[clang] diagnose_as attribute for Fortify diagnosing like builtins.

[george.burgess.iv]

Thanks for this! The idea LGTM, and sounds like a solid way for us to do better about diagnosing FORTIFY'ed calls in Clang. I have a handful of mostly nits/questions for you :)

clang/include/clang/Basic/Attr.td

3835

purely subjective nit: diagnose_as feels a bit too generic. if you agree, does diagnose_as_builtin sound potentially better?

clang/lib/Sema/SemaChecking.cpp

656

nit: const

658

nit: const auto *

660–665

It seems that this is serving as implicit validation of this attribute's members (e.g., if we can't figure out the Function that this DAIAttr is pointing to, we exit gracefully, etc.)

Would it be better to instead do this validation in handleDiagnoseAsAttr, and store the results (which we can then presume are valid here) in the DiagnoseAsAttr?

In that case, it might be easiest to simply store the FunctionDecl that's being referenced, rather than a DRE to it.

clang/lib/Sema/SemaDeclAttr.cpp

1013

nit: const?

clang/test/Sema/warn-fortify-source.c

184 ↗

(On Diff #380482)

we generally try to extensively test error cases around new attributes. i'd recommend the following cases:

• diagnose_as(__function_that_doesnt_exist)
• diagnose_as(function_i_predeclared_but_which_isnt_a_builtin)
• diagnose_as(__builtin_memcpy, 1, 2, 3, 4) (too many args)
• diagnose_as(__builtin_memcpy, 1, 2) (too few args)
• diagnose_as(__builtin_memcpy, "abc", 2, 3)
• void test_memcpy(double, double, double) __attribute__((diagnose_as(__builtin_memcpy, 1, 2, 3)); (mismatched param types)
• diagnose_as(__some_overloaded_function_name)

there're probably more that might be nice, but those seem like a good foundation :)

[aaron.ballman]

clang/include/clang/Basic/Attr.td

3835

Agreed on it being a bit generic -- it sounds like this is only useful for Fortify, so I wonder if I'm wrong about that or whether we should name it fortify_diagnose_as_builtin or fortify_diagnostic, etc.

clang/include/clang/Basic/AttrDocs.td

5954–5955

I think we should go into more detail about what the correct order of arguments actually means. The example doesn't make it particularly clear what's going on.

clang/lib/Sema/SemaChecking.cpp

660–663

713–718

728–733

clang/lib/Sema/SemaDeclAttr.cpp

1018–1019

This diagnostic looks incorrect to me -- the call to checkUInt32Argument() diagnoses if the expression is not an appropriately-sized integer. This diagnostic is about the value received being out of bounds.

1026–1030

This also seems a bit wrong -- we don't expect a constant expression, we expect a builtin function ID. You may need to use a new diagnostic here instead of reusing an existing one. Also, we should check that we got an actual builtin function as the expression, shouldn't we?

clang/test/Sema/warn-fortify-source.c

184 ↗

(On Diff #380482)

Additional tests:

diagnose_as(some_templated_function, 1, 2, 3)
diagnose_as(some_templated_function_instantiation<int>, 1, 2, 3)
diagnose_as("123", 1, 2, 3)

Also interesting to test is redeclaration behavior:

void my_awesome_func(const char *);

void use1() {
  my_awesome_func(0);
}

[[clang::diagnose_as(__builtin_strlen, 1)]] void my_awesome_func(const char *str) {}

void use2() {
  my_awesome_func(0);
}

[serge-sans-paille]

clang/include/clang/Basic/Attr.td

3835

(Jumping in a bit late) I second the diagnose_as_builtin name. But then we should check that the attribute is only set on inline builtin declaration (as in Decl::isInlineBuiltinDeclaration) and state so in the documentation.

[mbenfield]

Renamed to diagnose_as_builtin (since two people suggested that name). Let me
know if a name mentioning fortify is preferred.

Validation in handleDiagnoseAsBuiltinAttr:

• first argument is a builtin function
• number of arguments matches number of parameters of that function
• subsequent arguments are integers
• indices are in bounds for the parameters of the declared function
• types match for declared function and builtin function

Added diagnostics for the above errors.

Added some consts.

Moved tests to new file attr-diagnose-as-builtin.c.

Added many test cases.

Fixed diagnostic around checkUInt32Argument.

Clarified documentation.

