<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/64650>64650</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            Calls to functions with __attribute__(format(printf, n, 0)) fail to trigger -Wformat-security
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          pkasting
      </td>
    </tr>
</table>

<pre>
    The following code should trigger -Wformat-security on the call to `f0()`, but does not:
```
void __attribute__((format(printf, 1, 0))) f0(const char* format, ...);
void __attribute__((format(printf, 1, 2))) f2(const char* format, ...);

void bar() {
    const char* str = "Test";
 f0("Test");
    f0(str);  // No warning (incorrect)
 f2("Test");
    f2(str);  // Warning (correct)
}
```

Godbolt repro: https://godbolt.org/z/5qGqrf3bW

While passing a `0` to the third arg of the format attribute means the args cannot be checks against the format string, checking that the format string itself is a literal should be independent of that.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJycVEFv4yoQ_jX4Moplg-M4Bx_SRuntnSrlGGEztnklkMK4Ud-vf4KkbbabXa1WQljmG74PZr5BhqBHi9iy5QNbbjM50-R8e3qRgbQds86p9_Z5QhicMe6s7Qi9UwhhcrNRQF6PI3pY7Afnj5IWAfvZa3oHZ4EmhF4aA-SA1cVQMN4wvmZ1wfgjdDOBchjAOmJiw4otKzYRu4z0--a0gsNBEnndzYSHQ6JoLmKMNyevLQ2RroxTEenTgKTWOxsI-kl6xjfwsesR8jyPYeLh72T4jQz_c5kbsS6GxmQAW11RAIAfiQJ5YGILjPNnDMQ4_6SCazI_gRuZSJTgQP6yDsD4jvEd_OPgLL2NVWS80bZ33mNPMepKy39Py-_S7r84vzOy1fZuZS_zk1OdMwQeT94xsYGJ6BSiGxLxeIFz50fGd_8xvlu-Pr36QXT7W5b9pA3CKVrZjiCj16JQtF20IE3aK5B-BDekhUuB4LPccERpQ4KkHwP00lpH0CH0E_YvAeQodSzMzeZAXtsxFjnFRGGa5J0Q0BTQDKADSDCa0Evz0T0dgrYKT2gVWrocT1KeqVaotVjLDNuyXpfNquKrOpvauqzkcpByEGW9XmNVSrXqhajLUvYrUTWZbnnBRdGUnJdFJep8KLARK4FqWFaqUw2rCjxKbXJj3o4xr5kOYca2ruplkRnZoQnpKeDc4hkSGH2w3Ga-jXsW3TwGVhVGBwpfLKTJYPsojQkx7cNse9LOBjhrmn5qrTt9ZW_aFwap06Pxy9clm71pv3lF0zR3ee-OjO_iua6fxcm7f5Mjd-k2gfFduu3_AQAA__-pNoWv">