1/* Internal functions for the *scanf* implementation.
2 Copyright (C) 1991-2020 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <https://www.gnu.org/licenses/>. */
18
19#include <assert.h>
20#include <errno.h>
21#include <limits.h>
22#include <ctype.h>
23#include <stdarg.h>
24#include <stdbool.h>
25#include <stdio.h>
26#include <stdint.h>
27#include <stdlib.h>
28#include <string.h>
29#include <wchar.h>
30#include <wctype.h>
31#include <libc-diag.h>
32#include <libc-lock.h>
33#include <locale/localeinfo.h>
34#include <scratch_buffer.h>
35
36#ifdef __GNUC__
37# define HAVE_LONGLONG
38# define LONGLONG long long
39#else
40# define LONGLONG long
41#endif
42
43/* Determine whether we have to handle `long long' at all. */
44#if LONG_MAX == LONG_LONG_MAX
45# define need_longlong 0
46#else
47# define need_longlong 1
48#endif
49
50/* Determine whether we have to handle `long'. */
51#if INT_MAX == LONG_MAX
52# define need_long 0
53#else
54# define need_long 1
55#endif
56
57/* Those are flags in the conversion format. */
58#define LONG 0x0001 /* l: long or double */
59#define LONGDBL 0x0002 /* L: long long or long double */
60#define SHORT 0x0004 /* h: short */
61#define SUPPRESS 0x0008 /* *: suppress assignment */
62#define POINTER 0x0010 /* weird %p pointer (`fake hex') */
63#define NOSKIP 0x0020 /* do not skip blanks */
64#define NUMBER_SIGNED 0x0040 /* signed integer */
65#define GROUP 0x0080 /* ': group numbers */
66#define GNU_MALLOC 0x0100 /* a: malloc strings */
67#define CHAR 0x0200 /* hh: char */
68#define I18N 0x0400 /* I: use locale's digits */
69#define HEXA_FLOAT 0x0800 /* hexadecimal float */
70#define READ_POINTER 0x1000 /* this is a pointer value */
71#define POSIX_MALLOC 0x2000 /* m: malloc strings */
72#define MALLOC (GNU_MALLOC | POSIX_MALLOC)
73
74#include <locale/localeinfo.h>
75#include <libioP.h>
76
77#ifdef COMPILE_WSCANF
78# define ungetc(c, s) ((void) (c == WEOF \
79 || (--read_in, \
80 _IO_sputbackwc (s, c))))
81# define ungetc_not_eof(c, s) ((void) (--read_in, \
82 _IO_sputbackwc (s, c)))
83# define inchar() (c == WEOF ? ((errno = inchar_errno), WEOF) \
84 : ((c = _IO_getwc_unlocked (s)), \
85 (void) (c != WEOF \
86 ? ++read_in \
87 : (size_t) (inchar_errno = errno)), c))
88
89# define ISSPACE(Ch) iswspace (Ch)
90# define ISDIGIT(Ch) iswdigit (Ch)
91# define ISXDIGIT(Ch) iswxdigit (Ch)
92# define TOLOWER(Ch) towlower (Ch)
93# define ORIENT if (_IO_fwide (s, 1) != 1) return WEOF
94# define __strtoll_internal __wcstoll_internal
95# define __strtoull_internal __wcstoull_internal
96# define __strtol_internal __wcstol_internal
97# define __strtoul_internal __wcstoul_internal
98# define __strtold_internal __wcstold_internal
99# define __strtod_internal __wcstod_internal
100# define __strtof_internal __wcstof_internal
101# if __HAVE_FLOAT128_UNLIKE_LDBL
102# define __strtof128_internal __wcstof128_internal
103# endif
104
105# define L_(Str) L##Str
106# define CHAR_T wchar_t
107# define UCHAR_T unsigned int
108# define WINT_T wint_t
109# undef EOF
110# define EOF WEOF
111#else
112# define ungetc(c, s) ((void) ((int) c == EOF \
113 || (--read_in, \
114 _IO_sputbackc (s, (unsigned char) c))))
115# define ungetc_not_eof(c, s) ((void) (--read_in, \
116 _IO_sputbackc (s, (unsigned char) c)))
117# define inchar() (c == EOF ? ((errno = inchar_errno), EOF) \
118 : ((c = _IO_getc_unlocked (s)), \
119 (void) (c != EOF \
120 ? ++read_in \
121 : (size_t) (inchar_errno = errno)), c))
122# define ISSPACE(Ch) __isspace_l (Ch, loc)
123# define ISDIGIT(Ch) __isdigit_l (Ch, loc)
124# define ISXDIGIT(Ch) __isxdigit_l (Ch, loc)
125# define TOLOWER(Ch) __tolower_l ((unsigned char) (Ch), loc)
126# define ORIENT if (_IO_vtable_offset (s) == 0 \
127 && _IO_fwide (s, -1) != -1) \
128 return EOF
129
130# define L_(Str) Str
131# define CHAR_T char
132# define UCHAR_T unsigned char
133# define WINT_T int
134#endif
135
136#include "printf-parse.h" /* Use read_int. */
137
138#define encode_error() do { \
139 __set_errno (EILSEQ); \
140 goto errout; \
141 } while (0)
142#define conv_error() do { \
143 goto errout; \
144 } while (0)
145#define input_error() do { \
146 if (done == 0) done = EOF; \
147 goto errout; \
148 } while (0)
149#define add_ptr_to_free(ptr) \
150 do \
151 { \
152 if (ptrs_to_free == NULL \
153 || ptrs_to_free->count == (sizeof (ptrs_to_free->ptrs) \
154 / sizeof (ptrs_to_free->ptrs[0]))) \
155 { \
156 struct ptrs_to_free *new_ptrs = alloca (sizeof (*ptrs_to_free)); \
157 new_ptrs->count = 0; \
158 new_ptrs->next = ptrs_to_free; \
159 ptrs_to_free = new_ptrs; \
160 } \
161 ptrs_to_free->ptrs[ptrs_to_free->count++] = (ptr); \
162 } \
163 while (0)
164#define ARGCHECK(s, format) \
165 do \
166 { \
167 /* Check file argument for consistence. */ \
168 CHECK_FILE (s, EOF); \
169 if (s->_flags & _IO_NO_READS) \
170 { \
171 __set_errno (EBADF); \
172 return EOF; \
173 } \
174 else if (format == NULL) \
175 { \
176 __set_errno (EINVAL); \
177 return EOF; \
178 } \
179 } while (0)
180#define LOCK_STREAM(S) \
181 __libc_cleanup_region_start (1, (void (*) (void *)) &_IO_funlockfile, (S)); \
182 _IO_flockfile (S)
183#define UNLOCK_STREAM(S) \
184 _IO_funlockfile (S); \
185 __libc_cleanup_region_end (0)
186
187struct ptrs_to_free
188{
189 size_t count;
190 struct ptrs_to_free *next;
191 char **ptrs[32];
192};
193
194struct char_buffer {
195 CHAR_T *current;
196 CHAR_T *end;
197 struct scratch_buffer scratch;
198};
199
200/* Returns a pointer to the first CHAR_T object in the buffer. Only
201 valid if char_buffer_add (BUFFER, CH) has been called and
202 char_buffer_error (BUFFER) is false. */
203static inline CHAR_T *
204char_buffer_start (const struct char_buffer *buffer)
205{
206 return (CHAR_T *) buffer->scratch.data;
207}
208
209/* Returns the number of CHAR_T objects in the buffer. Only valid if
210 char_buffer_error (BUFFER) is false. */
211static inline size_t
212char_buffer_size (const struct char_buffer *buffer)
213{
214 return buffer->current - char_buffer_start (buffer);
215}
216
217/* Reinitializes BUFFER->current and BUFFER->end to cover the entire
218 scratch buffer. */
219static inline void
220char_buffer_rewind (struct char_buffer *buffer)
221{
222 buffer->current = char_buffer_start (buffer);
223 buffer->end = buffer->current + buffer->scratch.length / sizeof (CHAR_T);
224}
225
226/* Returns true if a previous call to char_buffer_add (BUFFER, CH)
227 failed. */
228static inline bool
229char_buffer_error (const struct char_buffer *buffer)
230{
231 return __glibc_unlikely (buffer->current == NULL);
232}
233
234/* Slow path for char_buffer_add. */
235static void
236char_buffer_add_slow (struct char_buffer *buffer, CHAR_T ch)
237{
238 if (char_buffer_error (buffer))
239 return;
240 size_t offset = buffer->end - (CHAR_T *) buffer->scratch.data;
241 if (!scratch_buffer_grow_preserve (&buffer->scratch))
242 {
243 buffer->current = NULL;
244 buffer->end = NULL;
245 return;
246 }
247 char_buffer_rewind (buffer);
248 buffer->current += offset;
249 *buffer->current++ = ch;
250}
251
252/* Adds CH to BUFFER. This function does not report any errors, check
253 for them with char_buffer_error. */
254static inline void
255char_buffer_add (struct char_buffer *buffer, CHAR_T ch)
256 __attribute__ ((always_inline));
257static inline void
258char_buffer_add (struct char_buffer *buffer, CHAR_T ch)
259{
260 if (__glibc_unlikely (buffer->current == buffer->end))
261 char_buffer_add_slow (buffer, ch);
262 else
263 *buffer->current++ = ch;
264}
265
266/* Read formatted input from S according to the format string
267 FORMAT, using the argument list in ARG.
268 Return the number of assignments made, or -1 for an input error. */
269#ifdef COMPILE_WSCANF
270int
271__vfwscanf_internal (FILE *s, const wchar_t *format, va_list argptr,
272 unsigned int mode_flags)
273#else
274int
275__vfscanf_internal (FILE *s, const char *format, va_list argptr,
276 unsigned int mode_flags)
277#endif
278{
279 va_list arg;
280 const CHAR_T *f = format;
281 UCHAR_T fc; /* Current character of the format. */
282 WINT_T done = 0; /* Assignments done. */
283 size_t read_in = 0; /* Chars read in. */
284 WINT_T c = 0; /* Last char read. */
285 int width; /* Maximum field width. */
286 int flags; /* Modifiers for current format element. */
287#ifndef COMPILE_WSCANF
288 locale_t loc = _NL_CURRENT_LOCALE;
289 struct __locale_data *const curctype = loc->__locales[LC_CTYPE];
290#endif
291
292 /* Errno of last failed inchar call. */
293 int inchar_errno = 0;
294 /* Status for reading F-P nums. */
295 char got_digit, got_dot, got_e, got_sign;
296 /* If a [...] is a [^...]. */
297 CHAR_T not_in;
298#define exp_char not_in
299 /* Base for integral numbers. */
300 int base;
301 /* Decimal point character. */
302#ifdef COMPILE_WSCANF
303 wint_t decimal;
304#else
305 const char *decimal;
306#endif
307 /* The thousands character of the current locale. */
308#ifdef COMPILE_WSCANF
309 wint_t thousands;
310#else
311 const char *thousands;
312#endif
313 struct ptrs_to_free *ptrs_to_free = NULL;
314 /* State for the conversions. */
315 mbstate_t state;
316 /* Integral holding variables. */
317 union
318 {
319 long long int q;
320 unsigned long long int uq;
321 long int l;
322 unsigned long int ul;
323 } num;
324 /* Character-buffer pointer. */
325 char *str = NULL;
326 wchar_t *wstr = NULL;
327 char **strptr = NULL;
328 ssize_t strsize = 0;
329 /* We must not react on white spaces immediately because they can
330 possibly be matched even if in the input stream no character is
331 available anymore. */
332 int skip_space = 0;
333 /* Workspace. */
334 CHAR_T *tw; /* Temporary pointer. */
335 struct char_buffer charbuf;
336 scratch_buffer_init (&charbuf.scratch);
337
338#ifdef __va_copy
339 __va_copy (arg, argptr);
340#else
341 arg = (va_list) argptr;
342#endif
343
344#ifdef ORIENT
345 ORIENT;
346#endif
347
348 ARGCHECK (s, format);
349
350 {
351#ifndef COMPILE_WSCANF
352 struct __locale_data *const curnumeric = loc->__locales[LC_NUMERIC];
353#endif
354
355 /* Figure out the decimal point character. */
356#ifdef COMPILE_WSCANF
357 decimal = _NL_CURRENT_WORD (LC_NUMERIC, _NL_NUMERIC_DECIMAL_POINT_WC);
358#else
359 decimal = curnumeric->values[_NL_ITEM_INDEX (DECIMAL_POINT)].string;
360#endif
361 /* Figure out the thousands separator character. */
362#ifdef COMPILE_WSCANF
363 thousands = _NL_CURRENT_WORD (LC_NUMERIC, _NL_NUMERIC_THOUSANDS_SEP_WC);
364#else
365 thousands = curnumeric->values[_NL_ITEM_INDEX (THOUSANDS_SEP)].string;
366 if (*thousands == '\0')
367 thousands = NULL;
368#endif
369 }
370
371 /* Lock the stream. */
372 LOCK_STREAM (s);
373
374
375#ifndef COMPILE_WSCANF
376 /* From now on we use `state' to convert the format string. */
377 memset (&state, '\0', sizeof (state));
378#endif
379
380 /* Run through the format string. */
381 while (*f != '\0')
382 {
383 unsigned int argpos;
384 /* Extract the next argument, which is of type TYPE.
