Re: [PATCH] fix format security

Collin Funk wrote:
> I was preparing a bug report for Clang, and think I found out how to fix
> the issue.  See the following program:
> 
>     $ cat example.c 
>     #include <stdio.h>
>     #include <stdlib.h>
>     #ifdef ENABLE_NLS
>     # include <libintl.h>
>     #else
>     __attribute__ ((__always_inline__, __gnu_inline__,
>                     __format_arg__ (1)))
>     extern inline char const *
>     gettext (const char *msgid)
>     {
>       return msgid;
>     }
>     #endif
>     #define _(msgid) gettext (msgid)
>     int
>     main (void)
>     {
>       /* No warning.  */
>       printf (_("Hello, %s!\n"), "world");
>       /* Warning.  */
>       printf (_("Hello, world!\n"));
>       return EXIT_SUCCESS;
>     }
>     $ clang -Wformat-security example.c
> 
> So, adding "__format_arg__ (1)" in this instance will silence it.

After extending your test case
======================== example.c ========================
#include <stdio.h>
#include <stdlib.h>
#ifdef ENABLE_NLS
# include <libintl.h>
#else
__attribute__ ((__always_inline__, __gnu_inline__
# ifdef __clang__
  , __format_arg__ (1)
# endif
))
extern inline char const *
gettext (const char *msgid)
{
  return msgid;
}
#endif
#define _(msgid) gettext (msgid)
int
main (void)
{
  /* No warning. */
  printf (_("Hello, %s!\n"), "world");
  /* Warning without __format_arg__, no warning with __format_arg__. */
  printf (_("Hello, world!\n"));
  /* No warning. */
  printf ("%s", _("tax rate: between 7% & 19%. %a %b %c %d %e %f %g %h %i %j %k %l %m %n %o %p %q %r %s %t %u %v %w %x %y %z"));
  return EXIT_SUCCESS;
}
===========================================================

I see that there is indeed no warning for the third _() invocation either:
  $ gcc -Wall -Wformat=2 -Wformat-security example.c
  $ clang -Wall -Wformat=2 -Wformat-security example.c

I'm surprised. But I agree that it's a nice solution.

> If that sounds okay, I'll figure out what version of GCC and Clang added
> them and submit a patch.

I can do that; thanks. Thanks a lot for finding a solution in a direction
that I never would have looked at!

Bruno