[Sema] Warn about printf %n on Android and Fuchsia

[abrachet]

Summary

The printf specifier %n is not supported on Android's libc and will soon be removed from Fuchsia's

[erichkeane]

Other than the clang-format issues, this looks fine. However, I'm not really knowledgable enough/the owner of the Fuschia/Android stuff, so I'd prefer an approval 'in concept' come from someone more involved with that.

[abrachet]

Conditionally apply clang-format suggestions. It doesn't make sense to apply the suggestions in the tests because the style would diverge from the rest of the file.

+enh to review Android changes.

[phosek]

@srhines can you also take a look at the Android changes or suggest other reviewers?

[enh]

In D117611#3256089, @phosek wrote:

@srhines can you also take a look at the Android changes or suggest other reviewers?

sorry, took me this long to log in :-(

yeah, lgtm, thanks! %n hasn't worked for about 10 years; it changed from being silently ignored (which, in retrospect, was a cure every bit as bad as the disease) to causing a FORTIFY abort in Q/API 29. but, yeah, since it doesn't do what the C standard says in any version of Android that the NDK still supports, it makes sense for clang to just reject it regardless of API level.

[enh]

In D117611#3256094, @enh wrote:

In D117611#3256089, @phosek wrote:

@srhines can you also take a look at the Android changes or suggest other reviewers?

sorry, took me this long to log in :-(

yeah, lgtm, thanks! %n hasn't worked for about 10 years; it changed from being silently ignored (which, in retrospect, was a cure every bit as bad as the disease) to causing a FORTIFY abort in Q/API 29. but, yeah, since it doesn't do what the C standard says in any version of Android that the NDK still supports, it makes sense for clang to just reject it regardless of API level.

in case anyone's thinking "citation needed": search for %n on https://android.googlesource.com/platform/bionic/+/master/docs/status.md

[enh]

In D117611#3256097, @enh wrote:

In D117611#3256094, @enh wrote:

In D117611#3256089, @phosek wrote:

@srhines can you also take a look at the Android changes or suggest other reviewers?

sorry, took me this long to log in :-(

yeah, lgtm, thanks! %n hasn't worked for about 10 years; it changed from being silently ignored (which, in retrospect, was a cure every bit as bad as the disease) to causing a FORTIFY abort in Q/API 29. but, yeah, since it doesn't do what the C standard says in any version of Android that the NDK still supports, it makes sense for clang to just reject it regardless of API level.

in case anyone's thinking "citation needed": search for %n on https://android.googlesource.com/platform/bionic/+/master/docs/status.md

and in case anyone's thinking "please don't be so lazy --- go and look up when %n was _initially_ disabled!", it was so long ago that we weren't even using git for version control back then, and the corresponding bug has gone out of retention, so i literally don't have the history left. given that, i think "forever" is a good approximation :-)

[glandium]

This doesn't leave much room to use __attribute__((format(printf))) on custom printf implementations that do support %n on Android does it?

[aaron.ballman]

In D117611#3339137, @glandium wrote:

This doesn't leave much room to use __attribute__((format(printf))) on custom printf implementations that do support %n on Android does it?

+1 to this point; whether this is or is not supported depends on which libc the user is linking against.

[enh]

In D117611#3339137, @glandium wrote:

This doesn't leave much room to use __attribute__((format(printf))) on custom printf implementations that do support %n on Android does it?

it would be pretty hard to get into that situation though? apps are clones of the zygote, so you don't have any choice over your libc on Android: it's all bionic, all the time. (our seccomp policies also mean "good luck trying to run a static musl/glibc binary".) clang's Android target already assumes bionic in other ways --- things like whether math functions set errno, or whatever, so this seems in keeping to me.

ah, you don't mean *printf* implementations, you mean "other functions that take printf arguments"? yeah, that's a more interesting case. though that one's already broken: there's already no way to say what subset of printf formats you do/don't support. (all the ones in the Android OS itself are all subsets of the bionic printf; many equal, but several *much* smaller. that would be a pretty cool thing to be able to specify, but that's a much bigger bug, and this change brings us closer to reality than we currently are, for the 99% case :-) )

clang/include/clang/AST/FormatString.h

virtual bool HandleInvalidPrintfConversionSpecifier(
                                       const analyze_printf::PrintfSpecifier &FS,
                                       const char *startSpecifier,
                                       unsigned specifierLen) {
     return true;
   }
 
   virtual bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
                                      const char *startSpecifier,
-                                     unsigned specifierLen) {
+                                     unsigned specifierLen,
+                                     const TargetInfo &Target) {
     return true;
   }
 