[mbenfield]

clang/include/clang/Basic/Attr.td

3835

I think Decl::isInlineBuiltinDeclaration may be the wrong thing to check; it fails for some builtin functions. Instead I'm checking against getBuiltinID. Let me know if you feel this is incorrect.

[mbenfield]

Rebase.

[mbenfield]

Would @george.burgess.iv and/or @aaron.ballman mind taking another look at the latest revision?

[mbenfield]

Rebase.

[george.burgess.iv]

LGTM % 2 nits. Please feel free to commit after it LGT @aaron.ballman too. :)

Thanks again!

clang/include/clang/Basic/DiagnosticSemaKinds.td

2961

tiny nit: for consistency with the other options here

clang/test/Sema/attr-diagnose-as-builtin.c

63

nit: can we also add a non-templated overload check in here?

if the diag isn't beautiful, that's fine IMO. just having a test-case to show the expected behavior would be nice

[mbenfield]

clang/test/Sema/attr-diagnose-as-builtin.c

63

Sorry, not sure what is being requested. By a "non-templated overload check" do you mean something different from memcpy2 above?

[george.burgess.iv]

clang/test/Sema/attr-diagnose-as-builtin.c

63

something like the new edit suggestion below is what i have in mind :)

72

[mbenfield]

s/requires/takes in diagnostic message.

Test case with a non-template overloaded function.

[aaron.ballman]

clang/include/clang/Basic/AttrDocs.td

5973

One thing that's not quite clear from the docs is how to handle variadic arg builtins like __builtin_printf -- how do you specify "the variadic args go here"?

Another thing that's unclear is whether you can apply this attribute to a member function, and if so, how does that change the indexes given for the implicit this argument?

We should add test coverage for both of these situations.

clang/lib/Sema/SemaChecking.cpp

686

We typically don't use top-level const on value types for local variables/parameters (only on pointers or references). (same comment applies elsewhere)

696–698

Please spell out the type.

clang/lib/Sema/SemaDeclAttr.cpp

1006

I don't believe D can ever be null.

1014–1018

Removes curly braces and an else after a return.

1040

Passing in a NamedDecl will be automatically quoted by the diagnostics engine, while passing in a StringRef will not. We prefer syntax to be quoted in diagnostics to reduce confusion.

1055–1057

1061

1065–1066

Please spell out the type as it's not spelled out in the initialization.

1068–1069

This may be fine, but it may also be overly restrictive. Consider:

void f(void *dest, char val, size_t n) __attribute__((diagnose_as_builtin(__builtin_memset, 1, 2, 3))) {}

I think this will get diagnosed because of the type mismatch between char and int, won't it? But notionally, the argument passed to val will be promoted to int anyway, so they're morally equivalent. This would be a good test case to add.

FWIW, I prefer erring on the side of being overly restrictive (we can relax restrictions more easily than we can add new ones), which is why I think this is fine for now.

[mbenfield]

Error on member function. Test case for this.

Test case for attribute applied to a non-function declaration.

Handle variadic functions. Document this. Test case for variadic functions.

Remove const from some local values.

Spell out some types.

Change superflous dyn_cast_or_null to dyn_cast.

Remove some curly braces.

Pass in a NamedDecl directly rather than its name to a diagnostic.

Add a test case for types not being identical.

[aaron.ballman]

clang/include/clang/Basic/AttrDocs.td

5956

We should mention that the attribute cannot be applied to a member function (and if you decide it shouldn't apply to a static member function either, I'd call that out explicitly as well).

5975

5987

clang/lib/AST/Decl.cpp

2021

Spurious whitespace change can be reverted.

clang/lib/Sema/SemaDeclAttr.cpp

1006–1009

Sorry, I should have suggested this earlier -- might as well assert if D is something we should have already validated is a FunctionDecl before calling this helper.

1011–1014

Hmm, this is getting into real nit territory, but, shouldn't it be fine to use a static member function?

1021–1022

Sorry, missed this one earlier as well (no else after a return per our usual coding guidelines).

1059–1061

1065

clang/test/Sema/attr-diagnose-as-builtin.c

104

It'd be good to add another test case for static member functions just to show whether we do or do not support them.

[mbenfield]

Revert spurious whitespace change.

assert(D)

No else after return.

Allow attribute to be applied to static member functions and test this.

Document that it can't be applied to a non-static member function.

[mbenfield]

Replace DeclFD->getName() with just DeclFD.