385 For a %N$... spec, this is the Nth argument from the beginning;
386 otherwise it is the next argument after the state now in ARG. */
387#ifdef __va_copy
388# define ARG(type) (argpos == 0 ? va_arg (arg, type) \
389 : ({ unsigned int pos = argpos; \
390 va_list arg; \
391 __va_copy (arg, argptr); \
392 while (--pos > 0) \
393 (void) va_arg (arg, void *); \
394 va_arg (arg, type); \
395 }))
396#else
397# if 0
398 /* XXX Possible optimization. */
399# define ARG(type) (argpos == 0 ? va_arg (arg, type) \
400 : ({ va_list arg = (va_list) argptr; \
401 arg = (va_list) ((char *) arg \
402 + (argpos - 1) \
403 * __va_rounded_size (void *)); \
404 va_arg (arg, type); \
405 }))
406# else
407# define ARG(type) (argpos == 0 ? va_arg (arg, type) \
408 : ({ unsigned int pos = argpos; \
409 va_list arg = (va_list) argptr; \
410 while (--pos > 0) \
411 (void) va_arg (arg, void *); \
412 va_arg (arg, type); \
413 }))
414# endif
415#endif
416
417#ifndef COMPILE_WSCANF
418 if (!isascii ((unsigned char) *f))
419 {
420 /* Non-ASCII, may be a multibyte. */
421 int len = __mbrlen (f, strlen (f), &state);
422 if (len > 0)
423 {
424 do
425 {
426 c = inchar ();
427 if (__glibc_unlikely (c == EOF))
428 input_error ();
429 else if (c != (unsigned char) *f++)
430 {
431 ungetc_not_eof (c, s);
432 conv_error ();
433 }
434 }
435 while (--len > 0);
436 continue;
437 }
438 }
439#endif
440
441 fc = *f++;
442 if (fc != '%')
443 {
444 /* Remember to skip spaces. */
445 if (ISSPACE (fc))
446 {
447 skip_space = 1;
448 continue;
449 }
450
451 /* Read a character. */
452 c = inchar ();
453
454 /* Characters other than format specs must just match. */
455 if (__glibc_unlikely (c == EOF))
456 input_error ();
457
458 /* We saw white space char as the last character in the format
459 string. Now it's time to skip all leading white space. */
460 if (skip_space)
461 {
462 while (ISSPACE (c))
463 if (__glibc_unlikely (inchar () == EOF))
464 input_error ();
465 skip_space = 0;
466 }
467
468 if (__glibc_unlikely (c != fc))
469 {
470 ungetc (c, s);
471 conv_error ();
472 }
473
474 continue;
475 }
476
477 /* This is the start of the conversion string. */
478 flags = 0;
479
480 /* Initialize state of modifiers. */
481 argpos = 0;
482
483 /* Prepare temporary buffer. */
484 char_buffer_rewind (&charbuf);
485
486 /* Check for a positional parameter specification. */
487 if (ISDIGIT ((UCHAR_T) *f))
488 {
489 argpos = read_int ((const UCHAR_T **) &f);
490 if (*f == L_('$'))
491 ++f;
492 else
493 {
494 /* Oops; that was actually the field width. */
495 width = argpos;
496 argpos = 0;
497 goto got_width;
498 }
499 }
500
501 /* Check for the assignment-suppressing, the number grouping flag,
502 and the signal to use the locale's digit representation. */
503 while (*f == L_('*') || *f == L_('\'') || *f == L_('I'))
504 switch (*f++)
505 {
506 case L_('*'):
507 flags |= SUPPRESS;
508 break;
509 case L_('\''):
510#ifdef COMPILE_WSCANF
511 if (thousands != L'\0')
512#else
513 if (thousands != NULL)
514#endif
515 flags |= GROUP;
516 break;
517 case L_('I'):
518 flags |= I18N;
519 break;
520 }
521
522 /* Find the maximum field width. */
523 width = 0;
524 if (ISDIGIT ((UCHAR_T) *f))
525 width = read_int ((const UCHAR_T **) &f);
526 got_width:
527 if (width == 0)
528 width = -1;
529
530 /* Check for type modifiers. */
531 switch (*f++)
532 {
533 case L_('h'):
534 /* ints are short ints or chars. */
535 if (*f == L_('h'))
536 {
537 ++f;
538 flags |= CHAR;
539 }
540 else
541 flags |= SHORT;
542 break;
543 case L_('l'):
544 if (*f == L_('l'))
545 {
546 /* A double `l' is equivalent to an `L'. */
547 ++f;
548 flags |= LONGDBL | LONG;
549 }
550 else
551 /* ints are long ints. */
552 flags |= LONG;
553 break;
554 case L_('q'):
555 case L_('L'):
556 /* doubles are long doubles, and ints are long long ints. */
557 flags |= LONGDBL | LONG;
558 break;
559 case L_('a'):
560 /* The `a' is used as a flag only if followed by `s', `S' or
561 `['. */
562 if (*f != L_('s') && *f != L_('S') && *f != L_('['))
563 {
564 --f;
565 break;
566 }
567 /* In __isoc99_*scanf %as, %aS and %a[ extension is not
568 supported at all. */
569 if (__glibc_likely ((mode_flags & SCANF_ISOC99_A) != 0))
570 {
571 --f;
572 break;
573 }
574 /* String conversions (%s, %[) take a `char **'
575 arg and fill it in with a malloc'd pointer. */
576 flags |= GNU_MALLOC;
577 break;
578 case L_('m'):
579 flags |= POSIX_MALLOC;
580 if (*f == L_('l'))
581 {
582 ++f;
583 flags |= LONG;
584 }
585 break;
586 case L_('z'):
587 if (need_longlong && sizeof (size_t) > sizeof (unsigned long int))
588 flags |= LONGDBL;
589 else if (sizeof (size_t) > sizeof (unsigned int))
590 flags |= LONG;
591 break;
592 case L_('j'):
593 if (need_longlong && sizeof (uintmax_t) > sizeof (unsigned long int))
594 flags |= LONGDBL;
595 else if (sizeof (uintmax_t) > sizeof (unsigned int))
596 flags |= LONG;
597 break;
598 case L_('t'):
599 if (need_longlong && sizeof (ptrdiff_t) > sizeof (long int))
600 flags |= LONGDBL;
601 else if (sizeof (ptrdiff_t) > sizeof (int))
602 flags |= LONG;
603 break;
604 default:
605 /* Not a recognized modifier. Backup. */
606 --f;
607 break;
608 }
609
610 /* End of the format string? */
611 if (__glibc_unlikely (*f == L_('\0')))
612 conv_error ();
613
614 /* Find the conversion specifier. */
615 fc = *f++;
616 if (skip_space || (fc != L_('[') && fc != L_('c')
617 && fc != L_('C') && fc != L_('n')))
618 {
619 /* Eat whitespace. */
620 int save_errno = errno;
621 __set_errno (0);
622 do
623 /* We add the additional test for EOF here since otherwise
624 inchar will restore the old errno value which might be
625 EINTR but does not indicate an interrupt since nothing
626 was read at this time. */
627 if (__builtin_expect ((c == EOF || inchar () == EOF)
628 && errno == EINTR, 0))
629 input_error ();
630 while (ISSPACE (c));
631 __set_errno (save_errno);
632 ungetc (c, s);
633 skip_space = 0;
634 }
635
636 switch (fc)
637 {
638 case L_('%'): /* Must match a literal '%'. */
639 c = inchar ();
640 if (__glibc_unlikely (c == EOF))
641 input_error ();
642 if (__glibc_unlikely (c != fc))
643 {
644 ungetc_not_eof (c, s);
645 conv_error ();
646 }
647 break;
648
649 case L_('n'): /* Answer number of assignments done. */
650 /* Corrigendum 1 to ISO C 1990 describes the allowed flags
651 with the 'n' conversion specifier. */
652 if (!(flags & SUPPRESS))
653 {
654 /* Don't count the read-ahead. */
655 if (need_longlong && (flags & LONGDBL))
656 *ARG (long long int *) = read_in;
657 else if (need_long && (flags & LONG))
658 *ARG (long int *) = read_in;
659 else if (flags & SHORT)
660 *ARG (short int *) = read_in;
661 else if (!(flags & CHAR))
662 *ARG (int *) = read_in;
663 else
664 *ARG (char *) = read_in;
665
666#ifdef NO_BUG_IN_ISO_C_CORRIGENDUM_1
667 /* We have a severe problem here. The ISO C standard
668 contradicts itself in explaining the effect of the %n
669 format in `scanf'. While in ISO C:1990 and the ISO C
670 Amendement 1:1995 the result is described as
671
672 Execution of a %n directive does not effect the
673 assignment count returned at the completion of
674 execution of the f(w)scanf function.
675
676 in ISO C Corrigendum 1:1994 the following was added:
677
678 Subclause 7.9.6.2
679 Add the following fourth example:
680 In:
681 #include <stdio.h>
682 int d1, d2, n1, n2, i;
683 i = sscanf("123", "%d%n%n%d", &d1, &n1, &n2, &d2);
684 the value 123 is assigned to d1 and the value3 to n1.
685 Because %n can never get an input failure the value
686 of 3 is also assigned to n2. The value of d2 is not
687 affected. The value 3 is assigned to i.
