Add an attribute that causes clang to emit fortified calls to C stdlib functions

[erik.pilkington]

Summary

This attribute applies to declarations of C stdlib functions (sprintf, memcpy...) that have known fortified variants (sprintf_chk, memcpy_chk, ...). When applied, clang will emit calls to the fortified variant functions. We need this attribute because its impossible to write gnu_inline-style wrappers to variadic functions because we don't support __builtin_va_arg_pack, and don't intend to (see https://reviews.llvm.org/D57635).

Fixes rdar://47905754

Thanks for taking a look!
Erik

[rjmccall]

clang/include/clang/Basic/AttrDocs.td

986 ↗

(On Diff #185836)

Probably worth clarifying somewhere in here that only a specific set of stdlib functions are supported. I don't know that it's important to spell that set out.

clang/lib/CodeGen/CGBuiltin.cpp

1490 ↗

(On Diff #185836)

Could you move the body of this into a helper function? This function is really far too large as it is.

1516 ↗

(On Diff #185836)

I think this might be over-commented. :)

Could you just put smaller comments on groups of cases, like:

// All of these take the destination object size as the final argument.

or

// These take flags and the destination object size immediately before the format string.

clang/test/Sema/fortify-std-lib.c

6 ↗

(On Diff #185836)

Silly comment, but: you typo'd "anything" here.

[erik.pilkington]

Address John's comments.

clang/include/clang/Basic/AttrDocs.td

986 ↗

(On Diff #185836)

I just copied a list in, there really aren't that many, so may as well just be explicit.

[rjmccall]

LGTM, thanks!

clang/include/clang/Basic/AttrDocs.td

986 ↗

(On Diff #185836)

WFM

[aaron.ballman]

clang/include/clang/Basic/Attr.td

1572 ↗

(On Diff #186013)

Nothing in the docs describes these two arguments.

clang/include/clang/Basic/AttrDocs.td

987 ↗

(On Diff #186013)

And we don't have Annex K versions for any of these, like memset_s()?

[erik.pilkington]

Describe what the arguments do in the docs.

clang/include/clang/Basic/AttrDocs.td

987 ↗

(On Diff #186013)

No, it doesn't look like clang even recognizes these yet, and our c library doesn't define _chk functions for them. Whenever that happens, it would good to support them though I guess.

[aaron.ballman]

clang/include/clang/Basic/AttrDocs.td

987–989 ↗

(On Diff #186028)

Maybe I'm being dense, but I still have no idea what I'd pass for either of these arguments. When I hear "type", I immediately assume I should pass in something like 'int', but that seems wrong given that this is an integer argument. Is there some public documentation we could link to with a "for more information, see <blah>" snippet? Similar for the fortified format function flag.

However, I'm also starting to wonder why this attribute is interesting to users. Why not infer this attribute automatically, since there's only a specified set of standard library functions that it can be applied to anyway? Is it a bad idea to try to infer this for some reason?

[erik.pilkington]

clang/include/clang/Basic/AttrDocs.td

987–989 ↗

(On Diff #186028)

Yeah, I guess we could link to GCC's docs for __builtin_object_size, I'll update this. I think the flag argument has something to do with enabling checking %n output parameters, but I'm not totally sure and don't want to spread any misinformation in the clang docs. On our implementation, the value is just ignored.

This attribute would never really be used by users that aren't C library implementers. The problem with doing this automatically is that library users need to be able to customize the checking mode by defining the _FORTIFY_SOURCE macro to a level in their .c files. We can't do this based on the presence of that macro for a couple reasons, firstly, I'm not sure we can assume that all *_chk variants are present just because _FORTIFY_SOURCE is defined (whether the _chk variants are present seems like a decision best left to the library). And secondly because that would mean that clang -E t.c -o - | clang -xc - would generate different code from clang t.c. Given that, it seems like an attribute is the best customization point.

[erik.pilkington]

Link to the GCC docs for __builitn_object_size.

[aaron.ballman]

LGTM aside from some very minor nits.

clang/include/clang/Basic/AttrDocs.td

994–1012 ↗

(On Diff #186300)

Rather than enumerate a long list, can you shorten it vertically by grouping the functions? e.g., strpcpy, strcpy, et. al. on the same line

987–989 ↗

(On Diff #186028)

Thank you for the explanation -- I agree that an attribute probably makes sense then. I'd appreciate a note in the docs saying something along the lines of "This attribute is intended for use within standard C library implementations and should not generally be used for user applications." or some such. WDYT?

clang/lib/CodeGen/CGBuiltin.cpp

1491 ↗

(On Diff #186300)

Is the explicit trailing return here needed? I would have assumed this could be inferred.