[aaron.ballman]

clang/include/clang/Basic/Attr.td

3839

Why does this need to be late parsed? I don't think the arguments to the attribute are ones that name class members or anything like that.

clang/lib/Sema/SemaDeclAttr.cpp

1006–1009

Sorry, my suggestion wasn't as clear as it could have been -- cast<> does the assertion for you, so you can switch dyn_cast to cast and remove the explicit assert here.

[mbenfield]

Rebase.

[mbenfield]

@aaron.ballman Look to you like this is ready to land?

EDIT: oops sorry, missed your latest comments, will address them shortly.

[mbenfield]

Remove late parsing.

Switch dyn_cast to cast.

[aaron.ballman]

In D112024#3180347, @mbenfield wrote:

@aaron.ballman Look to you like this is ready to land?

EDIT: oops sorry, missed your latest comments, will address them shortly.

Thanks for catching those! FWIW, I think we're close, but precommit CI is failing: https://reviews.llvm.org/harbormaster/unit/view/1534779/ In fact, LGTM aside from that bit.

[mbenfield]

Fix test clang/test/Misc/pragma-attribute-supported-attributes-list.test

clang/include/clang/Basic/Attr.td

 
 def ReleaseHandle : InheritableParamAttr {
   let Spellings = [Clang<"release_handle">];
   let Args = [StringArgument<"HandleType">];
   let Subjects = SubjectList<[ParmVar]>;
   let Documentation = [ReleaseHandleDocs];
 }
 
+def DiagnoseAsBuiltin : InheritableAttr {
+  let Spellings = [Clang<"diagnose_as_builtin">];
+  let Args = [DeclArgument<Function, "Function">,
+              VariadicUnsignedArgument<"ArgIndices">];
+  let Subjects = SubjectList<[Function]>;
+  let LateParsed = 1;
+  let Documentation = [DiagnoseAsBuiltinDocs];
+}
+
 def Builtin : InheritableAttr {
   let Spellings = [];
   let Args = [UnsignedArgument<"ID">];
   let Subjects = SubjectList<[Function]>;
   let SemaHandler = 0;
   let Documentation = [Undocumented];
 }
 

clang/include/clang/Basic/AttrDocs.td

 attribute requires a string literal argument to identify the handle being released.
 
 .. code-block:: c++
 
   zx_status_t zx_handle_close(zx_handle_t handle [[clang::release_handle("tag")]]);
   }];
 }
 
+def DiagnoseAsBuiltinDocs : Documentation {
+  let Category = DocCatFunction;
+  let Content = [{
+The ``diagnose_as_builtin` attribute indicates that Fortify diagnostics are to
+be applied to the declared function as if it were the function specified by the
+attribute. The builtin function whose diagnostics are to be mimicked should be
+given. In addition, the order in which arguments should be applied must also
+be given.
+
+For example, the attribute can be used as follows.
+
+  .. code-block:: c
+
+    __attribute__((diagnose_as_builtin(__builtin_memset, 3, 2, 1)))
+    void *mymemset(int n, int c, void *s) {
+      // ...
+    }
+
+This indicates that calls to ``mymemset`` should be diagnosed as if they were
+calls to ``__builtin_memset``. The arguments ``3, 2, 1`` indicate by index the
+order in which arguments of ``mymemset`` should be applied to
+``__builtin_memset``. The third argument should be applied first, then the
+second, and then the first. Thus (when Fortify warnings are enabled) the call
+``mymemset(n, c, s)`` will diagnose overflows as if it were the call
+``__builtin_memset(s, c, n)``.
+
+For variadic functions, the variadic arguments must simply come in the same
+order as they would to the builtin function, after all normal arguments. For
+instance, to diagnose a new function as if it were `sscanf`, we can use the
+attribute as follows.
+
+  .. code-block:: c
+  __attribute__((diagnose_as_builtin(sscanf, 1, 2)))
+  int mysscanf(const char *str, const char *format, ...)  {
+    // ...
+  }
+
+Then the call `mysscanf("abc def", "%4s %4s", buf1, buf2)` will be diagnosed as
+if it were the call `mysscanf("abc def", "%4s %4s", buf1, buf2)`.
+}];
+}
+
 def ArmSveVectorBitsDocs : Documentation {
   let Category = DocCatType;
   let Content = [{
 The ``arm_sve_vector_bits(N)`` attribute is defined by the Arm C Language
 Extensions (ACLE) for SVE. It is used to define fixed-length (VLST) variants of
 sizeless types (VLAT).
 
