<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>I've coded up some support in clang to flag warnings for non-constant format strings used in calls to printf-like functions (all the functions listed in "man fprintf"). Non-constant format strings are a source of many security exploits in C/C++ programs, and I believe are currently detected by gcc using the flag <span class="Apple-style-span" style="font-family: Courier; font-size: 10px; line-height: 19px; ">-Wformat-nonliteral.</span></div><div><br></div><div>I've attached a patch that adds this support. I've also included two new files not under version control, including one file for regression testing.</div><div><br class="webkit-block-placeholder"></div><div>I plan on adding additional checking for format strings.</div><div><br></div><div>Patch affects:</div><div><br class="webkit-block-placeholder"></div><div><div>include/clang/Basic/DiagnosticKinds.def</div><div>Sema/SemaExpr.cpp</div><div>Sema/Sema.cpp</div><div>Sema/Sema.h</div><div><br></div></div><div>New files:</div><div><br class="webkit-block-placeholder"></div><div>in Sema/: SemaChecking.cpp</div><div>in test/: format-strings.c</div><div><br class="webkit-block-placeholder"></div><div><br class="webkit-block-placeholder"></div><div><div></div></div></body></html>