1/* $NetBSD: chk.c,v 1.15 2002/01/21 19:49:52 tv Exp $ */
2
3/*
4 * Copyright (c) 1996 Christopher G. Demetriou.  All Rights Reserved.
5 * Copyright (c) 1994, 1995 Jochen Pohl
6 * All Rights Reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 *    notice, this list of conditions and the following disclaimer in the
15 *    documentation and/or other materials provided with the distribution.
16 * 3. All advertising materials mentioning features or use of this software
17 *    must display the following acknowledgement:
18 *      This product includes software developed by Jochen Pohl for
19 *	The NetBSD Project.
20 * 4. The name of the author may not be used to endorse or promote products
21 *    derived from this software without specific prior written permission.
22 *
23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
24 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
25 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
26 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35#include <sys/cdefs.h>
36#if defined(__RCSID) && !defined(lint)
37__RCSID("$NetBSD: chk.c,v 1.15 2002/01/21 19:49:52 tv Exp $");
38#endif
39__FBSDID("$FreeBSD$");
40
41#include <ctype.h>
42#include <err.h>
43#include <limits.h>
44#include <stdlib.h>
45
46#include "lint2.h"
47
48static	void	chkund(hte_t *);
49static	void	chkdnu(hte_t *);
50static	void	chkdnud(hte_t *);
51static	void	chkmd(hte_t *);
52static	void	chkvtui(hte_t *, sym_t *, sym_t *);
53static	void	chkvtdi(hte_t *, sym_t *, sym_t *);
54static	void	chkfaui(hte_t *, sym_t *, sym_t *);
55static	void	chkau(hte_t *, int, sym_t *, sym_t *, pos_t *,
56			   fcall_t *, fcall_t *, type_t *, type_t *);
57static	void	chkrvu(hte_t *, sym_t *);
58static	void	chkadecl(hte_t *, sym_t *, sym_t *);
59static	void	printflike(hte_t *,fcall_t *, int, const char *, type_t **);
60static	void	scanflike(hte_t *, fcall_t *, int, const char *, type_t **);
61static	void	badfmt(hte_t *, fcall_t *);
62static	void	inconarg(hte_t *, fcall_t *, int);
63static	void	tofewarg(hte_t *, fcall_t *);
64static	void	tomanyarg(hte_t *, fcall_t *);
65static	int	eqtype(type_t *, type_t *, int, int, int, int *);
66static	int	eqargs(type_t *, type_t *, int *);
67static	int	mnoarg(type_t *, int *);
68
69
70/*
71 * If there is a symbol named "main", mark it as used.
72 */
73void
74mainused(void)
75{
76	hte_t	*hte;
77
78	if ((hte = hsearch("main", 0)) != NULL)
79		hte->h_used = 1;
80}
81
82/*
83 * Performs all tests for a single name
84 */
85void
86chkname(hte_t *hte)
87{
88	sym_t	*sym, *def, *pdecl, *decl;
89
90	if (uflag) {
91		chkund(hte);
92		chkdnu(hte);
93		if (xflag)
94			chkdnud(hte);
95	}
96	chkmd(hte);
97
98	/* Get definition, prototype declaration and declaration */
99	def = pdecl = decl = NULL;
100	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
101		if (def == NULL && (sym->s_def == DEF || sym->s_def == TDEF))
102			def = sym;
103		if (pdecl == NULL && sym->s_def == DECL &&
104		    TP(sym->s_type)->t_tspec == FUNC &&
105		    TP(sym->s_type)->t_proto) {
106			pdecl = sym;
107		}
108		if (decl == NULL && sym->s_def == DECL)
109			decl = sym;
110	}
111
112	/* A prototype is better than an old style declaration. */
113	if (pdecl != NULL)
114		decl = pdecl;
115
116	chkvtui(hte, def, decl);
117
118	chkvtdi(hte, def, decl);
119
120	chkfaui(hte, def, decl);
121
122	chkrvu(hte, def);
123
124	chkadecl(hte, def, decl);
125}
126
127/*
128 * Print a warning if the name has been used, but not defined.
129 */
130static void
131chkund(hte_t *hte)
132{
133	fcall_t	*fcall;
134	usym_t	*usym;
135
136	if (!hte->h_used || hte->h_def)
137		return;
138
139	if ((fcall = hte->h_calls) != NULL) {
140		/* %s used( %s ), but not defined */
141		msg(0, hte->h_name, mkpos(&fcall->f_pos));
142	} else if ((usym = hte->h_usyms) != NULL) {
143		/* %s used( %s ), but not defined */
144		msg(0, hte->h_name, mkpos(&usym->u_pos));
145	}
146}
147
148/*
149 * Print a warning if the name has been defined, but never used.
150 */
151static void
152chkdnu(hte_t *hte)
153{
154	sym_t	*sym;
155
156	if (!hte->h_def || hte->h_used)
157		return;
158
159	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
160		if (sym->s_def == DEF || sym->s_def == TDEF) {
161			/* %s defined( %s ), but never used */
162			msg(1, hte->h_name, mkpos(&sym->s_pos));
163			break;
164		}
165	}
166}
167
168/*
169 * Print a warning if the variable has been declared, but is not used
170 * or defined.
171 */
172static void
173chkdnud(hte_t *hte)
174{
175	sym_t	*sym;
176
177	if (hte->h_syms == NULL || hte->h_used || hte->h_def)
178		return;
179
180	sym = hte->h_syms;
181	if (TP(sym->s_type)->t_tspec == FUNC)
182		return;
183
184	if (sym->s_def != DECL)
185		errx(1, "internal error: chkdnud() 1");
186	/* %s declared( %s ), but never used or defined */
187	msg(2, hte->h_name, mkpos(&sym->s_pos));
188}
189
190/*
191 * Print a warning if there is more than one definition for
192 * this name.
