Add format attribute to printf-style wrappers and fix format string errors

[Copilot]

Description

Enabled compiler validation of printf-style format strings by adding __attribute__ ((format (printf, ...))) to wrapper functions. Fixed 85+ format string errors discovered by the compiler across CoreCLR, Mono, and Corehost. Merged with latest main branch to ensure compatibility with recent changes.

Changes

Centralized format attribute macro in src/native/minipal/types.h:

• Added MINIPAL_ATTR_FORMAT_PRINTF(fmt_pos, arg_pos) macro for consistent usage across the codebase
• Eliminates need for duplicated #ifdef __GNUC__ blocks throughout the codebase
• Does not redefine standard C99 PRI macros - relies entirely on system inttypes.h

Added format attributes to 60+ wrapper functions across 13 headers using MINIPAL_ATTR_FORMAT_PRINTF:

• src/native/minipal/types.h - Centralized MINIPAL_ATTR_FORMAT_PRINTF macro definition
• src/native/minipal/log.h - minipal_log_print
• src/native/corehost/hostmisc/trace.h - trace::verbose, info, warning, error, println
• src/native/libs/Common/pal_compiler.h - do_abort_unless
• src/native/libs/System.Native/pal_string.h - SystemNative_SNPrintF
• src/native/libs/System.Security.Cryptography.Native/osslcompat_30.h - ERR_set_error (uses shared MINIPAL_ATTR_FORMAT_PRINTF macro)
• src/coreclr/inc/log.h - LogSpew, LogSpew2, LogSpewAlways
• src/coreclr/inc/stresslog.h - StressLog::LogMsg, ThreadStressLog::LogMsg
• src/coreclr/inc/sstring.h - Printf, AppendPrintf
• src/coreclr/jit/host.h - jitprintf, logf, flogf, gcDump_logf
• src/coreclr/jit/compiler.h - printfAlloc, JitLogEE
• src/coreclr/gc/gc.h - GCLog
• src/coreclr/gc/gcpriv.h - GCLogConfig
• src/mono/mono/eglib/glib.h - g_error_new, g_set_error, g_print, g_printerr, g_log, g_assertion_message, g_async_safe_*

Fixed 85+ format string errors across 24 source files:

Error Type	Count	Fix
Platform-specific format codes	16	%I64d/%Id → %zd/%zu
uint64_t formatting	19	Use standard PRIX64/PRIx64/PRIu64 from <inttypes.h>
Invalid %p flags	4	Removed # and 0 flags
Missing pointer casts	7	Added (void*) cast for pointers
Format-security warnings	24	printf(str) → printf("%s", str)
Member function attributes	1	Adjusted positions for implicit this
Miscellaneous type mismatches	14+	Fixed various format/argument type mismatches

Files with format errors fixed:

• JIT: emit.cpp, emitwasm.cpp, emitxarch.cpp, emitarm.cpp, emitarm64.cpp, emitarm64sve.cpp, codegencommon.cpp, jitinterface.cpp, gentree.cpp, inlinepolicy.cpp
• VM: perfmap.cpp, stubgen.cpp, crst.cpp, excep.cpp, dynamicmethod.cpp, stubmgr.cpp, gcheaputilities.cpp, threadsuspend.cpp, amd64/excepamd64.cpp
• GC: gc.cpp, diagnostics.cpp
• Corehost: sdk_resolver.cpp, hostpolicy_init.cpp, hostpolicy.cpp, hostpolicy_context.cpp, deps_format.cpp, nethost.cpp, bundle/reader.h
• Mono: mono-threads-state-machine.c, mono-threads.c, mono-os-mutex.c
• Tools: ildasm/dasm.cpp, metainfo/mdinfo.cpp
• Debug: di/rsthread.cpp, debug/ee/arm/walker.cpp, debug/ee/controller.cpp

Added missing header includes:

• src/coreclr/ildasm/ildasmpch.h - Added #include <inttypes.h> for PRI macros
• src/coreclr/tools/metainfo/mdinfo.cpp - Added #include <inttypes.h> for PRI macros
• src/coreclr/vm/jitinterface.cpp - Added #include <inttypes.h> for PRI macros
• src/coreclr/jit/gentree.cpp - Added #include <inttypes.h> for PRI macros

Portability for PRI macros in C++: Added guarded __STDC_FORMAT_MACROS define before <inttypes.h> includes in C++ translation units that use PRI* format macros (emitwasm.cpp, jitinterface.cpp, stubgen.cpp, mdinfo.cpp, ildasmpch.h, arm64/loongarch64/riscv64 singlestepper.cpp). This keeps PRI macros visible on older C++ libc implementations (notably glibc) where they are gated behind __STDC_FORMAT_MACROS in C++ mode.

