scanf analysis: the 'a' length modifier is valid with a scanlist

Before r148025 we (accidentally) didn't check whether a length modifier is
appropriate for a scanlist, but now we do.

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@148026 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/lib/Analysis/FormatString.cpp b/lib/Analysis/FormatString.cpp
index 8e295aa..3519735 100644
--- a/lib/Analysis/FormatString.cpp
+++ b/lib/Analysis/FormatString.cpp
@@ -550,6 +550,7 @@
       switch (CS.getKind()) {
         case ConversionSpecifier::sArg:
         case ConversionSpecifier::SArg:
+        case ConversionSpecifier::ScanListArg:
           return true;
         default:
           return false;
diff --git a/test/Sema/format-strings-c90.c b/test/Sema/format-strings-c90.c
index 1b00c38..74e5fb1 100644
--- a/test/Sema/format-strings-c90.c
+++ b/test/Sema/format-strings-c90.c
@@ -7,6 +7,7 @@
 void foo(char **sp, float *fp, int *ip) {
   /* TODO: Warn that the 'a' length modifier is an extension. */
   scanf("%as", sp);
+  scanf("%a[abc]", sp);
 
   /* TODO: Warn that the 'a' conversion specifier is a C99 feature. */
   scanf("%a", fp);
diff --git a/test/Sema/format-strings-scanf.c b/test/Sema/format-strings-scanf.c
index 2e32a26..7a2f278 100644
--- a/test/Sema/format-strings-scanf.c
+++ b/test/Sema/format-strings-scanf.c
@@ -68,8 +68,9 @@
   vsscanf(buf, "%[abc", ap); // expected-warning{{no closing ']' for '%[' in scanf format string}}
 }
 
-void test_scanlist(int *ip) {
+void test_scanlist(int *ip, char *sp) {
   scanf("%[abc]", ip); // expected-warning{{conversion specifies type 'char *' but the argument has type 'int *'}}
+  scanf("%h[abc]", sp); // expected-warning{{length modifier 'h' results in undefined behavior or no effect with '[' conversion specifier}}
 }
 
 void test_alloc_extension(char **sp, wchar_t **lsp) {