scanf analysis: the 'a' length modifier is valid with a scanlist

Before r148025 we (accidentally) didn't check whether a length modifier is
appropriate for a scanlist, but now we do.

llvm-svn: 148026

clang/lib/Analysis/FormatString.cpp

@@ -550,6 +550,7 @@ bool FormatSpecifier::hasValidLengthModifier() const {
       switch (CS.getKind()) {
         case ConversionSpecifier::sArg:
         case ConversionSpecifier::SArg:
+        case ConversionSpecifier::ScanListArg:
           return true;
         default:
           return false;

clang/test/Sema/format-strings-c90.c

@@ -7,6 +7,7 @@ int printf(const char *restrict, ...);
 void foo(char **sp, float *fp, int *ip) {
   /* TODO: Warn that the 'a' length modifier is an extension. */
   scanf("%as", sp);
+  scanf("%a[abc]", sp);
 
   /* TODO: Warn that the 'a' conversion specifier is a C99 feature. */
   scanf("%a", fp);

clang/test/Sema/format-strings-scanf.c

@@ -68,8 +68,9 @@ void test_variants(int *i, const char *s, ...) {
   vsscanf(buf, "%[abc", ap); // expected-warning{{no closing ']' for '%[' in scanf format string}}
 }
 
-void test_scanlist(int *ip) {
+void test_scanlist(int *ip, char *sp) {
   scanf("%[abc]", ip); // expected-warning{{conversion specifies type 'char *' but the argument has type 'int *'}}
+  scanf("%h[abc]", sp); // expected-warning{{length modifier 'h' results in undefined behavior or no effect with '[' conversion specifier}}
 }
 
 void test_alloc_extension(char **sp, wchar_t **lsp) {