xref: /freebsd/lib/libc/stdio/vfprintf.c (revision 1b6c76a2fe091c74f08427e6c870851025a9cf67) 
1 /*-
2  * Copyright (c) 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Chris Torek.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *	This product includes software developed by the University of
19  *	California, Berkeley and its contributors.
20  * 4. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #if defined(LIBC_SCCS) && !defined(lint)
38 #if 0
39 static char sccsid[] = "@(#)vfprintf.c	8.1 (Berkeley) 6/4/93";
40 #endif
41 static const char rcsid[] =
42   "$FreeBSD$";
43 #endif /* LIBC_SCCS and not lint */
44 
45 /*
46  * Actual printf innards.
47  *
48  * This code is large and complicated...
49  */
50 
51 #include "namespace.h"
52 #include <sys/types.h>
53 
54 #include <limits.h>
55 #include <stdio.h>
56 #include <stdlib.h>
57 #include <string.h>
58 
59 #if __STDC__
60 #include <stdarg.h>
61 #else
62 #include <varargs.h>
63 #endif
64 #include "un-namespace.h"
65 
66 #include "libc_private.h"
67 #include "local.h"
68 #include "fvwrite.h"
69 
70 /* Define FLOATING_POINT to get floating point. */
71 #define	FLOATING_POINT
72 
73 static int	__sprint __P((FILE *, struct __suio *));
74 static int	__sbprintf __P((FILE *, const char *, va_list));
75 static char *	__ultoa __P((u_long, char *, int, int, char *));
76 static char *	__uqtoa __P((u_quad_t, char *, int, int, char *));
77 static void	__find_arguments __P((const char *, va_list, void ***));
78 static void	__grow_type_table __P((int, unsigned char **, int *));
79 
80 /*
81  * Flush out all the vectors defined by the given uio,
82  * then reset it so that it can be reused.
83  */
84 static int
85 __sprint(FILE *fp, struct __suio *uio)
86 {
87 	int err;
88 
89 	if (uio->uio_resid == 0) {
90 		uio->uio_iovcnt = 0;
91 		return (0);
92 	}
93 	err = __sfvwrite(fp, uio);
94 	uio->uio_resid = 0;
95 	uio->uio_iovcnt = 0;
96 	return (err);
97 }
98 
99 /*
100  * Helper function for `fprintf to unbuffered unix file': creates a
101  * temporary buffer.  We only work on write-only files; this avoids
102  * worries about ungetc buffers and so forth.
103  */
104 static int
105 __sbprintf(FILE *fp, const char *fmt, va_list ap)
106 {
107 	int ret;
108 	FILE fake;
109 	unsigned char buf[BUFSIZ];
110 
111 	/* copy the important variables */
112 	fake._flags = fp->_flags & ~__SNBF;
113 	fake._file = fp->_file;
114 	fake._cookie = fp->_cookie;
115 	fake._write = fp->_write;
116 
117 	/* set up the buffer */
118 	fake._bf._base = fake._p = buf;
119 	fake._bf._size = fake._w = sizeof(buf);
120 	fake._lbfsize = 0;	/* not actually used, but Just In Case */
121 
122 	/* do the work, then copy any error status */
123 	ret = __vfprintf(&fake, fmt, ap);
124 	if (ret >= 0 && __fflush(&fake))
125 		ret = EOF;
126 	if (fake._flags & __SERR)
127 		fp->_flags |= __SERR;
128 	return (ret);
129 }
130 
131 /*
132  * Macros for converting digits to letters and vice versa
133  */
134 #define	to_digit(c)	((c) - '0')
135 #define is_digit(c)	((unsigned)to_digit(c) <= 9)
136 #define	to_char(n)	((n) + '0')
137 
138 /*
139  * Convert an unsigned long to ASCII for printf purposes, returning
140  * a pointer to the first character of the string representation.
141  * Octal numbers can be forced to have a leading zero; hex numbers
142  * use the given digits.
143  */
144 static char *
145 __ultoa(u_long val, char *endp, int base, int octzero, char *xdigs)
146 {
147 	register char *cp = endp;
148 	register long sval;
149 
150 	/*
151 	 * Handle the three cases separately, in the hope of getting
152 	 * better/faster code.
153 	 */
154 	switch (base) {
155 	case 10:
156 		if (val < 10) {	/* many numbers are 1 digit */
157 			*--cp = to_char(val);
158 			return (cp);
159 		}
160 		/*
161 		 * On many machines, unsigned arithmetic is harder than
162 		 * signed arithmetic, so we do at most one unsigned mod and
163 		 * divide; this is sufficient to reduce the range of
164 		 * the incoming value to where signed arithmetic works.
