New warnings and errors in Clang 16

Clang 16 will be available with Red Hat Enterprise Linux (RHEL) 8.9 and 9.3. Like Clang 15, it comes with some new warnings and errors enabled by default that more strictly enforce language standards and help prevent bugs.

Wimplicit-function-declaration

Starting with Clang 16, implicit function definitions will be considered an error instead of a warning. The C99 standard dropped support for implicit function definitions, but many compilers continued to accept them for backward compatibility.

Implicit function definitions are usually caused by a programmer forgetting to include a necessary header in a C file, or forgetting to add a function prototype when implementing a new function. They can be dangerous and lead to subtle bugs or even security issues, because without a prototype, the compiler will accept any number of arguments of any type passed to the function.  Passing too many arguments or arguments that are too large can override the stack and cause the program to crash or give an attacker the opportunity to insert malicious code.

$ cat implicit-function.c
int main(int argc, char **argv) {
  implicit_function();
}
$ clang-15 -c implicit-function.c
test.c:2:3: warning: call to undeclared function 'implicit_function'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
$ clang-16 -c implicit-function.c
test.c:2:3: error: call to undeclared function 'implicit_function'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]

Wimplicit-int

This is another warning that was upgraded to an error in Clang 16.  Prior to C99, functions without a return type were assumed to return int.  C99 dropped support for this feature, but just like with implicit function definitions, compilers continued to accept this as valid C code until now.

$ cat implicit-int.c 
main (int argc, char **argv) {
  return 0; 
}
$ clang-15 -c implicit-int.c
implicit-int.c:1:1: warning: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]
$ clang-16 -c implicit-int.c
implicit-int.c:1:1: error: type specifier missing, defaults to 'int'; ISO C99 and later do not support implicit int [-Wimplicit-int]

Wincompatible-function-pointer-types

This warning was also upgraded to an error by default in Clang 16.  It is able to detect when you use the wrong function type when initializing a function variable or passing a function as an argument to another function.

$ cat ifpt.c
int callback(int a, int b) {
    return a + b;
}

int do_something(int (*callback)(int)) {
    return callback(5);
}

int main (int argc, char **argv) {
    do_something(callback);
}
$ clang-15 -c ifpt.c
ifpt.c:10:18: warning: incompatible function pointer types passing 'int (int, int)' to parameter of type 'int (*)(int)' [-Wincompatible-function-pointer-types]

$ clang-16 -c ifpt.c
ifpt.c:10:18: error: incompatible function pointer types passing 'int (int, int)' to parameter of type 'int (*)(int)' [-Wincompatible-function-pointer-types]

Wcast-function-type-strict and Wincompatible-function-pointer-types-strict

These warnings were added to Clang 16 and are intended to help avoid false positives when using Control Flow Integrity (CFI). CFI is a security feature that prevents certain types of exploits by adding some extra checks around function calls.  For more details about how to use CFI, please refer to this blog post.

These warnings are "strict" versions of existing warnings that handle a few extra cases that are relevant to CFI.  For example, -Wincompatible-function-pointer-types-strict, will warn about enum and int mismatches even in cases where the enum is the same size as an int.

These warnings are not enabled by default, so if you want to use them, you need to explicitly pass these options to the compiler.  It is also a good idea to promote them to errors using the -Werror= flag to ensure that you don't introduce false positives into your program.

$ cat cfi.c
enum cfi_enum {
  A = -1,
  B = 0
};

int callback(int a) {
    return a;
}

int do_something(int (*callback)(enum cfi_enum)) {
    return callback(5);
}

int main (int argc, char **argv) {
    do_something(callback);
}
$ clang -fsanitize=cfi -flto -fvisibility=hidden cfi.c -o cfi
$ ./cfi 
Illegal instruction (core dumped)

Our application failed because we passed the wrong function type to do_something().  Notice that -Wincompatible-function-pointer-types did not catch this case and we need to use the strict variant if we want to be compatible with CFI.

$ clang -Werror=incompatible-function-pointer-types-strict -fsanitize=cfi -flto -fvisibility=hidden cfi.c -o cfi
cfi.c:15:18: error: incompatible function pointer types passing 'int (int)' to parameter of type 'int (*)(enum cfi_enum)' [-Werror,-Wincompatible-function-pointer-types-strict]

Disabling warnings

While these changes to warnings and errors are designed to help improve your application, you may encounter  situations where it’s not possible or you don't have time to fix some of these new errors.  In these cases, you can work around the problem by disabling or downgrading the error to a warning.  

To downgrade an error to a warning, use the -Wno-error= option like this:

$ clang -Wno-error=implicit-function-declaration -c implicit-function.c
implicit-function.c:1:37: warning: call to undeclared function 'implicit_function'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] int main(int argc, char **argv) {   implicit_function(); } 

To disable an error or warning completely, use the -Wno option:

$ clang -Wno-implicit-function-declaration -c implicit-function.c

Try it out

You don't need to wait until the next RHEL release to try out these new compiler features.  Clang-16 builds are available today in the CentOS Stream repositories.  If you are a C developer, give Clang-16 a try with your applications.  These new warnings and errors can help you catch bugs and ensure that your applications comply with the modern C standards.