193 */
194static void
195chkmd(hte_t *hte)
196{
197	sym_t	*sym, *def1;
198	char	*pos1;
199
200	if (!hte->h_def)
201		return;
202
203	def1 = NULL;
204	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
205		/*
206		 * ANSI C allows tentative definitions of the same name in
207		 * only one compilation unit.
208		 */
209		if (sym->s_def != DEF && (!sflag || sym->s_def != TDEF))
210			continue;
211		if (def1 == NULL) {
212			def1 = sym;
213			continue;
214		}
215		pos1 = xstrdup(mkpos(&def1->s_pos));
216		/* %s multiply defined\t%s  ::  %s */
217		msg(3, hte->h_name, pos1, mkpos(&sym->s_pos));
218		free(pos1);
219	}
220}
221
222/*
223 * Print a warning if the return value assumed for a function call
224 * differs from the return value of the function definition or
225 * function declaration.
226 *
227 * If no definition/declaration can be found, the assumed return values
228 * are always int. So there is no need to compare with another function
229 * call as it's done for function arguments.
230 */
231static void
232chkvtui(hte_t *hte, sym_t *def, sym_t *decl)
233{
234	fcall_t	*call;
235	char	*pos1;
236	type_t	*tp1, *tp2;
237	/* LINTED (automatic hides external declaration: warn) */
238	int	warn, eq;
239	tspec_t	t1;
240
241	if (hte->h_calls == NULL)
242		return;
243
244	if (def == NULL)
245		def = decl;
246	if (def == NULL)
247		return;
248
249	t1 = (tp1 = TP(def->s_type)->t_subt)->t_tspec;
250	for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
251		tp2 = TP(call->f_type)->t_subt;
252		eq = eqtype(tp1, tp2, 1, 0, 0, (warn = 0, &warn));
253		if (!call->f_rused) {
254			/* no return value used */
255			if ((t1 == STRUCT || t1 == UNION) && !eq) {
256				/*
257				 * If a function returns a struct or union it
258				 * must be declared to return a struct or
259				 * union, also if the return value is ignored.
260				 * This is necessary because the caller must
261				 * allocate stack space for the return value.
262				 * If it does not, the return value would over-
263				 * write other data.
264				 * XXX Following massage may be confusing
265				 * because it appears also if the return value
266				 * was declared inconsistently. But this
267				 * behaviour matches pcc based lint, so it is
268				 * accepted for now.
269				 */
270				pos1 = xstrdup(mkpos(&def->s_pos));
271				/* %s value must be decl. before use %s :: %s */
272				msg(17, hte->h_name,
273				    pos1, mkpos(&call->f_pos));
274				free(pos1);
275			}
276			continue;
277		}
278		if (!eq || (sflag && warn)) {
279			pos1 = xstrdup(mkpos(&def->s_pos));
280			/* %s value used inconsistenty\t%s  ::  %s */
281			msg(4, hte->h_name, pos1, mkpos(&call->f_pos));
282			free(pos1);
283		}
284	}
285}
286
287/*
288 * Print a warning if a definition/declaration does not match another
289 * definition/declaration of the same name. For functions, only the
290 * types of return values are tested.
291 */
292static void
293chkvtdi(hte_t *hte, sym_t *def, sym_t *decl)
294{
295	sym_t	*sym;
296	type_t	*tp1, *tp2;
297	/* LINTED (automatic hides external declaration: warn) */
298	int	eq, warn;
299	char	*pos1;
300
301	if (def == NULL)
302		def = decl;
303	if (def == NULL)
304		return;
305
306	tp1 = TP(def->s_type);
307	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
308		if (sym == def)
309			continue;
310		tp2 = TP(sym->s_type);
311		warn = 0;
312		if (tp1->t_tspec == FUNC && tp2->t_tspec == FUNC) {
313			eq = eqtype(tp1->t_subt, tp2->t_subt, 1, 0, 0, &warn);
314		} else {
315			eq = eqtype(tp1, tp2, 0, 0, 0, &warn);
316		}
317		if (!eq || (sflag && warn)) {
318			pos1 = xstrdup(mkpos(&def->s_pos));
319			/* %s value declared inconsistently\t%s  ::  %s */
320			msg(5, hte->h_name, pos1, mkpos(&sym->s_pos));
321			free(pos1);
322		}
323	}
324}
325
326/*
327 * Print a warning if a function is called with arguments which does
328 * not match the function definition, declaration or another call
329 * of the same function.
330 */
331static void
332chkfaui(hte_t *hte, sym_t *def, sym_t *decl)
333{
334	type_t	*tp1, *tp2, **ap1, **ap2;
335	pos_t	*pos1p = NULL;
336	fcall_t	*calls, *call, *call1;
337	int	n, as;
338	char	*pos1;
339	arginf_t *ai;
340
341	if ((calls = hte->h_calls) == NULL)
342		return;
343
344	/*
345	 * If we find a function definition, we use this for comparison,
346	 * otherwise the first prototype we can find. If there is no
347	 * definition or prototype declaration, the first function call
348	 * is used.