165 		 */
166 		if (val > LONG_MAX) {
167 			*--cp = to_char(val % 10);
168 			sval = val / 10;
169 		} else
170 			sval = val;
171 		do {
172 			*--cp = to_char(sval % 10);
173 			sval /= 10;
174 		} while (sval != 0);
175 		break;
176 
177 	case 8:
178 		do {
179 			*--cp = to_char(val & 7);
180 			val >>= 3;
181 		} while (val);
182 		if (octzero && *cp != '0')
183 			*--cp = '0';
184 		break;
185 
186 	case 16:
187 		do {
188 			*--cp = xdigs[val & 15];
189 			val >>= 4;
190 		} while (val);
191 		break;
192 
193 	default:			/* oops */
194 		abort();
195 	}
196 	return (cp);
197 }
198 
199 /* Identical to __ultoa, but for quads. */
200 static char *
201 __uqtoa(u_quad_t val, char *endp, int base, int octzero, char *xdigs)
202 {
203 	char *cp = endp;
204 	quad_t sval;
205 
206 	/* quick test for small values; __ultoa is typically much faster */
207 	/* (perhaps instead we should run until small, then call __ultoa?) */
208 	if (val <= ULONG_MAX)
209 		return (__ultoa((u_long)val, endp, base, octzero, xdigs));
210 	switch (base) {
211 	case 10:
212 		if (val < 10) {
213 			*--cp = to_char(val % 10);
214 			return (cp);
215 		}
216 		if (val > QUAD_MAX) {
217 			*--cp = to_char(val % 10);
218 			sval = val / 10;
219 		} else
220 			sval = val;
221 		do {
222 			*--cp = to_char(sval % 10);
223 			sval /= 10;
224 		} while (sval != 0);
225 		break;
226 
227 	case 8:
228 		do {
229 			*--cp = to_char(val & 7);
230 			val >>= 3;
231 		} while (val);
232 		if (octzero && *cp != '0')
233 			*--cp = '0';
234 		break;
235 
236 	case 16:
237 		do {
238 			*--cp = xdigs[val & 15];
239 			val >>= 4;
240 		} while (val);
241 		break;
242 
243 	default:
244 		abort();
245 	}
246 	return (cp);
247 }
248 
249 /*
250  * MT-safe version
251  */
252 int
253 vfprintf(FILE *fp, const char *fmt0, va_list ap)
254 {
255 	int ret;
256 
257 	FLOCKFILE(fp);
258 	ret = __vfprintf(fp, fmt0, ap);
259 	FUNLOCKFILE(fp);
260 	return (ret);
261 }
262 
263 #ifdef FLOATING_POINT
264 #include <locale.h>
265 #include <math.h>
266 #include "floatio.h"
267 
268 #define	BUF		(MAXEXP+MAXFRACT+1)	/* + decimal point */
269 #define	DEFPREC		6
270 
271 static char *cvt __P((double, int, int, char *, int *, int, int *, char **));
272 static int exponent __P((char *, int, int));
273 
274 #else /* no FLOATING_POINT */
275 
276 #define	BUF		68
277 
278 #endif /* FLOATING_POINT */
279 
280 #define STATIC_ARG_TBL_SIZE 8           /* Size of static argument table. */
281 
282 /*
283  * Flags used during conversion.
284  */
285 #define	ALT		0x001		/* alternate form */
286 #define	HEXPREFIX	0x002		/* add 0x or 0X prefix */
287 #define	LADJUST		0x004		/* left adjustment */
288 #define	LONGDBL		0x008		/* long double */
289 #define	LONGINT		0x010		/* long integer */
290 #define	QUADINT		0x020		/* quad integer */
291 #define	SHORTINT	0x040		/* short integer */
292 #define	ZEROPAD		0x080		/* zero (as opposed to blank) pad */
293 #define FPT		0x100		/* Floating point number */
294 /*
295  * Non-MT-safe version
296  */
297 int
298 __vfprintf(FILE *fp, const char *fmt0, va_list ap)
299 {
300 	char *fmt;		/* format string */
301 	int ch;			/* character from fmt */
302 	int n, n2;		/* handy integer (short term usage) */
303 	char *cp;		/* handy char pointer (short term usage) */
304 	struct __siov *iovp;	/* for PRINT macro */
305 	int flags;		/* flags as above */
306 	int ret;		/* return value accumulator */
307 	int width;		/* width from format (%8d), or 0 */
308 	int prec;		/* precision from format (%.3d), or -1 */
309 	char sign;		/* sign prefix (' ', '+', '-', or \0) */
310 #ifdef FLOATING_POINT
311 	char *decimal_point = localeconv()->decimal_point;
312 	char softsign;		/* temporary negative sign for floats */
313 	double _double;		/* double precision arguments %[eEfgG] */
314 	int expt;		/* integer value of exponent */
315 	int expsize;		/* character count for expstr */
316 	int ndig;		/* actual number of digits returned by cvt */
317 	char expstr[7];		/* buffer for exponent string */
318 	char *dtoaresult;	/* buffer allocated by dtoa */
319 #endif
320 	u_long	ulval;		/* integer arguments %[diouxX] */
321 	u_quad_t uqval;		/* %q integers */
322 	int base;		/* base for [diouxX] conversion */
323 	int dprec;		/* a copy of prec if [diouxX], 0 otherwise */
324 	int realsz;		/* field size expanded by dprec, sign, etc */
325 	int size;		/* size of converted field or string */
326 	int prsize;             /* max size of printed field */
327 	char *xdigs;		/* digits for [xX] conversion */
328 #define NIOV 8
329 	struct __suio uio;	/* output information: summary */
330 	struct __siov iov[NIOV];/* ... and individual io vectors */
331 	char buf[BUF];		/* space for %c, %[diouxX], %[eEfgG] */
332 	char ox[2];		/* space for 0x hex-prefix */
333         void **argtable;        /* args, built due to positional arg */
334         void *statargtable [STATIC_ARG_TBL_SIZE];
335         int nextarg;            /* 1-based argument index */
336         va_list orgap;          /* original argument pointer */
337 
338 	/*
339 	 * Choose PADSIZE to trade efficiency vs. size.  If larger printf
340 	 * fields occur frequently, increase PADSIZE and make the initialisers
341 	 * below longer.
