Attach format attributes to declarations of various message-formatting

routines under gcc.  In a couple of routines, hard-code the preference
for using the vsnprintf paths instead of list-of-int-arguments hacks
now that we're assuming vsnprintf is available in other places.

Installed headers affected:
  com_err.h (com_err, com_err_va)
  ss.h (ss_error)
  krb5.h (krb5_set_error_message, krb5_vset_error_message)

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@19653 dc483132-0cff-0310-8789-dd5450dbe970

14 files changed, 117 insertions, 73 deletions

diff --git a/src/appl/gssftp/ftp/ftp_var.h b/src/appl/gssftp/ftp/ftp_var.h
index 9baa04730..39386ff1d 100644
--- a/src/appl/gssftp/ftp/ftp_var.h
+++ b/src/appl/gssftp/ftp/ftp_var.h
@@ -173,7 +173,11 @@ extern	char *tail();
 extern	char *mktemp();
 #endif
 
-extern int command(char *, ...);
+extern int command(char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 1, 2)))
+#endif
+    ;
 
 char *remglob (char **, int);
 int another (int *, char ***, char *);
diff --git a/src/appl/gssftp/ftp/secure.h b/src/appl/gssftp/ftp/secure.h
index 5d1bd0bdb..011d745f6 100644
--- a/src/appl/gssftp/ftp/secure.h
+++ b/src/appl/gssftp/ftp/secure.h
@@ -12,4 +12,8 @@ int secure_write (int, unsigned char *, unsigned int);
 int secure_read (int, char *, unsigned int);
 void secure_gss_error (OM_uint32 maj_stat, OM_uint32 min_stat, char *s);
 
-void secure_error(char *, ...);
+void secure_error(char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 1, 2)))
+#endif
+    ;
diff --git a/src/appl/gssftp/ftpd/ftpd.c b/src/appl/gssftp/ftpd/ftpd.c
index 94b40dcc5..708bfde93 100644
--- a/src/appl/gssftp/ftpd/ftpd.c
+++ b/src/appl/gssftp/ftpd/ftpd.c
@@ -1464,26 +1464,15 @@ dataconn(name, size, fmode)
  * XXX callers need to limit total length of output string to
  * FTP_BUFSIZ
  */
-#ifdef STDARG
 void
 secure_error(char *fmt, ...)
-#else
-/* VARARGS1 */
-void
-secure_error(fmt, p1, p2, p3, p4, p5)
-	char *fmt;
-#endif
 {
 	char buf[FTP_BUFSIZ];
-#ifdef STDARG
 	va_list ap;
 
 	va_start(ap, fmt);
-	vsprintf(buf, fmt, ap);
+	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
-#else
-	sprintf(buf, fmt, p1, p2, p3, p4, p5);
-#endif
 	reply(535, "%s", buf);
 	syslog(LOG_ERR, "%s", buf);
 }
@@ -2612,36 +2601,29 @@ static char *onefile[] = {
  * XXX callers need to limit total length of output string to
  * FTP_BUFSIZ
  */
-#ifdef STDARG
 static int
 secure_fprintf(FILE *stream, char *fmt, ...)
-#else
-static int
-secure_fprintf(stream, fmt, p1, p2, p3, p4, p5)
-FILE *stream;
-char *fmt;
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 2, 3)))
 #endif
+    ;
+
+static int
+secure_fprintf(FILE *stream, char *fmt, ...)
 {
         char s[FTP_BUFSIZ];
         int rval;
-#ifdef STDARG
         va_list ap;
 
         va_start(ap, fmt);
         if (dlevel == PROT_C) rval = vfprintf(stream, fmt, ap);
         else {
-                vsprintf(s, fmt, ap);
+		vsnprintf(s, sizeof(s), fmt, ap);
                 rval = secure_write(fileno(stream), s, strlen(s));
         }
         va_end(ap);
 
         return(rval);
-#else
-        if (dlevel == PROT_C)
-                return(fprintf(stream, fmt, p1, p2, p3, p4, p5));
-        sprintf(s, fmt, p1, p2, p3, p4, p5);
-        return(secure_write(fileno(stream), s, strlen(s)));
-#endif
 }
 
 void
diff --git a/src/appl/gssftp/ftpd/secure.h b/src/appl/gssftp/ftpd/secure.h
index 97fd0c752..21b7ff836 100644
--- a/src/appl/gssftp/ftpd/secure.h
+++ b/src/appl/gssftp/ftpd/secure.h
@@ -12,8 +12,8 @@ int secure_write (int, unsigned char *, unsigned int);
 int secure_read (int, char *, unsigned int);
 void secure_gss_error (OM_uint32 maj_stat, OM_uint32 min_stat, char *s);
 