 For example:

clang/include/clang/Basic/DiagnosticSemaKinds.td

 def err_attributes_are_not_compatible : Error<
   "%0 and %1 attributes are not compatible">;
 def err_attribute_invalid_argument : Error<
   "%select{a reference type|an array type|a non-vector or "
   "non-vectorizable scalar type}0 is an invalid argument to attribute %1">;
 def err_attribute_wrong_number_arguments : Error<
   "%0 attribute %plural{0:takes no arguments|1:takes one argument|"
   ":requires exactly %1 arguments}1">;
+def err_attribute_wrong_number_arguments_for : Error <
+  "%0 attribute references function %1, which %plural{0:takes no arguments|1:takes one argument|"
+  ":takes exactly %2 arguments}2">;
+def err_attribute_bounds_for_function : Error<
+  "%0 attribute references parameter %1, but the function %2 has only %3 parameters">;
+def err_attribute_no_member_function : Error<
+  "%0 attribute only applies to non-member functions">;
+def err_attribute_parameter_types : Error<
+  "%0 attribute parameter types do not match: parameter %1 of function %2 has type %3, "
+  "but parameter %4 of function %5 has type %6">;
+
 def err_attribute_too_many_arguments : Error<
   "%0 attribute takes no more than %1 argument%s1">;
 def err_attribute_too_few_arguments : Error<
   "%0 attribute takes at least %1 argument%s1">;
 def err_attribute_invalid_vector_type : Error<"invalid vector element type %0">;
 def err_attribute_invalid_matrix_type : Error<"invalid matrix element type %0">;
 def err_attribute_bad_neon_vector_size : Error<
   "Neon vector size must be 64 or 128 bits">;

 def err_alignas_underaligned : Error<
   "requested alignment is less than minimum alignment of %1 for type %0">;
 def warn_aligned_attr_underaligned : Warning<err_alignas_underaligned.Text>,
   InGroup<IgnoredAttributes>;
 def err_attribute_sizeless_type : Error<
   "%0 attribute cannot be applied to sizeless type %1">;
 def err_attribute_argument_n_type : Error<
   "%0 attribute requires parameter %1 to be %select{int or bool|an integer "
-  "constant|a string|an identifier|a constant expression}2">;
+  "constant|a string|an identifier|a constant expression|a builtin function}2">;
 def err_attribute_argument_type : Error<
   "%0 attribute requires %select{int or bool|an integer "
   "constant|a string|an identifier}1">;
 def err_attribute_argument_out_of_range : Error<
   "%0 attribute requires integer constant between %1 and %2 inclusive">;
 def err_init_priority_object_attr : Error<
   "can only use 'init_priority' attribute on file-scope definitions "
   "of objects of class type">;

clang/include/clang/Sema/ParsedAttr.h

 /// These constants match the enumerated choices of
 /// err_attribute_argument_n_type and err_attribute_argument_type.
 enum AttributeArgumentNType {
   AANT_ArgumentIntOrBool,
   AANT_ArgumentIntegerConstant,
   AANT_ArgumentString,
   AANT_ArgumentIdentifier,
   AANT_ArgumentConstantExpr,
+  AANT_ArgumentBuiltinFunction,
 };
 
 /// These constants match the enumerated choices of
 /// warn_attribute_wrong_decl_type and err_attribute_wrong_decl_type.
 enum AttributeDeclKind {
   ExpectedFunction,
   ExpectedUnion,
   ExpectedVariableOrFunction,

clang/lib/AST/Decl.cpp

 }
 
 VarDecl::VarDecl(Kind DK, ASTContext &C, DeclContext *DC,
                  SourceLocation StartLoc, SourceLocation IdLoc,
                  IdentifierInfo *Id, QualType T, TypeSourceInfo *TInfo,
                  StorageClass SC)
     : DeclaratorDecl(DK, DC, IdLoc, Id, T, TInfo, StartLoc),
       redeclarable_base(C) {
+
   static_assert(sizeof(VarDeclBitfields) <= sizeof(unsigned),
                 "VarDeclBitfields too large!");
   static_assert(sizeof(ParmVarDeclBitfields) <= sizeof(unsigned),
                 "ParmVarDeclBitfields too large!");
   static_assert(sizeof(NonParmVarDeclBitfields) <= sizeof(unsigned),
                 "NonParmVarDeclBitfields too large!");
   AllBits = 0;
   VarDeclBits.SClass = SC;

clang/lib/Sema/SemaChecking.cpp

bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS,
     case analyze_format_string::ConversionSpecifier::sArg:
     case analyze_format_string::ConversionSpecifier::ScanListArg:
       NulByte = 1;
       break;
     case analyze_format_string::ConversionSpecifier::cArg:
       break;
     }
 