1548 ↗

(On Diff #186300)

auto *

1574 ↗

(On Diff #186300)

const auto * and some other identifier than Attr (so it won't conflict with the type name).

clang/lib/Sema/SemaDeclAttr.cpp

6437 ↗

(On Diff #186300)

lol, I'll fix that typo after you land your patch.

[erik.pilkington]

clang/include/clang/Basic/AttrDocs.td

987–989 ↗

(On Diff #186028)

Sure, I added that in the commit.

clang/lib/Sema/SemaDeclAttr.cpp

6437 ↗

(On Diff #186300)

Thanks, guess you're less lazy then me :)

[erik.pilkington]

I reverted this in r356103:

Revert "Add a new attribute, fortify_stdlib"

This reverts commit r353765. After talking with our c stdlib folks, we decided
to use the existing pass_object_size attribute to implement _FORTIFY_SOURCE
wrappers, like Bionic does (I didn't realize that pass_object_size could be used
for this purpose). Sorry for the flip/flop, and thanks to James Y. Knight for
pointing this out to me.

cfe/trunk/include/clang/Basic/Attr.td

 // __builtin_object_size with Type=N evaluated on the parameter at the callsite.
 def PassObjectSize : InheritableParamAttr {
   let Spellings = [Clang<"pass_object_size">];
   let Args = [IntArgument<"Type">];
   let Subjects = SubjectList<[ParmVar]>;
   let Documentation = [PassObjectSizeDocs];
 }
 
+def FortifyStdLib : InheritableAttr {
+  let Spellings = [Clang<"fortify_stdlib">];
+  let Args = [IntArgument<"Type">, IntArgument<"Flag">];
+  let Subjects = SubjectList<[Function]>;
+  let Documentation = [FortifyStdLibDocs];
+}
+
 // Nullability type attributes.
 def TypeNonNull : TypeAttr {
   let Spellings = [Keyword<"_Nonnull">];
   let Documentation = [TypeNonNullDocs];
 }
 
 def TypeNullable : TypeAttr {
   let Spellings = [Keyword<"_Nullable">];

cfe/trunk/include/clang/Basic/AttrDocs.td

if (a > n) {
     bar();
   }
 
 where the call to "nodupfunc" is duplicated and sunk into the two branches
 of the condition.
   }];
 }
 
+def FortifyStdLibDocs : Documentation {
+  let Category = DocCatFunction;
+  let Content = [{
+The ``fortify_stdlib`` attribute applies to declarations of C stdlib functions
+(memcpy, sprintf, ...), and causes clang to emit calls to their fortified
+variants with ``__builtin_object_size``. This attribute is intended for use
+within standard C library implementations and should not generally be used for
+user applications. For instance:
+
+.. code-block:: c
+
+  __attribute__((fortify_stdlib(0, 0)))
+  int sprintf(char *buf, const char *fmt, ...);
+
+  int main() {
+    char buf[5];
+    sprintf(buf, "%f", 42.0);
+    // Clang generates code equivalent to:
+    // __sprintf_chk(buf, 0, __builtin_object_size(0), "%f", 42.0);
+  }
+
+The first argument to the attribute is the integer `type` argument passed to
+`__builtin_object_size` (you can read more about `__builtin_object_size`
+`here <https://gcc.gnu.org/onlinedocs/gcc-4.8.5/gcc/Object-Size-Checking.html>`_),
+The second argument to this attribute is the flag that the fortified format
+functions accept.
+
+Only a specific set of standard library functions are supported:
+  - memcpy, memmove, memset
+  - stpcpy, strcat, strcpy
+  - strlcat, strlcpy
+  - strncat, strncpy, stpncpy
+  - snprintf, vsnprintf, sprintf, vsprintf
+  - fprintf, vfprintf, printf, vprintf
+}];
+}
+
 def ConvergentDocs : Documentation {
   let Category = DocCatFunction;
   let Content = [{
 The ``convergent`` attribute can be placed on a function declaration. It is
 translated into the LLVM ``convergent`` attribute, which indicates that the call
 instructions of a function with this attribute cannot be made control-dependent
 on any additional values.
 