688
689 We go for now with the historically correct code from ISO C,
690 i.e., we don't count the %n assignments. When it ever
691 should proof to be wrong just remove the #ifdef above. */
692 ++done;
693#endif
694 }
695 break;
696
697 case L_('c'): /* Match characters. */
698 if ((flags & LONG) == 0)
699 {
700 if (width == -1)
701 width = 1;
702
703#define STRING_ARG(Str, Type, Width) \
704 do if (!(flags & SUPPRESS)) \
705 { \
706 if (flags & MALLOC) \
707 { \
708 /* The string is to be stored in a malloc'd buffer. */ \
709 /* For %mS using char ** is actually wrong, but \
710 shouldn't make a difference on any arch glibc \
711 supports and would unnecessarily complicate \
712 things. */ \
713 strptr = ARG (char **); \
714 if (strptr == NULL) \
715 conv_error (); \
716 /* Allocate an initial buffer. */ \
717 strsize = Width; \
718 *strptr = (char *) malloc (strsize * sizeof (Type)); \
719 Str = (Type *) *strptr; \
720 if (Str != NULL) \
721 add_ptr_to_free (strptr); \
722 else if (flags & POSIX_MALLOC) \
723 { \
724 done = EOF; \
725 goto errout; \
726 } \
727 } \
728 else \
729 Str = ARG (Type *); \
730 if (Str == NULL) \
731 conv_error (); \
732 } while (0)
733#ifdef COMPILE_WSCANF
734 STRING_ARG (str, char, 100);
735#else
736 STRING_ARG (str, char, (width > 1024 ? 1024 : width));
737#endif
738
739 c = inchar ();
740 if (__glibc_unlikely (c == EOF))
741 input_error ();
742
743#ifdef COMPILE_WSCANF
744 /* We have to convert the wide character(s) into multibyte
745 characters and store the result. */
746 memset (&state, '\0', sizeof (state));
747
748 do
749 {
750 size_t n;
751
752 if (!(flags & SUPPRESS) && (flags & POSIX_MALLOC)
753 && *strptr + strsize - str <= MB_LEN_MAX)
754 {
755 /* We have to enlarge the buffer if the `m' flag
756 was given. */
757 size_t strleng = str - *strptr;
758 char *newstr;
759
760 newstr = (char *) realloc (*strptr, strsize * 2);
761 if (newstr == NULL)
762 {
763 /* Can't allocate that much. Last-ditch effort. */
764 newstr = (char *) realloc (*strptr,
765 strleng + MB_LEN_MAX);
766 if (newstr == NULL)
767 {
768 /* c can't have `a' flag, only `m'. */
769 done = EOF;
770 goto errout;
771 }
772 else
773 {
774 *strptr = newstr;
775 str = newstr + strleng;
776 strsize = strleng + MB_LEN_MAX;
777 }
778 }
779 else
780 {
781 *strptr = newstr;
782 str = newstr + strleng;
783 strsize *= 2;
784 }
785 }
786
787 n = __wcrtomb (!(flags & SUPPRESS) ? str : NULL, c, &state);
788 if (__glibc_unlikely (n == (size_t) -1))
789 /* No valid wide character. */
790 input_error ();
791
792 /* Increment the output pointer. Even if we don't
793 write anything. */
794 str += n;
795 }
796 while (--width > 0 && inchar () != EOF);
797#else
798 if (!(flags & SUPPRESS))
799 {
800 do
801 {
802 if ((flags & MALLOC)
803 && (char *) str == *strptr + strsize)
804 {
805 /* Enlarge the buffer. */
806 size_t newsize
807 = strsize
808 + (strsize >= width ? width - 1 : strsize);
809
810 str = (char *) realloc (*strptr, newsize);
811 if (str == NULL)
812 {
813 /* Can't allocate that much. Last-ditch
814 effort. */
815 str = (char *) realloc (*strptr, strsize + 1);
816 if (str == NULL)
817 {
818 /* c can't have `a' flag, only `m'. */
819 done = EOF;
820 goto errout;
821 }
822 else
823 {
824 *strptr = (char *) str;
825 str += strsize;
826 ++strsize;
827 }
828 }
829 else
830 {
831 *strptr = (char *) str;
832 str += strsize;
833 strsize = newsize;
834 }
835 }
836 *str++ = c;
837 }
838 while (--width > 0 && inchar () != EOF);
839 }
840 else
841 while (--width > 0 && inchar () != EOF);
842#endif
843
844 if (!(flags & SUPPRESS))
845 {
846 if ((flags & MALLOC) && str - *strptr != strsize)
847 {
848 char *cp = (char *) realloc (*strptr, str - *strptr);
849 if (cp != NULL)
850 *strptr = cp;
851 }
852 strptr = NULL;
853 ++done;
854 }
855
856 break;
857 }
858 /* FALLTHROUGH */
859 case L_('C'):
860 if (width == -1)
861 width = 1;
862
863 STRING_ARG (wstr, wchar_t, (width > 1024 ? 1024 : width));
864
865 c = inchar ();
866 if (__glibc_unlikely (c == EOF))
867 input_error ();
868
869#ifdef COMPILE_WSCANF
870 /* Just store the incoming wide characters. */
871 if (!(flags & SUPPRESS))
872 {
873 do
874 {
875 if ((flags & MALLOC)
876 && wstr == (wchar_t *) *strptr + strsize)
877 {
878 size_t newsize
879 = strsize + (strsize > width ? width - 1 : strsize);
880 /* Enlarge the buffer. */
881 wstr = (wchar_t *) realloc (*strptr,
882 newsize * sizeof (wchar_t));
883 if (wstr == NULL)
884 {
885 /* Can't allocate that much. Last-ditch effort. */
886 wstr = (wchar_t *) realloc (*strptr,
887 (strsize + 1)
888 * sizeof (wchar_t));
889 if (wstr == NULL)
890 {
891 /* C or lc can't have `a' flag, only `m'
892 flag. */
893 done = EOF;
894 goto errout;
895 }
896 else
897 {
898 *strptr = (char *) wstr;
899 wstr += strsize;
900 ++strsize;
901 }
902 }
903 else
904 {
905 *strptr = (char *) wstr;
906 wstr += strsize;
907 strsize = newsize;
908 }
909 }
910 *wstr++ = c;
911 }
912 while (--width > 0 && inchar () != EOF);
913 }
914 else
915 while (--width > 0 && inchar () != EOF);
916#else
917 {
918 /* We have to convert the multibyte input sequence to wide
919 characters. */
920 char buf[1];
921 mbstate_t cstate;
922
923 memset (&cstate, '\0', sizeof (cstate));
924
925 do
926 {
927 /* This is what we present the mbrtowc function first. */
928 buf[0] = c;
929
930 if (!(flags & SUPPRESS) && (flags & MALLOC)
931 && wstr == (wchar_t *) *strptr + strsize)
932 {
933 size_t newsize
934 = strsize + (strsize > width ? width - 1 : strsize);
935 /* Enlarge the buffer. */
936 wstr = (wchar_t *) realloc (*strptr,
937 newsize * sizeof (wchar_t));
938 if (wstr == NULL)
939 {
940 /* Can't allocate that much. Last-ditch effort. */
941 wstr = (wchar_t *) realloc (*strptr,
942 ((strsize + 1)
943 * sizeof (wchar_t)));
944 if (wstr == NULL)
945 {
946 /* C or lc can't have `a' flag, only `m' flag. */
947 done = EOF;
948 goto errout;
949 }
950 else
951 {
952 *strptr = (char *) wstr;
953 wstr += strsize;
954 ++strsize;
955 }
956 }
957 else
958 {
959 *strptr = (char *) wstr;
960 wstr += strsize;
961 strsize = newsize;
962 }
963 }
964
965 while (1)
966 {
967 size_t n;
968
969 n = __mbrtowc (!(flags & SUPPRESS) ? wstr : NULL,
970 buf, 1, &cstate);
971
972 if (n == (size_t) -2)
973 {
974 /* Possibly correct character, just not enough
975 input. */
976 if (__glibc_unlikely (inchar () == EOF))
977 encode_error ();
978
979 buf[0] = c;
980 continue;
981 }
982
983 if (__glibc_unlikely (n != 1))
984 encode_error ();
985
986 /* We have a match. */
987 break;
988 }
989
990 /* Advance the result pointer. */
991 ++wstr;
992 }
993 while (--width > 0 && inchar () != EOF);
994 }
995#endif
996
997 if (!(flags & SUPPRESS))
998 {
999 if ((flags & MALLOC) && wstr - (wchar_t *) *strptr != strsize)
1000 {
1001 wchar_t *cp = (wchar_t *) realloc (*strptr,
1002 ((wstr
1003 - (wchar_t *) *strptr)
1004 * sizeof (wchar_t)));
1005 if (cp != NULL)
1006 *strptr = (char *) cp;
1007 }
1008 strptr = NULL;
1009
1010 ++done;
1011 }
1012
1013 break;
1014
1015 case L_('s'): /* Read a string. */
1016 if (!(flags & LONG))
1017 {
1018 STRING_ARG (str, char, 100);
1019
1020 c = inchar ();
1021 if (__glibc_unlikely (c == EOF))
1022 input_error ();
1023
1024#ifdef COMPILE_WSCANF
1025 memset (&state, '\0', sizeof (state));
1026#endif
1027
1028 do
1029 {
1030 if (ISSPACE (c))
1031 {
1032 ungetc_not_eof (c, s);
1033 break;
1034 }
1035
1036#ifdef COMPILE_WSCANF
1037 /* This is quite complicated. We have to convert the
1038 wide characters into multibyte characters and then
1039 store them. */
1040 {
1041 size_t n;
1042
1043 if (!(flags & SUPPRESS) && (flags & MALLOC)
1044 && *strptr + strsize - str <= MB_LEN_MAX)
1045 {
1046 /* We have to enlarge the buffer if the `a' or `m'
1047 flag was given. */
1048 size_t strleng = str - *strptr;
1049 char *newstr;
1050
1051 newstr = (char *) realloc (*strptr, strsize * 2);
1052 if (newstr == NULL)
1053 {
1054 /* Can't allocate that much. Last-ditch
1055 effort. */
1056 newstr = (char *) realloc (*strptr,
1057 strleng + MB_LEN_MAX);
1058 if (newstr == NULL)
1059 {
1060 if (flags & POSIX_MALLOC)
1061 {
1062 done = EOF;
1063 goto errout;
1064 }
1065 /* We lose. Oh well. Terminate the
1066 string and stop converting,
1067 so at least we don't skip any input. */
1068 ((char *) (*strptr))[strleng] = '\0';
1069 strptr = NULL;
1070 ++done;
1071 conv_error ();
1072 }
1073 else
1074 {
1075 *strptr = newstr;
1076 str = newstr + strleng;
1077 strsize = strleng + MB_LEN_MAX;
1078 }
1079 }
1080 else
1081 {
1082 *strptr = newstr;
1083 str = newstr + strleng;
1084 strsize *= 2;
1085 }
1086 }
1087
1088 n = __wcrtomb (!(flags & SUPPRESS) ? str : NULL, c,
1089 &state);
1090 if (__glibc_unlikely (n == (size_t) -1))
1091 encode_error ();
1092
1093 assert (n <= MB_LEN_MAX);
1094 str += n;
1095 }
1096#else
1097 /* This is easy. */
1098 if (!(flags & SUPPRESS))
1099 {
1100 *str++ = c;
1101 if ((flags & MALLOC)
1102 && (char *) str == *strptr + strsize)
1103 {
1104 /* Enlarge the buffer. */
1105 str = (char *) realloc (*strptr, 2 * strsize);
