It won't work.  You can either put the wrapper in a system header (add
#pragma GCC system_header) or build this TU with -fno-builtin-strftime.

Hey Richard. Thanks for the timely feedback.

As far as I know, it works more or less good for printf-wrappers. So I expected this to be working for strftime as well.

I don't think that your proposed solutions are clean and desirable ones, do you?

Is there anything wrong in expecting the posted code snipped to compile fine? Especially if the "fmt" argument is indeed a checked, constant, fixed size (literal) string.

I ran into this as well. I tried two ways, neither of which works with strftime (both work with printf):

static void __attribute__((format (strftime, 1, 0)))
test1(const char *fmt, const struct tm *tm)
{
	char buf[100];

	strftime(buf, sizeof(buf), fmt, tm);
}

static const char *__attribute__((format_arg (1)))
helper(const char *fmt)
{
	return fmt;
}

static void
test2(const char *fmt, const struct tm *tm)
{
	char buf[100];

	strftime(buf, sizeof(buf), helper(fmt), tm);
}

I have this problem too.  I'm writing a wrapper for strftime.  I get a warning on the actual strftime call.  

warning: format not a string literal, format string not checked [-Wformat-nonliteral]
  strftime(buf, buflen, fmt, t);

Surely GCC should not that for "fmt" argument has been checked to be a valid strftime format at the points where prettynow gets called.  So there is no need to whine that it is unchecked.


static void prettynow(char *buf, size_t buflen, const char *fmt) __attribute__ ((format (__strftime__, 3, 0)));

static void prettynow(char *buf, size_t buflen, const char *fmt)
{
 	time_t n = time(0);
	struct tm tm1;
	struct tm *t = localtime_r(&n, &tm1);

	strftime(buf, buflen, fmt, t);
}

I'm using gcc-4.8.2-7.fc20.x86_64 on Fedora 20.

I managed to suppress the warning with a very ugly cast:

        ((size_t (*)(char *, size_t, const char *, const struct tm *))strftime)(buf, buflen, fmt, t);

Could you produce a complete testcase that (In reply to D. Hugh Redelmeier from comment #4)
> I have this problem too.  I'm writing a wrapper for strftime.  I get a
> warning on the actual strftime call.  
> 
> warning: format not a string literal, format string not checked
> [-Wformat-nonliteral]
>   strftime(buf, buflen, fmt, t);
> 
> Surely GCC should not that for "fmt" argument has been checked to be a valid
> strftime format at the points where prettynow gets called.  So there is no
> need to whine that it is unchecked.
> 

You should be able to produce a minimal self-contained testcase (the one you posted doesn't compile). See http://gcc.gnu.org/bugs/minimize.html
The best would be to include only the definitions of the types that you need and declare as 'extern' library functions that you use to avoid including headers.

If you can produce another similar example that works with printf, that would also help.

The second step would be to find out why it works with printf and not with strftime, but that would require debugging GCC while compiling your (new) testcases, so saving the first step will make it more likely that someone will do the second.

Responding to Comment 5 by Manuel López-Ibáñez:

Thanks for looking at this.

> Could you produce a complete testcase
===
/* compile with -c -Wformat -Werror=format-nonliteral */
#include <time.h>

extern void prettynow(char *buf, size_t buflen, const char *fmt, struct tm *t) __attribute__ ((format (__strftime__, 3, 0)));

void prettynow(char *buf, size_t buflen, const char *fmt, struct tm *t)
{
        strftime(buf, buflen, fmt, t);
}
===

> The best would be to include only the definitions of the types that you need > and declare as 'extern' library functions that you use to avoid including headers.

I didn't do this part.  My excuses: the type declarations are not portable but the example should be; the solution might be in fixing headers; this way is shorter too.

> If you can produce another similar example that works with printf, that would also help.

I don't think that printf is similar enough.  A strftime format doesn't interact with varargs in a complex and problematic way.  A string, on its own, is or is not a valid strftime format; a string is only a valid printf format when considered with the argument list.

If an arg is marked as a const char * (i.e. unchanging) and has the strftime format attribute, it should be accepted as if it were a literal strftime argument.  After all, the necessary checking would have been done at this routine's points of call.

(In reply to D. Hugh Redelmeier from comment #6)
> > The best would be to include only the definitions of the types that you need > and declare as 'extern' library functions that you use to avoid including headers.
> 
> I didn't do this part.  My excuses: the type declarations are not portable
> but the example should be; the solution might be in fixing headers; this way
> is shorter too.

If you compile with --save-temps (as the instruction say), you will see what GCC parses. All that code makes debugging more complex. So if someone had to debug this, he would have to cut down that code to a few lines. This is one reason why examples should be minimal.