349	 */
350	tp1 = NULL;
351	call1 = NULL;
352	if (def != NULL) {
353		if ((tp1 = TP(def->s_type))->t_tspec != FUNC)
354			return;
355		pos1p = &def->s_pos;
356	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
357		if ((tp1 = TP(decl->s_type))->t_tspec != FUNC)
358			return;
359		pos1p = &decl->s_pos;
360	}
361	if (tp1 == NULL) {
362		call1 = calls;
363		calls = calls->f_nxt;
364		if ((tp1 = TP(call1->f_type))->t_tspec != FUNC)
365			return;
366		pos1p = &call1->f_pos;
367	}
368
369	n = 1;
370	for (call = calls; call != NULL; call = call->f_nxt) {
371		if ((tp2 = TP(call->f_type))->t_tspec != FUNC)
372			continue;
373		ap1 = tp1->t_args;
374		ap2 = tp2->t_args;
375		n = 0;
376		while (*ap1 != NULL && *ap2 != NULL) {
377			if (def != NULL && def->s_va && n >= def->s_nva)
378				break;
379			n++;
380			chkau(hte, n, def, decl, pos1p, call1, call,
381			      *ap1, *ap2);
382			ap1++;
383			ap2++;
384		}
385		if (*ap1 == *ap2) {
386			/* equal # of arguments */
387		} else if (def != NULL && def->s_va && n >= def->s_nva) {
388			/*
389			 * function definition with VARARGS; The # of
390			 * arguments of the call must be at least as large
391			 * as the parameter of VARARGS.
392			 */
393		} else if (*ap2 != NULL && tp1->t_proto && tp1->t_vararg) {
394			/*
395			 * prototype with ... and function call with
396			 * at least the same # of arguments as declared
397			 * in the prototype.
398			 */
399		} else {
400			pos1 = xstrdup(mkpos(pos1p));
401			/* %s: variable # of args\t%s  ::  %s */
402			msg(7, hte->h_name, pos1, mkpos(&call->f_pos));
403			free(pos1);
404			continue;
405		}
406
407		/* perform SCANFLIKE/PRINTFLIKE tests */
408		if (def == NULL || (!def->s_prfl && !def->s_scfl))
409			continue;
410		as = def->s_prfl ? def->s_nprfl : def->s_nscfl;
411		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
412			if (ai->a_num == as)
413				break;
414		}
415		if (ai == NULL || !ai->a_fmt)
416			continue;
417		if (def->s_prfl) {
418			printflike(hte, call, n, ai->a_fstrg, ap2);
419		} else {
420			scanflike(hte, call, n, ai->a_fstrg, ap2);
421		}
422	}
423}
424
425/*
426 * Check a single argument in a function call.
427 *
428 *  hte		a pointer to the hash table entry of the function
429 *  n		the number of the argument (1..)
430 *  def		the function definition or NULL
431 *  decl	prototype declaration, old style declaration or NULL
432 *  pos1p	position of definition, declaration of first call
433 *  call1	first call, if both def and decl are old style def/decl
434 *  call	checked call
435 *  arg1	currently checked argument of def/decl/call1
436 *  arg2	currently checked argument of call
437 *
438 */
439static void
440chkau(hte_t *hte, int n, sym_t *def, sym_t *decl, pos_t *pos1p,
441	fcall_t *call1, fcall_t *call, type_t *arg1, type_t *arg2)
442{
443	/* LINTED (automatic hides external declaration: warn) */
444	int	promote, asgn, warn;
445	tspec_t	t1, t2;
446	arginf_t *ai, *ai1;
447	char	*pos1;
448
449	/*
450	 * If a function definition is available (def != NULL), we compare the
451	 * function call (call) with the definition. Otherwise, if a function
452	 * definition is available and it is not an old style definition
453	 * (decl != NULL && TP(decl->s_type)->t_proto), we compare the call
454	 * with this declaration. Otherwise we compare it with the first
455	 * call we have found (call1).
456	 */
457
458	/* arg1 must be promoted if it stems from an old style definition */
459	promote = def != NULL && def->s_osdef;
460
461	/*
462	 * If we compare with a definition or declaration, we must perform
463	 * the same checks for qualifiers in indirected types as in
464	 * assignments.
465	 */
466	asgn = def != NULL || (decl != NULL && TP(decl->s_type)->t_proto);
467
468	warn = 0;
469	if (eqtype(arg1, arg2, 1, promote, asgn, &warn) && (!sflag || !warn))
470		return;
471
472	/*
473	 * Other lint implementations print warnings as soon as the type
474	 * of an argument does not match exactly the expected type. The
475	 * result are lots of warnings which are really not necessary.
476	 * We print a warning only if
477	 *   (0) at least one type is not an integer type and types differ
478	 *   (1) hflag is set and types differ
479	 *   (2) types differ, except in signedness
480	 * If the argument is an integer constant whose msb is not set,
481	 * signedness is ignored (e.g. 0 matches both signed and unsigned
482	 * int). This is with and without hflag.
483	 * If the argument is an integer constant with value 0 and the
484	 * expected argument is of type pointer and the width of the
485	 * integer constant is the same as the width of the pointer,
486	 * no warning is printed.
487	 */
488	t1 = arg1->t_tspec;
489	t2 = arg2->t_tspec;
490	if (isityp(t1) && isityp(t2) && !arg1->t_isenum && !arg2->t_isenum) {
491		if (promote) {
492			/*
493			 * XXX Here is a problem: Although it is possible to
494			 * pass an int where a char/short it expected, there
495			 * may be loss in significant digits. We should first
496			 * check for const arguments if they can be converted
497			 * into the original parameter type.