cfe/trunk/include/clang/Basic/Builtins.h

private:
   bool builtinIsSupported(const Builtin::Info &BuiltinInfo,
                           const LangOptions &LangOpts);
 
   /// Helper function for isPrintfLike and isScanfLike.
   bool isLike(unsigned ID, unsigned &FormatIdx, bool &HasVAListArg,
               const char *Fmt) const;
 };
 
-}
+/// For a given BuiltinID, return the ID of the fortified variant function. For
+/// instance, if Builtin::BIsprintf is passed, this function will return
+/// Builtin::BI__builtin___sprintf_chk. If BuiltinID doesn't have a fortified
+/// variant, 0 is returned.
+unsigned getFortifiedVariantFunction(unsigned BuiltinID);
+
+} // end namespace Builtin
 
 /// Kinds of BuiltinTemplateDecl.
 enum BuiltinTemplateKind : int {
   /// This names the __make_integer_seq BuiltinTemplateDecl.
   BTK__make_integer_seq,
 
   /// This names the __type_pack_element BuiltinTemplateDecl.
   BTK__type_pack_element
 };
 
 } // end namespace clang
 #endif

cfe/trunk/include/clang/Basic/DiagnosticSemaKinds.td

 def err_forward_ref_enum : Error<
   "ISO C++ forbids forward references to 'enum' types">;
 def ext_ms_forward_ref_enum : ExtWarn<
   "forward references to 'enum' types are a Microsoft extension">,
   InGroup<MicrosoftEnumForwardReference>;
 def ext_forward_ref_enum_def : Extension<
   "redeclaration of already-defined enum %0 is a GNU extension">,
   InGroup<GNURedeclaredEnum>;
+def err_fortify_std_lib_bad_decl : Error<
+  "'fortify_stdlib' attribute applied to an unknown function">;
 
 def err_redefinition_of_enumerator : Error<"redefinition of enumerator %0">;
 def err_duplicate_member : Error<"duplicate member %0">;
 def err_misplaced_ivar : Error<
   "instance variables may not be placed in %select{categories|class extension}0">;
 def warn_ivars_in_interface : Warning<
   "declaration of instance variables in the interface is deprecated">,
   InGroup<DiagGroup<"objc-interface-ivars">>, DefaultIgnore;

cfe/trunk/lib/Basic/Builtins.cpp

 }
 
 bool Builtin::Context::canBeRedeclared(unsigned ID) const {
   return ID == Builtin::NotBuiltin ||
          ID == Builtin::BI__va_start ||
          (!hasReferenceArgsOrResult(ID) &&
           !hasCustomTypechecking(ID));
 }
+
+unsigned Builtin::getFortifiedVariantFunction(unsigned BuiltinID) {
+  switch (BuiltinID) {
+  case Builtin::BImemcpy:    return Builtin::BI__builtin___memcpy_chk;
+  case Builtin::BImemmove:   return Builtin::BI__builtin___memmove_chk;
+  case Builtin::BImemset:    return Builtin::BI__builtin___memset_chk;
+  case Builtin::BIstpcpy:    return Builtin::BI__builtin___stpcpy_chk;
+  case Builtin::BIstrcat:    return Builtin::BI__builtin___strcat_chk;
+  case Builtin::BIstrcpy:    return Builtin::BI__builtin___strcpy_chk;
+  case Builtin::BIstrlcat:   return Builtin::BI__builtin___strlcat_chk;
+  case Builtin::BIstrlcpy:   return Builtin::BI__builtin___strlcpy_chk;
+  case Builtin::BIstrncat:   return Builtin::BI__builtin___strncat_chk;
+  case Builtin::BIstrncpy:   return Builtin::BI__builtin___strncpy_chk;
+  case Builtin::BIstpncpy:   return Builtin::BI__builtin___stpncpy_chk;
+  case Builtin::BIsnprintf:  return Builtin::BI__builtin___snprintf_chk;
+  case Builtin::BIvsnprintf: return Builtin::BI__builtin___vsnprintf_chk;
+  case Builtin::BIsprintf:   return Builtin::BI__builtin___sprintf_chk;
+  case Builtin::BIvsprintf:  return Builtin::BI__builtin___vsprintf_chk;
+  case Builtin::BIfprintf:   return Builtin::BI__builtin___fprintf_chk;
+  case Builtin::BIvfprintf:  return Builtin::BI__builtin___vfprintf_chk;
+  case Builtin::BIprintf:    return Builtin::BI__builtin___printf_chk;
+  case Builtin::BIvprintf:   return Builtin::BI__builtin___vprintf_chk;
+  default: return 0;
+  }
+}