-    auto OptionalFW = FS.getFieldWidth();
-    if (OptionalFW.getHowSpecified() !=
+    analyze_format_string::OptionalAmount FW = FS.getFieldWidth();
+    if (FW.getHowSpecified() !=
         analyze_format_string::OptionalAmount::HowSpecified::Constant)
       return true;
 
-    unsigned SourceSize = OptionalFW.getConstantAmount() + NulByte;
+    unsigned SourceSize = FW.getConstantAmount() + NulByte;
 
-    auto DestSizeAPS = ComputeSizeArgument(FS.getArgIndex());
+    Optional<llvm::APSInt> DestSizeAPS = ComputeSizeArgument(FS.getArgIndex());
     if (!DestSizeAPS)
       return true;
 
     unsigned DestSize = DestSizeAPS->getZExtValue();
 
     if (DestSize < SourceSize)
       Diagnose(FS.getArgIndex(), DestSize, SourceSize);
 

 } // namespace
 
 void Sema::checkFortifiedBuiltinMemoryFunction(FunctionDecl *FD,
                                                CallExpr *TheCall) {
   if (TheCall->isValueDependent() || TheCall->isTypeDependent() ||
       isConstantEvaluated())
     return;
 
-  unsigned BuiltinID = FD->getBuiltinID(/*ConsiderWrappers=*/true);
+  bool UseDABAttr = false;
+  const FunctionDecl *UseDecl = FD;
+
+  const auto *DABAttr = FD->getAttr<DiagnoseAsBuiltinAttr>();
+  if (DABAttr) {
+    UseDecl = DABAttr->getFunction();
+    assert(UseDecl && "Missing FunctionDecl in DiagnoseAsBuiltin attribute!");
+    UseDABAttr = true;
+  }
+
+  unsigned BuiltinID = UseDecl->getBuiltinID(/*ConsiderWrappers=*/true);
+
   if (!BuiltinID)
     return;
 
   const TargetInfo &TI = getASTContext().getTargetInfo();
   unsigned SizeTypeWidth = TI.getTypeWidth(TI.getSizeType());
 
+  auto TranslateIndex = [&](unsigned Index) -> Optional<unsigned> {
+    // If we refer to a diagnose_as_builtin attribute, we need to change the
+    // argument index to refer to the arguments of the called function. Unless
+    // the index is out of bounds, which presumably means it's a variadic
+    // function.
+    unsigned NewIndex = UseDABAttr && Index < DABAttr->argIndices_size()
+                            ? DABAttr->argIndices_begin()[Index]
+                            : Index;
+    if (NewIndex >= TheCall->getNumArgs())
+      return llvm::None;
+    return NewIndex;
+  };
+
   auto ComputeExplicitObjectSizeArgument =
       [&](unsigned Index) -> Optional<llvm::APSInt> {
+    Optional<unsigned> IndexOptional = TranslateIndex(Index);
+    if (!IndexOptional)
+      return llvm::None;
+    unsigned NewIndex = IndexOptional.getValue();
     Expr::EvalResult Result;
-    Expr *SizeArg = TheCall->getArg(Index);
+    Expr *SizeArg = TheCall->getArg(NewIndex);
     if (!SizeArg->EvaluateAsInt(Result, getASTContext()))
       return llvm::None;
-    return Result.Val.getInt();
+    llvm::APSInt Integer = Result.Val.getInt();
+    Integer.setIsUnsigned(true);
+    return Integer;
   };
 
   auto ComputeSizeArgument = [&](unsigned Index) -> Optional<llvm::APSInt> {
     // If the parameter has a pass_object_size attribute, then we should use its
     // (potentially) more strict checking mode. Otherwise, conservatively assume
     // type 0.
     int BOSType = 0;
     // This check can fail for variadic functions.
     if (Index < FD->getNumParams()) {
       if (const auto *POS =
               FD->getParamDecl(Index)->getAttr<PassObjectSizeAttr>())
         BOSType = POS->getType();
     }
 
-    const Expr *ObjArg = TheCall->getArg(Index);
+    Optional<unsigned> IndexOptional = TranslateIndex(Index);
+    if (!IndexOptional)
+      return llvm::None;
+    unsigned NewIndex = IndexOptional.getValue();
+
+    const Expr *ObjArg = TheCall->getArg(NewIndex);
     uint64_t Result;
     if (!ObjArg->tryEvaluateObjectSize(Result, getASTContext(), BOSType))
       return llvm::None;
 