498			 */
499			if (t1 == FLOAT) {
500				t1 = DOUBLE;
501			} else if (t1 == CHAR || t1 == SCHAR) {
502				t1 = INT;
503			} else if (t1 == UCHAR) {
504				t1 = tflag ? UINT : INT;
505			} else if (t1 == SHORT) {
506				t1 = INT;
507			} else if (t1 == USHORT) {
508				/* CONSTCOND */
509				t1 = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
510			}
511		}
512
513		if (styp(t1) == styp(t2)) {
514
515			/*
516			 * types differ only in signedness; get information
517			 * about arguments
518			 */
519
520			/*
521			 * treat a definition like a call with variable
522			 * arguments
523			 */
524			ai1 = call1 != NULL ? call1->f_args : NULL;
525
526			/*
527			 * if two calls are compared, ai1 is set to the
528			 * information for the n-th argument, if this was
529			 * a constant, otherwise to NULL
530			 */
531			for ( ; ai1 != NULL; ai1 = ai1->a_nxt) {
532				if (ai1->a_num == n)
533					break;
534			}
535			/*
536			 * ai is set to the information of the n-th arg
537			 * of the (second) call, if this was a constant,
538			 * otherwise to NULL
539			 */
540			for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
541				if (ai->a_num == n)
542					break;
543			}
544
545			if (ai1 == NULL && ai == NULL) {
546				/* no constant at all */
547				if (!hflag)
548					return;
549			} else if (ai1 == NULL || ai == NULL) {
550				/* one constant */
551				if (ai == NULL)
552					ai = ai1;
553				if (ai->a_zero || ai->a_pcon)
554					/* same value in signed and unsigned */
555					return;
556				/* value (not representation) differently */
557			} else {
558				/*
559				 * two constants, one signed, one unsigned;
560				 * if the msb of one of the constants is set,
561				 * the argument is used inconsistently.
562				 */
563				if (!ai1->a_ncon && !ai->a_ncon)
564					return;
565			}
566		}
567
568	} else if (t1 == PTR && isityp(t2)) {
569		for (ai = call->f_args; ai != NULL; ai = ai->a_nxt) {
570			if (ai->a_num == n)
571				break;
572		}
573		/*
574		 * Vendor implementations of lint (e.g. HP-UX, Digital UNIX)
575		 * don't care about the size of the integer argument,
576		 * only whether or not it is zero.  We do the same.
577		 */
578		if (ai != NULL && ai->a_zero)
579			return;
580	}
581
582	pos1 = xstrdup(mkpos(pos1p));
583	/* %s, arg %d used inconsistently\t%s  ::  %s */
584	msg(6, hte->h_name, n, pos1, mkpos(&call->f_pos));
585	free(pos1);
586}
587
588/*
589 * Compare the types in the NULL-terminated array ap with the format
590 * string fmt.
591 */
592static void
593printflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
594{
595	const	char *fp;
596	int	fc;
597	int	fwidth, prec, left, sign, space, alt, zero;
598	tspec_t	sz, t1, t2 = NOTSPEC;
599	type_t	*tp;
600
601	fp = fmt;
602	fc = *fp++;
603
604	for ( ; ; ) {
605		if (fc == '\0') {
606			if (*ap != NULL)
607				tomanyarg(hte, call);
608			break;
609		}
610		if (fc != '%') {
611			badfmt(hte, call);
612			break;
613		}
614		fc = *fp++;
615		fwidth = prec = left = sign = space = alt = zero = 0;
616		sz = NOTSPEC;
617
618		/* Flags */
619		for ( ; ; ) {
620			if (fc == '-') {
621				if (left)
622					break;
623				left = 1;
624			} else if (fc == '+') {
625				if (sign)
626					break;
627				sign = 1;
628			} else if (fc == ' ') {
629				if (space)
630					break;
631				space = 1;
632			} else if (fc == '#') {
633				if (alt)
634					break;
635				alt = 1;
636			} else if (fc == '0') {
637				if (zero)
638					break;
639				zero = 1;
640			} else {
641				break;
642			}
643			fc = *fp++;
644		}
645
646		/* field width */
647		if (isdigit(fc)) {
648			fwidth = 1;
649			do { fc = *fp++; } while (isdigit(fc)) ;
650		} else if (fc == '*') {
651			fwidth = 1;
652			fc = *fp++;
653			if ((tp = *ap++) == NULL) {
654				tofewarg(hte, call);
655				break;
656			}
657			n++;
658			if ((t1 = tp->t_tspec) != INT && (hflag || t1 != UINT))
659				inconarg(hte, call, n);
660		}
661
662		/* precision */
663		if (fc == '.') {
664			fc = *fp++;
665			prec = 1;
666			if (isdigit(fc)) {
667				do { fc = *fp++; } while (isdigit(fc));
668			} else if (fc == '*') {
669				fc = *fp++;
670				if ((tp = *ap++) == NULL) {
671					tofewarg(hte, call);
672					break;
673				}
674				n++;
675				if (tp->t_tspec != INT)
676					inconarg(hte, call, n);
677			} else {
678				badfmt(hte, call);
679				break;
680			}
681		}
682
683		if (fc == 'h') {
684			sz = SHORT;
685		} else if (fc == 'l') {
686			sz = LONG;
687		} else if (fc == 'q') {
688			sz = QUAD;
689		} else if (fc == 'L') {
690			sz = LDOUBLE;
691		}
692		if (sz != NOTSPEC)
693			fc = *fp++;
694
695		if (fc == '%') {
696			if (sz != NOTSPEC || left || sign || space ||
697			    alt || zero || prec || fwidth) {
698				badfmt(hte, call);
699			}
700			fc = *fp++;
701			continue;
702		}
703
704		if (fc == '\0') {
705			badfmt(hte, call);
706			break;
707		}
708
709		if ((tp = *ap++) == NULL) {
710			tofewarg(hte, call);
711			break;
712		}
713		n++;
714		if ((t1 = tp->t_tspec) == PTR)
715			t2 = tp->t_subt->t_tspec;
716
717		if (fc == 'd' || fc == 'i') {
718			if (alt || sz == LDOUBLE) {
719				badfmt(hte, call);
720				break;
721			}
722		int_conv:
723			if (sz == LONG) {
724				if (t1 != LONG && (hflag || t1 != ULONG))
725					inconarg(hte, call, n);
726			} else if (sz == QUAD) {
727				if (t1 != QUAD && (hflag || t1 != UQUAD))
728					inconarg(hte, call, n);
729			} else {
730				/*
731				 * SHORT is always promoted to INT, USHORT
732				 * to INT or UINT.
