xref: /freebsd/lib/libc/stdio/vfscanf.c (revision 224af215a6fe8d5e5e2c91cc97c48bdd67c991c7)
1 /*-
2  * Copyright (c) 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Chris Torek.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *	This product includes software developed by the University of
19  *	California, Berkeley and its contributors.
20  * 4. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #if defined(LIBC_SCCS) && !defined(lint)
38 static char sccsid[] = "@(#)vfscanf.c	8.1 (Berkeley) 6/4/93";
39 #endif /* LIBC_SCCS and not lint */
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD$");
42 
43 #include "namespace.h"
44 #include <ctype.h>
45 #include <inttypes.h>
46 #include <stdio.h>
47 #include <stdlib.h>
48 #include <stddef.h>
49 #include <stdarg.h>
50 #include <string.h>
51 #include <wchar.h>
52 #include <wctype.h>
53 #include "un-namespace.h"
54 
55 #include "collate.h"
56 #include "libc_private.h"
57 #include "local.h"
58 
59 #define FLOATING_POINT
60 
61 #ifdef FLOATING_POINT
62 #include <locale.h>
63 #include "floatio.h"
64 #endif
65 
66 #define	BUF		513	/* Maximum length of numeric string. */
67 
68 /*
69  * Flags used during conversion.
70  */
71 #define	LONG		0x01	/* l: long or double */
72 #define	LONGDBL		0x02	/* L: long double */
73 #define	SHORT		0x04	/* h: short */
74 #define	SUPPRESS	0x08	/* *: suppress assignment */
75 #define	POINTER		0x10	/* p: void * (as hex) */
76 #define	NOSKIP		0x20	/* [ or c: do not skip blanks */
77 #define	LONGLONG	0x400	/* ll: long long (+ deprecated q: quad) */
78 #define	INTMAXT		0x800	/* j: intmax_t */
79 #define	PTRDIFFT	0x1000	/* t: ptrdiff_t */
80 #define	SIZET		0x2000	/* z: size_t */
81 #define	SHORTSHORT	0x4000	/* hh: char */
82 #define	UNSIGNED	0x8000	/* %[oupxX] conversions */
83 
84 /*
85  * The following are used in numeric conversions only:
86  * SIGNOK, NDIGITS, DPTOK, and EXPOK are for floating point;
87  * SIGNOK, NDIGITS, PFXOK, and NZDIGITS are for integral.
88  */
89 #define	SIGNOK		0x40	/* +/- is (still) legal */
90 #define	NDIGITS		0x80	/* no digits detected */
91 
92 #define	DPTOK		0x100	/* (float) decimal point is still legal */
93 #define	EXPOK		0x200	/* (float) exponent (e+3, etc) still legal */
94 
95 #define	PFXOK		0x100	/* 0x prefix is (still) legal */
96 #define	NZDIGITS	0x200	/* no zero digits detected */
97 
98 /*
99  * Conversion types.