1106 if (str == NULL)
1107 {
1108 /* Can't allocate that much. Last-ditch
1109 effort. */
1110 str = (char *) realloc (*strptr, strsize + 1);
1111 if (str == NULL)
1112 {
1113 if (flags & POSIX_MALLOC)
1114 {
1115 done = EOF;
1116 goto errout;
1117 }
1118 /* We lose. Oh well. Terminate the
1119 string and stop converting,
1120 so at least we don't skip any input. */
1121 ((char *) (*strptr))[strsize - 1] = '\0';
1122 strptr = NULL;
1123 ++done;
1124 conv_error ();
1125 }
1126 else
1127 {
1128 *strptr = (char *) str;
1129 str += strsize;
1130 ++strsize;
1131 }
1132 }
1133 else
1134 {
1135 *strptr = (char *) str;
1136 str += strsize;
1137 strsize *= 2;
1138 }
1139 }
1140 }
1141#endif
1142 }
1143 while ((width <= 0 || --width > 0) && inchar () != EOF);
1144
1145 if (!(flags & SUPPRESS))
1146 {
1147#ifdef COMPILE_WSCANF
1148 /* We have to emit the code to get into the initial
1149 state. */
1150 char buf[MB_LEN_MAX];
1151 size_t n = __wcrtomb (buf, L'\0', &state);
1152 if (n > 0 && (flags & MALLOC)
1153 && str + n >= *strptr + strsize)
1154 {
1155 /* Enlarge the buffer. */
1156 size_t strleng = str - *strptr;
1157 char *newstr;
1158
1159 newstr = (char *) realloc (*strptr, strleng + n + 1);
1160 if (newstr == NULL)
1161 {
1162 if (flags & POSIX_MALLOC)
1163 {
1164 done = EOF;
1165 goto errout;
1166 }
1167 /* We lose. Oh well. Terminate the string
1168 and stop converting, so at least we don't
1169 skip any input. */
1170 ((char *) (*strptr))[strleng] = '\0';
1171 strptr = NULL;
1172 ++done;
1173 conv_error ();
1174 }
1175 else
1176 {
1177 *strptr = newstr;
1178 str = newstr + strleng;
1179 strsize = strleng + n + 1;
1180 }
1181 }
1182
1183 str = __mempcpy (str, buf, n);
1184#endif
1185 *str++ = '\0';
1186
1187 if ((flags & MALLOC) && str - *strptr != strsize)
1188 {
1189 char *cp = (char *) realloc (*strptr, str - *strptr);
1190 if (cp != NULL)
1191 *strptr = cp;
1192 }
1193 strptr = NULL;
1194
1195 ++done;
1196 }
1197 break;
1198 }
1199 /* FALLTHROUGH */
1200
1201 case L_('S'):
1202 {
1203#ifndef COMPILE_WSCANF
1204 mbstate_t cstate;
1205#endif
1206
1207 /* Wide character string. */
1208 STRING_ARG (wstr, wchar_t, 100);
1209
1210 c = inchar ();
1211 if (__builtin_expect (c == EOF, 0))
1212 input_error ();
1213
1214#ifndef COMPILE_WSCANF
1215 memset (&cstate, '\0', sizeof (cstate));
1216#endif
1217
1218 do
1219 {
1220 if (ISSPACE (c))
1221 {
1222 ungetc_not_eof (c, s);
1223 break;
1224 }
1225
1226#ifdef COMPILE_WSCANF
1227 /* This is easy. */
1228 if (!(flags & SUPPRESS))
1229 {
1230 *wstr++ = c;
1231 if ((flags & MALLOC)
1232 && wstr == (wchar_t *) *strptr + strsize)
1233 {
1234 /* Enlarge the buffer. */
1235 wstr = (wchar_t *) realloc (*strptr,
1236 (2 * strsize)
1237 * sizeof (wchar_t));
1238 if (wstr == NULL)
1239 {
1240 /* Can't allocate that much. Last-ditch
1241 effort. */
1242 wstr = (wchar_t *) realloc (*strptr,
1243 (strsize + 1)
1244 * sizeof (wchar_t));
1245 if (wstr == NULL)
1246 {
1247 if (flags & POSIX_MALLOC)
1248 {
1249 done = EOF;
1250 goto errout;
1251 }
1252 /* We lose. Oh well. Terminate the string
1253 and stop converting, so at least we don't
1254 skip any input. */
1255 ((wchar_t *) (*strptr))[strsize - 1] = L'\0';
1256 strptr = NULL;
1257 ++done;
1258 conv_error ();
1259 }
1260 else
1261 {
1262 *strptr = (char *) wstr;
1263 wstr += strsize;
1264 ++strsize;
1265 }
1266 }
1267 else
1268 {
1269 *strptr = (char *) wstr;
1270 wstr += strsize;
1271 strsize *= 2;
1272 }
1273 }
1274 }
1275#else
1276 {
1277 char buf[1];
1278
1279 buf[0] = c;
1280
1281 while (1)
1282 {
1283 size_t n;
1284
1285 n = __mbrtowc (!(flags & SUPPRESS) ? wstr : NULL,
1286 buf, 1, &cstate);
1287
1288 if (n == (size_t) -2)
1289 {
1290 /* Possibly correct character, just not enough
1291 input. */
1292 if (__glibc_unlikely (inchar () == EOF))
1293 encode_error ();
1294
1295 buf[0] = c;
1296 continue;
1297 }
1298
1299 if (__glibc_unlikely (n != 1))
1300 encode_error ();
1301
1302 /* We have a match. */
1303 ++wstr;
1304 break;
1305 }
1306
1307 if (!(flags & SUPPRESS) && (flags & MALLOC)
1308 && wstr == (wchar_t *) *strptr + strsize)
1309 {
1310 /* Enlarge the buffer. */
1311 wstr = (wchar_t *) realloc (*strptr,
1312 (2 * strsize
1313 * sizeof (wchar_t)));
1314 if (wstr == NULL)
1315 {
1316 /* Can't allocate that much. Last-ditch effort. */
1317 wstr = (wchar_t *) realloc (*strptr,
1318 ((strsize + 1)
1319 * sizeof (wchar_t)));
1320 if (wstr == NULL)
1321 {
1322 if (flags & POSIX_MALLOC)
1323 {
1324 done = EOF;
1325 goto errout;
1326 }
1327 /* We lose. Oh well. Terminate the
1328 string and stop converting, so at
1329 least we don't skip any input. */
1330 ((wchar_t *) (*strptr))[strsize - 1] = L'\0';
1331 strptr = NULL;
1332 ++done;
1333 conv_error ();
1334 }
1335 else
1336 {
1337 *strptr = (char *) wstr;
1338 wstr += strsize;
1339 ++strsize;
1340 }
1341 }
1342 else
1343 {
1344 *strptr = (char *) wstr;
1345 wstr += strsize;
1346 strsize *= 2;
1347 }
1348 }
1349 }
1350#endif
1351 }
1352 while ((width <= 0 || --width > 0) && inchar () != EOF);
1353
1354 if (!(flags & SUPPRESS))
1355 {
1356 *wstr++ = L'\0';
1357
1358 if ((flags & MALLOC) && wstr - (wchar_t *) *strptr != strsize)
1359 {
1360 wchar_t *cp = (wchar_t *) realloc (*strptr,
1361 ((wstr
1362 - (wchar_t *) *strptr)
1363 * sizeof (wchar_t)));
1364 if (cp != NULL)
1365 *strptr = (char *) cp;
1366 }
1367 strptr = NULL;
1368
1369 ++done;
1370 }
1371 }
1372 break;
1373
1374 case L_('x'): /* Hexadecimal integer. */
1375 case L_('X'): /* Ditto. */
1376 base = 16;
1377 goto number;
1378
1379 case L_('o'): /* Octal integer. */
1380 base = 8;
1381 goto number;
1382
1383 case L_('u'): /* Unsigned decimal integer. */
1384 base = 10;
1385 goto number;
1386
1387 case L_('d'): /* Signed decimal integer. */
1388 base = 10;
1389 flags |= NUMBER_SIGNED;
1390 goto number;
1391
1392 case L_('i'): /* Generic number. */
1393 base = 0;
1394 flags |= NUMBER_SIGNED;
1395
1396 number:
1397 c = inchar ();
1398 if (__glibc_unlikely (c == EOF))
1399 input_error ();
1400
1401 /* Check for a sign. */
1402 if (c == L_('-') || c == L_('+'))
1403 {
1404 char_buffer_add (&charbuf, c);
1405 if (width > 0)
1406 --width;
1407 c = inchar ();
1408 }
1409
1410 /* Look for a leading indication of base. */
1411 if (width != 0 && c == L_('0'))
1412 {
1413 if (width > 0)
1414 --width;
1415
1416 char_buffer_add (&charbuf, c);
1417 c = inchar ();
1418
1419 if (width != 0 && TOLOWER (c) == L_('x'))
1420 {
1421 if (base == 0)
1422 base = 16;
1423 if (base == 16)
1424 {
1425 if (width > 0)
1426 --width;
1427 c = inchar ();
1428 }
1429 }
1430 else if (base == 0)
1431 base = 8;
1432 }
1433
1434 if (base == 0)
1435 base = 10;
1436
1437 if (base == 10 && __builtin_expect ((flags & I18N) != 0, 0))
1438 {
1439 int from_level;
1440 int to_level;
1441 int level;
1442#ifdef COMPILE_WSCANF
1443 const wchar_t *wcdigits[10];
1444 const wchar_t *wcdigits_extended[10];
1445#else
1446 const char *mbdigits[10];
1447 const char *mbdigits_extended[10];
1448#endif
1449 /* "to_inpunct" is a map from ASCII digits to their
1450 equivalent in locale. This is defined for locales
1451 which use an extra digits set. */
1452 wctrans_t map = __wctrans ("to_inpunct");
1453 int n;
1454
1455 from_level = 0;
1456#ifdef COMPILE_WSCANF
1457 to_level = _NL_CURRENT_WORD (LC_CTYPE,
1458 _NL_CTYPE_INDIGITS_WC_LEN) - 1;
1459#else
1460 to_level = (uint32_t) curctype->values[_NL_ITEM_INDEX (_NL_CTYPE_INDIGITS_MB_LEN)].word - 1;
1461#endif
1462
1463 /* Get the alternative digit forms if there are any. */
1464 if (__glibc_unlikely (map != NULL))
1465 {
1466 /* Adding new level for extra digits set in locale file. */
1467 ++to_level;
1468
1469 for (n = 0; n < 10; ++n)
1470 {
1471#ifdef COMPILE_WSCANF
1472 wcdigits[n] = (const wchar_t *)
1473 _NL_CURRENT (LC_CTYPE, _NL_CTYPE_INDIGITS0_WC + n);
1474
1475 wchar_t *wc_extended = (wchar_t *)
1476 alloca ((to_level + 2) * sizeof (wchar_t));
1477 __wmemcpy (wc_extended, wcdigits[n], to_level);
1478 wc_extended[to_level] = __towctrans (L'0' + n, map);
1479 wc_extended[to_level + 1] = '\0';
1480 wcdigits_extended[n] = wc_extended;
1481#else
1482 mbdigits[n]
1483 = curctype->values[_NL_CTYPE_INDIGITS0_MB + n].string;
1484
1485 /* Get the equivalent wide char in map. */
1486 wint_t extra_wcdigit = __towctrans (L'0' + n, map);
1487
1488 /* Convert it to multibyte representation. */
1489 mbstate_t state;
1490 memset (&state, '\0', sizeof (state));
1491
1492 char extra_mbdigit[MB_LEN_MAX];
1493 size_t mblen
1494 = __wcrtomb (extra_mbdigit, extra_wcdigit, &state);
1495
1496 if (mblen == (size_t) -1)
1497 {
1498 /* Ignore this new level. */
1499 map = NULL;
1500 break;
1501 }
1502
1503 /* Calculate the length of mbdigits[n]. */
1504 const char *last_char = mbdigits[n];
1505 for (level = 0; level < to_level; ++level)
1506 last_char = strchr (last_char, '\0') + 1;
1507
1508 size_t mbdigits_len = last_char - mbdigits[n];
1509
1510 /* Allocate memory for extended multibyte digit. */
1511 char *mb_extended;
1512 mb_extended = (char *) alloca (mbdigits_len + mblen + 1);