   /// Handle mask types whose sizes are not between one and eight bytes.
   virtual void handleInvalidMaskType(StringRef MaskType) {}
 
     // Scanf-specific handlers.
 

clang/include/clang/Basic/DiagnosticSemaKinds.td

def warn_printf_empty_objc_flag: Warning<
   "missing object format flag">,
   InGroup<Format>;
 def warn_printf_ObjCflags_without_ObjCConversion: Warning<
   "object format flags cannot be used with '%0' conversion specifier">,
   InGroup<Format>;
 def warn_printf_invalid_objc_flag: Warning<
     "'%0' is not a valid object format flag">,
     InGroup<Format>;
+def warn_printf_narg_not_supported : Warning<
+    "'%%n' specifier not supported on this platform">,
+    InGroup<Format>;
 def warn_scanf_scanlist_incomplete : Warning<
   "no closing ']' for '%%[' in scanf format string">,
   InGroup<Format>;
 def warn_format_bool_as_character : Warning<
   "using '%0' format specifier, but argument has boolean value">,
   InGroup<Format>;
 def note_format_string_defined : Note<"format string is defined here">;
 def note_format_fix_specifier : Note<"did you mean to use '%0'?">;

clang/lib/AST/OSLog.cpp

private:
   }
 
 public:
   OSLogFormatStringHandler(ArrayRef<const Expr *> Args) : Args(Args) {
     ArgsData.reserve(Args.size());
   }
 
   bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
-                             const char *StartSpecifier,
-                             unsigned SpecifierLen) override {
+                             const char *StartSpecifier, unsigned SpecifierLen,
+                             const TargetInfo &) override {
     if (!FS.consumesDataArgument() &&
         FS.getConversionSpecifier().getKind() !=
             clang::analyze_format_string::ConversionSpecifier::PrintErrno)
       return true;
 
     ArgsData.emplace_back();
     unsigned ArgIndex = FS.getArgIndex();
     if (ArgIndex < Args.size())

clang/lib/AST/PrintfFormatString.cpp

while (I != E) {
     if (FSR.shouldStop())
       return true;
     // Did we exhaust the string or encounter an error that
     // we can recover from?
     if (!FSR.hasValue())
       continue;
     // We have a format specifier.  Pass it to the callback.
     if (!H.HandlePrintfSpecifier(FSR.getValue(), FSR.getStart(),
-                                 I - FSR.getStart()))
+                                 I - FSR.getStart(), Target))
       return true;
   }
   assert(I == E && "Format string not exhausted");
   return false;
 }
 
 bool clang::analyze_format_string::ParseFormatStringHasSArg(const char *I,
                                                             const char *E,

clang/lib/Sema/SemaChecking.cpp

class EstimateSizeFormatHandler
   size_t Size;
 
 public:
   EstimateSizeFormatHandler(StringRef Format)
       : Size(std::min(Format.find(0), Format.size()) +
              1 /* null byte always written by sprintf */) {}
 
   bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
-                             const char *, unsigned SpecifierLen) override {
+                             const char *, unsigned SpecifierLen,
+                             const TargetInfo &) override {
 
     const size_t FieldWidth = computeFieldWidth(FS);
     const size_t Precision = computePrecision(FS);
 
     // The actual format.
     switch (FS.getConversionSpecifier().getKind()) {
     // Just a char.
     case analyze_format_string::ConversionSpecifier::cArg:
public:
   bool HandleInvalidPrintfConversionSpecifier(
                                       const analyze_printf::PrintfSpecifier &FS,
                                       const char *startSpecifier,
                                       unsigned specifierLen) override;
 
   void handleInvalidMaskType(StringRef MaskType) override;
 
   bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,
-                             const char *startSpecifier,
-                             unsigned specifierLen) override;
+                             const char *startSpecifier, unsigned specifierLen,
+                             const TargetInfo &Target) override;
   bool checkFormatExpr(const analyze_printf::PrintfSpecifier &FS,
                        const char *StartSpecifier,
                        unsigned SpecifierLen,
                        const Expr *E);
 
   bool HandleAmount(const analyze_format_string::OptionalAmount &Amt, unsigned k,
                     const char *startSpecifier, unsigned specifierLen);
   void HandleInvalidAmount(const analyze_printf::PrintfSpecifier &FS,
if (Method->getMinRequiredArguments() == 0 &&
           << "c_str()" << FixItHint::CreateInsertion(EndLoc, ".c_str()");
       return true;
     }
   }
 