342 	 */
343 #define	PADSIZE	16		/* pad chunk size */
344 	static char blanks[PADSIZE] =
345 	 {' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' '};
346 	static char zeroes[PADSIZE] =
347 	 {'0','0','0','0','0','0','0','0','0','0','0','0','0','0','0','0'};
348 
349 	/*
350 	 * BEWARE, these `goto error' on error, and PAD uses `n'.
351 	 */
352 #define	PRINT(ptr, len) { \
353 	iovp->iov_base = (ptr); \
354 	iovp->iov_len = (len); \
355 	uio.uio_resid += (len); \
356 	iovp++; \
357 	if (++uio.uio_iovcnt >= NIOV) { \
358 		if (__sprint(fp, &uio)) \
359 			goto error; \
360 		iovp = iov; \
361 	} \
362 }
363 #define	PAD(howmany, with) { \
364 	if ((n = (howmany)) > 0) { \
365 		while (n > PADSIZE) { \
366 			PRINT(with, PADSIZE); \
367 			n -= PADSIZE; \
368 		} \
369 		PRINT(with, n); \
370 	} \
371 }
372 #define	FLUSH() { \
373 	if (uio.uio_resid && __sprint(fp, &uio)) \
374 		goto error; \
375 	uio.uio_iovcnt = 0; \
376 	iovp = iov; \
377 }
378 
379         /*
380          * Get the argument indexed by nextarg.   If the argument table is
381          * built, use it to get the argument.  If its not, get the next
382          * argument (and arguments must be gotten sequentially).
383          */
384 #define GETARG(type) \
385         ((argtable != NULL) ? *((type*)(argtable[nextarg++])) : \
386             (nextarg++, va_arg(ap, type)))
387 
388 	/*
389 	 * To extend shorts properly, we need both signed and unsigned
390 	 * argument extraction methods.
391 	 */
392 #define	SARG() \
393 	(flags&LONGINT ? GETARG(long) : \
394 	    flags&SHORTINT ? (long)(short)GETARG(int) : \
395 	    (long)GETARG(int))
396 #define	UARG() \
397 	(flags&LONGINT ? GETARG(u_long) : \
398 	    flags&SHORTINT ? (u_long)(u_short)GETARG(int) : \
399 	    (u_long)GETARG(u_int))
400 
401         /*
402          * Get * arguments, including the form *nn$.  Preserve the nextarg
403          * that the argument can be gotten once the type is determined.
404          */
405 #define GETASTER(val) \
406         n2 = 0; \
407         cp = fmt; \
408         while (is_digit(*cp)) { \
409                 n2 = 10 * n2 + to_digit(*cp); \
410                 cp++; \
411         } \
412         if (*cp == '$') { \
413             	int hold = nextarg; \
414                 if (argtable == NULL) { \
415                         argtable = statargtable; \
416                         __find_arguments (fmt0, orgap, &argtable); \
417                 } \
418                 nextarg = n2; \
419                 val = GETARG (int); \
420                 nextarg = hold; \
421                 fmt = ++cp; \
422         } else { \
423 		val = GETARG (int); \
424         }
425 
426 
427 #ifdef FLOATING_POINT
428 	dtoaresult = NULL;
429 #endif
430 	/* sorry, fprintf(read_only_file, "") returns EOF, not 0 */
431 	if (cantwrite(fp))
432 		return (EOF);
433 
434 	/* optimise fprintf(stderr) (and other unbuffered Unix files) */
435 	if ((fp->_flags & (__SNBF|__SWR|__SRW)) == (__SNBF|__SWR) &&
436 	    fp->_file >= 0)
437 		return (__sbprintf(fp, fmt0, ap));
438 
439 	fmt = (char *)fmt0;
440         argtable = NULL;
441         nextarg = 1;
442         orgap = ap;
443 	uio.uio_iov = iovp = iov;
444 	uio.uio_resid = 0;
445 	uio.uio_iovcnt = 0;
446 	ret = 0;
447 
448 	/*
449 	 * Scan the format for conversions (`%' character).
450 	 */
451 	for (;;) {
452 		for (cp = fmt; (ch = *fmt) != '\0' && ch != '%'; fmt++)
453 			/* void */;
454 		if ((n = fmt - cp) != 0) {
455 			if ((unsigned)ret + n > INT_MAX) {
456 				ret = EOF;
457 				goto error;
458 			}
459 			PRINT(cp, n);
460 			ret += n;
461 		}
462 		if (ch == '\0')
463 			goto done;
464 		fmt++;		/* skip over '%' */
465 
466 		flags = 0;
467 		dprec = 0;
468 		width = 0;
469 		prec = -1;
470 		sign = '\0';
471 
472 rflag:		ch = *fmt++;
473 reswitch:	switch (ch) {
474 		case ' ':
475 			/*
476 			 * ``If the space and + flags both appear, the space
477 			 * flag will be ignored.''
478 			 *	-- ANSI X3J11
479 			 */
480 			if (!sign)
481 				sign = ' ';
482 			goto rflag;
483 		case '#':
484 			flags |= ALT;
485 			goto rflag;
486 		case '*':
487 			/*
488 			 * ``A negative field width argument is taken as a
489 			 * - flag followed by a positive field width.''
490 			 *	-- ANSI X3J11
491 			 * They don't exclude field widths read from args.
