@@ -124,6 +124,8 @@ Removed Compiler Flags
124124
125125Attribute Changes in Clang
126126--------------------------
127+ Adding [[clang::unsafe_buffer_usage]] attribute to a method definition now turns off all -Wunsafe-buffer-usage
128+ related warnings within the method body.
127129
128130- The ``no_sanitize `` attribute now accepts both ``gnu `` and ``clang `` names.
129131- Clang now diagnoses use of declaration attributes on void parameters. (#GH108819)
@@ -132,6 +134,50 @@ Attribute Changes in Clang
132134 This forces the global to be considered small or large in regards to the
133135 x86-64 code model, regardless of the code model specified for the compilation.
134136
137+ - There is a new ``format_matches `` attribute to complement the existing
138+ ``format `` attribute. ``format_matches `` allows the compiler to verify that
139+ a format string argument is equivalent to a reference format string: it is
140+ useful when a function accepts a format string without its accompanying
141+ arguments to format. For instance:
142+
143+ .. code-block :: c
144+
145+ static int status_code;
146+ static const char *status_string;
147+
148+ void print_status(const char *fmt) {
149+ fprintf(stderr, fmt, status_code, status_string);
150+ // ^ warning: format string is not a string literal [-Wformat-nonliteral]
151+ }
152+
153+ void stuff(void) {
154+ print_status("%s (%#08x)\n");
155+ // order of %s and %x is swapped but there is no diagnostic
156+ }
157+
158+ format_matches ``, this code cannot be verified
159+ at compile-time. ``format_matches `` plugs that hole:
160+
161+ .. code-block :: c
162+
163+ __attribute__((format_matches(printf, 1, "%x %s")))
164+ void print_status(const char *fmt) {
165+ fprintf(stderr, fmt, status_code, status_string);
166+ // ^ `fmt` verified as if it was "%x %s" here; no longer triggers
167+ // -Wformat-nonliteral, would warn if arguments did not match "%x %s"
168+ }
169+
170+ void stuff(void) {
171+ print_status("%s (%#08x)\n");
172+ // warning: format specifier 's' is incompatible with 'x'
173+ // warning: format specifier 'x' is incompatible with 's'
174+ }
175+
176+ format ``, the first argument is the format string flavor and the
177+ second argument is the index of the format string parameter.
178+ ``format_matches `` accepts an example valid format string as its third
179+ argument. For more information, see the Clang attributes documentation.
180+
135181Improvements to Clang's diagnostics
136182-----------------------------------
137183
0 commit comments