-#if defined(STDARG) || (defined(__STDC__) && ! defined(VARARGS)) || defined(HAVE_STDARG_H)
-void secure_error(char *, ...);
-#else
-void secure_error();
+void secure_error(char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 1, 2)))
 #endif
+    ;
diff --git a/src/appl/telnet/telnetd/ext.h b/src/appl/telnet/telnetd/ext.h
index 5d4f8e159..3a0d10320 100644
--- a/src/appl/telnet/telnetd/ext.h
+++ b/src/appl/telnet/telnetd/ext.h
@@ -184,9 +184,21 @@ extern void
 	willoption (int),
 	wontoption (int);
 
-extern void netprintf (const char *, ...);
-extern void netprintf_urg (const char *fmt, ...);
-extern void netprintf_noflush (const char *fmt, ...);
+extern void netprintf (const char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 1, 2)))
+#endif
+    ;
+extern void netprintf_urg (const char *fmt, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 1, 2)))
+#endif
+    ;
+extern void netprintf_noflush (const char *fmt, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 1, 2)))
+#endif
+    ;
 extern int netwrite (const unsigned char *, size_t);
 extern void netputs (const char *);
 
diff --git a/src/appl/telnet/telnetd/utility.c b/src/appl/telnet/telnetd/utility.c
index f4568ec28..a091d0894 100644
--- a/src/appl/telnet/telnetd/utility.c
+++ b/src/appl/telnet/telnetd/utility.c
@@ -393,6 +393,13 @@ netflush()
  */
 static void
 netprintf_ext(int noflush, int seturg, const char *fmt, va_list args)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 0)))
+#endif
+    ;
+
+static void
+netprintf_ext(int noflush, int seturg, const char *fmt, va_list args)
 {
 	size_t remain;
 	size_t maxoutlen;
@@ -412,11 +419,7 @@ netprintf_ext(int noflush, int seturg, const char *fmt, va_list args)
 	if (maxoutlen >= sizeof(buf))
 		return;		/* highly unlikely */
 
-#ifdef HAVE_VSNPRINTF
 	len = vsnprintf(buf, sizeof(buf), fmt, args);
-#else
-	len = vsprintf(buf, fmt, args);	/* XXX need to fix for SunOS? */
-#endif
 
 	/*
 	 * The return value from sprintf()-like functions may be the
diff --git a/src/include/adm_proto.h b/src/include/adm_proto.h
index f2bd465f7..04e6a4791 100644
--- a/src/include/adm_proto.h
+++ b/src/include/adm_proto.h
@@ -1,7 +1,7 @@
 /*
  * include/krb5/adm_proto.h
  *
- * Copyright 1995 by the Massachusetts Institute of Technology.
+ * Copyright 1995, 2007 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -62,7 +62,11 @@ krb5_error_code krb5_klog_init
 	 char *,
 	 krb5_boolean);
 void krb5_klog_close (krb5_context);
-int krb5_klog_syslog (int, const char *, ...);
+int krb5_klog_syslog (int, const char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 2, 3)))
+#endif
+    ;
 void krb5_klog_reopen (krb5_context);
 