cfe/trunk/lib/CodeGen/CGBuiltin.cpp

RValue CodeGenFunction::emitRotate(const CallExpr *E, bool IsRotateRight) {
   ShiftAmt = Builder.CreateIntCast(ShiftAmt, Ty, false);
 
   // Rotate is a special case of LLVM funnel shift - 1st 2 args are the same.
   unsigned IID = IsRotateRight ? Intrinsic::fshr : Intrinsic::fshl;
   Function *F = CGM.getIntrinsic(IID, Ty);
   return RValue::get(Builder.CreateCall(F, { Src, Src, ShiftAmt }));
 }
 
+/// For a call to a builtin C standard library function, emit a call to a
+/// fortified variant using __builtin_object_size. For instance, instead of
+/// emitting `sprintf(buf, "%d", 32)`, this function would emit
+/// `__sprintf_chk(buf, Flag, __builtin_object_size(buf, 0), "%d", 32)`.
+RValue CodeGenFunction::emitFortifiedStdLibCall(CodeGenFunction &CGF,
+                                                const CallExpr *CE,
+                                                unsigned BuiltinID,
+                                                unsigned BOSType,
+                                                unsigned Flag) {
+  SmallVector<llvm::Value *, 8> ArgVals;
+  for (const Expr *Arg : CE->arguments())
+    ArgVals.push_back(EmitScalarExpr(Arg));
+
+  llvm::Value *FlagVal = llvm::ConstantInt::get(IntTy, Flag);
+  auto emitObjSize = [&]() {
+    return evaluateOrEmitBuiltinObjectSize(CE->getArg(0), BOSType, SizeTy,
+                                           ArgVals[0], false);
+  };
+
+  unsigned FortifiedVariantID = Builtin::getFortifiedVariantFunction(BuiltinID);
+  assert(FortifiedVariantID != 0 && "Should be diagnosed in Sema");
+
+  // Adjust ArgVals to include a __builtin_object_size(n) or flag argument at
+  // the right position. Variadic printf-like functions take a flag and object
+  // size (if they're printing to a string) before the format string, and all
+  // other functions just take the object size as their last argument. The
+  // object size, if present, always corresponds to the first argument.
+  switch (BuiltinID) {
+  case Builtin::BImemcpy:
+  case Builtin::BImemmove:
+  case Builtin::BImemset:
+  case Builtin::BIstpcpy:
+  case Builtin::BIstrcat:
+  case Builtin::BIstrcpy:
+  case Builtin::BIstrlcat:
+  case Builtin::BIstrlcpy:
+  case Builtin::BIstrncat:
+  case Builtin::BIstrncpy:
+  case Builtin::BIstpncpy:
+    ArgVals.push_back(emitObjSize());
+    break;
+
+  case Builtin::BIsnprintf:
+  case Builtin::BIvsnprintf:
+    ArgVals.insert(ArgVals.begin() + 2, FlagVal);
+    ArgVals.insert(ArgVals.begin() + 3, emitObjSize());
+    break;
+
+  case Builtin::BIsprintf:
+  case Builtin::BIvsprintf:
+    ArgVals.insert(ArgVals.begin() + 1, FlagVal);
+    ArgVals.insert(ArgVals.begin() + 2, emitObjSize());
+    break;
+
+  case Builtin::BIfprintf:
+  case Builtin::BIvfprintf:
+    ArgVals.insert(ArgVals.begin() + 1, FlagVal);
+    break;
+
+  case Builtin::BIprintf:
+  case Builtin::BIvprintf:
+    ArgVals.insert(ArgVals.begin(), FlagVal);
+    break;
+
+  default:
+    llvm_unreachable("Unknown fortified builtin?");
+  }
+
+  ASTContext::GetBuiltinTypeError Err;
+  QualType VariantTy = getContext().GetBuiltinType(FortifiedVariantID, Err);
+  assert(Err == ASTContext::GE_None && "Should not codegen an error");
+  auto *LLVMVariantTy = cast<llvm::FunctionType>(ConvertType(VariantTy));
+  StringRef VariantName = getContext().BuiltinInfo.getName(FortifiedVariantID) +
+                          strlen("__builtin_");
+
+  llvm::Value *V = Builder.CreateCall(
+      CGM.CreateRuntimeFunction(LLVMVariantTy, VariantName), ArgVals);
+  return RValue::get(V);
+}
+
 RValue CodeGenFunction::EmitBuiltinExpr(const GlobalDecl GD, unsigned BuiltinID,
                                         const CallExpr *E,
                                         ReturnValueSlot ReturnValue) {
   const FunctionDecl *FD = GD.getDecl()->getAsFunction();
   // See if we can constant fold this builtin.  If so, don't emit it at all.
   Expr::EvalResult Result;
   if (E->EvaluateAsRValue(Result, CGM.getContext()) &&
       !Result.hasSideEffects()) {
     if (Result.Val.isInt())
       return RValue::get(llvm::ConstantInt::get(getLLVMContext(),
                                                 Result.Val.getInt()));
     if (Result.Val.isFloat())
       return RValue::get(llvm::ConstantFP::get(getLLVMContext(),
                                                Result.Val.getFloat()));
   }
 