733				 */
734				if (t1 != INT && (hflag || t1 != UINT))
735					inconarg(hte, call, n);
736			}
737		} else if (fc == 'o' || fc == 'u' || fc == 'x' || fc == 'X') {
738			if ((alt && fc == 'u') || sz == LDOUBLE)
739				badfmt(hte, call);
740		uint_conv:
741			if (sz == LONG) {
742				if (t1 != ULONG && (hflag || t1 != LONG))
743					inconarg(hte, call, n);
744			} else if (sz == QUAD) {
745				if (t1 != UQUAD && (hflag || t1 != QUAD))
746					inconarg(hte, call, n);
747			} else if (sz == SHORT) {
748				/* USHORT was promoted to INT or UINT */
749				if (t1 != UINT && t1 != INT)
750					inconarg(hte, call, n);
751			} else {
752				if (t1 != UINT && (hflag || t1 != INT))
753					inconarg(hte, call, n);
754			}
755		} else if (fc == 'D' || fc == 'O' || fc == 'U') {
756			if ((alt && fc != 'O') || sz != NOTSPEC || !tflag)
757				badfmt(hte, call);
758			sz = LONG;
759			if (fc == 'D') {
760				goto int_conv;
761			} else {
762				goto uint_conv;
763			}
764		} else if (fc == 'f' || fc == 'e' || fc == 'E' ||
765			   fc == 'g' || fc == 'G') {
766			if (sz == NOTSPEC)
767				sz = DOUBLE;
768			if (sz != DOUBLE && sz != LDOUBLE)
769				badfmt(hte, call);
770			if (t1 != sz)
771				inconarg(hte, call, n);
772		} else if (fc == 'c') {
773			if (sz != NOTSPEC || alt || zero)
774				badfmt(hte, call);
775			if (t1 != INT)
776				inconarg(hte, call, n);
777		} else if (fc == 's') {
778			if (sz != NOTSPEC || alt || zero)
779				badfmt(hte, call);
780			if (t1 != PTR ||
781			    (t2 != CHAR && t2 != UCHAR && t2 != SCHAR)) {
782				inconarg(hte, call, n);
783			}
784		} else if (fc == 'p') {
785			if (fwidth || prec || sz != NOTSPEC || alt || zero)
786				badfmt(hte, call);
787			if (t1 != PTR || (hflag && t2 != VOID))
788				inconarg(hte, call, n);
789		} else if (fc == 'n') {
790			if (fwidth || prec || alt || zero || sz == LDOUBLE)
791				badfmt(hte, call);
792			if (t1 != PTR) {
793				inconarg(hte, call, n);
794			} else if (sz == LONG) {
795				if (t2 != LONG && t2 != ULONG)
796					inconarg(hte, call, n);
797			} else if (sz == SHORT) {
798				if (t2 != SHORT && t2 != USHORT)
799					inconarg(hte, call, n);
800			} else {
801				if (t2 != INT && t2 != UINT)
802					inconarg(hte, call, n);
803			}
804		} else {
805			badfmt(hte, call);
806			break;
807		}
808
809		fc = *fp++;
810	}
811}
812
813/*
814 * Compare the types in the NULL-terminated array ap with the format
815 * string fmt.