(In reply to D. Hugh Redelmeier from comment #6)
> > If you can produce another similar example that works with printf, that would also help.
> 
> I don't think that printf is similar enough.  A strftime format doesn't
> interact with varargs in a complex and problematic way.  A string, on its
> own, is or is not a valid strftime format; a string is only a valid printf
> format when considered with the argument list.
> 
> If an arg is marked as a const char * (i.e. unchanging) and has the strftime
> format attribute, it should be accepted as if it were a literal strftime
> argument.  After all, the necessary checking would have been done at this
> routine's points of call.

Assuming that the wrapper is marked with the correct attribute, GCC would need to know that this const char* comes from the correct wrapper's argument. I am not sure this is trivial to know at the point of warning without additional work/info in the front-end. Some comments above have suggested that this work/info is done for printf, so the first thing someone looking at this should do is to understand how printf detects this case, and why the same is not done for strftime, and then try to share as much code between the two cases as possible. Perhaps it is a bug, perhaps it was never implemented for strftime. In any case, one would need to debug GCC using two similar and minimal testcases to understand what is going on.

See http://gcc.gnu.org/wiki/DebuggingGCC if you want to see how this works. As an exercise, try to find the point of warning while debugging using your testcase.

Bugs/features are more likely to be fixed if:

1. There is a minimal testcase that reproduces the problem
2. Someone has debugged GCC and identified the problem
3. Someone has done all the legal prerequisites and posted a patch that fixes the problem
4. Someone has tested and submitted the patch for review
5. Someone has taken care of the review comments and committed the patch

We are not even in 1 and the real work is 2 and 3.

Created attachment 32784 [details]
minimal C source code that demonstrates the problem

minimal C source code that demonstrates the problem.
Notice that the (system-provided) declaration annotates the format argument dirrectly with __format.  I haven't found documentation for that.

(In reply to D. Hugh Redelmeier from comment #6)
> If an arg is marked as a const char * (i.e. unchanging) and has the strftime
> format attribute, it should be accepted as if it were a literal strftime
> argument.  After all, the necessary checking would have been done at this
> routine's points of call.

The code that warns is this: gcc/c-family/c-format.c

    if (res.number_non_literal > 0)
      {
        /* Functions taking a va_list normally pass a non-literal format
           string.  These functions typically are declared with
           first_arg_num == 0, so avoid warning in those cases.  */
        if (!(format_types[info->format_type].flags & (int) FMT_FLAG_ARG_CONVERT))
          {
            /* For strftime-like formats, warn for not checking the format
               string; but there are no arguments to check.  */
            warning_at (loc, OPT_Wformat_nonliteral,
                        "format not a string literal, format string not checked");
          }

Thus, there is nothing checking the attributes of the caller. In the same file there is this code:

                tree c;
                for (c = TYPE_ATTRIBUTES (TREE_TYPE (current_function_decl));
                     c;
                     c = TREE_CHAIN (c))
                  if (is_attribute_p ("format", TREE_PURPOSE (c))
                      && (decode_format_type (IDENTIFIER_POINTER
                                              (TREE_VALUE (TREE_VALUE (c))))
                          == info.format_type))
                    break;
                if (c == NULL_TREE)
                  {
                    /* Check if the current function has a parameter to which
                       the format attribute could be attached; if not, it
                       can't be a candidate for a format attribute, despite
                       the vprintf-like or vscanf-like call.  */
                    tree args;
                    for (args = DECL_ARGUMENTS (current_function_decl);
                         args != 0;
                         args = DECL_CHAIN (args))
                      {
                        if (TREE_CODE (TREE_TYPE (args)) == POINTER_TYPE
                            && (TYPE_MAIN_VARIANT (TREE_TYPE (TREE_TYPE (args)))
                                == char_type_node))
                          break;
                      }
                    if (args != 0)
                      warning (OPT_Wsuggest_attribute_format, "function might "
                               "be possible candidate for %qs format attribute",
                               format_types[info.format_type].name);
                  }

I'm confident that the above code can be adjusted and moved to the point of the warning in order to check that the caller of strftime has an attribute format of type 'strftime' that refers to the same declaration as the nonliteral format argument in the call to strftime, then avoid warning. I'm not planning to work on this though.

I'm still seeing this with "gcc (Ubuntu 5.4.0-6ubuntu1~16.04.9) 5.4.0 20160609".
Is there any chance that this NINE YEAR OLD bug is going to be fixed?

Also happens with `gcc (Ubuntu 8.1.0-5ubuntu1~16.04) 8.1.0`