+  if (const auto *FortifyAttr = FD->getAttr<FortifyStdLibAttr>())
+    return emitFortifiedStdLibCall(*this, E, BuiltinID, FortifyAttr->getType(),
+                                   FortifyAttr->getFlag());
+
   // There are LLVM math intrinsics/instructions corresponding to math library
   // functions except the LLVM op will never set errno while the math library
   // might. Also, math builtins have the same semantics as their math library
   // twins. Thus, we can transform math library and builtin calls to their
   // LLVM counterparts if the call is marked 'const' (known to never set errno).
   if (FD->hasAttr<ConstAttr>()) {
     switch (BuiltinID) {
     case Builtin::BIceil:

cfe/trunk/lib/CodeGen/CodeGenFunction.h

RValue EmitCUDAKernelCallExpr(const CUDAKernelCallExpr *E,
                                 ReturnValueSlot ReturnValue);
 
   RValue EmitNVPTXDevicePrintfCallExpr(const CallExpr *E,
                                        ReturnValueSlot ReturnValue);
 
   RValue EmitBuiltinExpr(const GlobalDecl GD, unsigned BuiltinID,
                          const CallExpr *E, ReturnValueSlot ReturnValue);
 
+  RValue emitFortifiedStdLibCall(CodeGenFunction &CGF, const CallExpr *CE,
+                                 unsigned BuiltinID, unsigned BOSType,
+                                 unsigned Flag);
+
   RValue emitRotate(const CallExpr *E, bool IsRotateRight);
 
   /// Emit IR for __builtin_os_log_format.
   RValue emitBuiltinOSLogFormat(const CallExpr &E);
 
   llvm::Function *generateBuiltinOSLogHelperFunction(
       const analyze_os_log::OSLogBufferLayout &Layout,
       CharUnits BufferAlignment);

cfe/trunk/lib/Sema/SemaDeclAttr.cpp

if (Ty.getLocalUnqualifiedType().getQualifiers().getObjCLifetime() ==
         Qualifiers::OCL_Strong)
       continue;
 
     tryMakeVariablePseudoStrong(S, PVD, /*DiagnoseFailure=*/false);
   }
   handleSimpleAttribute<ObjCExternallyRetainedAttr>(S, D, AL);
 }
 
+static void handleFortifyStdLib(Sema &S, Decl *D, const ParsedAttr &AL) {
+  auto *FD = cast<FunctionDecl>(D);
+  unsigned VariantID = Builtin::getFortifiedVariantFunction(FD->getBuiltinID());
+  if (VariantID == 0) {
+    S.Diag(D->getLocation(), diag::err_fortify_std_lib_bad_decl);
+    return;
+  }
+
+  uint32_t BOSType, Flag;
+  if (!checkUInt32Argument(S, AL, AL.getArgAsExpr(0), BOSType, 0, true) ||
+      !checkUInt32Argument(S, AL, AL.getArgAsExpr(1), Flag, 1, true))
+    return;
+
+  if (BOSType > 3) {
+    S.Diag(AL.getArgAsExpr(0)->getBeginLoc(),
+           diag::err_attribute_argument_outof_range)
+        << AL << 0 << 3;
+    return;
+  }
+
+  D->addAttr(::new (S.getASTContext()) FortifyStdLibAttr(
+      AL.getLoc(), S.getASTContext(), BOSType, Flag,
+      AL.getAttributeSpellingListIndex()));
+}
+
 //===----------------------------------------------------------------------===//
 // Top Level Sema Entry Points
 //===----------------------------------------------------------------------===//
 