492 			 */
493 			GETASTER (width);
494 			if (width >= 0)
495 				goto rflag;
496 			width = -width;
497 			/* FALLTHROUGH */
498 		case '-':
499 			flags |= LADJUST;
500 			goto rflag;
501 		case '+':
502 			sign = '+';
503 			goto rflag;
504 		case '.':
505 			if ((ch = *fmt++) == '*') {
506 				GETASTER (n);
507 				prec = n < 0 ? -1 : n;
508 				goto rflag;
509 			}
510 			n = 0;
511 			while (is_digit(ch)) {
512 				n = 10 * n + to_digit(ch);
513 				ch = *fmt++;
514 			}
515 			prec = n < 0 ? -1 : n;
516 			goto reswitch;
517 		case '0':
518 			/*
519 			 * ``Note that 0 is taken as a flag, not as the
520 			 * beginning of a field width.''
521 			 *	-- ANSI X3J11
522 			 */
523 			flags |= ZEROPAD;
524 			goto rflag;
525 		case '1': case '2': case '3': case '4':
526 		case '5': case '6': case '7': case '8': case '9':
527 			n = 0;
528 			do {
529 				n = 10 * n + to_digit(ch);
530 				ch = *fmt++;
531 			} while (is_digit(ch));
532 			if (ch == '$') {
533 				nextarg = n;
534                         	if (argtable == NULL) {
535                                 	argtable = statargtable;
536                                 	__find_arguments (fmt0, orgap,
537 						&argtable);
538 				}
539 				goto rflag;
540                         }
541 			width = n;
542 			goto reswitch;
543 #ifdef FLOATING_POINT
544 		case 'L':
545 			flags |= LONGDBL;
546 			goto rflag;
547 #endif
548 		case 'h':
549 			flags |= SHORTINT;
550 			goto rflag;
551 		case 'l':
552 			if (flags & LONGINT)
553 				flags |= QUADINT;
554 			else
555 				flags |= LONGINT;
556 			goto rflag;
557 		case 'q':
558 			flags |= QUADINT;
559 			goto rflag;
560 		case 'c':
561 			*(cp = buf) = GETARG(int);
562 			size = 1;
563 			sign = '\0';
564 			break;
565 		case 'D':
566 			flags |= LONGINT;
567 			/*FALLTHROUGH*/
568 		case 'd':
569 		case 'i':
570 			if (flags & QUADINT) {
571 				uqval = GETARG(quad_t);
572 				if ((quad_t)uqval < 0) {
573 					uqval = -uqval;
574 					sign = '-';
575 				}
576 			} else {
577 				ulval = SARG();
578 				if ((long)ulval < 0) {
579 					ulval = -ulval;
580 					sign = '-';
581 				}
582 			}
583 			base = 10;
584 			goto number;
585 #ifdef FLOATING_POINT
586 		case 'e':
587 		case 'E':
588 		case 'f':
589 			goto fp_begin;
590 		case 'g':
591 		case 'G':
592 			if (prec == 0)
593 				prec = 1;
594 fp_begin:		if (prec == -1)
595 				prec = DEFPREC;
596 			if (flags & LONGDBL)
597 				/* XXX this loses precision. */
598 				_double = (double)GETARG(long double);
599 			else
600 				_double = GETARG(double);
601 			/* do this before tricky precision changes */
602 			if (isinf(_double)) {
603 				if (_double < 0)
604 					sign = '-';
605 				cp = "Inf";
606 				size = 3;
607 				break;
608 			}
609 			if (isnan(_double)) {
610 				cp = "NaN";
611 				size = 3;
612 				break;
613 			}
614 			flags |= FPT;
615 			if (dtoaresult != NULL) {
616 				free(dtoaresult);
617 				dtoaresult = NULL;
618 			}
619 			cp = cvt(_double, prec, flags, &softsign,
620 				&expt, ch, &ndig, &dtoaresult);
621 			if (ch == 'g' || ch == 'G') {
622 				if (expt <= -4 || expt > prec)
623 					ch = (ch == 'g') ? 'e' : 'E';
624 				else
625 					ch = 'g';
626 			}
627 			if (ch <= 'e') {	/* 'e' or 'E' fmt */
628 				--expt;
629 				expsize = exponent(expstr, expt, ch);
630 				size = expsize + ndig;
631 				if (ndig > 1 || flags & ALT)
632 					++size;
633 			} else if (ch == 'f') {		/* f fmt */
634 				if (expt > 0) {
635 					size = expt;
636 					if (prec || flags & ALT)
637 						size += prec + 1;
638 				} else	/* "0.X" */
639 					size = prec + 2;
640 			} else if (expt >= ndig) {	/* fixed g fmt */
641 				size = expt;
642 				if (flags & ALT)
643 					++size;
644 			} else
645 				size = ndig + (expt > 0 ?
646 					1 : 2 - expt);
647 
648 			if (softsign)
649 				sign = '-';
650 			break;
651 #endif /* FLOATING_POINT */
652 		case 'n':
653 			if (flags & QUADINT)
654 				*GETARG(quad_t *) = ret;
655 			else if (flags & LONGINT)
656 				*GETARG(long *) = ret;
657 			else if (flags & SHORTINT)
658 				*GETARG(short *) = ret;
659 			else
660 				*GETARG(int *) = ret;
661 			continue;	/* no output */
662 		case 'O':
663 			flags |= LONGINT;
664 			/*FALLTHROUGH*/
665 		case 'o':
666 			if (flags & QUADINT)
667 				uqval = GETARG(u_quad_t);
668 			else
669 				ulval = UARG();
670 			base = 8;
671 			goto nosign;
672 		case 'p':
673 			/*
674 			 * ``The argument shall be a pointer to void.  The
675 			 * value of the pointer is converted to a sequence
676 			 * of printable characters, in an implementation-
677 			 * defined manner.''