Merged from main:

• Successfully merged latest changes from origin/main
• Verified clean build with 0 errors and 0 warnings
• All format attributes remain compatible with latest codebase changes

Review feedback addressed:

• src/coreclr/vm/crst.cpp: Simplified format strings to avoid unnecessary line splits
• src/coreclr/gc/diagnostics.cpp: Removed unnecessary size_t casts (type already size_t)
• Spurious indentation changes: Restored original indentation in excep.cpp, emitxarch.cpp, dynamicmethod.cpp, and stubmgr.cpp to keep diff clean
• Format/cast mismatch: Fixed emitxarch.cpp line 12477 to use %zu instead of %zd for unsigned size_t
• Format error in jitinterface.cpp: Reverted incorrect %lld back to %d for INT32 type
• Unnecessary blank lines: Removed two blank lines in CMakeLists.txt
• 32-bit ARM build failure: Fixed gentree.cpp, compiler.cpp, error.cpp, morph.cpp, and codegencommon.cpp by replacing empty printf("") calls with fflush(stdout) to fix GCC format-zero-length errors on linux.armel.Checked
• Latest CI/review-feedback follow-ups:
  • src/coreclr/vm/gcheaputilities.cpp: Log invalid GC module name as UTF-8 string (MAKE_UTF8PTR_FROMWIDE + %s) instead of pointer (%p) so the diagnostic shows the actual name
  • src/coreclr/jit/inlinepolicy.cpp: Print m_ModelCodeSizeEstimate for the size= label (the original code had a label/value mismatch where the per-call instruction estimate was being printed under the size label)
  • src/native/corehost/hostpolicy/hostpolicy_init.cpp: Changed %zd → %zu for size_t input->version_lo in two locations
  • src/mono/mono/utils/mono-os-mutex.c: Cast ts.tv_sec to long long for %lld and ts.tv_nsec to long for %ld in both pthread_cond_timedwait and pthread_cond_timedwait_relative_np branches
  • src/native/libs/System.Security.Cryptography.Native/osslcompat_30.h: Replaced inline #ifdef __GNUC__ block on ERR_set_error with the shared MINIPAL_ATTR_FORMAT_PRINTF macro and added #include <minipal/types.h>
  • src/native/corehost/bundle/reader.h: Cast int64_t m_offset_in_file to unsigned long long to match %llx (avoids varargs UB)
  • src/coreclr/vm/stubgen.cpp: Use 0x%zx/0x%08zx with (size_t) cast for UINT_PTR pInstruction->uArg to fix Win64 truncation (where unsigned long is 32-bit)
  • src/coreclr/vm/threadsuspend.cpp:4312 and src/coreclr/vm/amd64/excepamd64.cpp:197: Removed redundant 0x literal prefix before %p format specifier (which already includes 0x on most platforms, resulting in 0x0x... output)
  • src/coreclr/debug/di/rsthread.cpp:692: Added explicit (size_t) cast for UINT_PTR m_id used with %zx format specifier
  • src/tools/ilasm: Reverted accidental changes to auto-generated C# files that had introduced Windows-specific absolute paths into // Generated from comments

Example fixes:

// Before: Platform-specific, requires #ifdef blocks
#ifdef TARGET_64BIT
printf("%lu", (unsigned long)uint64_value);
#else
printf("%llu", (unsigned long long)uint64_value);
#endif

// After: Portable using standard inttypes.h macros
#include <inttypes.h>
printf("%" PRIX64, uint64_value);

// Before: Format-security warning
printf(sstr);

// After: Safe format string
printf("%s", sstr);

// Before: Platform-specific
printf("%I64d", ssize_value);

// After: Portable
printf("%zd", (size_t)ssize_value);

// Before: pthread_t with wrong format
printf("thread %d", pthread_id);

// After: Pointer type with correct format
printf("thread %p", (void*)pthread_id);

// Before: GCC format-zero-length error (linux.armel.Checked)
printf(""); // null string means flush

