scanf analysis: handle scanlists that start with ^] (PR19559)

llvm-svn: 207573

2 files changed, 14 insertions, 0 deletions

diff --git a/clang/lib/Analysis/ScanfFormatString.cpp b/clang/lib/Analysis/ScanfFormatString.cpp
index 3ff7f0ad2e5..18505e263be 100644
--- a/clang/lib/Analysis/ScanfFormatString.cpp
+++ b/clang/lib/Analysis/ScanfFormatString.cpp
@@ -50,6 +50,15 @@ static bool ParseScanList(FormatStringHandler &H,
     }
   }
 
+  // Special case: "]^" are the first characters.
+  if (I + 1 != E && I[0] == '^' && I[1] == ']') {
+    I += 2;
+    if (I == E) {
+      H.HandleIncompleteScanList(start, I - 1);
+      return true;
+    }
+  }
+
   // Look for a ']' character which denotes the end of the scan list.
   while (*I != ']') {
     if (++I == E) {
diff --git a/clang/test/Sema/format-strings-scanf.c b/clang/test/Sema/format-strings-scanf.c
index 381447c84a6..d3a03adf619 100644
--- a/clang/test/Sema/format-strings-scanf.c
+++ b/clang/test/Sema/format-strings-scanf.c
@@ -86,6 +86,11 @@ void test_scanlist(int *ip, char *sp, wchar_t *ls) {
   scanf("%h[abc]", sp); // expected-warning{{length modifier 'h' results in undefined behavior or no effect with '[' conversion specifier}}
   scanf("%l[xyx]", ls); // no-warning
   scanf("%ll[xyx]", ls); // expected-warning {{length modifier 'll' results in undefined behavior or no effect with '[' conversion specifier}}
+
+  // PR19559
+  scanf("%[]% ]", sp); // no-warning
+  scanf("%[^]% ]", sp); // no-warning
+  scanf("%[a^]% ]", sp); // expected-warning {{invalid conversion specifier ' '}}
 }
 
 void test_alloc_extension(char **sp, wchar_t **lsp, float *fp) {