Fix start index for sprintf ovlerap check + tests

[steakhal]

I think you should squash this into D150430.

[ArnaudBienner]

Sorry about creating a new patch instead of updating the existing one.
Closing that one.

clang/lib/StaticAnalyzer/Checkers/CStringChecker.cpp

 void CStringChecker::evalSprintfCommon(CheckerContext &C, const CallExpr *CE,
                                        bool IsBounded, bool IsBuiltin) const {
   ProgramStateRef state = C.getState();
   DestinationArgExpr Dest = {CE->getArg(0), 0};
 
   // Check that the source and destination do not overlap.
   // Iterate over CE->getNumArgs(), skipping all parameters which are not format
   // arguments
-  // For sprintf case, it starts at index 3:
+  // For sprintf case, it starts at position 3/index 2:
   // sprintf(char *buffer, const char* format, ... /* format arguments */);
-  unsigned int format_arguments_start_idx = 3;
+  unsigned int format_arguments_start_idx = 2;
   // snprintf case: one extra extra arguments for size
   // int snprintf(char *buffer, size_t bufsz, const char *format,
   //              ... /* format arguments */);
   if (IsBounded)
     format_arguments_start_idx++;
   // built in functions have two extra arguments: flag and os, before format
   // arguments
   // int __builtin___sprintf_chk (char *buffer, int flag, size_t os,

clang/test/Analysis/buffer-overlap.c

int snprintf(char *restrict buffer, size_t bufsz,
              const char *restrict format, ... );
 #endif /* VARIANT */
 
 void test_sprintf1() {
   char a[4] = {0};
   sprintf(a, "%d/%s", 1, a); // expected-warning{{overlapping}}
 }
 
+void test_sprintf2() {
+  char a[4] = {0};
+  sprintf(a, "%s", a); // expected-warning{{overlapping}}
+}
+
+void test_sprintf3() {
+  char a[4] = {0};
+  sprintf(a, "%s/%s", a, a); // expected-warning{{overlapping}}
+}
+
 void test_snprintf1() {
   char a[4] = {0};
   snprintf(a, sizeof(a), "%d/%s", 1, a); // expected-warning{{overlapping}}
 }
 
 void test_snprintf2() {
   char a[4] = {0};
   snprintf(a+1, sizeof(a)-1, "%d/%s", 1, a); // expected-warning{{overlapping}}
 }
+
+void test_snprintf3() {
+  char a[4] = {0};
+  snprintf(a, sizeof(a), "%s", a); // expected-warning{{overlapping}}
+}
+
+void test_snprintf4() {
+  char a[4] = {0};
+  snprintf(a, sizeof(a), "%s/%s", a, a); // expected-warning{{overlapping}}
+}