// After: Explicit flush
fflush(stdout); // flush

Impact

• Security: Eliminated 24 format-security vulnerabilities where non-literal strings were used as format arguments
• Code quality: Removed 170+ lines of duplicated #ifdef __GNUC__ blocks via centralized MINIPAL_ATTR_FORMAT_PRINTF macro (now also used by osslcompat_30.h); restored original indentation to keep git history clean; reverted accidental changes to auto-generated src/tools/ilasm files
• Portability: Replaced platform-specific format codes with standard C99/POSIX specifiers; uses system inttypes.h macros without any custom redefinition; added guarded __STDC_FORMAT_MACROS before <inttypes.h> in C++ files for older libc compatibility; fixed UINT_PTR formatting in stubgen for Win64 (where unsigned long is 32-bit); fixed builds across x64, ARM64, and 32-bit ARM platforms
• Correctness: Fixed type mismatches causing crashes/incorrect output on 64-bit platforms and macOS; corrected format/cast mismatches; restored a useful diagnostic in gcheaputilities.cpp (UTF-8 module name instead of pointer); fixed a pre-existing label/value mismatch in inlinepolicy.cpp so the size= log label now reports the model code size; removed redundant 0x prefixes before %p specifiers that were producing 0x0x... output
• Maintainability: Format errors now caught at compile time with consistent macro usage across CoreCLR, Mono, and Corehost; verified compatibility with latest main branch
• Compatibility: No macro redefinition conflicts with Windows MSVC, Android NDK, or other standard library implementations; all files using PRI macros include proper headers

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[jkotas]

@copilot

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Pull request overview

Copilot reviewed 206 out of 206 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (3)

src/coreclr/debug/ee/debuggermodule.cpp:127

• Using a literal "0x" prefix with %p can lead to duplicated prefixes on platforms where %p already includes 0x (resulting in 0x0x...). Drop the manual prefix when printing pointers with %p.

    LOG((LF_CORDB, LL_INFO1000, "DMT::RM Attempting to remove Module:0x%p\n", pModule));

src/coreclr/debug/ee/debuggermodule.cpp:144

• Using a literal "0x" prefix with %p can lead to duplicated prefixes on platforms where %p already includes 0x (resulting in 0x0x...). Drop the manual prefix when printing pointers with %p.

            LOG((LF_CORDB, LL_INFO1000, "DMT::RM Removing DebuggerMod:0x%p - Module:0x%p Asm:0x%p\n",
                pDM, pModule, pDM->GetAssembly()));

src/coreclr/debug/ee/debuggermodule.cpp:153

• Using a literal "0x" prefix with %p can lead to duplicated prefixes on platforms where %p already includes 0x (resulting in 0x0x...). Drop the manual prefix when printing pointers with %p.

    LOG((LF_CORDB, LL_INFO1000, "DMT::RM  No debugger module found for Module:0x%p\n", pModule));

[jkoritzinsky]

@copilot please triage and fix the build errors encountered in CI.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot please triage and fix the build errors encountered in CI.

Fixed the CI build failures in commit b659f4b:

• emitwasm.cpp:1367,1371: Added missing % before PRIx64/PRIu64 macros. The format strings " %u reloc 0x" PRIx64 were being treated as two separate string literals with no format specifier for the second argument, causing -Wformat-extra-args errors. Fixed to " %u reloc 0x%" PRIx64 and " %u %" PRIu64.

Also addressed the unresolved review comments from the latest review:

• debuggermodule.cpp lines 102, 127, 143, 153: Removed the redundant 0x prefix before %p specifiers (which already include 0x on most platforms, resulting in 0x0x... output).
• crashinfo.h: Added #include <minipal/types.h> to make the header self-contained rather than relying on transitive inclusion through createdump.h.

[jkoritzinsky]

@copilot please triage the CI build failures, merge from main, and implement fixes for the CI build failures.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot please triage the CI build failures, merge from main, and implement fixes for the CI build failures.

Done. I merged the latest main in 5b4b2e335ab and fixed the resulting cross-platform format build errors in 5b12fae26a0.

Validation completed successfully with both ./build.sh clr+host and ./build.sh clr+host -rc checked reporting 0 warnings and 0 errors. Two independent final reviews found no significant issues, and automated validation reported no alerts. JIT formatting could not run because the formatter download was blocked by network access; no formatter-generated changes were made.

Note

This reply was generated by GitHub Copilot.

[jkoritzinsky]

@copilot please triage the CI build failures, merge from main, and implement fixes for the CI build failures.

[Copilot]

Pull request overview

Copilot reviewed 208 out of 208 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/coreclr/vm/tieredcompilation.cpp:939

• With printf-format checking enabled on LOG/LogSpew, %p (and %pM, which is parsed as %p + literal M) requires the corresponding argument to be passed as void*. Here pMethod is a MethodDesc*, so this remains varargs-UB and is likely to trigger -Wformat diagnostics on GCC/Clang builds that compile with LOGGING enabled.
  src/mono/mono/mini/tramp-amd64.c:602
• g_assertf ultimately uses printf-style formatting; %p expects a void* argument. Passing code/buf as typed pointers is varargs-UB and (with format attributes enabled on the GLib-style helpers) is likely to reintroduce the format diagnostics this PR is trying to eliminate.