678 			 *	-- ANSI X3J11
679 			 */
680 			ulval = (u_long)GETARG(void *);
681 			base = 16;
682 			xdigs = "0123456789abcdef";
683 			flags = (flags & ~QUADINT) | HEXPREFIX;
684 			ch = 'x';
685 			goto nosign;
686 		case 's':
687 			if ((cp = GETARG(char *)) == NULL)
688 				cp = "(null)";
689 			if (prec >= 0) {
690 				/*
691 				 * can't use strlen; can only look for the
692 				 * NUL in the first `prec' characters, and
693 				 * strlen() will go further.
694 				 */
695 				char *p = memchr(cp, 0, (size_t)prec);
696 
697 				if (p != NULL) {
698 					size = p - cp;
699 					if (size > prec)
700 						size = prec;
701 				} else
702 					size = prec;
703 			} else
704 				size = strlen(cp);
705 			sign = '\0';
706 			break;
707 		case 'U':
708 			flags |= LONGINT;
709 			/*FALLTHROUGH*/
710 		case 'u':
711 			if (flags & QUADINT)
712 				uqval = GETARG(u_quad_t);
713 			else
714 				ulval = UARG();
715 			base = 10;
716 			goto nosign;
717 		case 'X':
718 			xdigs = "0123456789ABCDEF";
719 			goto hex;
720 		case 'x':
721 			xdigs = "0123456789abcdef";
722 hex:			if (flags & QUADINT)
723 				uqval = GETARG(u_quad_t);
724 			else
725 				ulval = UARG();
726 			base = 16;
727 			/* leading 0x/X only if non-zero */
728 			if (flags & ALT &&
729 			    (flags & QUADINT ? uqval != 0 : ulval != 0))
730 				flags |= HEXPREFIX;
731 
732 			/* unsigned conversions */
733 nosign:			sign = '\0';
734 			/*
735 			 * ``... diouXx conversions ... if a precision is
736 			 * specified, the 0 flag will be ignored.''
737 			 *	-- ANSI X3J11
738 			 */
739 number:			if ((dprec = prec) >= 0)
740 				flags &= ~ZEROPAD;
741 
742 			/*
743 			 * ``The result of converting a zero value with an
744 			 * explicit precision of zero is no characters.''
745 			 *	-- ANSI X3J11
746 			 */
747 			cp = buf + BUF;
748 			if (flags & QUADINT) {
749 				if (uqval != 0 || prec != 0)
750 					cp = __uqtoa(uqval, cp, base,
751 					    flags & ALT, xdigs);
752 			} else {
753 				if (ulval != 0 || prec != 0)
754 					cp = __ultoa(ulval, cp, base,
755 					    flags & ALT, xdigs);
756 			}
757 			size = buf + BUF - cp;
758 			break;
759 		default:	/* "%?" prints ?, unless ? is NUL */
760 			if (ch == '\0')
761 				goto done;
762 			/* pretend it was %c with argument ch */
763 			cp = buf;
764 			*cp = ch;
765 			size = 1;
766 			sign = '\0';
767 			break;
768 		}
769 
770 		/*
771 		 * All reasonable formats wind up here.  At this point, `cp'
772 		 * points to a string which (if not flags&LADJUST) should be
773 		 * padded out to `width' places.  If flags&ZEROPAD, it should
774 		 * first be prefixed by any sign or other prefix; otherwise,
775 		 * it should be blank padded before the prefix is emitted.
776 		 * After any left-hand padding and prefixing, emit zeroes
777 		 * required by a decimal [diouxX] precision, then print the
778 		 * string proper, then emit zeroes required by any leftover
779 		 * floating precision; finally, if LADJUST, pad with blanks.
780 		 *
781 		 * Compute actual size, so we know how much to pad.
782 		 * size excludes decimal prec; realsz includes it.