     // Get the object size in the target's size_t width.
     return llvm::APSInt::getUnsigned(Result).extOrTrunc(SizeTypeWidth);
   };
 
   auto ComputeStrLenArgument = [&](unsigned Index) -> Optional<llvm::APSInt> {
-    Expr *ObjArg = TheCall->getArg(Index);
+    Optional<unsigned> IndexOptional = TranslateIndex(Index);
+    if (!IndexOptional)
+      return llvm::None;
+    unsigned NewIndex = IndexOptional.getValue();
+
+    const Expr *ObjArg = TheCall->getArg(NewIndex);
     uint64_t Result;
     if (!ObjArg->tryEvaluateStrLen(Result, getASTContext()))
       return llvm::None;
     // Add 1 for null byte.
     return llvm::APSInt::getUnsigned(Result + 1).extOrTrunc(SizeTypeWidth);
   };
 
   Optional<llvm::APSInt> SourceSize;
case Builtin::BI__builtin_vsnprintf: {
     DiagID = diag::warn_fortify_source_size_mismatch;
     SourceSize = ComputeExplicitObjectSizeArgument(1);
     DestinationSize = ComputeSizeArgument(0);
     break;
   }
   }
 
   if (!SourceSize || !DestinationSize ||
-      SourceSize.getValue().ule(DestinationSize.getValue()))
+      llvm::APSInt::compareValues(SourceSize.getValue(),
+                                  DestinationSize.getValue()) <= 0)
     return;
 
   StringRef FunctionName = GetFunctionName();
 
   SmallString<16> DestinationStr;
   SmallString<16> SourceStr;
   DestinationSize->toString(DestinationStr, /*Radix=*/10);
   SourceSize->toString(SourceStr, /*Radix=*/10);

clang/lib/Sema/SemaDeclAttr.cpp

if (const auto *PVD = dyn_cast<ParmVarDecl>(DRE->getDecl()))
         Result = true;
         return false;
       }
     return true;
   }
 };
 }
 
+static void handleDiagnoseAsBuiltinAttr(Sema &S, Decl *D,
+                                        const ParsedAttr &AL) {
+  const auto *DeclFD = dyn_cast<FunctionDecl>(D);
+  if (!DeclFD)
+    // User will have already been warned.
+    return;
+
+  if (isa<CXXMethodDecl>(DeclFD)) {
+    S.Diag(AL.getLoc(), diag::err_attribute_no_member_function) << AL;
+    return;
+  }
+
+  const auto DiagnoseType = [&](unsigned Index, AttributeArgumentNType T) {
+    SourceLocation Loc = [&]() {
+      auto Union = AL.getArg(Index - 1);
+      if (Union.is<Expr *>())
+        return Union.get<Expr *>()->getBeginLoc();
+      else
+        return Union.get<IdentifierLoc *>()->Loc;
+    }();
+
+    S.Diag(Loc, diag::err_attribute_argument_n_type) << AL << Index << T;
+  };
+
+  FunctionDecl *AttrFD = [&]() -> FunctionDecl * {
+    if (!AL.isArgExpr(0))
+      return nullptr;
+    auto *F = dyn_cast_or_null<DeclRefExpr>(AL.getArgAsExpr(0));
+    if (!F)
+      return nullptr;
+    return dyn_cast_or_null<FunctionDecl>(F->getFoundDecl());
+  }();
+
+  if (!AttrFD || !AttrFD->getBuiltinID(true)) {
+    DiagnoseType(1, AANT_ArgumentBuiltinFunction);
+    return;
+  }
+
+  if (AttrFD->getNumParams() != AL.getNumArgs() - 1) {
+    S.Diag(AL.getLoc(), diag::err_attribute_wrong_number_arguments_for)
+        << AL << AttrFD << AttrFD->getNumParams();
+    return;
+  }
+
+  SmallVector<unsigned, 8> Indices;
+
+  for (unsigned I = 1; I < AL.getNumArgs(); ++I) {
+    if (!AL.isArgExpr(I)) {
+      DiagnoseType(I + 1, AANT_ArgumentIntegerConstant);
+      return;
+    }
+
+    const Expr *IndexExpr = AL.getArgAsExpr(I);
+    uint32_t Index;
+
+    if (!checkUInt32Argument(S, AL, IndexExpr, Index, I + 1, false)) {
+      return;
+    }
+
+    if (Index > DeclFD->getNumParams()) {
+      S.Diag(AL.getLoc(), diag::err_attribute_bounds_for_function)
+          << AL << Index << DeclFD->getName() << DeclFD->getNumParams();
+      return;
+    }
+
+    QualType T1 = AttrFD->getParamDecl(I - 1)->getType();
+    QualType T2 = DeclFD->getParamDecl(Index - 1)->getType();
+
+    if (T1.getCanonicalType().getUnqualifiedType() !=
+        T2.getCanonicalType().getUnqualifiedType()) {
+      S.Diag(IndexExpr->getBeginLoc(), diag::err_attribute_parameter_types)
+          << AL << Index << DeclFD << T2 << I << AttrFD << T1;
+      return;
+    }
+
+    Indices.push_back(Index - 1);
+  }
+
+  D->addAttr(::new (S.Context) DiagnoseAsBuiltinAttr(
+      S.Context, AL, AttrFD, Indices.data(), Indices.size()));
+}
+
 static void handleDiagnoseIfAttr(Sema &S, Decl *D, const ParsedAttr &AL) {
   S.Diag(AL.getLoc(), diag::ext_clang_diagnose_if);
 