816 */
817static void
818scanflike(hte_t *hte, fcall_t *call, int n, const char *fmt, type_t **ap)
819{
820	const	char *fp;
821	int	fc;
822	int	noasgn, fwidth;
823	tspec_t	sz, t1 = NOTSPEC, t2 = NOTSPEC;
824	type_t	*tp = NULL;
825
826	fp = fmt;
827	fc = *fp++;
828
829	for ( ; ; ) {
830		if (fc == '\0') {
831			if (*ap != NULL)
832				tomanyarg(hte, call);
833			break;
834		}
835		if (fc != '%') {
836			badfmt(hte, call);
837			break;
838		}
839		fc = *fp++;
840
841		noasgn = fwidth = 0;
842		sz = NOTSPEC;
843
844		if (fc == '*') {
845			noasgn = 1;
846			fc = *fp++;
847		}
848
849		if (isdigit(fc)) {
850			fwidth = 1;
851			do { fc = *fp++; } while (isdigit(fc));
852		}
853
854		if (fc == 'h') {
855			sz = SHORT;
856		} else if (fc == 'l') {
857			sz = LONG;
858		} else if (fc == 'q') {
859			sz = QUAD;
860		} else if (fc == 'L') {
861			sz = LDOUBLE;
862		}
863		if (sz != NOTSPEC)
864			fc = *fp++;
865
866		if (fc == '%') {
867			if (sz != NOTSPEC || noasgn || fwidth)
868				badfmt(hte, call);
869			fc = *fp++;
870			continue;
871		}
872
873		if (!noasgn) {
874			if ((tp = *ap++) == NULL) {
875				tofewarg(hte, call);
876				break;
877			}
878			n++;
879			if ((t1 = tp->t_tspec) == PTR)
880				t2 = tp->t_subt->t_tspec;
881		}
882
883		if (fc == 'd' || fc == 'i' || fc == 'n') {
884			if (sz == LDOUBLE)
885				badfmt(hte, call);
886			if (sz != SHORT && sz != LONG && sz != QUAD)
887				sz = INT;
888		conv:
889			if (!noasgn) {
890				if (t1 != PTR) {
891					inconarg(hte, call, n);
892				} else if (t2 != styp(sz)) {
893					inconarg(hte, call, n);
894				} else if (hflag && t2 != sz) {
895					inconarg(hte, call, n);
896				} else if (tp->t_subt->t_const) {
897					inconarg(hte, call, n);
898				}
899			}
900		} else if (fc == 'o' || fc == 'u' || fc == 'x') {
901			if (sz == LDOUBLE)
902				badfmt(hte, call);
903			if (sz == SHORT) {
904				sz = USHORT;
905			} else if (sz == LONG) {
906				sz = ULONG;
907			} else if (sz == QUAD) {
908				sz = UQUAD;
909			} else {
910				sz = UINT;
911			}
912			goto conv;
913		} else if (fc == 'D') {
914			if (sz != NOTSPEC || !tflag)
915				badfmt(hte, call);
916			sz = LONG;
917			goto conv;
918		} else if (fc == 'O') {
919			if (sz != NOTSPEC || !tflag)
920				badfmt(hte, call);
921			sz = ULONG;
922			goto conv;
923		} else if (fc == 'X') {
924			/*
925			 * XXX valid in ANSI C, but in NetBSD's libc imple-
926			 * mented as "lx". Thats why it should be avoided.
927			 */
928			if (sz != NOTSPEC || !tflag)
929				badfmt(hte, call);
930			sz = ULONG;
931			goto conv;
932		} else if (fc == 'E') {
933			/*
934			 * XXX valid in ANSI C, but in NetBSD's libc imple-
935			 * mented as "lf". Thats why it should be avoided.
936			 */
937			if (sz != NOTSPEC || !tflag)
938				badfmt(hte, call);
939			sz = DOUBLE;
940			goto conv;
941		} else if (fc == 'F') {
942			/* XXX only for backward compatibility */
943			if (sz != NOTSPEC || !tflag)
944				badfmt(hte, call);
945			sz = DOUBLE;
946			goto conv;
947		} else if (fc == 'G') {
948			/*
949			 * XXX valid in ANSI C, but in NetBSD's libc not
950			 * implemented
951			 */
952			if (sz != NOTSPEC && sz != LONG && sz != LDOUBLE)
953				badfmt(hte, call);
954			goto fconv;
955		} else if (fc == 'e' || fc == 'f' || fc == 'g') {
956		fconv:
957			if (sz == NOTSPEC) {
958				sz = FLOAT;
959			} else if (sz == LONG) {
960				sz = DOUBLE;
961			} else if (sz != LDOUBLE) {
962				badfmt(hte, call);
963				sz = FLOAT;
964			}
965			goto conv;
966		} else if (fc == 's' || fc == '[' || fc == 'c') {
967			if (sz != NOTSPEC)
968				badfmt(hte, call);
969			if (fc == '[') {
970				if ((fc = *fp++) == '-') {
971					badfmt(hte, call);
972					fc = *fp++;
973				}
974				if (fc != ']') {
975					badfmt(hte, call);
976					if (fc == '\0')
977						break;
978				}
979			}
980			if (!noasgn) {
981				if (t1 != PTR) {
982					inconarg(hte, call, n);
983				} else if (t2 != CHAR && t2 != UCHAR &&
984					   t2 != SCHAR) {
985					inconarg(hte, call, n);
986				}
987			}
988		} else if (fc == 'p') {
989			if (sz != NOTSPEC)
990				badfmt(hte, call);
991			if (!noasgn) {
992				if (t1 != PTR || t2 != PTR) {
993					inconarg(hte, call, n);
994				} else if (tp->t_subt->t_subt->t_tspec!=VOID) {
995					if (hflag)
996						inconarg(hte, call, n);
997				}
998			}
999		} else {
1000			badfmt(hte, call);
1001			break;
1002		}
1003
1004		fc = *fp++;
1005	}
1006}
1007
1008static void
1009badfmt(hte_t *hte, fcall_t *call)
1010{
1011
1012	/* %s: malformed format string\t%s */
1013	msg(13, hte->h_name, mkpos(&call->f_pos));
1014}
1015
1016static void
1017inconarg(hte_t *hte, fcall_t *call, int n)
1018{
1019
1020	/* %s, arg %d inconsistent with format\t%s(%d) */
1021	msg(14, hte->h_name, n, mkpos(&call->f_pos));
1022}
1023
1024static void
1025tofewarg(hte_t *hte, fcall_t *call)
1026{
1027
1028	/* %s: too few args for format  \t%s */
1029	msg(15, hte->h_name, mkpos(&call->f_pos));
1030}
1031
1032static void
1033tomanyarg(hte_t *hte, fcall_t *call)
1034{
1035
1036	/* %s: too many args for format  \t%s */
1037	msg(16, hte->h_name, mkpos(&call->f_pos));
1038}
1039
1040
1041/*
1042 * Print warnings for return values which are used, but not returned,
1043 * or return values which are always or sometimes ignored.