783 		 */
784 		realsz = dprec > size ? dprec : size;
785 		if (sign)
786 			realsz++;
787 		else if (flags & HEXPREFIX)
788 			realsz += 2;
789 
790 		prsize = width > realsz ? width : realsz;
791 		if ((unsigned)ret + prsize > INT_MAX) {
792 			ret = EOF;
793 			goto error;
794 		}
795 
796 		/* right-adjusting blank padding */
797 		if ((flags & (LADJUST|ZEROPAD)) == 0)
798 			PAD(width - realsz, blanks);
799 
800 		/* prefix */
801 		if (sign) {
802 			PRINT(&sign, 1);
803 		} else if (flags & HEXPREFIX) {
804 			ox[0] = '0';
805 			ox[1] = ch;
806 			PRINT(ox, 2);
807 		}
808 
809 		/* right-adjusting zero padding */
810 		if ((flags & (LADJUST|ZEROPAD)) == ZEROPAD)
811 			PAD(width - realsz, zeroes);
812 
813 		/* leading zeroes from decimal precision */
814 		PAD(dprec - size, zeroes);
815 
816 		/* the string or number proper */
817 #ifdef FLOATING_POINT
818 		if ((flags & FPT) == 0) {
819 			PRINT(cp, size);
820 		} else {	/* glue together f_p fragments */
821 			if (ch >= 'f') {	/* 'f' or 'g' */
822 				if (_double == 0) {
823 					/* kludge for __dtoa irregularity */
824 					PRINT("0", 1);
825 					if (expt < ndig || (flags & ALT) != 0) {
826 						PRINT(decimal_point, 1);
827 						PAD(ndig - 1, zeroes);
828 					}
829 				} else if (expt <= 0) {
830 					PRINT("0", 1);
831 					PRINT(decimal_point, 1);
832 					PAD(-expt, zeroes);
833 					PRINT(cp, ndig);
834 				} else if (expt >= ndig) {
835 					PRINT(cp, ndig);
836 					PAD(expt - ndig, zeroes);
837 					if (flags & ALT)
838 						PRINT(decimal_point, 1);
839 				} else {
840 					PRINT(cp, expt);
841 					cp += expt;
842 					PRINT(decimal_point, 1);
843 					PRINT(cp, ndig-expt);
844 				}
845 			} else {	/* 'e' or 'E' */
846 				if (ndig > 1 || flags & ALT) {
847 					ox[0] = *cp++;
848 					ox[1] = *decimal_point;
849 					PRINT(ox, 2);
850 					if (_double) {
851 						PRINT(cp, ndig-1);
852 					} else	/* 0.[0..] */
853 						/* __dtoa irregularity */
854 						PAD(ndig - 1, zeroes);
855 				} else	/* XeYYY */
856 					PRINT(cp, 1);
857 				PRINT(expstr, expsize);
858 			}
859 		}
860 #else
861 		PRINT(cp, size);
862 #endif
863 		/* left-adjusting padding (always blank) */
864 		if (flags & LADJUST)
865 			PAD(width - realsz, blanks);
866 
867 		/* finally, adjust ret */
868 		ret += prsize;
869 
870 		FLUSH();	/* copy out the I/O vectors */
871 	}
872 done:
873 	FLUSH();
874 error:
875 #ifdef FLOATING_POINT
876 	if (dtoaresult != NULL)
877 		free(dtoaresult);
878 #endif
879 	if (__sferror(fp))
880 		ret = EOF;
881         if ((argtable != NULL) && (argtable != statargtable))
882                 free (argtable);
883 	return (ret);
884 	/* NOTREACHED */
885 }
886 
887 /*
888  * Type ids for argument type table.
889  */
890 #define T_UNUSED	0
891 #define T_SHORT		1
892 #define T_U_SHORT	2
893 #define TP_SHORT	3
894 #define T_INT		4
895 #define T_U_INT		5
896 #define TP_INT		6
897 #define T_LONG		7
898 #define T_U_LONG	8
899 #define TP_LONG		9
900 #define T_QUAD		10
901 #define T_U_QUAD	11
902 #define TP_QUAD		12
903 #define T_DOUBLE	13
904 #define T_LONG_DOUBLE	14
905 #define TP_CHAR		15
906 #define TP_VOID		16
907 
908 /*
909  * Find all arguments when a positional parameter is encountered.  Returns a
910  * table, indexed by argument number, of pointers to each arguments.  The
911  * initial argument table should be an array of STATIC_ARG_TBL_SIZE entries.
912  * It will be replaces with a malloc-ed one if it overflows.
913  */
914 static void
915 __find_arguments (const char *fmt0, va_list ap, void ***argtable)
916 {
917 	char *fmt;		/* format string */
918 	int ch;			/* character from fmt */
919 	int n, n2;		/* handy integer (short term usage) */
920 	char *cp;		/* handy char pointer (short term usage) */
921 	int flags;		/* flags as above */
922 	int width;		/* width from format (%8d), or 0 */
923 	unsigned char *typetable; /* table of types */
924 	unsigned char stattypetable [STATIC_ARG_TBL_SIZE];
925 	int tablesize;		/* current size of type table */
926 	int tablemax;		/* largest used index in table */
927 	int nextarg;		/* 1-based argument index */
928 
929 	/*
930 	 * Add an argument type to the table, expanding if necessary.
931 	 */
932 #define ADDTYPE(type) \
933 	((nextarg >= tablesize) ? \
934 		__grow_type_table(nextarg, &typetable, &tablesize) : 0, \
935 	(nextarg > tablemax) ? tablemax = nextarg : 0, \
936 	typetable[nextarg++] = type)
937 
938 #define	ADDSARG() \
939 	((flags&LONGINT) ? ADDTYPE(T_LONG) : \
940 		((flags&SHORTINT) ? ADDTYPE(T_SHORT) : ADDTYPE(T_INT)))
941 
942 #define	ADDUARG() \
943 	((flags&LONGINT) ? ADDTYPE(T_U_LONG) : \
944 		((flags&SHORTINT) ? ADDTYPE(T_U_SHORT) : ADDTYPE(T_U_INT)))
945 
946 	/*
947 	 * Add * arguments to the type array.
948 	 */
949 #define ADDASTER() \
950 	n2 = 0; \
951 	cp = fmt; \
952 	while (is_digit(*cp)) { \
953 		n2 = 10 * n2 + to_digit(*cp); \
954 		cp++; \
955 	} \
956 	if (*cp == '$') { \
957 		int hold = nextarg; \
958 		nextarg = n2; \
959 		ADDTYPE (T_INT); \
960 		nextarg = hold; \
961 		fmt = ++cp; \
962 	} else { \
963 		ADDTYPE (T_INT); \
964 	}
965 	fmt = (char *)fmt0;
966 	typetable = stattypetable;
967 	tablesize = STATIC_ARG_TBL_SIZE;
968 	tablemax = 0;
969 	nextarg = 1;
970 	memset (typetable, T_UNUSED, STATIC_ARG_TBL_SIZE);
971 
972 	/*
973 	 * Scan the format for conversions (`%' character).