 /* alt_prof.c */
diff --git a/src/include/k5-err.h b/src/include/k5-err.h
index c2cc52cee..a6dedcc88 100644
--- a/src/include/k5-err.h
+++ b/src/include/k5-err.h
@@ -1,7 +1,7 @@
 /*
  * include/k5-err.h
  *
- * Copyright 2006 Massachusetts Institute of Technology.
+ * Copyright 2006, 2007 Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -53,10 +53,18 @@ struct errinfo {
 void
 krb5int_set_error (struct errinfo *ep,
 		   long code,
-		   const char *fmt, ...);
+		   const char *fmt, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 4)))
+#endif
+    ;
 void
 krb5int_vset_error (struct errinfo *ep, long code,
-		    const char *fmt, va_list args);
+		    const char *fmt, va_list args)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 0)))
+#endif
+    ;
 const char *
 krb5int_get_error (struct errinfo *ep, long code);
 void
diff --git a/src/include/krb5/krb5.hin b/src/include/krb5/krb5.hin
index cfaa90493..88154f885 100644
--- a/src/include/krb5/krb5.hin
+++ b/src/include/krb5/krb5.hin
@@ -1,7 +1,7 @@
 /* -*- c -*-
  * include/krb5.h
  *
- * Copyright 1989,1990,1995,2001, 2003  by the Massachusetts Institute of Technology.
+ * Copyright 1989,1990,1995,2001, 2003, 2007  by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -2264,9 +2264,17 @@ krb5_prompt_type* KRB5_CALLCONV krb5_get_prompt_types
 
 /* Error reporting */
 void KRB5_CALLCONV_C
-krb5_set_error_message (krb5_context, krb5_error_code, const char *, ...);
+krb5_set_error_message (krb5_context, krb5_error_code, const char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 4)))
+#endif
+    ;
 void KRB5_CALLCONV
-krb5_vset_error_message (krb5_context, krb5_error_code, const char *, va_list);
+krb5_vset_error_message (krb5_context, krb5_error_code, const char *, va_list)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 0)))
+#endif
+    ;
 /*
  * The behavior of krb5_get_error_message is only defined the first
  * time it is called after a failed call to a krb5 function using the
diff --git a/src/kdc/kerberos_v4.c b/src/kdc/kerberos_v4.c
index 9f93e451e..d8daa7924 100644
--- a/src/kdc/kerberos_v4.c
+++ b/src/kdc/kerberos_v4.c
@@ -1,7 +1,7 @@
 /*
  * kdc/kerberos_v4.c
  *
- * Copyright 1985, 1986, 1987, 1988,1991 by the Massachusetts Institute
+ * Copyright 1985, 1986, 1987, 1988,1991,2007 by the Massachusetts Institute
  * of Technology.
  * All Rights Reserved.
  *
@@ -75,7 +75,11 @@ static int kerb_get_principal (char *, char *, Principal *,
 static int check_princ (char *, char *, int, Principal *,
 				  krb5_keyblock *, int, krb5_deltat *);
 
-char * v4_klog (int, const char *, ...);
+static char * v4_klog (int, const char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 2, 3)))
+#endif
+    ;
 #define klog v4_klog
 
 /* take this out when we don't need it anymore */
@@ -271,7 +275,7 @@ process_v4(const krb5_data *pkt, const krb5_fulladdr *client_fulladdr,
     return(retval);
 }
 
-char * v4_klog( int type, const char *format, ...)
+static char * v4_klog( int type, const char *format, ...)
 {
     int logpri = LOG_INFO;
     va_list pvar;
diff --git a/src/lib/kadm5/logger.c b/src/lib/kadm5/logger.c
index e6fe44da6..86abf48e9 100644
--- a/src/lib/kadm5/logger.c
+++ b/src/lib/kadm5/logger.c
@@ -1,7 +1,7 @@
 /*
  * lib/kadm/logger.c
  *
- * Copyright 1995 by the Massachusetts Institute of Technology.
+ * Copyright 1995, 2007 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -168,6 +168,14 @@ static struct log_entry	def_log_entry;
  *			  profile.
  */
 static krb5_context err_context;
+
+static void
+klog_com_err_proc(const char *whoami, long int code, const char *format, va_list ap)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 0)))
+#endif
+    ;
+
 static void
 klog_com_err_proc(const char *whoami, long int code, const char *format, va_list ap)
 {
@@ -257,16 +265,8 @@ klog_com_err_proc(const char *whoami, long int code, const char *format, va_list
 #endif	/* HAVE_SYSLOG */
 
