)))
+#endif
+;
 #if defined(SYSLOG_NAMES)
 #define	INTERNAL_NOPRI 0x10
 #define	INTERNAL_MARK (LOG_NFACILITIES<<3)
-- 
2.7.0.rc3

Re: [PATCH] Add format attribute to some function declarations

[Alexander Monakov]

On Sat, 23 Jan 2016, Hauke Mehrtens wrote:

> GCC and Clang are able to check the format arguments given to a
> function and warn the user if there is a error in the format arguments
> or if there is a potential uncontrolled format string security problem
> in the code. GCC does this automatically for some functions like
> printf(), but it is also possible to annotate other functions in a way
> that it will check them too. This feature is used by glibc for many
> functions. This patch adds the attribute to the some functions of musl
> expect for these functions where gcc automatically adds it.

Here's how a similar change was done the last time around:
http://git.musl-libc.org/cgit/musl/commit/?id=ccc71e0ea881b7f6594ed95afd706442829c39fc

Note that that approach avoids repeating #ifdef __GNUC__ ...

How did you choose which functions from stdio.h to annotate?  Are you saying
that gcc is unaware of snprintf while it recognizes sprintf?

Thanks.
Alexander

Re: [PATCH] Add format attribute to some function declarations

[Hauke Mehrtens]

On 01/23/2016 10:05 PM, Alexander Monakov wrote:
> On Sat, 23 Jan 2016, Hauke Mehrtens wrote:
> 
>> GCC and Clang are able to check the format arguments given to a
>> function and warn the user if there is a error in the format arguments
>> or if there is a potential uncontrolled format string security problem
>> in the code. GCC does this automatically for some functions like
>> printf(), but it is also possible to annotate other functions in a way
>> that it will check them too. This feature is used by glibc for many
>> functions. This patch adds the attribute to the some functions of musl
>> expect for these functions where gcc automatically adds it.
> 
> Here's how a similar change was done the last time around:
> http://git.musl-libc.org/cgit/musl/commit/?id=ccc71e0ea881b7f6594ed95afd706442829c39fc

Ok, I will do it in a similar way.

Is there a central file where I can put the "#if __GNUC__ >= 3" or
should I put it into all 4 files?

> Note that that approach avoids repeating #ifdef __GNUC__ ...
> 
> How did you choose which functions from stdio.h to annotate?  Are you saying
> that gcc is unaware of snprintf while it recognizes sprintf?

snprintf is only check when in C99 mode. This is from the GCC documentation:

> The compiler always (unless -ffreestanding or -fno-builtin is used)
> checks formats for the standard library functions printf, fprintf,
> sprintf, scanf, fscanf, sscanf, strftime, vprintf, vfprintf and
> vsprintf whenever such warnings are requested (using -Wformat), so
> there is no need to modify the header file stdio.h. In C99 mode, the
> functions snprintf, vsnprintf, vscanf, vfscanf and vsscanf are also
> checked. Except in strictly conforming C standard modes, the X/Open
> function strfmon is also checked as are printf_unlocked and
> fprintf_unlocked. See Options Controlling C Dialect.

glibc did it the same way.

Hauke