974 	 */
975 	for (;;) {
976 		for (cp = fmt; (ch = *fmt) != '\0' && ch != '%'; fmt++)
977 			/* void */;
978 		if (ch == '\0')
979 			goto done;
980 		fmt++;		/* skip over '%' */
981 
982 		flags = 0;
983 		width = 0;
984 
985 rflag:		ch = *fmt++;
986 reswitch:	switch (ch) {
987 		case ' ':
988 		case '#':
989 			goto rflag;
990 		case '*':
991 			ADDASTER ();
992 			goto rflag;
993 		case '-':
994 		case '+':
995 			goto rflag;
996 		case '.':
997 			if ((ch = *fmt++) == '*') {
998 				ADDASTER ();
999 				goto rflag;
1000 			}
1001 			while (is_digit(ch)) {
1002 				ch = *fmt++;
1003 			}
1004 			goto reswitch;
1005 		case '0':
1006 			goto rflag;
1007 		case '1': case '2': case '3': case '4':
1008 		case '5': case '6': case '7': case '8': case '9':
1009 			n = 0;
1010 			do {
1011 				n = 10 * n + to_digit(ch);
1012 				ch = *fmt++;
1013 			} while (is_digit(ch));
1014 			if (ch == '$') {
1015 				nextarg = n;
1016 				goto rflag;
1017 			}
1018 			width = n;
1019 			goto reswitch;
1020 #ifdef FLOATING_POINT
1021 		case 'L':
1022 			flags |= LONGDBL;
1023 			goto rflag;
1024 #endif
1025 		case 'h':
1026 			flags |= SHORTINT;
1027 			goto rflag;
1028 		case 'l':
1029 			if (flags & LONGINT)
1030 				flags |= QUADINT;
1031 			else
1032 				flags |= LONGINT;
1033 			goto rflag;
1034 		case 'q':
1035 			flags |= QUADINT;
1036 			goto rflag;
1037 		case 'c':
1038 			ADDTYPE(T_INT);
1039 			break;
1040 		case 'D':
1041 			flags |= LONGINT;
1042 			/*FALLTHROUGH*/
1043 		case 'd':
1044 		case 'i':
1045 			if (flags & QUADINT) {
1046 				ADDTYPE(T_QUAD);
1047 			} else {
1048 				ADDSARG();
1049 			}
1050 			break;
1051 #ifdef FLOATING_POINT
1052 		case 'e':
1053 		case 'E':
1054 		case 'f':
1055 		case 'g':
1056 		case 'G':
1057 			if (flags & LONGDBL)
1058 				ADDTYPE(T_LONG_DOUBLE);
1059 			else
1060 				ADDTYPE(T_DOUBLE);
1061 			break;
1062 #endif /* FLOATING_POINT */
1063 		case 'n':
1064 			if (flags & QUADINT)
1065 				ADDTYPE(TP_QUAD);
1066 			else if (flags & LONGINT)
1067 				ADDTYPE(TP_LONG);
1068 			else if (flags & SHORTINT)
1069 				ADDTYPE(TP_SHORT);
1070 			else
1071 				ADDTYPE(TP_INT);
1072 			continue;	/* no output */
1073 		case 'O':
1074 			flags |= LONGINT;
1075 			/*FALLTHROUGH*/
1076 		case 'o':
1077 			if (flags & QUADINT)
1078 				ADDTYPE(T_U_QUAD);
1079 			else
1080 				ADDUARG();
1081 			break;
1082 		case 'p':
1083 			ADDTYPE(TP_VOID);
1084 			break;
1085 		case 's':
1086 			ADDTYPE(TP_CHAR);
1087 			break;
1088 		case 'U':
1089 			flags |= LONGINT;
1090 			/*FALLTHROUGH*/
1091 		case 'u':
1092 			if (flags & QUADINT)
1093 				ADDTYPE(T_U_QUAD);
1094 			else
1095 				ADDUARG();
1096 			break;
1097 		case 'X':
1098 		case 'x':
1099 			if (flags & QUADINT)
1100 				ADDTYPE(T_U_QUAD);
1101 			else
1102 				ADDUARG();
1103 			break;
1104 		default:	/* "%?" prints ?, unless ? is NUL */
1105 			if (ch == '\0')
1106 				goto done;
1107 			break;
1108 		}
1109 	}
1110 done:
1111 	/*
1112 	 * Build the argument table.