1044 */
1045static void
1046chkrvu(hte_t *hte, sym_t *def)
1047{
1048	fcall_t	*call;
1049	int	used, ignored;
1050
1051	if (def == NULL)
1052		/* don't know wheter or not the functions returns a value */
1053		return;
1054
1055	if (hte->h_calls == NULL)
1056		return;
1057
1058	if (def->s_rval) {
1059		/* function has return value */
1060		used = ignored = 0;
1061		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1062			used |= call->f_rused || call->f_rdisc;
1063			ignored |= !call->f_rused && !call->f_rdisc;
1064		}
1065		/*
1066		 * XXX as soon as we are able to disable single warnings
1067		 * the following dependencies from hflag should be removed.
1068		 * but for now I do'nt want to be botherd by this warnings
1069		 * which are almost always useless.
1070		 */
1071		if (!used && ignored) {
1072			if (hflag)
1073				/* %s returns value which is always ignored */
1074				msg(8, hte->h_name);
1075		} else if (used && ignored) {
1076			if (hflag)
1077				/* %s returns value which is sometimes ign. */
1078				msg(9, hte->h_name);
1079		}
1080	} else {
1081		/* function has no return value */
1082		for (call = hte->h_calls; call != NULL; call = call->f_nxt) {
1083			if (call->f_rused)
1084				/* %s value is used( %s ), but none ret. */
1085				msg(10, hte->h_name, mkpos(&call->f_pos));
1086		}
1087	}
1088}
1089
1090/*
1091 * Print warnings for inconsistent argument declarations.
1092 */
1093static void
1094chkadecl(hte_t *hte, sym_t *def, sym_t *decl)
1095{
1096	/* LINTED (automatic hides external declaration: warn) */
1097	int	osdef, eq, warn, n;
1098	sym_t	*sym1, *sym;
1099	type_t	**ap1, **ap2, *tp1, *tp2;
1100	char	*pos1;
1101	const	char *pos2;
1102
1103	osdef = 0;
1104	if (def != NULL) {
1105		osdef = def->s_osdef;
1106		sym1 = def;
1107	} else if (decl != NULL && TP(decl->s_type)->t_proto) {
1108		sym1 = decl;
1109	} else {
1110		return;
1111	}
1112	if (TP(sym1->s_type)->t_tspec != FUNC)
1113		return;
1114
1115	/*
1116	 * XXX Prototypes should also be compared with old style function
1117	 * declarations.
1118	 */
1119
1120	for (sym = hte->h_syms; sym != NULL; sym = sym->s_nxt) {
1121		if (sym == sym1 || !TP(sym->s_type)->t_proto)
1122			continue;
1123		ap1 = TP(sym1->s_type)->t_args;
1124		ap2 = TP(sym->s_type)->t_args;
1125		n = 0;
1126		while (*ap1 != NULL && *ap2 != NULL) {
1127			warn = 0;
1128			eq = eqtype(*ap1, *ap2, 1, osdef, 0, &warn);
1129			if (!eq || warn) {
1130				pos1 = xstrdup(mkpos(&sym1->s_pos));
1131				pos2 = mkpos(&sym->s_pos);
1132				/* %s, arg %d declared inconsistently ... */
1133				msg(11, hte->h_name, n + 1, pos1, pos2);
1134				free(pos1);
1135			}
1136			n++;
1137			ap1++;
1138			ap2++;
1139		}
1140		if (*ap1 == *ap2) {
1141			tp1 = TP(sym1->s_type);
1142			tp2 = TP(sym->s_type);
1143			if (tp1->t_vararg == tp2->t_vararg)
1144				continue;
1145			if (tp2->t_vararg &&
1146			    sym1->s_va && sym1->s_nva == n && !sflag) {
1147				continue;
1148			}
1149		}
1150		/* %s: variable # of args declared\t%s  ::  %s */
1151		pos1 = xstrdup(mkpos(&sym1->s_pos));
1152		msg(12, hte->h_name, pos1, mkpos(&sym->s_pos));
1153		free(pos1);
1154	}
1155}
1156
1157
1158/*
1159 * Check compatibility of two types. Returns 1 if types are compatible,
1160 * otherwise 0.
1161 *
1162 * ignqual	if set, ignore qualifiers of outhermost type; used for
1163 *		function arguments
1164 * promote	if set, promote left type before comparison; used for
1165 *		comparisons of arguments with parameters of old style
1166 *		definitions
1167 * asgn		left indirected type must have at least the same qualifiers
1168 *		like right indirected type (for assignments and function
1169 *		arguments)
1170 * *warn	set to 1 if an old style declaration was compared with
1171 *		an incompatible prototype declaration
1172 */
1173static int
1174eqtype(type_t *tp1, type_t *tp2, int ignqual, int promot, int asgn, int *warn)
1175{
1176	tspec_t	t, to;
1177	int	indir;
1178
1179	to = NOTSPEC;
1180	indir = 0;
1181
1182	while (tp1 != NULL && tp2 != NULL) {
1183
1184		t = tp1->t_tspec;
1185		if (promot) {
1186			if (t == FLOAT) {
1187				t = DOUBLE;
1188			} else if (t == CHAR || t == SCHAR) {
1189				t = INT;
1190			} else if (t == UCHAR) {
1191				t = tflag ? UINT : INT;
1192			} else if (t == SHORT) {
1193				t = INT;
1194			} else if (t == USHORT) {
1195				/* CONSTCOND */
1196				t = INT_MAX < USHRT_MAX || tflag ? UINT : INT;
1197			}
1198		}
1199
1200		if (asgn && to == PTR) {
1201			if (indir == 1 && (t == VOID || tp2->t_tspec == VOID))
1202				return (1);
1203		}
1204
1205		if (t != tp2->t_tspec) {
1206			/*
1207			 * Give pointer to types which differ only in
1208			 * signedness a chance if not sflag and not hflag.