 /// ProcessDeclAttribute - Apply the specific attribute to the specified decl if
 /// the attribute applies to decls.  If the attribute is a type attribute, just
 /// silently ignore it if a GNU attribute.
 static void ProcessDeclAttribute(Sema &S, Scope *scope, Decl *D,
static void ProcessDeclAttribute(Sema &S, Scope *scope, Decl *D,
 
   case ParsedAttr::AT_Uninitialized:
     handleUninitializedAttr(S, D, AL);
     break;
 
   case ParsedAttr::AT_ObjCExternallyRetained:
     handleObjCExternallyRetainedAttr(S, D, AL);
     break;
+
+  case ParsedAttr::AT_FortifyStdLib:
+    handleFortifyStdLib(S, D, AL);
+    break;
   }
 }
 
 /// ProcessDeclAttributeList - Apply all the decl attributes in the specified
 /// attribute list to the specified decl, ignoring any type attributes.
 void Sema::ProcessDeclAttributeList(Scope *S, Decl *D,
                                     const ParsedAttributesView &AttrList,
                                     bool IncludeCXX11Attributes) {

cfe/trunk/test/CodeGen/fortify-std-lib.c

+// RUN: %clang_cc1       -triple x86_64-apple-macosx10.14.0 %s -emit-llvm -O0 -disable-llvm-passes -o - -Wno-format-security | FileCheck %s
+// RUN: %clang_cc1 -xc++ -triple x86_64-apple-macosx10.14.0 %s -emit-llvm -O0 -disable-llvm-passes -o - -Wno-format-security | FileCheck %s
+
+#ifdef __cplusplus
+#define EXTERN extern "C"
+#else
+#define EXTERN
+#endif
+
+#define FSL(x,y) __attribute__((fortify_stdlib(x,y)))
+typedef unsigned long size_t;
+
+FSL(0, 0) EXTERN
+void *memcpy(void *dst, const void *src, size_t sz);
+
+EXTERN
+void call_memcpy(void *dst, const void *src, size_t sz) {
+  memcpy(dst, src, sz);
+  // CHECK-LABEL: define void @call_memcpy
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__memcpy_chk(i8* {{.*}}, i8* {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+void *memmove(void *dst, const void *src, size_t sz);
+
+EXTERN
+void call_memmove(void *dst, const void *src, size_t sz) {
+  memmove(dst, src, sz);
+  // CHECK-LABEL: define void @call_memmove
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__memmove_chk(i8* {{.*}}, i8* {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+void *memset(void *dst, int c, size_t sz);
+
+EXTERN
+void call_memset(void *dst, int c, size_t sz) {
+  memset(dst, c, sz);
+  // CHECK-LABEL: define void @call_memset
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__memset_chk(i8* {{.*}}, i32 {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+char *stpcpy(char* dst, const char *src);
+
+EXTERN
+void call_stpcpy(char *dst, const char *src) {
+  stpcpy(dst, src);
+  // CHECK-LABEL: define void @call_stpcpy
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__stpcpy_chk(i8* {{.*}}, i8* {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+char *strcat(char* dst, const char *src);
+
+EXTERN
+void call_strcat(char *dst, const char *src) {
+  strcat(dst, src);
+  // CHECK-LABEL: define void @call_strcat
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__strcat_chk(i8* {{.*}}, i8* {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+char *strcpy(char* dst, const char *src);
+
+EXTERN
+void call_strcpy(char *dst, const char *src) {
+  strcpy(dst, src);
+  // CHECK-LABEL: define void @call_strcpy
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__strcpy_chk(i8* {{.*}}, i8* {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+size_t strlcat(char* dst, const char *src, size_t len);
+
+EXTERN
+void call_strlcat(char *dst, const char *src, size_t len) {
+  strlcat(dst, src, len);
+  // CHECK-LABEL: define void @call_strlcat
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i64 @__strlcat_chk(i8* {{.*}}, i8* {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+size_t strlcpy(char* dst, const char *src, size_t len);
+
+EXTERN
+void call_strlcpy(char *dst, const char *src, size_t len) {
+  strlcpy(dst, src, len);
+  // CHECK-LABEL: define void @call_strlcpy