1513
1514 /* And get the mbdigits + extra_digit string. */
1515 *(char *) __mempcpy (__mempcpy (mb_extended, mbdigits[n],
1516 mbdigits_len),
1517 extra_mbdigit, mblen) = '\0';
1518 mbdigits_extended[n] = mb_extended;
1519#endif
1520 }
1521 }
1522
1523 /* Read the number into workspace. */
1524 while (c != EOF && width != 0)
1525 {
1526 /* In this round we get the pointer to the digit strings
1527 and also perform the first round of comparisons. */
1528 for (n = 0; n < 10; ++n)
1529 {
1530 /* Get the string for the digits with value N. */
1531#ifdef COMPILE_WSCANF
1532
1533 /* wcdigits_extended[] is fully set in the loop
1534 above, but the test for "map != NULL" is done
1535 inside the loop here and outside the loop there. */
1536 DIAG_PUSH_NEEDS_COMMENT;
1537 DIAG_IGNORE_NEEDS_COMMENT (4.7, "-Wmaybe-uninitialized");
1538
1539 if (__glibc_unlikely (map != NULL))
1540 wcdigits[n] = wcdigits_extended[n];
1541 else
1542 wcdigits[n] = (const wchar_t *)
1543 _NL_CURRENT (LC_CTYPE, _NL_CTYPE_INDIGITS0_WC + n);
1544 wcdigits[n] += from_level;
1545
1546 DIAG_POP_NEEDS_COMMENT;
1547
1548 if (c == (wint_t) *wcdigits[n])
1549 {
1550 to_level = from_level;
1551 break;
1552 }
1553
1554 /* Advance the pointer to the next string. */
1555 ++wcdigits[n];
1556#else
1557 const char *cmpp;
1558 int avail = width > 0 ? width : INT_MAX;
1559
1560 if (__glibc_unlikely (map != NULL))
1561 mbdigits[n] = mbdigits_extended[n];
1562 else
1563 mbdigits[n]
1564 = curctype->values[_NL_CTYPE_INDIGITS0_MB + n].string;
1565
1566 for (level = 0; level < from_level; level++)
1567 mbdigits[n] = strchr (mbdigits[n], '\0') + 1;
1568
1569 cmpp = mbdigits[n];
1570 while ((unsigned char) *cmpp == c && avail >= 0)
1571 {
1572 if (*++cmpp == '\0')
1573 break;
1574 else
1575 {
1576 if (avail == 0 || inchar () == EOF)
1577 break;
1578 --avail;
1579 }
1580 }
1581
1582 if (*cmpp == '\0')
1583 {
1584 if (width > 0)
1585 width = avail;
1586 to_level = from_level;
1587 break;
1588 }
1589
1590 /* We are pushing all read characters back. */
1591 if (cmpp > mbdigits[n])
1592 {
1593 ungetc (c, s);
1594 while (--cmpp > mbdigits[n])
1595 ungetc_not_eof ((unsigned char) *cmpp, s);
1596 c = (unsigned char) *cmpp;
1597 }
1598
1599 /* Advance the pointer to the next string. */
1600 mbdigits[n] = strchr (mbdigits[n], '\0') + 1;
1601#endif
1602 }
1603
1604 if (n == 10)
1605 {
1606 /* Have not yet found the digit. */
1607 for (level = from_level + 1; level <= to_level; ++level)
1608 {
1609 /* Search all ten digits of this level. */
1610 for (n = 0; n < 10; ++n)
1611 {
1612#ifdef COMPILE_WSCANF
1613 if (c == (wint_t) *wcdigits[n])
1614 break;
1615
1616 /* Advance the pointer to the next string. */
1617 ++wcdigits[n];
1618#else
1619 const char *cmpp;
1620 int avail = width > 0 ? width : INT_MAX;
1621
1622 cmpp = mbdigits[n];
1623 while ((unsigned char) *cmpp == c && avail >= 0)
1624 {
1625 if (*++cmpp == '\0')
1626 break;
1627 else
1628 {
1629 if (avail == 0 || inchar () == EOF)
1630 break;
1631 --avail;
1632 }
1633 }
1634
1635 if (*cmpp == '\0')
1636 {
1637 if (width > 0)
1638 width = avail;
1639 break;
1640 }
1641
1642 /* We are pushing all read characters back. */
1643 if (cmpp > mbdigits[n])
1644 {
1645 ungetc (c, s);
1646 while (--cmpp > mbdigits[n])
1647 ungetc_not_eof ((unsigned char) *cmpp, s);
1648 c = (unsigned char) *cmpp;
1649 }
1650
1651 /* Advance the pointer to the next string. */
1652 mbdigits[n] = strchr (mbdigits[n], '\0') + 1;
1653#endif
1654 }
1655
1656 if (n < 10)
1657 {
1658 /* Found it. */
1659 from_level = level;
1660 to_level = level;
1661 break;
1662 }
1663 }
1664 }
1665
1666 if (n < 10)
1667 c = L_('0') + n;
1668 else if (flags & GROUP)
1669 {
1670 /* Try matching against the thousands separator. */
1671#ifdef COMPILE_WSCANF
1672 if (c != thousands)
1673 break;
1674#else
1675 const char *cmpp = thousands;
1676 int avail = width > 0 ? width : INT_MAX;
1677
1678 while ((unsigned char) *cmpp == c && avail >= 0)
1679 {
1680 char_buffer_add (&charbuf, c);
1681 if (*++cmpp == '\0')
1682 break;
1683 else
1684 {
1685 if (avail == 0 || inchar () == EOF)
1686 break;
1687 --avail;
1688 }
1689 }
1690
1691 if (char_buffer_error (&charbuf))
1692 {
1693 __set_errno (ENOMEM);
1694 done = EOF;
1695 goto errout;
1696 }
1697
1698 if (*cmpp != '\0')
1699 {
1700 /* We are pushing all read characters back. */
1701 if (cmpp > thousands)
1702 {
1703 charbuf.current -= cmpp - thousands;
1704 ungetc (c, s);
1705 while (--cmpp > thousands)
1706 ungetc_not_eof ((unsigned char) *cmpp, s);
1707 c = (unsigned char) *cmpp;
1708 }
1709 break;
1710 }
1711
1712 if (width > 0)
1713 width = avail;
1714
1715 /* The last thousands character will be added back by
1716 the char_buffer_add below. */
1717 --charbuf.current;
1718#endif
1719 }
1720 else
1721 break;
1722
1723 char_buffer_add (&charbuf, c);
1724 if (width > 0)
1725 --width;
1726
1727 c = inchar ();
1728 }
1729 }
1730 else
1731 /* Read the number into workspace. */
1732 while (c != EOF && width != 0)
1733 {
1734 if (base == 16)
1735 {
1736 if (!ISXDIGIT (c))
1737 break;
1738 }
1739 else if (!ISDIGIT (c) || (int) (c - L_('0')) >= base)
1740 {
1741 if (base == 10 && (flags & GROUP))
1742 {
1743 /* Try matching against the thousands separator. */
1744#ifdef COMPILE_WSCANF
1745 if (c != thousands)
1746 break;
1747#else
1748 const char *cmpp = thousands;
1749 int avail = width > 0 ? width : INT_MAX;
1750
1751 while ((unsigned char) *cmpp == c && avail >= 0)
1752 {
1753 char_buffer_add (&charbuf, c);
1754 if (*++cmpp == '\0')
1755 break;
1756 else
1757 {
1758 if (avail == 0 || inchar () == EOF)
1759 break;
1760 --avail;
1761 }
1762 }
1763
1764 if (char_buffer_error (&charbuf))
1765 {
1766 __set_errno (ENOMEM);
1767 done = EOF;
1768 goto errout;
1769 }
1770
1771 if (*cmpp != '\0')
1772 {
1773 /* We are pushing all read characters back. */
1774 if (cmpp > thousands)
1775 {
1776 charbuf.current -= cmpp - thousands;
1777 ungetc (c, s);
1778 while (--cmpp > thousands)
1779 ungetc_not_eof ((unsigned char) *cmpp, s);
1780 c = (unsigned char) *cmpp;
1781 }
1782 break;
1783 }
1784
1785 if (width > 0)
1786 width = avail;
1787
1788 /* The last thousands character will be added back by
1789 the char_buffer_add below. */
1790 --charbuf.current;
1791#endif
1792 }
1793 else
1794 break;
1795 }
1796 char_buffer_add (&charbuf, c);
1797 if (width > 0)
1798 --width;
1799
1800 c = inchar ();
1801 }
1802
1803 if (char_buffer_error (&charbuf))
1804 {
1805 __set_errno (ENOMEM);
1806 done = EOF;
1807 goto errout;
1808 }
1809
1810 if (char_buffer_size (&charbuf) == 0
1811 || (char_buffer_size (&charbuf) == 1
1812 && (char_buffer_start (&charbuf)[0] == L_('+')
1813 || char_buffer_start (&charbuf)[0] == L_('-'))))
1814 {
1815 /* There was no number. If we are supposed to read a pointer
1816 we must recognize "(nil)" as well. */
1817 if (__builtin_expect (char_buffer_size (&charbuf) == 0
1818 && (flags & READ_POINTER)
1819 && (width < 0 || width >= 5)
1820 && c == '('
1821 && TOLOWER (inchar ()) == L_('n')
1822 && TOLOWER (inchar ()) == L_('i')
1823 && TOLOWER (inchar ()) == L_('l')
1824 && inchar () == L_(')'), 1))
1825 /* We must produce the value of a NULL pointer. A single
1826 '0' digit is enough. */
1827 char_buffer_add (&charbuf, L_('0'));
1828 else
1829 {
1830 /* The last read character is not part of the number
1831 anymore. */
1832 ungetc (c, s);
1833
1834 conv_error ();
1835 }
1836 }
1837 else
1838 /* The just read character is not part of the number anymore. */
1839 ungetc (c, s);
1840
1841 /* Convert the number. */
1842 char_buffer_add (&charbuf, L_('\0'));
1843 if (char_buffer_error (&charbuf))
1844 {
1845 __set_errno (ENOMEM);
1846 done = EOF;
1847 goto errout;
1848 }
1849 if (need_longlong && (flags & LONGDBL))
1850 {
1851 if (flags & NUMBER_SIGNED)
1852 num.q = __strtoll_internal
1853 (char_buffer_start (&charbuf), &tw, base, flags & GROUP);
1854 else
1855 num.uq = __strtoull_internal
1856 (char_buffer_start (&charbuf), &tw, base, flags & GROUP);
1857 }
1858 else
1859 {
1860 if (flags & NUMBER_SIGNED)
1861 num.l = __strtol_internal
1862 (char_buffer_start (&charbuf), &tw, base, flags & GROUP);
1863 else
1864 num.ul = __strtoul_internal
1865 (char_buffer_start (&charbuf), &tw, base, flags & GROUP);
1866 }
1867 if (__glibc_unlikely (char_buffer_start (&charbuf) == tw))
1868 conv_error ();
1869
1870 if (!(flags & SUPPRESS))
1871 {
1872 if (flags & NUMBER_SIGNED)
1873 {
1874 if (need_longlong && (flags & LONGDBL))
1875 *ARG (LONGLONG int *) = num.q;
1876 else if (need_long && (flags & LONG))
1877 *ARG (long int *) = num.l;
1878 else if (flags & SHORT)
1879 *ARG (short int *) = (short int) num.l;
1880 else if (!(flags & CHAR))
1881 *ARG (int *) = (int) num.l;
1882 else
1883 *ARG (signed char *) = (signed char) num.ul;
1884 }
1885 else
1886 {
1887 if (need_longlong && (flags & LONGDBL))
1888 *ARG (unsigned LONGLONG int *) = num.uq;
1889 else if (need_long && (flags & LONG))
1890 *ARG (unsigned long int *) = num.ul;
1891 else if (flags & SHORT)