     /* Now format the actual message */
-#if	HAVE_VSNPRINTF
     vsnprintf(cp, sizeof(outbuf) - (cp - outbuf), actual_format, ap);
-#elif	HAVE_VSPRINTF
-    vsprintf(cp, actual_format, ap);
-#else	/* HAVE_VSPRINTF */
-    sprintf(cp, actual_format, ((int *) ap)[0], ((int *) ap)[1],
-	    ((int *) ap)[2], ((int *) ap)[3],
-	    ((int *) ap)[4], ((int *) ap)[5]);
-#endif	/* HAVE_VSPRINTF */
-    
+
     /*
      * Now that we have the message formatted, perform the output to each
      * logging specification.
@@ -796,6 +796,13 @@ severity2string(int severity)
  */
 static int
 klog_vsyslog(int priority, const char *format, va_list arglist)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 2, 0)))
+#endif
+    ;
+
+static int
+klog_vsyslog(int priority, const char *format, va_list arglist)
 {
     char	outbuf[KRB5_KLOG_MAX_ERRMSG_SIZE];
     int		lindex;
@@ -848,15 +855,7 @@ klog_vsyslog(int priority, const char *format, va_list arglist)
     syslogp = &outbuf[strlen(outbuf)];
 
     /* Now format the actual message */
-#ifdef	HAVE_VSNPRINTF
     vsnprintf(syslogp, sizeof(outbuf) - (syslogp - outbuf), format, arglist);
-#elif	HAVE_VSPRINTF
-    vsprintf(syslogp, format, arglist);
-#else	/* HAVE_VSPRINTF */
-    sprintf(syslogp, format, ((int *) arglist)[0], ((int *) arglist)[1],
-	    ((int *) arglist)[2], ((int *) arglist)[3],
-	    ((int *) arglist)[4], ((int *) arglist)[5]);
-#endif	/* HAVE_VSPRINTF */
 
     /*
      * If the user did not use krb5_klog_init() instead of dropping
diff --git a/src/lib/krb4/krb4int.h b/src/lib/krb4/krb4int.h
index 15ea14564..51b1138c9 100644
--- a/src/lib/krb4/krb4int.h
+++ b/src/lib/krb4/krb4int.h
@@ -1,7 +1,7 @@
 /*
  * lib/krb4/krb4int.h
  *
- * Copyright 2001-2002 by the Massachusetts Institute of Technology.
+ * Copyright 2001-2002, 2007 by the Massachusetts Institute of Technology.
  * All Rights Reserved.
  *
  * Export of this software from the United States of America may
@@ -62,7 +62,11 @@ int krb_get_in_tkt_preauth_creds(char *, char *, char *,
 void kset_logfile(char *);
 
 /* log.c */
-void krb_log(const char *, ...);
+void krb_log(const char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 1, 2)))
+#endif
+    ;
 
 void krb_set_logfile(char *);
 
diff --git a/src/util/et/com_err.h b/src/util/et/com_err.h
index 042a9bd45..58c43d31d 100644
--- a/src/util/et/com_err.h
+++ b/src/util/et/com_err.h
@@ -39,10 +39,18 @@ extern "C" {
 
 /* Public interfaces */
 extern void KRB5_CALLCONV_C com_err
-	(const char *, errcode_t, const char *, ...);
+	(const char *, errcode_t, const char *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 4)))
+#endif
+    ;
 extern void KRB5_CALLCONV com_err_va
 	(const char *whoami, errcode_t code, const char *fmt,
-	 va_list ap);
+	 va_list ap)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 0)))
+#endif
+    ;
 extern /*@observer@*//*@dependent@*/ const char * KRB5_CALLCONV error_message
 	(errcode_t)
        /*@modifies internalState@*/;
diff --git a/src/util/ss/ss.h b/src/util/ss/ss.h
index 45ba4061b..ac25266d3 100644
--- a/src/util/ss/ss.h
+++ b/src/util/ss/ss.h
@@ -49,7 +49,11 @@ void ss_list_requests __SS_PROTO;
 void ss_quit __SS_PROTO;
 char *ss_current_request();
 char *ss_name(int);
-void ss_error (int, long, char const *, ...);
+void ss_error (int, long, char const *, ...)
+#if !defined(__cplusplus) && (__GNUC__ > 2)
+    __attribute__((__format__(__printf__, 3, 4)))
+#endif
+    ;
 void ss_perror (int, long, char const *);
 int ss_listen (int);
 int ss_create_invocation(char *, char *, char *, ss_request_table *, int *);