build: Add format string linter #13705

Add format string linter.

This linter checks that the number of arguments passed to each variadic format string function matches the number of format specifiers in the format string.

Example output:

$ test/lint/lint-format-strings.sh
src/init.cpp: Expected 2 argument(s) after format string but found 1 argument(s): 
  LogPrintf("We have a mismatch here: foo=%s bar=%d\n", foo)
src/init.cpp: Expected 1 argument(s) after format string but found 2 argument(s):
  LogPrint(BCLog::RPC, "RPC stopped. This is a mismatch: %s\n", s1, s2)
$ echo $?
1

@practicalswift Is this for a specific bug/issue you've seen previously?

@fanquake In the past there has been at least one incident where a mistake in the log message formatting resulted in a near DoS vulnerability. It was an under-tested error path in the network code with an invalid LogPrintf() spec. @laanwj has more details. @laanwj suggested writing a format string linter in #9423 (comment).

Yes, I think this is very useful! we've had some issues with this in the past. Better to find these issues before they cause runtime problems.

Thank for writing it in Python instead of making a long shell mess, this means I can usefully review it.

Needs rebase for some reason

@laanwj Weird! Now rebased!

Thanks, new error:

src/wallet/wallet.h: Expected 1 argument(s) after format string but found 2 argument(s): LogPrintf(("%s " + fmt).c_str(), GetDisplayName(), parameters...)

@laanwj Oh, a good chance to add linting also of WalletLogPrintf format strings. Fixed. Please re-review :-)

ACK bcd4b0f5cdde2a1b562a612c78ec1ef1fe47d3dd

This won't allow have template inside: https://travis-ci.org/bitcoin/bitcoin/jobs/414449333

@ken2812221 Oh, interesting! I’ll fix that. Thanks for reporting. In the meantime you can just add an exception (FALSE_POSITIVES) in the script to get around it.