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i64 @__strlcpy_chk(i8* {{.*}}, i8* {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+char *strncat(char* dst, const char *src, size_t len);
+
+EXTERN
+void call_strncat(char *dst, const char *src, size_t len) {
+  strncat(dst, src, len);
+  // CHECK-LABEL: define void @call_strncat
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__strncat_chk(i8* {{.*}}, i8* {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+char *strncpy(char* dst, const char *src, size_t len);
+
+EXTERN
+void call_strncpy(char *dst, const char *src, size_t len) {
+  strncpy(dst, src, len);
+  // CHECK-LABEL: define void @call_strncpy
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__strncpy_chk(i8* {{.*}}, i8* {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+char *stpncpy(char* dst, const char *src, size_t len);
+
+EXTERN
+void call_stpncpy(char *dst, const char *src, size_t len) {
+  stpncpy(dst, src, len);
+  // CHECK-LABEL: define void @call_stpncpy
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i8* @__stpncpy_chk(i8* {{.*}}, i8* {{.*}}, i64 {{.*}}, i64 [[REG]])
+}
+
+FSL(0, 0) EXTERN
+int snprintf(char *buf, size_t n, const char *fmt, ...);
+
+EXTERN
+void call_snprintf(char *buf, size_t n, const char *fmt) {
+  snprintf(buf, n, fmt);
+  // CHECK-LABEL: define void @call_snprintf
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i32 (i8*, i64, i32, i64, i8*, ...) @__snprintf_chk(i8* {{.*}}, i64 {{.*}}, i32 0, i64 [[REG]]
+}
+
+FSL(0, 0) EXTERN
+int vsnprintf(char *buf, size_t n, const char *fmt, __builtin_va_list lst);
+
+EXTERN
+void call_vsnprintf(char *buf, size_t n, const char *fmt, __builtin_va_list lst) {
+  vsnprintf(buf, n, fmt, lst);
+  // CHECK-LABEL: define void @call_vsnprintf
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i32 @__vsnprintf_chk(i8* {{.*}}, i64 {{.*}}, i32 0, i64 [[REG]]
+}
+
+FSL(0,0) EXTERN
+int sprintf(char *buf, const char *fmt, ...);
+
+void call_sprintf(char *buf, const char* fmt) {
+  sprintf(buf, fmt);
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* {{.*}}, i32 0, i64 [[REG]]
+  sprintf(buf, fmt, 1, 2, 3);
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i32 (i8*, i32, i64, i8*, ...) @__sprintf_chk(i8* {{.*}}, i32 0, i64 [[REG]], i8* {{.*}}, i32 1, i32 2, i32 3)
+}
+
+FSL(0, 0) EXTERN
+int vsprintf(char *buf, const char *fmt, __builtin_va_list lst);
+
+EXTERN
+void call_vsprintf(char *buf, const char *fmt, __builtin_va_list lst) {
+  vsprintf(buf, fmt, lst);
+  // CHECK-LABEL: define void @call_vsprintf
+  // CHECK: [[REG:%[0-9]+]] = call i64 @llvm.objectsize.i64.p0i8(i8*{{.*}}, i1 false, i1 true, i1 false)
+  // CHECK: call i32 @__vsprintf_chk(i8* {{.*}}, i32 0, i64 [[REG]]
+}
+
+typedef struct {} FILE;
+
+FSL(0, 0) EXTERN
+int fprintf(FILE *file, const char *fmt, ...);
+
+EXTERN
+void call_fprintf(FILE *file, const char *fmt) {
+  fprintf(file, fmt);
+  // CHECK-LABEL: define void @call_fprintf
+  // CHECK: call i32 ({{.*}}*, i32, i8*, ...) @__fprintf_chk({{.*}}, i32 0, i8* {{.*}})
+}
+
+FSL(0, 0) EXTERN
+int vfprintf(FILE *file, const char *fmt, __builtin_va_list lst);
+
+EXTERN
+void call_vfprintf(FILE *file, const char *fmt, __builtin_va_list lst) {
+  vfprintf(file, fmt, lst);
+  // CHECK-LABEL: define void @call_vfprintf
+  // CHECK: call i32 @__vfprintf_chk({{.*}}, i32 0, i8* {{.*}}, {{.*}})
+}
+
+FSL(0, 0) EXTERN
+int printf(const char *fmt, ...);
+
+EXTERN
+void call_printf(const char *fmt) {
+  printf(fmt);
+  // CHECK-LABEL: define void @call_printf
+  // CHECK: call i32 (i32, i8*, ...) @__printf_chk(i32 0, i8* {{.*}})
+}
+
+FSL(0, 0) EXTERN
+int vprintf(const char *fmt, __builtin_va_list lst);
+
+EXTERN
+void call_vprintf(const char *fmt, __builtin_va_list lst) {
+  vprintf(fmt, lst);
+  // CHECK-LABEL: define void @call_vprintf
+  // CHECK: call i32 @__vprintf_chk(i32 0, {{.*}})
+}
+