   return false;
 }
 
-bool
-CheckPrintfHandler::HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier
-                                            &FS,
-                                          const char *startSpecifier,
-                                          unsigned specifierLen) {
+bool CheckPrintfHandler::HandlePrintfSpecifier(
+    const analyze_printf::PrintfSpecifier &FS, const char *startSpecifier,
+    unsigned specifierLen, const TargetInfo &Target) {
   using namespace analyze_format_string;
   using namespace analyze_printf;
 
   const PrintfConversionSpecifier &CS = FS.getConversionSpecifier();
 
   if (FS.consumesDataArgument()) {
     if (atFirstArg) {
         atFirstArg = false;
if (FS.isPrivate().isSet()) {
       EmitFormatDiagnostic(S.PDiag(diag::warn_format_invalid_annotation)
                                << "private",
                            getLocationOfByte(FS.isPrivate().getPosition()),
                            /*IsStringLocation*/ false,
                            getSpecifierRange(startSpecifier, specifierLen));
     }
   }
 
+  const llvm::Triple &Triple = Target.getTriple();
+  if (CS.getKind() == ConversionSpecifier::nArg &&
+      (Triple.isAndroid() || Triple.isOSFuchsia())) {
+    EmitFormatDiagnostic(S.PDiag(diag::warn_printf_narg_not_supported),
+                         getLocationOfByte(CS.getStart()),
+                         /*IsStringLocation*/ false,
+                         getSpecifierRange(startSpecifier, specifierLen));
+  }
+
   // Check for invalid use of field width
   if (!FS.hasValidFieldWidth()) {
     HandleInvalidAmount(FS, FS.getFieldWidth(), /* field width */ 0,
         startSpecifier, specifierLen);
   }
 
   // Check for invalid use of precision
   if (!FS.hasValidPrecision()) {

clang/test/FixIt/format.m

 void testSizeTypes() {
   printf("%zu", 0.f); // expected-warning-re{{format specifies type 'size_t' (aka '{{.+}}') but the argument has type 'float'}}
   // CHECK: fix-it:"{{.*}}":{[[@LINE-1]]:11-[[@LINE-1]]:14}:"%f"
 
   printf("%zd", 0.f); // expected-warning-re{{format specifies type 'ssize_t' (aka '{{.+}}') but the argument has type 'float'}}
   // CHECK: fix-it:"{{.*}}":{[[@LINE-1]]:11-[[@LINE-1]]:14}:"%f"
   
   short x;
+#if !defined(__ANDROID__) && !defined(__Fuchsia__)
   printf("%zn", &x); // expected-warning-re{{format specifies type 'ssize_t *' (aka '{{.+}}') but the argument has type 'short *'}}
-  // PrintfSpecifier::fixType doesn't handle %n, so a fix-it is not emitted, 
+#else
+  printf("%zn", &x); // expected-warning-re{{format specifies type 'ssize_t *' (aka '{{.+}}') but the argument has type 'short *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+#endif // !defined(__ANDROID__) && !defined(__Fuchsia__)
+  // PrintfSpecifier::fixType doesn't handle %n, so a fix-it is not emitted,
   // see the comment in PrintfSpecifier::fixType in PrintfFormatString.cpp.
 }
 
 typedef __PTRDIFF_TYPE__ ptrdiff_t;
 #define __UNSIGNED_PTRDIFF_TYPE__                                              \
   __typeof__(_Generic((__PTRDIFF_TYPE__)0,                                     \
                       long long int : (unsigned long long int)0,               \
                       long int : (unsigned long int)0,                         \
void testPtrDiffTypes() {
   
   ptrdiff_t p2 = 0;
   printf("%td", p2);  // No warning.
 
   printf("%td", 0.f); // expected-warning-re{{format specifies type 'ptrdiff_t' (aka '{{.+}}') but the argument has type 'float'}}
   // CHECK: fix-it:"{{.*}}":{[[@LINE-1]]:11-[[@LINE-1]]:14}:"%f"
 
   ptrdiff_t p3 = 0;
+#if !defined(__ANDROID__) && !defined(__Fuchsia__)
   printf("%tn", &p3); // No warning.
+#else
+  printf("%tn", &p3); // expected-warning{{'%n' specifier not supported on this platform}}
+#endif // !defined(__ANDROID__) && !defined(__Fuchsia__)
 
   short x;
+#if !defined(__ANDROID__) && !defined(__Fuchsia__)
   printf("%tn", &x); // expected-warning-re{{format specifies type 'ptrdiff_t *' (aka '{{.+}}') but the argument has type 'short *'}}
   // PrintfSpecifier::fixType doesn't handle %n, so a fix-it is not emitted,
   // see the comment in PrintfSpecifier::fixType in PrintfFormatString.cpp.
+#else
+  printf("%tn", &x); // expected-warning-re{{format specifies type 'ptrdiff_t *' (aka '{{.+}}') but the argument has type 'short *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+#endif // !defined(__ANDROID__) && !defined(__Fuchsia__)
 }
 