1209			 */
1210			if (sflag || hflag || to != PTR)
1211				return (0);
1212			if (styp(t) != styp(tp2->t_tspec))
1213				return (0);
1214		}
1215
1216		if (tp1->t_isenum && tp2->t_isenum) {
1217			if (tp1->t_istag && tp2->t_istag) {
1218				return (tp1->t_tag == tp2->t_tag);
1219			} else if (tp1->t_istynam && tp2->t_istynam) {
1220				return (tp1->t_tynam == tp2->t_tynam);
1221			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1222				return (tp1->t_uniqpos.p_line ==
1223				      tp2->t_uniqpos.p_line &&
1224				    tp1->t_uniqpos.p_file ==
1225				      tp2->t_uniqpos.p_file &&
1226				    tp1->t_uniqpos.p_uniq ==
1227				      tp2->t_uniqpos.p_uniq);
1228			} else {
1229				return (0);
1230			}
1231		}
1232
1233		/*
1234		 * XXX Handle combinations of enum and int if eflag is set.
1235		 * But note: enum and 0 should be allowed.
1236		 */
1237
1238		if (asgn && indir == 1) {
1239			if (!tp1->t_const && tp2->t_const)
1240				return (0);
1241			if (!tp1->t_volatile && tp2->t_volatile)
1242				return (0);
1243		} else if (!ignqual && !tflag) {
1244			if (tp1->t_const != tp2->t_const)
1245				return (0);
1246			if (tp1->t_const != tp2->t_const)
1247				return (0);
1248		}
1249
1250		if (t == STRUCT || t == UNION) {
1251			if (tp1->t_istag && tp2->t_istag) {
1252				return (tp1->t_tag == tp2->t_tag);
1253			} else if (tp1->t_istynam && tp2->t_istynam) {
1254				return (tp1->t_tynam == tp2->t_tynam);
1255			} else if (tp1->t_isuniqpos && tp2->t_isuniqpos) {
1256				return (tp1->t_uniqpos.p_line ==
1257				      tp2->t_uniqpos.p_line &&
1258				    tp1->t_uniqpos.p_file ==
1259				      tp2->t_uniqpos.p_file &&
1260				    tp1->t_uniqpos.p_uniq ==
1261				      tp2->t_uniqpos.p_uniq);
1262			} else {
1263				return (0);
1264			}
1265		}
1266
1267		if (t == ARRAY && tp1->t_dim != tp2->t_dim) {
1268			if (tp1->t_dim != 0 && tp2->t_dim != 0)
1269				return (0);
1270		}
1271
1272		if (t == FUNC) {
1273			if (tp1->t_proto && tp2->t_proto) {
1274				if (!eqargs(tp1, tp2, warn))
1275					return (0);
1276			} else if (tp1->t_proto) {
1277				if (!mnoarg(tp1, warn))
1278					return (0);
1279			} else if (tp2->t_proto) {
1280				if (!mnoarg(tp2, warn))
1281					return (0);
1282			}
1283		}
1284
1285		tp1 = tp1->t_subt;
1286		tp2 = tp2->t_subt;
1287		ignqual = promot = 0;
1288		to = t;
1289		indir++;
1290
1291	}
1292
1293	return (tp1 == tp2);
1294}
1295
1296/*
1297 * Compares arguments of two prototypes
1298 */
1299static int
1300eqargs(type_t *tp1, type_t *tp2, int *warn)
1301{
1302	type_t	**a1, **a2;
1303
1304	if (tp1->t_vararg != tp2->t_vararg)
1305		return (0);
1306
1307	a1 = tp1->t_args;
1308	a2 = tp2->t_args;
1309
1310	while (*a1 != NULL && *a2 != NULL) {
1311
1312		if (eqtype(*a1, *a2, 1, 0, 0, warn) == 0)
1313			return (0);
1314
1315		a1++;
1316		a2++;
1317
1318	}
1319
1320	return (*a1 == *a2);
1321}
1322
1323/*
1324 * mnoarg() (matches functions with no argument type information)
1325 * returns 1 if all parameters of a prototype are compatible with
1326 * and old style function declaration.
1327 * This is the case if following conditions are met:
1328 *	1. the prototype must have a fixed number of parameters
1329 *	2. no parameter is of type float
1330 *	3. no parameter is converted to another type if integer promotion
1331 *	   is applied on it
1332 */
1333static int
1334mnoarg(type_t *tp, int *warn)
1335{
1336	type_t	**arg;
1337	tspec_t	t;
1338
1339	if (tp->t_vararg && warn != NULL)
1340		*warn = 1;
1341	for (arg = tp->t_args; *arg != NULL; arg++) {
1342		if ((t = (*arg)->t_tspec) == FLOAT)
1343			return (0);
1344		if (t == CHAR || t == SCHAR || t == UCHAR)
1345			return (0);
1346		if (t == SHORT || t == USHORT)
1347			return (0);
1348	}
1349	return (1);
1350}
1351