cfe/trunk/test/Misc/pragma-attribute-supported-attributes-list.test

 // CHECK-NEXT: Destructor (SubjectMatchRule_function)
 // CHECK-NEXT: DisableTailCalls (SubjectMatchRule_function, SubjectMatchRule_objc_method)
 // CHECK-NEXT: EnableIf (SubjectMatchRule_function)
 // CHECK-NEXT: EnumExtensibility (SubjectMatchRule_enum)
 // CHECK-NEXT: ExcludeFromExplicitInstantiation (SubjectMatchRule_variable, SubjectMatchRule_function, SubjectMatchRule_record)
 // CHECK-NEXT: ExternalSourceSymbol ((SubjectMatchRule_record, SubjectMatchRule_enum, SubjectMatchRule_enum_constant, SubjectMatchRule_field, SubjectMatchRule_function, SubjectMatchRule_namespace, SubjectMatchRule_objc_category, SubjectMatchRule_objc_interface, SubjectMatchRule_objc_method, SubjectMatchRule_objc_property, SubjectMatchRule_objc_protocol, SubjectMatchRule_record, SubjectMatchRule_type_alias, SubjectMatchRule_variable))
 // CHECK-NEXT: FlagEnum (SubjectMatchRule_enum)
 // CHECK-NEXT: Flatten (SubjectMatchRule_function)
+// CHECK-NEXT: FortifyStdLib (SubjectMatchRule_function)
 // CHECK-NEXT: GNUInline (SubjectMatchRule_function)
 // CHECK-NEXT: Hot (SubjectMatchRule_function)
 // CHECK-NEXT: IBAction (SubjectMatchRule_objc_method_is_instance)
 // CHECK-NEXT: IFunc (SubjectMatchRule_function)
 // CHECK-NEXT: InitPriority (SubjectMatchRule_variable)
 // CHECK-NEXT: InternalLinkage (SubjectMatchRule_variable, SubjectMatchRule_function, SubjectMatchRule_record)
 // CHECK-NEXT: LTOVisibilityPublic (SubjectMatchRule_record)
 // CHECK-NEXT: Lockable (SubjectMatchRule_record)

cfe/trunk/test/Sema/fortify-std-lib.c

+// RUN: %clang_cc1 -triple x86_64-apple-macosx10.14.0 -fsyntax-only %s -verify
+
+typedef unsigned long size_t;
+
+__attribute__((fortify_stdlib(0, 0)))
+int not_anything_special(); // expected-error {{'fortify_stdlib' attribute applied to an unknown function}}
+
+__attribute__((fortify_stdlib(4, 0))) // expected-error {{'fortify_stdlib' attribute requires integer constant between 0 and 3 inclusive}}
+int sprintf(char *, const char *, ...);
+
+__attribute__((fortify_stdlib())) // expected-error {{'fortify_stdlib' attribute requires exactly 2 arguments}}
+int sprintf(char *, const char *, ...);
+
+__attribute__((fortify_stdlib(1, 2, 3))) // expected-error {{'fortify_stdlib' attribute requires exactly 2 arguments}}
+int sprintf(char *, const char *, ...);
+
+__attribute__((fortify_stdlib(-1, 2))) // expected-error {{'fortify_stdlib' attribute requires a non-negative integral compile time constant expression}}
+int sprintf(char *, const char *, ...);