1892 *ARG (unsigned short int *)
1893 = (unsigned short int) num.ul;
1894 else if (!(flags & CHAR))
1895 *ARG (unsigned int *) = (unsigned int) num.ul;
1896 else
1897 *ARG (unsigned char *) = (unsigned char) num.ul;
1898 }
1899 ++done;
1900 }
1901 break;
1902
1903 case L_('e'): /* Floating-point numbers. */
1904 case L_('E'):
1905 case L_('f'):
1906 case L_('F'):
1907 case L_('g'):
1908 case L_('G'):
1909 case L_('a'):
1910 case L_('A'):
1911 c = inchar ();
1912 if (width > 0)
1913 --width;
1914 if (__glibc_unlikely (c == EOF))
1915 input_error ();
1916
1917 got_digit = got_dot = got_e = got_sign = 0;
1918
1919 /* Check for a sign. */
1920 if (c == L_('-') || c == L_('+'))
1921 {
1922 got_sign = 1;
1923 char_buffer_add (&charbuf, c);
1924 if (__glibc_unlikely (width == 0 || inchar () == EOF))
1925 /* EOF is only an input error before we read any chars. */
1926 conv_error ();
1927 if (width > 0)
1928 --width;
1929 }
1930
1931 /* Take care for the special arguments "nan" and "inf". */
1932 if (TOLOWER (c) == L_('n'))
1933 {
1934 /* Maybe "nan". */
1935 char_buffer_add (&charbuf, c);
1936 if (__builtin_expect (width == 0
1937 || inchar () == EOF
1938 || TOLOWER (c) != L_('a'), 0))
1939 conv_error ();
1940 if (width > 0)
1941 --width;
1942 char_buffer_add (&charbuf, c);
1943 if (__builtin_expect (width == 0
1944 || inchar () == EOF
1945 || TOLOWER (c) != L_('n'), 0))
1946 conv_error ();
1947 if (width > 0)
1948 --width;
1949 char_buffer_add (&charbuf, c);
1950 /* It is "nan". */
1951 goto scan_float;
1952 }
1953 else if (TOLOWER (c) == L_('i'))
1954 {
1955 /* Maybe "inf" or "infinity". */
1956 char_buffer_add (&charbuf, c);
1957 if (__builtin_expect (width == 0
1958 || inchar () == EOF
1959 || TOLOWER (c) != L_('n'), 0))
1960 conv_error ();
1961 if (width > 0)
1962 --width;
1963 char_buffer_add (&charbuf, c);
1964 if (__builtin_expect (width == 0
1965 || inchar () == EOF
1966 || TOLOWER (c) != L_('f'), 0))
1967 conv_error ();
1968 if (width > 0)
1969 --width;
1970 char_buffer_add (&charbuf, c);
1971 /* It is as least "inf". */
1972 if (width != 0 && inchar () != EOF)
1973 {
1974 if (TOLOWER (c) == L_('i'))
1975 {
1976 if (width > 0)
1977 --width;
1978 /* Now we have to read the rest as well. */
1979 char_buffer_add (&charbuf, c);
1980 if (__builtin_expect (width == 0
1981 || inchar () == EOF
1982 || TOLOWER (c) != L_('n'), 0))
1983 conv_error ();
1984 if (width > 0)
1985 --width;
1986 char_buffer_add (&charbuf, c);
1987 if (__builtin_expect (width == 0
1988 || inchar () == EOF
1989 || TOLOWER (c) != L_('i'), 0))
1990 conv_error ();
1991 if (width > 0)
1992 --width;
1993 char_buffer_add (&charbuf, c);
1994 if (__builtin_expect (width == 0
1995 || inchar () == EOF
1996 || TOLOWER (c) != L_('t'), 0))
1997 conv_error ();
1998 if (width > 0)
1999 --width;
2000 char_buffer_add (&charbuf, c);
2001 if (__builtin_expect (width == 0
2002 || inchar () == EOF
2003 || TOLOWER (c) != L_('y'), 0))
2004 conv_error ();
2005 if (width > 0)
2006 --width;
2007 char_buffer_add (&charbuf, c);
2008 }
2009 else
2010 /* Never mind. */
2011 ungetc (c, s);
2012 }
2013 goto scan_float;
2014 }
2015
2016 exp_char = L_('e');
2017 if (width != 0 && c == L_('0'))
2018 {
2019 char_buffer_add (&charbuf, c);
2020 c = inchar ();
2021 if (width > 0)
2022 --width;
2023 if (width != 0 && TOLOWER (c) == L_('x'))
2024 {
2025 /* It is a number in hexadecimal format. */
2026 char_buffer_add (&charbuf, c);
2027
2028 flags |= HEXA_FLOAT;
2029 exp_char = L_('p');
2030
2031 /* Grouping is not allowed. */
2032 flags &= ~GROUP;
2033 c = inchar ();
2034 if (width > 0)
2035 --width;
2036 }
2037 else
2038 got_digit = 1;
2039 }
2040
2041 while (1)
2042 {
2043 if (char_buffer_error (&charbuf))
2044 {
2045 __set_errno (ENOMEM);
2046 done = EOF;
2047 goto errout;
2048 }
2049 if (ISDIGIT (c))
2050 {
2051 char_buffer_add (&charbuf, c);
2052 got_digit = 1;
2053 }
2054 else if (!got_e && (flags & HEXA_FLOAT) && ISXDIGIT (c))
2055 {
2056 char_buffer_add (&charbuf, c);
2057 got_digit = 1;
2058 }
2059 else if (got_e && charbuf.current[-1] == exp_char
2060 && (c == L_('-') || c == L_('+')))
2061 char_buffer_add (&charbuf, c);
2062 else if (got_digit && !got_e
2063 && (CHAR_T) TOLOWER (c) == exp_char)
2064 {
2065 char_buffer_add (&charbuf, exp_char);
2066 got_e = got_dot = 1;
2067 }
2068 else
2069 {
2070#ifdef COMPILE_WSCANF
2071 if (! got_dot && c == decimal)
2072 {
2073 char_buffer_add (&charbuf, c);
2074 got_dot = 1;
2075 }
2076 else if ((flags & GROUP) != 0 && ! got_dot && c == thousands)
2077 char_buffer_add (&charbuf, c);
2078 else
2079 {
2080 /* The last read character is not part of the number
2081 anymore. */
2082 ungetc (c, s);
2083 break;
2084 }
2085#else
2086 const char *cmpp = decimal;
2087 int avail = width > 0 ? width : INT_MAX;
2088
2089 if (! got_dot)
2090 {
2091 while ((unsigned char) *cmpp == c && avail >= 0)
2092 if (*++cmpp == '\0')
2093 break;
2094 else
2095 {
2096 if (avail == 0 || inchar () == EOF)
2097 break;
2098 --avail;
2099 }
2100 }
2101
2102 if (*cmpp == '\0')
2103 {
2104 /* Add all the characters. */
2105 for (cmpp = decimal; *cmpp != '\0'; ++cmpp)
2106 char_buffer_add (&charbuf, (unsigned char) *cmpp);
2107 if (width > 0)
2108 width = avail;
2109 got_dot = 1;
2110 }
2111 else
2112 {
2113 /* Figure out whether it is a thousands separator.
2114 There is one problem: we possibly read more than
2115 one character. We cannot push them back but since
2116 we know that parts of the `decimal' string matched,
2117 we can compare against it. */
2118 const char *cmp2p = thousands;
2119
2120 if ((flags & GROUP) != 0 && ! got_dot)
2121 {
2122 while (cmp2p - thousands < cmpp - decimal
2123 && *cmp2p == decimal[cmp2p - thousands])
2124 ++cmp2p;
2125 if (cmp2p - thousands == cmpp - decimal)
2126 {
2127 while ((unsigned char) *cmp2p == c && avail >= 0)
2128 if (*++cmp2p == '\0')
2129 break;
2130 else
2131 {
2132 if (avail == 0 || inchar () == EOF)
2133 break;
2134 --avail;
2135 }
2136 }
2137 }
2138
2139 if (cmp2p != NULL && *cmp2p == '\0')
2140 {
2141 /* Add all the characters. */
2142 for (cmpp = thousands; *cmpp != '\0'; ++cmpp)
2143 char_buffer_add (&charbuf, (unsigned char) *cmpp);
2144 if (width > 0)
2145 width = avail;
2146 }
2147 else
2148 {
2149 /* The last read character is not part of the number
2150 anymore. */
2151 ungetc (c, s);
2152 break;
2153 }
2154 }
2155#endif
2156 }
2157
2158 if (width == 0 || inchar () == EOF)
2159 break;
2160
2161 if (width > 0)
2162 --width;
2163 }
2164
2165 if (char_buffer_error (&charbuf))
2166 {
2167 __set_errno (ENOMEM);
2168 done = EOF;
2169 goto errout;
2170 }
2171
2172 wctrans_t map;
2173 if (__builtin_expect ((flags & I18N) != 0, 0)
2174 /* Hexadecimal floats make no sense, fixing localized
2175 digits with ASCII letters. */
2176 && !(flags & HEXA_FLOAT)
2177 /* Minimum requirement. */
2178 && (char_buffer_size (&charbuf) == got_sign || got_dot)
2179 && (map = __wctrans ("to_inpunct")) != NULL)
2180 {
2181 /* Reget the first character. */
2182 inchar ();
2183
2184 /* Localized digits, decimal points, and thousands
2185 separator. */
2186 wint_t wcdigits[12];
2187
2188 /* First get decimal equivalent to check if we read it
2189 or not. */
2190 wcdigits[11] = __towctrans (L'.', map);
2191
2192 /* If we have not read any character or have just read
2193 locale decimal point which matches the decimal point
2194 for localized FP numbers, then we may have localized
2195 digits. Note, we test GOT_DOT above. */
2196#ifdef COMPILE_WSCANF
2197 if (char_buffer_size (&charbuf) == got_sign
2198 || (char_buffer_size (&charbuf) == got_sign + 1
2199 && wcdigits[11] == decimal))
2200#else
2201 char mbdigits[12][MB_LEN_MAX + 1];
2202
2203 mbstate_t state;
2204 memset (&state, '\0', sizeof (state));
2205
2206 bool match_so_far = char_buffer_size (&charbuf) == got_sign;
2207 size_t mblen = __wcrtomb (mbdigits[11], wcdigits[11], &state);
2208 if (mblen != (size_t) -1)
2209 {
2210 mbdigits[11][mblen] = '\0';
2211 match_so_far |=
2212 (char_buffer_size (&charbuf) == strlen (decimal) + got_sign
2213 && strcmp (decimal, mbdigits[11]) == 0);
2214 }
2215 else
2216 {
2217 size_t decimal_len = strlen (decimal);
2218 /* This should always be the case but the data comes
2219 from a file. */
2220 if (decimal_len <= MB_LEN_MAX)
2221 {
2222 match_so_far |= (char_buffer_size (&charbuf)
2223 == decimal_len + got_sign);
2224 memcpy (mbdigits[11], decimal, decimal_len + 1);
2225 }
2226 else
2227 match_so_far = false;
2228 }
2229
2230 if (match_so_far)
2231#endif
2232 {
2233 bool have_locthousands = (flags & GROUP) != 0;
2234
2235 /* Now get the digits and the thousands-sep equivalents. */
2236 for (int n = 0; n < 11; ++n)
2237 {
2238 if (n < 10)
2239 wcdigits[n] = __towctrans (L'0' + n, map);
2240 else if (n == 10)
2241 {
2242 wcdigits[10] = __towctrans (L',', map);
2243 have_locthousands &= wcdigits[10] != L'\0';
2244 }
2245
2246#ifndef COMPILE_WSCANF
2247 memset (&state, '\0', sizeof (state));
2248
2249 size_t mblen = __wcrtomb (mbdigits[n], wcdigits[n],
2250 &state);