[Copilot]

Pull request overview

Copilot reviewed 208 out of 208 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/coreclr/debug/di/divalue.cpp:813

• Using a literal 0x prefix together with %p can produce 0x0x... on platforms where %p already includes the 0x prefix (common on Unix/libc). Prefer plain %p for portability/consistency with other fixes in this PR.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::~CRV: this:0x%p\n",this));

src/coreclr/debug/di/divalue.cpp:744

• Using a literal 0x prefix together with %p can produce 0x0x... on platforms where %p already includes the 0x prefix (common on Unix/libc). Prefer plain %p for portability/consistency with other fixes in this PR.

This issue also appears on line 813 of the same file.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::CRV: this:0x%p\n",this));

[Copilot]

Pull request overview

Copilot reviewed 210 out of 210 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/coreclr/debug/di/divalue.cpp:813

• Same as above: avoid hardcoding 0x before %p to prevent potential 0x0x... output and keep pointer formatting consistent.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::~CRV: this:0x%p\n",this));

src/coreclr/debug/di/divalue.cpp:744

• %p formatting is implementation-defined but commonly already includes a 0x prefix. Keeping the literal 0x here can result in 0x0x... in logs, which hurts diagnostics consistency (and this PR already removes redundant 0x prefixes elsewhere).

This issue also appears on line 813 of the same file.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::CRV: this:0x%p\n",this));

[Copilot]

Pull request overview

Copilot reviewed 210 out of 210 changed files in this pull request and generated no new comments.

Suppressed comments (4)

src/coreclr/debug/di/divalue.cpp:813

• Same issue as the constructor log: %p expects void* (cast required for varargs correctness / format checking), and the 0x prefix can produce 0x0x... on some platforms.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::~CRV: this:0x%p\n",this));

src/coreclr/debug/di/rsmain.cpp:1333

• Same %p argument typing issue: cast process to void* to avoid format diagnostics under GCC/Clang with printf-style validation enabled.

    STRESS_LOG1(LF_CORDB, LL_INFO10, "Cordb::RemoveProcess %p...\n", process);

src/coreclr/debug/di/divalue.cpp:744

• %p format specifier requires a void* argument. Passing this (a typed pointer) can trigger -Wformat diagnostics once printf-style validation is enabled and is technically incorrect for varargs. Also the literal 0x prefix can result in 0x0x... output on platforms where %p already includes the prefix.

This issue also appears on line 813 of the same file.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::CRV: this:0x%p\n",this));

src/coreclr/debug/di/rsmain.cpp:1308

• %p requires a void* argument for printf-style format checking; passing a typed pointer can trigger -Wformat warnings/errors with the new format attributes. Cast the argument to void* for correctness and portability.

This issue also appears on line 1333 of the same file.

    STRESS_LOG1(LF_CORDB, LL_INFO10, "Cordb::AddProcess %p...\n", process);

[azure-pipelines]

Azure Pipelines:
Successfully started running 10 pipeline(s).
6 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

Copilot reviewed 210 out of 210 changed files in this pull request and generated no new comments.

Suppressed comments (4)

src/coreclr/vm/peimagelayout.cpp:304

• This LOG call uses %p but passes GetPreferredBase()/GetBase() without casting to a pointer type. In this file these values are treated as pointer-sized integers (e.g., preferredBase = (void*)GetPreferredBase()), so this will trip format checking (and is UB). Cast to void* at the call site.
  src/coreclr/debug/di/divalue.cpp:813
• Same as the constructor: the explicit "0x" prefix with %p will commonly result in "0x0x..." output. Drop the literal prefix here as well.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::~CRV: this:0x%p\n",this));

src/coreclr/inc/stresslog.h:316

• StressLog::LogMsg stores varargs based on cArgs. LogMsgOL currently passes cArgs=0 but also passes one vararg ("%s", format), so the argument is not stored and later formatting of "%s" will read a missing argument (undefined behavior / corrupted stress log output).
  src/coreclr/debug/di/divalue.cpp:744
• Using the literal prefix "0x" with %p will typically produce duplicated prefixes ("0x0x...") on platforms where %p already includes 0x. This file only has these two occurrences (constructor and destructor); consider dropping the explicit "0x" in both places for consistent output.

This issue also appears on line 813 of the same file.

    LOG((LF_CORDB,LL_EVERYTHING,"CRV::CRV: this:0x%p\n",this));