[clang] Emit `Wformat` for bool value and char specifier confusion in scanf

[Fznamznon]

Summary

Fixes https://github.com/llvm/llvm-project/issues/64987

[aaron.ballman]

LGTM, thank you!

[Fznamznon]

Rebase to maybe pass precommit

clang/docs/ReleaseNotes.rst

- Clang now emits an error if it is not possible to deduce array size for a
   variable with incomplete array type.
   (`#37257 <https://github.com/llvm/llvm-project/issues/37257>`_)
 - Clang's ``-Wunused-private-field`` no longer warns on fields whose type is
   declared with ``[[maybe_unused]]``.
   (`#61334 <https://github.com/llvm/llvm-project/issues/61334>`_)
 - For function multi-versioning using the ``target`` or ``target_clones``
   attributes, remove comdat for internal linkage functions.
   (`#65114 <https://github.com/llvm/llvm-project/issues/65114>`_)
+- Clang now reports ``-Wformat`` for bool value and char specifier confusion
+  in scanf. Fixes
+  (`#64987 <https://github.com/llvm/llvm-project/issues/64987>`_)
 
 Bug Fixes to Compiler Builtins
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Bug Fixes to Attribute Support
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
 Bug Fixes to C++ Support

clang/lib/AST/FormatString.cpp

case AnyCharTy: {
         // The types are perfectly matched?
         switch (BT->getKind()) {
         default:
           break;
         case BuiltinType::Char_S:
         case BuiltinType::SChar:
         case BuiltinType::UChar:
         case BuiltinType::Char_U:
+            return Match;
         case BuiltinType::Bool:
+          if (!Ptr)
             return Match;
+          break;
         }
         // "Partially matched" because of promotions?
         if (!Ptr) {
           switch (BT->getKind()) {
           default:
             break;
           case BuiltinType::Int:
           case BuiltinType::UInt:
case SpecificTy: {
       if (T == argTy)
         return Match;
       if (const auto *BT = argTy->getAs<BuiltinType>()) {
         // Check if the only difference between them is signed vs unsigned
         // if true, we consider they are compatible.
         switch (BT->getKind()) {
           default:
             break;
+          case BuiltinType::Bool:
+            if (Ptr && (T == C.UnsignedCharTy || T == C.SignedCharTy))
+              return NoMatch;
+            [[fallthrough]];
           case BuiltinType::Char_S:
           case BuiltinType::SChar:
           case BuiltinType::Char_U:
           case BuiltinType::UChar:
-          case BuiltinType::Bool:
             if (T == C.UnsignedShortTy || T == C.ShortTy)
               return NoMatchTypeConfusion;
             if (T == C.UnsignedCharTy || T == C.SignedCharTy)
               return Match;
             break;
           case BuiltinType::Short:
             if (T == C.UnsignedShortTy)
               return Match;

clang/test/SemaCXX/format-strings-scanf.cpp

union bag {
     __fp16 f16;
     float ff;
     double fd;
     long double fl;
 };
 
 void test(void) {
     bag b;
+    // expected-warning@+2 {{format specifies type 'char *' but the argument has type 'bool *'}}
+    // expected-warning@+1 {{format specifies type 'unsigned char *' but the argument has type 'bool *'}}
     scan("%hhi %hhu %hhi %hhu", &b.sc, &b.uc, &b.b, &b.b);
     scan("%hi %hu", &b.ss, &b.us);
     scan("%i %u", &b.si, &b.ui);
     scan("%li %lu", &b.sl, &b.ul);
     scan("%lli %llu", &b.sll, &b.ull);
     scan("%f", &b.ff);
     scan("%lf", &b.fd);
     scan("%Lf", &b.fl);