2251 if (mblen == (size_t) -1)
2252 {
2253 if (n == 10)
2254 {
2255 if (have_locthousands)
2256 {
2257 size_t thousands_len = strlen (thousands);
2258 if (thousands_len <= MB_LEN_MAX)
2259 memcpy (mbdigits[10], thousands,
2260 thousands_len + 1);
2261 else
2262 have_locthousands = false;
2263 }
2264 }
2265 else
2266 /* Ignore checking against localized digits. */
2267 goto no_i18nflt;
2268 }
2269 else
2270 mbdigits[n][mblen] = '\0';
2271#endif
2272 }
2273
2274 /* Start checking against localized digits, if
2275 conversion is done correctly. */
2276 while (1)
2277 {
2278 if (char_buffer_error (&charbuf))
2279 {
2280 __set_errno (ENOMEM);
2281 done = EOF;
2282 goto errout;
2283 }
2284 if (got_e && charbuf.current[-1] == exp_char
2285 && (c == L_('-') || c == L_('+')))
2286 char_buffer_add (&charbuf, c);
2287 else if (char_buffer_size (&charbuf) > got_sign && !got_e
2288 && (CHAR_T) TOLOWER (c) == exp_char)
2289 {
2290 char_buffer_add (&charbuf, exp_char);
2291 got_e = got_dot = 1;
2292 }
2293 else
2294 {
2295 /* Check against localized digits, decimal point,
2296 and thousands separator. */
2297 int n;
2298 for (n = 0; n < 12; ++n)
2299 {
2300#ifdef COMPILE_WSCANF
2301 if (c == wcdigits[n])
2302 {
2303 if (n < 10)
2304 char_buffer_add (&charbuf, L_('0') + n);
2305 else if (n == 11 && !got_dot)
2306 {
2307 char_buffer_add (&charbuf, decimal);
2308 got_dot = 1;
2309 }
2310 else if (n == 10 && have_locthousands
2311 && ! got_dot)
2312 char_buffer_add (&charbuf, thousands);
2313 else
2314 /* The last read character is not part
2315 of the number anymore. */
2316 n = 12;
2317
2318 break;
2319 }
2320#else
2321 const char *cmpp = mbdigits[n];
2322 int avail = width > 0 ? width : INT_MAX;
2323
2324 while ((unsigned char) *cmpp == c && avail >= 0)
2325 if (*++cmpp == '\0')
2326 break;
2327 else
2328 {
2329 if (avail == 0 || inchar () == EOF)
2330 break;
2331 --avail;
2332 }
2333 if (*cmpp == '\0')
2334 {
2335 if (width > 0)
2336 width = avail;
2337
2338 if (n < 10)
2339 char_buffer_add (&charbuf, L_('0') + n);
2340 else if (n == 11 && !got_dot)
2341 {
2342 /* Add all the characters. */
2343 for (cmpp = decimal; *cmpp != '\0';
2344 ++cmpp)
2345 char_buffer_add (&charbuf,
2346 (unsigned char) *cmpp);
2347
2348 got_dot = 1;
2349 }
2350 else if (n == 10 && (flags & GROUP) != 0
2351 && ! got_dot)
2352 {
2353 /* Add all the characters. */
2354 for (cmpp = thousands; *cmpp != '\0';
2355 ++cmpp)
2356 char_buffer_add (&charbuf,
2357 (unsigned char) *cmpp);
2358 }
2359 else
2360 /* The last read character is not part
2361 of the number anymore. */
2362 n = 12;
2363
2364 break;
2365 }
2366
2367 /* We are pushing all read characters back. */
2368 if (cmpp > mbdigits[n])
2369 {
2370 ungetc (c, s);
2371 while (--cmpp > mbdigits[n])
2372 ungetc_not_eof ((unsigned char) *cmpp, s);
2373 c = (unsigned char) *cmpp;
2374 }
2375#endif
2376 }
2377
2378 if (n >= 12)
2379 {
2380 /* The last read character is not part
2381 of the number anymore. */
2382 ungetc (c, s);
2383 break;
2384 }
2385 }
2386
2387 if (width == 0 || inchar () == EOF)
2388 break;
2389
2390 if (width > 0)
2391 --width;
2392 }
2393 }
2394
2395#ifndef COMPILE_WSCANF
2396 no_i18nflt:
2397 ;
2398#endif
2399 }
2400
2401 if (char_buffer_error (&charbuf))
2402 {
2403 __set_errno (ENOMEM);
2404 done = EOF;
2405 goto errout;
2406 }
2407
2408 /* Have we read any character? If we try to read a number
2409 in hexadecimal notation and we have read only the `0x'
2410 prefix this is an error. */
2411 if (__glibc_unlikely (char_buffer_size (&charbuf) == got_sign
2412 || ((flags & HEXA_FLOAT)
2413 && (char_buffer_size (&charbuf)
2414 == 2 + got_sign))))
2415 conv_error ();
2416
2417 scan_float:
2418 /* Convert the number. */
2419 char_buffer_add (&charbuf, L_('\0'));
2420 if (char_buffer_error (&charbuf))
2421 {
2422 __set_errno (ENOMEM);
2423 done = EOF;
2424 goto errout;
2425 }
2426#if __HAVE_FLOAT128_UNLIKE_LDBL
2427 if ((flags & LONGDBL) \
2428 && (mode_flags & SCANF_LDBL_USES_FLOAT128) != 0)
2429 {
2430 _Float128 d = __strtof128_internal
2431 (char_buffer_start (&charbuf), &tw, flags & GROUP);
2432 if (!(flags & SUPPRESS) && tw != char_buffer_start (&charbuf))
2433 *ARG (_Float128 *) = d;
2434 }
2435 else
2436#endif
2437 if ((flags & LONGDBL) \
2438 && __glibc_likely ((mode_flags & SCANF_LDBL_IS_DBL) == 0))
2439 {
2440 long double d = __strtold_internal
2441 (char_buffer_start (&charbuf), &tw, flags & GROUP);
2442 if (!(flags & SUPPRESS) && tw != char_buffer_start (&charbuf))
2443 *ARG (long double *) = d;
2444 }
2445 else if (flags & (LONG | LONGDBL))
2446 {
2447 double d = __strtod_internal
2448 (char_buffer_start (&charbuf), &tw, flags & GROUP);
2449 if (!(flags & SUPPRESS) && tw != char_buffer_start (&charbuf))
2450 *ARG (double *) = d;
2451 }
2452 else
2453 {
2454 float d = __strtof_internal
2455 (char_buffer_start (&charbuf), &tw, flags & GROUP);
2456 if (!(flags & SUPPRESS) && tw != char_buffer_start (&charbuf))
2457 *ARG (float *) = d;
2458 }
2459
2460 if (__glibc_unlikely (tw == char_buffer_start (&charbuf)))
2461 conv_error ();
2462
2463 if (!(flags & SUPPRESS))
2464 ++done;
2465 break;
2466
2467 case L_('['): /* Character class. */
2468 if (flags & LONG)
2469 STRING_ARG (wstr, wchar_t, 100);
2470 else
2471 STRING_ARG (str, char, 100);
2472
2473 if (*f == L_('^'))
2474 {
2475 ++f;
2476 not_in = 1;
2477 }
2478 else
2479 not_in = 0;
2480
2481 if (width < 0)
2482 /* There is no width given so there is also no limit on the
2483 number of characters we read. Therefore we set width to
2484 a very high value to make the algorithm easier. */
2485 width = INT_MAX;
2486
2487#ifdef COMPILE_WSCANF
2488 /* Find the beginning and the end of the scanlist. We are not
2489 creating a lookup table since it would have to be too large.
2490 Instead we search each time through the string. This is not
2491 a constant lookup time but who uses this feature deserves to
2492 be punished. */
2493 tw = (wchar_t *) f; /* Marks the beginning. */
2494
2495 if (*f == L']')
2496 ++f;
2497
2498 while ((fc = *f++) != L'\0' && fc != L']');
2499
2500 if (__glibc_unlikely (fc == L'\0'))
2501 conv_error ();
2502 wchar_t *twend = (wchar_t *) f - 1;
2503#else
2504 /* Fill WP with byte flags indexed by character.
2505 We will use this flag map for matching input characters. */
2506 if (!scratch_buffer_set_array_size
2507 (&charbuf.scratch, UCHAR_MAX + 1, 1))
2508 {
2509 done = EOF;
2510 goto errout;
2511 }
2512 memset (charbuf.scratch.data, '\0', UCHAR_MAX + 1);
2513
2514 fc = *f;
2515 if (fc == ']' || fc == '-')
2516 {
2517 /* If ] or - appears before any char in the set, it is not
2518 the terminator or separator, but the first char in the
2519 set. */
2520 ((char *)charbuf.scratch.data)[fc] = 1;
2521 ++f;
2522 }
2523
2524 while ((fc = *f++) != '\0' && fc != ']')
2525 if (fc == '-' && *f != '\0' && *f != ']'
2526 && (unsigned char) f[-2] <= (unsigned char) *f)
2527 {
2528 /* Add all characters from the one before the '-'
2529 up to (but not including) the next format char. */
2530 for (fc = (unsigned char) f[-2]; fc < (unsigned char) *f; ++fc)
2531 ((char *)charbuf.scratch.data)[fc] = 1;
2532 }
2533 else
2534 /* Add the character to the flag map. */
2535 ((char *)charbuf.scratch.data)[fc] = 1;
2536
2537 if (__glibc_unlikely (fc == '\0'))
2538 conv_error();
2539#endif
2540
2541 if (flags & LONG)
2542 {
2543 size_t now = read_in;
2544#ifdef COMPILE_WSCANF
2545 if (__glibc_unlikely (inchar () == WEOF))
2546 input_error ();
2547
2548 do
2549 {
2550 wchar_t *runp;
2551
2552 /* Test whether it's in the scanlist. */
2553 runp = tw;
2554 while (runp < twend)
2555 {
2556 if (runp[0] == L'-' && runp[1] != '\0'
2557 && runp + 1 != twend
2558 && runp != tw
2559 && (unsigned int) runp[-1] <= (unsigned int) runp[1])
2560 {
2561 /* Match against all characters in between the
2562 first and last character of the sequence. */
2563 wchar_t wc;
2564
2565 for (wc = runp[-1] + 1; wc <= runp[1]; ++wc)
2566 if ((wint_t) wc == c)
2567 break;
2568
2569 if (wc <= runp[1] && !not_in)
2570 break;
2571 if (wc <= runp[1] && not_in)
2572 {
2573 /* The current character is not in the
2574 scanset. */
2575 ungetc (c, s);
2576 goto out;
2577 }
2578
2579 runp += 2;
2580 }
2581 else
2582 {
2583 if ((wint_t) *runp == c && !not_in)
2584 break;
2585 if ((wint_t) *runp == c && not_in)
2586 {
2587 ungetc (c, s);
2588 goto out;
2589 }
2590
2591 ++runp;
2592 }
2593 }
2594
2595 if (runp == twend && !not_in)
2596 {
2597 ungetc (c, s);
2598 goto out;
2599 }
2600
2601 if (!(flags & SUPPRESS))
2602 {
2603 *wstr++ = c;
2604
2605 if ((flags & MALLOC)
2606 && wstr == (wchar_t *) *strptr + strsize)
2607 {
2608 /* Enlarge the buffer. */
2609 wstr = (wchar_t *) realloc (*strptr,
2610 (2 * strsize)
2611 * sizeof (wchar_t));
2612 if (wstr == NULL)
2613 {
2614 /* Can't allocate that much. Last-ditch
2615 effort. */
2616 wstr = (wchar_t *)
2617 realloc (*strptr, (strsize + 1)
2618 * sizeof (wchar_t));
2619 if (wstr == NULL)
2620 {
2621 if (flags & POSIX_MALLOC)
2622 {
2623 done = EOF;