1113 	 */
1114 	if (tablemax >= STATIC_ARG_TBL_SIZE) {
1115 		*argtable = (void **)
1116 		    malloc (sizeof (void *) * (tablemax + 1));
1117 	}
1118 
1119 	(*argtable) [0] = NULL;
1120 	for (n = 1; n <= tablemax; n++) {
1121 		switch (typetable [n]) {
1122 		    case T_UNUSED:
1123 			(*argtable) [n] = (void *) &va_arg (ap, int);
1124 			break;
1125 		    case T_SHORT:
1126 			(*argtable) [n] = (void *) &va_arg (ap, int);
1127 			break;
1128 		    case T_U_SHORT:
1129 			(*argtable) [n] = (void *) &va_arg (ap, int);
1130 			break;
1131 		    case TP_SHORT:
1132 			(*argtable) [n] = (void *) &va_arg (ap, short *);
1133 			break;
1134 		    case T_INT:
1135 			(*argtable) [n] = (void *) &va_arg (ap, int);
1136 			break;
1137 		    case T_U_INT:
1138 			(*argtable) [n] = (void *) &va_arg (ap, unsigned int);
1139 			break;
1140 		    case TP_INT:
1141 			(*argtable) [n] = (void *) &va_arg (ap, int *);
1142 			break;
1143 		    case T_LONG:
1144 			(*argtable) [n] = (void *) &va_arg (ap, long);
1145 			break;
1146 		    case T_U_LONG:
1147 			(*argtable) [n] = (void *) &va_arg (ap, unsigned long);
1148 			break;
1149 		    case TP_LONG:
1150 			(*argtable) [n] = (void *) &va_arg (ap, long *);
1151 			break;
1152 		    case T_QUAD:
1153 			(*argtable) [n] = (void *) &va_arg (ap, quad_t);
1154 			break;
1155 		    case T_U_QUAD:
1156 			(*argtable) [n] = (void *) &va_arg (ap, u_quad_t);
1157 			break;
1158 		    case TP_QUAD:
1159 			(*argtable) [n] = (void *) &va_arg (ap, quad_t *);
1160 			break;
1161 		    case T_DOUBLE:
1162 			(*argtable) [n] = (void *) &va_arg (ap, double);
1163 			break;
1164 		    case T_LONG_DOUBLE:
1165 			(*argtable) [n] = (void *) &va_arg (ap, long double);
1166 			break;
1167 		    case TP_CHAR:
1168 			(*argtable) [n] = (void *) &va_arg (ap, char *);
1169 			break;
1170 		    case TP_VOID:
1171 			(*argtable) [n] = (void *) &va_arg (ap, void *);
1172 			break;
1173 		}
1174 	}
1175 
1176 	if ((typetable != NULL) && (typetable != stattypetable))
1177 		free (typetable);
1178 }
1179 
1180 /*
1181  * Increase the size of the type table.
1182  */
1183 static void
1184 __grow_type_table (int nextarg, unsigned char **typetable, int *tablesize)
1185 {
1186 	unsigned char *const oldtable = *typetable;
1187 	const int oldsize = *tablesize;
1188 	unsigned char *newtable;
1189 	int newsize = oldsize * 2;
1190 
1191 	if (newsize < nextarg + 1)
1192 		newsize = nextarg + 1;
1193 	if (oldsize == STATIC_ARG_TBL_SIZE) {
1194 		if ((newtable = malloc(newsize)) == NULL)
1195 			abort();			/* XXX handle better */
1196 		bcopy(oldtable, newtable, oldsize);
1197 	} else {
1198 		if ((newtable = reallocf(oldtable, newsize)) == NULL)
1199 			abort();			/* XXX handle better */
1200 	}
1201 	memset(&newtable[oldsize], T_UNUSED, newsize - oldsize);
1202 
1203 	*typetable = newtable;
1204 	*tablesize = newsize;
1205 }
1206 
1207 
1208 #ifdef FLOATING_POINT
1209 
1210 extern char *__dtoa __P((double, int, int, int *, int *, char **, char **));
1211 
1212 static char *
1213 cvt(double value, int ndigits, int flags, char *sign, int *decpt,
1214     int ch, int *length, char **dtoaresultp)
1215 {
1216 	int mode, dsgn;
1217 	char *digits, *bp, *rve;
1218 
1219 	if (ch == 'f')
1220 		mode = 3;		/* ndigits after the decimal point */
1221 	else {
1222 		/*
1223 		 * To obtain ndigits after the decimal point for the 'e'
1224 		 * and 'E' formats, round to ndigits + 1 significant
1225 		 * figures.
1226 		 */
1227 		if (ch == 'e' || ch == 'E')
1228 			ndigits++;
1229 		mode = 2;		/* ndigits significant digits */
1230 	}
1231 	if (value < 0) {
1232 		value = -value;
1233 		*sign = '-';
1234 	} else
1235 		*sign = '\000';
1236 	digits = __dtoa(value, mode, ndigits, decpt, &dsgn, &rve,
1237 			dtoaresultp);
1238 	if ((ch != 'g' && ch != 'G') || flags & ALT) {
1239 		/* print trailing zeros */
1240 		bp = digits + ndigits;
1241 		if (ch == 'f') {
1242 			if (*digits == '0' && value)
1243 				*decpt = -ndigits + 1;
1244 			bp += *decpt;
1245 		}
1246 		if (value == 0)	/* kludge for __dtoa irregularity */
1247 			rve = bp;
1248 		while (rve < bp)
1249 			*rve++ = '0';
1250 	}
1251 	*length = rve - digits;
1252 	return (digits);
1253 }
1254 
1255 static int
1256 exponent(char *p0, int exp, int fmtch)
1257 {
1258 	char *p, *t;
1259 	char expbuf[MAXEXP];
1260 
1261 	p = p0;
1262 	*p++ = fmtch;
1263 	if (exp < 0) {
1264 		exp = -exp;
1265 		*p++ = '-';
1266 	}
1267 	else
1268 		*p++ = '+';
1269 	t = expbuf + MAXEXP;
1270 	if (exp > 9) {
1271 		do {
1272 			*--t = to_char(exp % 10);
1273 		} while ((exp /= 10) > 9);
1274 		*--t = to_char(exp);
1275 		for (; t < expbuf + MAXEXP; *p++ = *t++);
1276 	}
1277 	else {
1278 		*p++ = '0';
1279 		*p++ = to_char(exp);
1280 	}
1281 	return (p - p0);
1282 }
1283 #endif /* FLOATING_POINT */
1284