   Expr *Cond;
   StringRef Msg;
   if (!checkFunctionConditionAttr(S, D, AL, Cond, Msg))
     return;
 
case ParsedAttr::AT_EnableIf:
     handleEnableIfAttr(S, D, AL);
     break;
   case ParsedAttr::AT_Error:
     handleErrorAttr(S, D, AL);
     break;
   case ParsedAttr::AT_DiagnoseIf:
     handleDiagnoseIfAttr(S, D, AL);
     break;
+  case ParsedAttr::AT_DiagnoseAsBuiltin:
+    handleDiagnoseAsBuiltinAttr(S, D, AL);
+    break;
   case ParsedAttr::AT_NoBuiltin:
     handleNoBuiltinAttr(S, D, AL);
     break;
   case ParsedAttr::AT_ExtVectorType:
     handleExtVectorTypeAttr(S, D, AL);
     break;
   case ParsedAttr::AT_ExternalSourceSymbol:
     handleExternalSourceSymbolAttr(S, D, AL);

clang/test/Sema/attr-diagnose-as-builtin.c

+// RUN: %clang_cc1 -Wfortify-source -triple x86_64-apple-macosx10.14.0 %s -verify
+// RUN: %clang_cc1 -Wfortify-source -xc++ -triple x86_64-apple-macosx10.14.0 %s -verify
+
+typedef unsigned long size_t;
+
+__attribute__((diagnose_as_builtin(__builtin_memcpy, 3, 1, 2))) int x; // expected-warning {{'diagnose_as_builtin' attribute only applies to functions}}
+
+void *test_memcpy(const void *src, size_t c, void *dst) __attribute__((diagnose_as_builtin(__builtin_memcpy, 3, 1, 2))) {
+  return __builtin_memcpy(dst, src, c);
+}
+
+void call_test_memcpy() {
+  char bufferA[10];
+  char bufferB[11];
+  test_memcpy(bufferB, 10, bufferA);
+  test_memcpy(bufferB, 11, bufferA); // expected-warning {{'memcpy' will always overflow; destination buffer has size 10, but size argument is 11}}
+}
+
+void failure_function_doesnt_exist() __attribute__((diagnose_as_builtin(__function_that_doesnt_exist))) {} // expected-error {{use of undeclared identifier '__function_that_doesnt_exist'}}
+
+void not_a_builtin() {}
+
+void failure_not_a_builtin() __attribute__((diagnose_as_builtin(not_a_builtin))) {} // expected-error {{'diagnose_as_builtin' attribute requires parameter 1 to be a builtin function}}
+
+void failure_too_many_parameters(void *dst, const void *src, size_t count, size_t nothing) __attribute__((diagnose_as_builtin(__builtin_memcpy, 1, 2, 3, 4))) {} // expected-error {{'diagnose_as_builtin' attribute references function '__builtin_memcpy', which takes exactly 3 arguments}}
+
+void failure_too_few_parameters(void *dst, const void *src) __attribute__((diagnose_as_builtin(__builtin_memcpy, 1, 2))) {} // expected-error{{'diagnose_as_builtin' attribute references function '__builtin_memcpy', which takes exactly 3 arguments}}
+
+void failure_not_an_integer(void *dst, const void *src, size_t count) __attribute__((diagnose_as_builtin(__builtin_memcpy, "abc", 2, 3))) {} // expected-error{{'diagnose_as_builtin' attribute requires parameter 2 to be an integer constant}}
+
+void failure_not_a_builtin2() __attribute__((diagnose_as_builtin("abc"))) {} // expected-error{{'diagnose_as_builtin' attribute requires parameter 1 to be a builtin function}}
+
+void failure_parameter_index_bounds(void *dst, const void *src) __attribute__((diagnose_as_builtin(__builtin_memcpy, 1, 2, 3))) {} // expected-error{{'diagnose_as_builtin' attribute references parameter 3, but the function failure_parameter_index_bounds has only 2 parameters}}
+