 void testEnum() {
   typedef enum {
     ImplicitA = 1,
     ImplicitB = 2
   } Implicit;
 

clang/test/Sema/format-strings.c

 // RUN: %clang_cc1 -fblocks -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs %s
 // RUN: %clang_cc1 -fblocks -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs -fno-signed-char %s
+// RUN: %clang_cc1 -fblocks -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs -triple=x86_64-unknown-fuchsia %s
+// RUN: %clang_cc1 -fblocks -fsyntax-only -verify -Wformat-nonliteral -isystem %S/Inputs -triple=x86_64-linux-android %s
 
 #include <stdarg.h>
 #include <stddef.h>
 #define __need_wint_t
 #include <stddef.h> // For wint_t and wchar_t
 
 typedef struct _FILE FILE;
 int fprintf(FILE *, const char *restrict, ...);
void check_conditional_literal(const char* s, int i) {
   printf(i ? "yes %s" : "no %d", 1); // expected-warning{{format specifies type 'char *'}}
   printf(i ? "yes" : "no %d", 1, 2); // expected-warning{{data argument not used by format string}}
 
   printf(i ? "%*s" : "-", i, s); // no-warning
   printf(i ? "yes" : 0 ? "no %*d" : "dont know %d", 1, 2); // expected-warning{{data argument not used by format string}}
   printf(i ? "%i\n" : "%i %s %s\n", i, s); // expected-warning{{more '%' conversions than data arguments}}
 }
 
+#if !defined(__ANDROID__) && !defined(__Fuchsia__)
+
 void check_writeback_specifier()
 {
   int x;
   char *b;
   printf("%n", b); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
   printf("%n", &x); // no-warning
 
   printf("%hhn", (signed char*)0); // no-warning
void check_writeback_specifier()
   printf("%qn", (long long*)0); // no-warning
   printf("%qn", (unsigned long long*)0); // no-warning
   printf("%qn", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
 
   printf("%Ln", 0); // expected-warning{{length modifier 'L' results in undefined behavior or no effect with 'n' conversion specifier}}
   // expected-note@-1{{did you mean to use 'll'?}}
 }
 
+#else
+
+void check_writeback_specifier()
+{
+  int x;
+  printf("%n", &x); // expected-warning{{'%n' specifier not supported on this platform}}
+
+  printf("%hhn", (signed char*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%hhn", (char*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%hhn", (unsigned char*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%hhn", (int*)0); // expected-warning{{format specifies type 'signed char *' but the argument has type 'int *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+
+  printf("%hn", (short*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%hn", (unsigned short*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%hn", (int*)0); // expected-warning{{format specifies type 'short *' but the argument has type 'int *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+
+  printf("%n", (int*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%n", (unsigned int*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%n", (char*)0); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+
+  printf("%ln", (long*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%ln", (unsigned long*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%ln", (int*)0); // expected-warning{{format specifies type 'long *' but the argument has type 'int *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+
+  printf("%lln", (long long*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%lln", (unsigned long long*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%lln", (int*)0); // expected-warning{{format specifies type 'long long *' but the argument has type 'int *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+
+  printf("%qn", (long long*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%qn", (unsigned long long*)0); // expected-warning{{'%n' specifier not supported on this platform}}
+}
+
+#endif // !defined(__ANDROID__) && !defined(__Fuchsia__)
+
 void check_invalid_specifier(FILE* fp, char *buf)
 {
   printf("%s%lb%d","unix",10,20); // expected-warning {{invalid conversion specifier 'b'}} expected-warning {{data argument not used by format string}}
   fprintf(fp,"%%%l"); // expected-warning {{incomplete format specifier}}
   sprintf(buf,"%%%%%ld%d%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}}
   snprintf(buf, 2, "%%%%%ld%;%d", 1, 2, 3); // expected-warning{{format specifies type 'long' but the argument has type 'int'}} expected-warning {{invalid conversion specifier ';'}} expected-warning {{data argument not used by format string}}
 }
 
void bug7377_bad_length_mod_usage() {
   printf("%hhs", "foo"); // expected-warning{{length modifier 'hh' results in undefined behavior or no effect with 's' conversion specifier}}
   printf("%1$zp", (void *)0); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}}
   printf("%ls", L"foo"); // no-warning
   printf("%#.2Lf", (long double)1.234); // no-warning
 
