Update __dfsw_s{,n}printf custom functions for new calling convention.

[martignlo]

LGTM

lib/dfsan/dfsan_custom.cc

1067

The labelling could now be in principle performed right after the formatting. I agree that this can be done later since not urgent. Maybe add a 'TODO(martignlo): ....'?

[pcc]

Closed by commit rL220907 (authored by @pcc).

lib/dfsan/dfsan_custom.cc

 // arguments for formatting. Returns the return value vsnprintf would return.
 //
 // The function tokenizes the format string in chunks representing either a
 // constant string or a single format directive (e.g., '%.3f') and formats each
 // chunk independently into the output string. This approach allows to figure
 // out which bytes of the output string depends on which argument and thus to
 // propagate labels more precisely.
 static int format_buffer(char *str, bool has_size, size_t size,
-                         const char *format, va_list ap) {
+                         const char *format, dfsan_label *va_labels,
+                         dfsan_label *ret_label, va_list ap) {
   InternalMmapVector<Chunk> chunks(8);
   size_t off = 0;
 
   while (*format) {
     chunks.push_back(Chunk());
     Chunk& chunk = chunks.back();
     chunk.ptr = str + off;
     chunk.arg = nullptr;
if (has_size) {
         chunk.size = 0;
       }
     } else {
       chunk.size = status;
     }
     off += status;
   }
 
-  // Consume the labels of the output buffer, (optional) size, and format
-  // string.
-  //
   // TODO(martignlo): Decide how to combine labels (e.g., whether to ignore or
   // not the label of the format string).
-  va_arg(ap, dfsan_label_va);
-  if (has_size) {
-    va_arg(ap, dfsan_label_va);
-  }
-  va_arg(ap, dfsan_label_va);
 
   // Label each output chunk according to the label supplied as argument to the
   // function. We need to go through all the chunks and arguments even if the
   // string was only partially printed ({v,}snprintf case).
   for (size_t i = 0; i < chunks.size(); ++i) {
     const Chunk& chunk = chunks[i];
 
     switch (chunk.label_type) {
       case Chunk::NONE:
         dfsan_set_label(0, (void*) chunk.ptr, chunk.size);
         break;
       case Chunk::IGNORED:
-        va_arg(ap, dfsan_label_va);
+        va_labels++;
         dfsan_set_label(0, (void*) chunk.ptr, chunk.size);
         break;
       case Chunk::NUMERIC: {
-        dfsan_label label = va_arg(ap, dfsan_label_va);
+        dfsan_label label = *va_labels++;
         dfsan_set_label(label, (void*) chunk.ptr, chunk.size);
         break;
       }
       case Chunk::STRING: {
         // Consume the label of the pointer to the string
-        va_arg(ap, dfsan_label_va);
+        va_labels++;
         internal_memcpy(shadow_for((void *) chunk.ptr),
                         shadow_for((void *) chunk.arg),
                         sizeof(dfsan_label) * (strlen(chunk.arg)));
         break;
       }
     }
   }
 
-  dfsan_label *ret_label_ptr = va_arg(ap, dfsan_label *);
-  *ret_label_ptr = 0;
+  *ret_label = 0;
 
   // Number of bytes written in total.
   return off;
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
-int __dfsw_sprintf(char *str, const char *format, ...) {
+int __dfsw_sprintf(char *str, const char *format, dfsan_label str_label,
+                   dfsan_label format_label, dfsan_label *va_labels,
+                   dfsan_label *ret_label, ...) {
   va_list ap;
-  va_start(ap, format);
-  int ret = format_buffer(str, false, 0, format, ap);
+  va_start(ap, ret_label);
+  int ret = format_buffer(str, false, 0, format, va_labels, ret_label, ap);
   va_end(ap);
   return ret;
 }
 
 SANITIZER_INTERFACE_ATTRIBUTE
-int __dfsw_snprintf(char *str, size_t size, const char *format, ...) {
+int __dfsw_snprintf(char *str, size_t size, const char *format,
+                    dfsan_label str_label, dfsan_label size_label,
+                    dfsan_label format_label, dfsan_label *va_labels,
+                    dfsan_label *ret_label, ...) {
   va_list ap;
-  va_start(ap, format);
-  int ret = format_buffer(str, true, size, format, ap);
+  va_start(ap, ret_label);
+  int ret = format_buffer(str, true, size, format, va_labels, ret_label, ap);
   va_end(ap);
   return ret;
 }
 }

test/dfsan/custom.cc

void test_sprintf() {
   char buf[2048];
   memset(buf, 'a', sizeof(buf));
 
   // Test formatting (no conversion specifier).
   assert(sprintf(buf, "Hello world!") == 12);
   assert(strcmp(buf, "Hello world!") == 0);
   ASSERT_READ_LABEL(buf, sizeof(buf), 0);
 
+  // Test for extra arguments.
+  assert(sprintf(buf, "Hello world!", 42, "hello") == 12);
+  assert(strcmp(buf, "Hello world!") == 0);
+  ASSERT_READ_LABEL(buf, sizeof(buf), 0);
+
   // Test formatting & label propagation (multiple conversion specifiers): %s,
   // %d, %n, %f, and %%.
   const char* s = "world";
   int m = 8;
   int d = 27;
   dfsan_set_label(k_label, (void *) (s + 1), 2);
   dfsan_set_label(i_label, &m, sizeof(m));
   dfsan_set_label(j_label, &d, sizeof(d));