+void failure_parameter_types(double dst, const void *src, size_t count) __attribute__((diagnose_as_builtin(__builtin_memcpy, 1, 2, 3))) {} // expected-error{{'diagnose_as_builtin' attribute parameter types do not match: parameter 1 of function 'failure_parameter_types' has type 'double', but parameter 1 of function '__builtin_memcpy' has type 'void *'}}
+
+void to_redeclare(void *dst, const void *src, size_t count);
+
+void use_to_redeclare() {
+  char src[10];
+  char dst[9];
+  // We shouldn't get an error yet.
+  to_redeclare(dst, src, 10);
+}
+
+void to_redeclare(void *dst, const void *src, size_t count) __attribute((diagnose_as_builtin(__builtin_memcpy, 1, 2, 3)));
+
+void error_to_redeclare() {
+  char src[10];
+  char dst[9];
+  // Now we get an error.
+  to_redeclare(dst, src, 10); // expected-warning {{'memcpy' will always overflow; destination buffer has size 9, but size argument is 10}}
+}
+
+// Make sure this works even with extra qualifiers and the pass_object_size attribute.
+void *memcpy2(void *const dst __attribute__((pass_object_size(0))), const void *src, size_t copy_amount) __attribute((diagnose_as_builtin(__builtin_memcpy, 1, 2, 3)));
+
+void call_memcpy2() {
+  char buf1[10];
+  char buf2[11];
+  memcpy2(buf1, buf2, 11); // expected-warning {{'memcpy' will always overflow; destination buffer has size 10, but size argument is 11}}
+}
+
+// We require the types to be identical, modulo canonicalization and qualifiers.
+// Maybe this could be relaxed if it proves too restrictive.
+void failure_type(void *dest, char val, size_t n) __attribute__((diagnose_as_builtin(__builtin_memset, 1, 2, 3))) {} // expected-error {{'diagnose_as_builtin' attribute parameter types do not match: parameter 2 of function 'failure_type' has type 'char', but parameter 2 of function '__builtin_memset' has type 'int'}}
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern int sscanf(const char *input, const char *format, ...);
+
+#ifdef __cplusplus
+}
+#endif
+
+// Variadics should work.
+int mysscanf(const char *str, const char *format, ...) __attribute__((diagnose_as_builtin(sscanf, 1, 2)));
+
+void warn_mysccanf() {
+  char buf[10];
+  mysscanf("", "%10s", buf); // expected-warning{{'sscanf' may overflow; destination buffer in argument 3 has size 10, but the corresponding specifier may require size 11}}
+}
+
+#ifdef __cplusplus
+
+template <class T>
+void some_templated_function(int x) {
+  return;
+}
+
+void failure_template(int x) __attribute__((diagnose_as_builtin(some_templated_function, 1))) {} // expected-error{{'diagnose_as_builtin' attribute requires parameter 1 to be a builtin function}}
+
+void failure_template_instantiation(int x) __attribute__((diagnose_as_builtin(some_templated_function<int>, 1))) {} // expected-error{{'diagnose_as_builtin' attribute requires parameter 1 to be a builtin function}}
+
+void overloaded_function(unsigned);
+
+void overloaded_function(int);
+
+void failure_overloaded_function(int) __attribute__((diagnose_as_builtin(overloaded_function, 1))) {} // expected-error{{'diagnose_as_builtin' attribute requires parameter 1 to be a builtin function}}
+
+struct S {
+  __attribute__((diagnose_as_builtin(__builtin_memset))) void f(); // expected-error{{'diagnose_as_builtin' attribute only applies to non-member functions}}
+};
+
+#endif