[clang] [clang][Sema] Avoid out-of-bounds format_arg access (PR #229010)

[via cfe-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang

Author: Chen Miao (ChenMiaoi)

<details>
<summary>Changes</summary>

Clang implicitly adds `format_arg(1)` to `__CFStringMakeConstantString`, 
including declarations created during error recovery. A zero-argument call can 
therefore make `checkFormatStringExpr` access a nonexistent argument.

Reproducer:

```c
void a(char *) __attribute__((format(__CFString__, 1, 2)));
void b() { a(__CFStringMakeConstantString()); }
```

Before this change, an assertions-enabled build crashes after reporting the 
source errors (diagnostic excerpts):

```text
error: call to undeclared function '__CFStringMakeConstantString';
       ISO C99 and later do not support implicit function declarations
error: incompatible integer to pointer conversion passing 'int' to parameter of 
type 'char *'
Assertion `Arg &lt; getNumArgs() &amp;&amp; "Arg access out of range!"' failed.
```

Check the `format_arg` index against `CE-&gt;getNumArgs()` before calling 
`CE-&gt;getArg()`. Return `SLCT_NotALiteral` when the argument is missing so 
normal diagnostics can continue.

After this change, the compiler reports diagnostics and exits with status 1 
without crashing (diagnostic excerpts):

```text
error: call to undeclared function '__CFStringMakeConstantString';
       ISO C99 and later do not support implicit function declarations
error: incompatible integer to pointer conversion passing 'int' to parameter of 
type 'char *'
warning: format string is not a string literal (potentially insecure)
```

Fixes #<!-- -->225034

---
Full diff: https://github.com/llvm/llvm-project/pull/229010.diff


2 Files Affected:

- (modified) clang/lib/Sema/SemaChecking.cpp (+6-1) 
- (added) clang/test/Sema/format-strings-cfstring.c (+18) 


``````````diff
diff --git a/clang/lib/Sema/SemaChecking.cpp b/clang/lib/Sema/SemaChecking.cpp
index 0531dfa877fbd..eb5982f10e763 100644
--- a/clang/lib/Sema/SemaChecking.cpp
+++ b/clang/lib/Sema/SemaChecking.cpp
@@ -7710,7 +7710,12 @@ checkFormatStringExpr(Sema &S, const StringLiteral 
*ReferenceFormatString,
       bool IsFirst = true;
       StringLiteralCheckType CommonResult;
       for (const auto *FA : ND->specific_attrs<FormatArgAttr>()) {
-        const Expr *Arg = CE->getArg(FA->getFormatIdx().getASTIndex());
+        // An implicitly added attribute may refer to a missing argument.
+        // https://github.com/llvm/llvm-project/issues/225034
+        unsigned ArgIndex = FA->getFormatIdx().getASTIndex();
+        if (ArgIndex >= CE->getNumArgs())
+          return SLCT_NotALiteral;
+        const Expr *Arg = CE->getArg(ArgIndex);
         StringLiteralCheckType Result = checkFormatStringExpr(
             S, ReferenceFormatString, Arg, Args, APK, format_idx, firstDataArg,
             Type, CallType, InFunctionCall, CheckedVarArgs, UncoveredArg,
diff --git a/clang/test/Sema/format-strings-cfstring.c 
b/clang/test/Sema/format-strings-cfstring.c
new file mode 100644
index 0000000000000..776a82e7c3eb7
--- /dev/null
+++ b/clang/test/Sema/format-strings-cfstring.c
@@ -0,0 +1,18 @@
+// RUN: %clang_cc1 -std=c11 -fsyntax-only -Wno-gcc-compat 
-verify=expected,implicit %s
+// RUN: %clang_cc1 -std=c11 -fsyntax-only -Wno-gcc-compat -DDECLARE_CFSTRING 
-verify %s
+
+// An implicitly added format_arg attribute may refer to a missing argument,
+// both during error recovery and with a non-prototype declaration.
+// https://github.com/llvm/llvm-project/issues/225034
+#ifdef DECLARE_CFSTRING
+char *__CFStringMakeConstantString();
+#endif
+
+void a(char *) __attribute__((format(__CFString__, 1, 2))); // implicit-note 
{{passing argument to parameter here}}
+
+void b(void) {
+  a(__CFStringMakeConstantString()); // expected-warning {{format string is 
not a string literal (potentially insecure)}}
+  // expected-note@-1 {{treat the string as an argument to avoid this}}
+  // implicit-error@-2 {{call to undeclared function 
'__CFStringMakeConstantString'}}
+  // implicit-error@-3 {{incompatible integer to pointer conversion passing 
'int' to parameter of type 'char *'}}
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/229010
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits