-Wformat-overflow drops from 159 to 14, and a full build from 882 to 737
warnings. Unlike the previous batch this is not just noise removal: GCC was
right about every one of these.
The SPRINTFn macros in incl/a4gl_libaubit4gl.h were already the house style -
3400-odd calls use them - and they expand to
A4GL_sprintf(__FILE__, __LINE__, dest, sizeof(dest), fmt, ...)
which formats into a scratch buffer of the destination's size and raises an
assertion naming the file and line if the result would not fit, instead of
writing past the end. 132 raw sprintf() calls that GCC could show overflowing
now go through it.
The yacc grammars were the bulk of them, and are the clearest case:
%union { char str[1024]; ... }
sprintf($<str>$, "%s,%s", $<str>1, $<str>3); /* up to 2048 bytes */
sizeof($<str>$) is the union member's 1024, so the macro checks these properly
rather than degrading to the unchecked pointer path.
Where the warned code lives in a build product the fix is in the source it is
assembled from: compilers/4glc/rules/*.rule and sqlpack/infx/*.rule feed the
generated fgl.infx.yacc, and 80.reqd feeds the sql.yacc that compilers/sql and
compilers/sqlcmd each cat together. Both .reqd copies are edited, since each
Makefile builds its own grammar.
Four sites are deliberately left alone:
- compilers/xgen/x.yacc (5): bin/xgen is a bootstrap tool built before
libaubit4gl exists and links no library, so A4GL_sprintf is not available to
it - converting it broke the link.
- lib/libui/ui_xml/proxy.c (2): includes only system headers, so the macro is
not in scope, and pulling a4gl_libaubit4gl.h into a socket proxy to silence
two warnings is a poor trade.
- sql.yacc (6) and lint.c (1): grammar rules spanning several lines, which the
mechanical pass could not map back to their source fragment with confidence.
One trade-off worth recording: A4GL_sprintf is not declared with
__attribute__((format(printf,5,6))), so GCC no longer type-checks the format
strings at these call sites - the runtime length check replaces a compile time
argument check. Adding that attribute to the declaration would get both back
across all 3400 existing uses; I have not measured how many new -Wformat
warnings it would surface.