   // Bad flag usage
   printf("%#p", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'p' conversion specifier}}
   printf("%0d", -1); // no-warning
+  printf("%-p", (void *) 0); // no-warning
+#if !defined(__ANDROID__) && !defined(__Fuchsia__)
   printf("%#n", (int *) 0); // expected-warning{{flag '#' results in undefined behavior with 'n' conversion specifier}}
   printf("%-n", (int *) 0); // expected-warning{{flag '-' results in undefined behavior with 'n' conversion specifier}}
-  printf("%-p", (void *) 0); // no-warning
+#else
+  printf("%#n", (int *) 0); // expected-warning{{flag '#' results in undefined behavior with 'n' conversion specifier}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+  printf("%-n", (int *) 0); // expected-warning{{flag '-' results in undefined behavior with 'n' conversion specifier}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+#endif // !defined(__ANDROID__) && !defined(__Fuchsia__)
 
   // Bad optional amount use
   printf("%.2c", 'a'); // expected-warning{{precision used with 'c' conversion specifier, resulting in undefined behavior}}
+#if !defined(__ANDROID__) && !defined(__Fuchsia__)
+  printf("%1n", (int *) 0); // expected-warning{{field width used with 'n' conversion specifier, resulting in undefined behavior}}
+  printf("%.9n", (int *) 0); // expected-warning{{precision used with 'n' conversion specifier, resulting in undefined behavior}}
+#else
   printf("%1n", (int *) 0); // expected-warning{{field width used with 'n' conversion specifier, resulting in undefined behavior}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
   printf("%.9n", (int *) 0); // expected-warning{{precision used with 'n' conversion specifier, resulting in undefined behavior}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+#endif // #if !defined(__ANDROID__) && !defined(__Fuchsia__)
 
   // Ignored flags
   printf("% +f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
   printf("%+ f", 1.23); // expected-warning{{flag ' ' is ignored when flag '+' is present}}
   printf("%0-f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
   printf("%-0f", 1.23); // expected-warning{{flag '0' is ignored when flag '-' is present}}
   printf("%-+f", 1.23); // no-warning
 }

 extern void test14_bar(const char *, const char *, ...)
      __attribute__((__format__(__printf__, 1, 3)));
 
 void test14_zed(int *p) {
   test14_foo("%", "%d", p); // expected-warning{{incomplete format specifier}}
   test14_bar("%", "%d", p); // expected-warning{{incomplete format specifier}}
 }
 
+#if !defined(__ANDROID__) && !defined(__Fuchsia__)
+
 void test_qualifiers(volatile int *vip, const int *cip,
                      const volatile int *cvip) {
   printf("%n", cip); // expected-warning{{format specifies type 'int *' but the argument has type 'const int *'}}
   printf("%n", cvip); // expected-warning{{format specifies type 'int *' but the argument has type 'const volatile int *'}}
 
   printf("%n", vip); // No warning.
   printf("%p", cip); // No warning.
   printf("%p", cvip); // No warning.
 
 
   typedef int* ip_t;
   typedef const int* cip_t;
   printf("%n", (ip_t)0); // No warning.
   printf("%n", (cip_t)0); // expected-warning{{format specifies type 'int *' but the argument has type 'cip_t' (aka 'const int *')}}
 }
 
+#else
+
+void test_qualifiers(volatile int *vip, const int *cip,
+                     const volatile int *cvip) {
+  printf("%n", cip); // expected-warning{{format specifies type 'int *' but the argument has type 'const int *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+  printf("%n", cvip); // expected-warning{{format specifies type 'int *' but the argument has type 'const volatile int *'}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+
+  printf("%n", vip); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%p", cip); // No warning.
+  printf("%p", cvip); // No warning.
+
+
+  typedef int* ip_t;
+  typedef const int* cip_t;
+  printf("%n", (ip_t)0); // expected-warning{{'%n' specifier not supported on this platform}}
+  printf("%n", (cip_t)0); // expected-warning{{format specifies type 'int *' but the argument has type 'cip_t' (aka 'const int *')}}
+  // expected-warning@-1 {{'%n' specifier not supported on this platform}}
+}
+
+#endif // #if !defined(__ANDROID__) && !defined(__Fuchsia__)
+
 #pragma GCC diagnostic ignored "-Wformat-nonliteral"
 #pragma GCC diagnostic warning "-Wformat-security"
 // <rdar://problem/14178260>
 extern void test_format_security_extra_args(const char*, int, ...)
     __attribute__((__format__(__printf__, 1, 3)));
 void test_format_security_pos(char* string) {
   test_format_security_extra_args(string, 5); // expected-warning {{format string is not a string literal (potentially insecure)}}
   // expected-note@-1{{treat the string as an argument to avoid this}}