2624 goto errout;
2625 }
2626 /* We lose. Oh well. Terminate the string
2627 and stop converting, so at least we don't
2628 skip any input. */
2629 ((wchar_t *) (*strptr))[strsize - 1] = L'\0';
2630 strptr = NULL;
2631 ++done;
2632 conv_error ();
2633 }
2634 else
2635 {
2636 *strptr = (char *) wstr;
2637 wstr += strsize;
2638 ++strsize;
2639 }
2640 }
2641 else
2642 {
2643 *strptr = (char *) wstr;
2644 wstr += strsize;
2645 strsize *= 2;
2646 }
2647 }
2648 }
2649 }
2650 while (--width > 0 && inchar () != WEOF);
2651 out:
2652#else
2653 char buf[MB_LEN_MAX];
2654 size_t cnt = 0;
2655 mbstate_t cstate;
2656
2657 if (__glibc_unlikely (inchar () == EOF))
2658 input_error ();
2659
2660 memset (&cstate, '\0', sizeof (cstate));
2661
2662 do
2663 {
2664 if (((char *) charbuf.scratch.data)[c] == not_in)
2665 {
2666 ungetc_not_eof (c, s);
2667 break;
2668 }
2669
2670 /* This is easy. */
2671 if (!(flags & SUPPRESS))
2672 {
2673 size_t n;
2674
2675 /* Convert it into a wide character. */
2676 buf[0] = c;
2677 n = __mbrtowc (wstr, buf, 1, &cstate);
2678
2679 if (n == (size_t) -2)
2680 {
2681 /* Possibly correct character, just not enough
2682 input. */
2683 ++cnt;
2684 assert (cnt < MB_LEN_MAX);
2685 continue;
2686 }
2687 cnt = 0;
2688
2689 ++wstr;
2690 if ((flags & MALLOC)
2691 && wstr == (wchar_t *) *strptr + strsize)
2692 {
2693 /* Enlarge the buffer. */
2694 wstr = (wchar_t *) realloc (*strptr,
2695 (2 * strsize
2696 * sizeof (wchar_t)));
2697 if (wstr == NULL)
2698 {
2699 /* Can't allocate that much. Last-ditch
2700 effort. */
2701 wstr = (wchar_t *)
2702 realloc (*strptr, ((strsize + 1)
2703 * sizeof (wchar_t)));
2704 if (wstr == NULL)
2705 {
2706 if (flags & POSIX_MALLOC)
2707 {
2708 done = EOF;
2709 goto errout;
2710 }
2711 /* We lose. Oh well. Terminate the
2712 string and stop converting,
2713 so at least we don't skip any input. */
2714 ((wchar_t *) (*strptr))[strsize - 1] = L'\0';
2715 strptr = NULL;
2716 ++done;
2717 conv_error ();
2718 }
2719 else
2720 {
2721 *strptr = (char *) wstr;
2722 wstr += strsize;
2723 ++strsize;
2724 }
2725 }
2726 else
2727 {
2728 *strptr = (char *) wstr;
2729 wstr += strsize;
2730 strsize *= 2;
2731 }
2732 }
2733 }
2734
2735 if (--width <= 0)
2736 break;
2737 }
2738 while (inchar () != EOF);
2739
2740 if (__glibc_unlikely (cnt != 0))
2741 /* We stopped in the middle of recognizing another
2742 character. That's a problem. */
2743 encode_error ();
2744#endif
2745
2746 if (__glibc_unlikely (now == read_in))
2747 /* We haven't succesfully read any character. */
2748 conv_error ();
2749
2750 if (!(flags & SUPPRESS))
2751 {
2752 *wstr++ = L'\0';
2753
2754 if ((flags & MALLOC)
2755 && wstr - (wchar_t *) *strptr != strsize)
2756 {
2757 wchar_t *cp = (wchar_t *)
2758 realloc (*strptr, ((wstr - (wchar_t *) *strptr)
2759 * sizeof (wchar_t)));
2760 if (cp != NULL)
2761 *strptr = (char *) cp;
2762 }
2763 strptr = NULL;
2764
2765 ++done;
2766 }
2767 }
2768 else
2769 {
2770 size_t now = read_in;
2771
2772 if (__glibc_unlikely (inchar () == EOF))
2773 input_error ();
2774
2775#ifdef COMPILE_WSCANF
2776
2777 memset (&state, '\0', sizeof (state));
2778
2779 do
2780 {
2781 wchar_t *runp;
2782 size_t n;
2783
2784 /* Test whether it's in the scanlist. */
2785 runp = tw;
2786 while (runp < twend)
2787 {
2788 if (runp[0] == L'-' && runp[1] != '\0'
2789 && runp + 1 != twend
2790 && runp != tw
2791 && (unsigned int) runp[-1] <= (unsigned int) runp[1])
2792 {
2793 /* Match against all characters in between the
2794 first and last character of the sequence. */
2795 wchar_t wc;
2796
2797 for (wc = runp[-1] + 1; wc <= runp[1]; ++wc)
2798 if ((wint_t) wc == c)
2799 break;
2800
2801 if (wc <= runp[1] && !not_in)
2802 break;
2803 if (wc <= runp[1] && not_in)
2804 {
2805 /* The current character is not in the
2806 scanset. */
2807 ungetc (c, s);
2808 goto out2;
2809 }
2810
2811 runp += 2;
2812 }
2813 else
2814 {
2815 if ((wint_t) *runp == c && !not_in)
2816 break;
2817 if ((wint_t) *runp == c && not_in)
2818 {
2819 ungetc (c, s);
2820 goto out2;
2821 }
2822
2823 ++runp;
2824 }
2825 }
2826
2827 if (runp == twend && !not_in)
2828 {
2829 ungetc (c, s);
2830 goto out2;
2831 }
2832
2833 if (!(flags & SUPPRESS))
2834 {
2835 if ((flags & MALLOC)
2836 && *strptr + strsize - str <= MB_LEN_MAX)
2837 {
2838 /* Enlarge the buffer. */
2839 size_t strleng = str - *strptr;
2840 char *newstr;
2841
2842 newstr = (char *) realloc (*strptr, 2 * strsize);
2843 if (newstr == NULL)
2844 {
2845 /* Can't allocate that much. Last-ditch
2846 effort. */
2847 newstr = (char *) realloc (*strptr,
2848 strleng + MB_LEN_MAX);
2849 if (newstr == NULL)
2850 {
2851 if (flags & POSIX_MALLOC)
2852 {
2853 done = EOF;
2854 goto errout;
2855 }
2856 /* We lose. Oh well. Terminate the string
2857 and stop converting, so at least we don't
2858 skip any input. */
2859 ((char *) (*strptr))[strleng] = '\0';
2860 strptr = NULL;
2861 ++done;
2862 conv_error ();
2863 }
2864 else
2865 {
2866 *strptr = newstr;
2867 str = newstr + strleng;
2868 strsize = strleng + MB_LEN_MAX;
2869 }
2870 }
2871 else
2872 {
2873 *strptr = newstr;
2874 str = newstr + strleng;
2875 strsize *= 2;
2876 }
2877 }
2878 }
2879
2880 n = __wcrtomb (!(flags & SUPPRESS) ? str : NULL, c, &state);
2881 if (__glibc_unlikely (n == (size_t) -1))
2882 encode_error ();
2883
2884 assert (n <= MB_LEN_MAX);
2885 str += n;
2886 }
2887 while (--width > 0 && inchar () != WEOF);
2888 out2:
2889#else
2890 do
2891 {
2892 if (((char *) charbuf.scratch.data)[c] == not_in)
2893 {
2894 ungetc_not_eof (c, s);
2895 break;
2896 }
2897
2898 /* This is easy. */
2899 if (!(flags & SUPPRESS))
2900 {
2901 *str++ = c;
2902 if ((flags & MALLOC)
2903 && (char *) str == *strptr + strsize)
2904 {
2905 /* Enlarge the buffer. */
2906 size_t newsize = 2 * strsize;
2907
2908 allocagain:
2909 str = (char *) realloc (*strptr, newsize);
2910 if (str == NULL)
2911 {
2912 /* Can't allocate that much. Last-ditch
2913 effort. */
2914 if (newsize > strsize + 1)
2915 {
2916 newsize = strsize + 1;
2917 goto allocagain;
2918 }
2919 if (flags & POSIX_MALLOC)
2920 {
2921 done = EOF;
2922 goto errout;
2923 }
2924 /* We lose. Oh well. Terminate the
2925 string and stop converting,
2926 so at least we don't skip any input. */
2927 ((char *) (*strptr))[strsize - 1] = '\0';
2928 strptr = NULL;
2929 ++done;
2930 conv_error ();
2931 }
2932 else
2933 {
2934 *strptr = (char *) str;
2935 str += strsize;
2936 strsize = newsize;
2937 }
2938 }
2939 }
2940 }
2941 while (--width > 0 && inchar () != EOF);
2942#endif
2943
2944 if (__glibc_unlikely (now == read_in))
2945 /* We haven't succesfully read any character. */
2946 conv_error ();
2947
2948 if (!(flags & SUPPRESS))
2949 {
2950#ifdef COMPILE_WSCANF
2951 /* We have to emit the code to get into the initial
2952 state. */
2953 char buf[MB_LEN_MAX];
2954 size_t n = __wcrtomb (buf, L'\0', &state);
2955 if (n > 0 && (flags & MALLOC)
2956 && str + n >= *strptr + strsize)
2957 {
2958 /* Enlarge the buffer. */
2959 size_t strleng = str - *strptr;
2960 char *newstr;
2961
2962 newstr = (char *) realloc (*strptr, strleng + n + 1);
2963 if (newstr == NULL)
2964 {
2965 if (flags & POSIX_MALLOC)
2966 {
2967 done = EOF;
2968 goto errout;
2969 }
2970 /* We lose. Oh well. Terminate the string
2971 and stop converting, so at least we don't
2972 skip any input. */
2973 ((char *) (*strptr))[strleng] = '\0';
2974 strptr = NULL;
2975 ++done;
2976 conv_error ();
2977 }
2978 else
2979 {
2980 *strptr = newstr;
2981 str = newstr + strleng;
2982 strsize = strleng + n + 1;
2983 }
2984 }
2985
2986 str = __mempcpy (str, buf, n);
2987#endif
2988 *str++ = '\0';
2989
2990 if ((flags & MALLOC) && str - *strptr != strsize)
2991 {
2992 char *cp = (char *) realloc (*strptr, str - *strptr);
2993 if (cp != NULL)
2994 *strptr = cp;
2995 }
2996 strptr = NULL;
2997
2998 ++done;
2999 }
3000 }
3001 break;
3002
3003 case L_('p'): /* Generic pointer. */
3004 base = 16;
3005 /* A PTR must be the same size as a `long int'. */
3006 flags &= ~(SHORT|LONGDBL);
3007 if (need_long)
3008 flags |= LONG;
3009 flags |= READ_POINTER;
3010 goto number;
3011
3012 default:
3013 /* If this is an unknown format character punt. */
3014 conv_error ();
3015 }
3016 }
3017
3018 /* The last thing we saw int the format string was a white space.
3019 Consume the last white spaces. */
3020 if (skip_space)
3021 {
3022 do
3023 c = inchar ();
3024 while (ISSPACE (c));
3025 ungetc (c, s);
3026 }
3027
3028 errout:
3029 /* Unlock stream. */
3030 UNLOCK_STREAM (s);
3031
3032 scratch_buffer_free (&charbuf.scratch);
3033
3034 if (__glibc_unlikely (done == EOF))
3035 {
3036 if (__glibc_unlikely (ptrs_to_free != NULL))
3037 {
3038 struct ptrs_to_free *p = ptrs_to_free;
3039 while (p != NULL)
3040 {
3041 for (size_t cnt = 0; cnt < p->count; ++cnt)
3042 {
3043 free (*p->ptrs[cnt]);
3044 *p->ptrs[cnt] = NULL;
3045 }
3046 p = p->next;
3047 ptrs_to_free = p;
3048 }
3049 }
3050 }
3051 else if (__glibc_unlikely (strptr != NULL))
3052 {
3053 free (*strptr);
3054 *strptr = NULL;
3055 }
3056 return done;
3057}
3058