Re: [PATCH] detect nonstring arguments to string functions (PR 82945)

[Jakub Jelinek <jakub at redhat dot com>]

On Sun, Nov 12, 2017 at 05:52:41PM -0700, Martin Sebor wrote:
> +   the referenced enclosing object or pointer.  Otherwise return
> +   null.  */
> +
> +tree
> +get_attr_nonstring_decl (tree expr, tree *ref)
> +{
> +  tree dcl = expr;

Usually we call vars decl, not dcl.
Or what does it stand for?  In multiple other spots.

> +  /* -1 terminated array of zero-based string arguments.  */
> +  unsigned argno[] = { -1, -1, -1 };
> +
> +  switch (DECL_FUNCTION_CODE (fndecl))
> +    {
> +    case BUILT_IN_STRCASECMP:
> +    case BUILT_IN_STRCMP:
> +    case BUILT_IN_STRCSPN:
> +    case BUILT_IN_STRSPN:
> +    case BUILT_IN_STRNCMP:
> +    case BUILT_IN_STRNCASECMP:
> +    case BUILT_IN_VSSCANF:
> +      argno[0] = 0;
> +      argno[1] = 1;
> +      break;
> +
> +    case BUILT_IN_STPCPY:
> +    case BUILT_IN_STPNCPY:
> +    case BUILT_IN_STRCAT:
> +    case BUILT_IN_STRCPY:
> +    case BUILT_IN_STRNCAT:
> +    case BUILT_IN_STRNCPY:
> +      argno[0] = 1;
> +      break;
> +
> +    case BUILT_IN_FPRINTF:
> +    case BUILT_IN_FPUTS:
> +    case BUILT_IN_SPRINTF:
> +    case BUILT_IN_STPCPY_CHK:
> +    case BUILT_IN_STPNCPY_CHK:
> +    case BUILT_IN_STRCAT_CHK:
> +    case BUILT_IN_STRCPY_CHK:
> +    case BUILT_IN_STRNCAT_CHK:
> +    case BUILT_IN_STRNCPY_CHK:
> +    case BUILT_IN_VFPRINTF:
> +    case BUILT_IN_VSPRINTF:
> +    case BUILT_IN_VFSCANF:
> +      argno[0] = 1;
> +      break;
> +
> +    case BUILT_IN_SNPRINTF:
> +    case BUILT_IN_VSNPRINTF:
> +      argno[0] = 2;
> +      break;
> +
> +    case BUILT_IN_PRINTF:
> +    case BUILT_IN_PRINTF_UNLOCKED:
> +    case BUILT_IN_PUTS:
> +    case BUILT_IN_PUTS_UNLOCKED:
> +    case BUILT_IN_STRCHR:
> +    case BUILT_IN_STRDUP:
> +    case BUILT_IN_STRLEN:

How was the above list of builtins chosen?
I don't see why some are included and others that behave similarly aren't.
Say, you have vsscanf and vfscanf in the list, but not vscanf, fscanf,
scanf and sscanf.  Or {f,s,sn,}printf and v{f,s,sn}printf,
but not vprintf, and have printf_unlocked, but not fprintf_unlocked.
And no *printf_chk.

	Jakub