100  */
101 #define	CT_CHAR		0	/* %c conversion */
102 #define	CT_CCL		1	/* %[...] conversion */
103 #define	CT_STRING	2	/* %s conversion */
104 #define	CT_INT		3	/* %[dioupxX] conversion */
105 #define	CT_FLOAT	4	/* %[efgEFG] conversion */
106 
107 static const u_char *__sccl(char *, const u_char *);
108 
109 /*
110  * __vfscanf - MT-safe version
111  */
112 int
113 __vfscanf(FILE *fp, char const *fmt0, va_list ap)
114 {
115 	int ret;
116 
117 	FLOCKFILE(fp);
118 	ret = __svfscanf(fp, fmt0, ap);
119 	FUNLOCKFILE(fp);
120 	return (ret);
121 }
122 
123 /*
124  * __svfscanf - non-MT-safe version of __vfscanf
125  */
126 int
127 __svfscanf(FILE *fp, const char *fmt0, va_list ap)
128 {
129 	const u_char *fmt = (const u_char *)fmt0;
130 	int c;			/* character from format, or conversion */
131 	size_t width;		/* field width, or 0 */
132 	char *p;		/* points into all kinds of strings */
133 	int n;			/* handy integer */
134 	int flags;		/* flags as defined above */
135 	char *p0;		/* saves original value of p when necessary */
136 	int nassigned;		/* number of fields assigned */
137 	int nconversions;	/* number of conversions */
138 	int nread;		/* number of characters consumed from fp */
139 	int base;		/* base argument to conversion function */
140 	char ccltab[256];	/* character class table for %[...] */
141 	char buf[BUF];		/* buffer for numeric and mb conversions */
142 	wchar_t *wcp;		/* handy wide character pointer */
143 	wchar_t *wcp0;		/* saves original value of wcp */
144 	mbstate_t mbs;		/* multibyte conversion state */
145 	size_t nconv;		/* length of multibyte sequence converted */
146 
147 	/* `basefix' is used to avoid `if' tests in the integer scanner */
148 	static short basefix[17] =
149 		{ 10, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 };
150 #ifdef FLOATING_POINT
151 	char decimal_point = localeconv()->decimal_point[0];
152 #endif
153 
154 	ORIENT(fp, -1);
155 
156 	nassigned = 0;
157 	nconversions = 0;
158 	nread = 0;
159 	for (;;) {
160 		c = *fmt++;
161 		if (c == 0)
162 			return (nassigned);
163 		if (isspace(c)) {
164 			while ((fp->_r > 0 || __srefill(fp) == 0) && isspace(*fp->_p))
165 				nread++, fp->_r--, fp->_p++;
166 			continue;
167 		}
168 		if (c != '%')
169 			goto literal;
170 		width = 0;
171 		flags = 0;
172 		/*
173 		 * switch on the format.  continue if done;
174 		 * break once format type is derived.
175 		 */
176 again:		c = *fmt++;
177 		switch (c) {
178 		case '%':
179 literal:
180 			if (fp->_r <= 0 && __srefill(fp))
181 				goto input_failure;
182 			if (*fp->_p != c)
183 				goto match_failure;
184 			fp->_r--, fp->_p++;
185 			nread++;
186 			continue;
187 
188 		case '*':
189 			flags |= SUPPRESS;
190 			goto again;
191 		case 'j':
192 			flags |= INTMAXT;
193 			goto again;
194 		case 'l':
195 			if (flags & LONG) {
196 				flags &= ~LONG;
197 				flags |= LONGLONG;
198 			} else
199 				flags |= LONG;
200 			goto again;
201 		case 'q':
202 			flags |= LONGLONG;	/* not quite */
203 			goto again;
204 		case 't':
205 			flags |= PTRDIFFT;
206 			goto again;
207 		case 'z':
208 			flags |= SIZET;
209 			goto again;
210 		case 'L':
211 			flags |= LONGDBL;
212 			goto again;
213 		case 'h':
214 			if (flags & SHORT) {
215 				flags &= ~SHORT;
216 				flags |= SHORTSHORT;
217 			} else
218 				flags |= SHORT;
219 			goto again;
220 
221 		case '0': case '1': case '2': case '3': case '4':
222 		case '5': case '6': case '7': case '8': case '9':
223 			width = width * 10 + c - '0';
224 			goto again;
225 
226 		/*
227 		 * Conversions.
228 		 */
229 		case 'd':
230 			c = CT_INT;
231 			base = 10;
232 			break;
233 
234 		case 'i':
235 			c = CT_INT;
236 			base = 0;
237 			break;
238 
239 		case 'o':
240 			c = CT_INT;
241 			flags |= UNSIGNED;
242 			base = 8;
243 			break;
244 
245 		case 'u':
246 			c = CT_INT;
247 			flags |= UNSIGNED;
248 			base = 10;
249 			break;
250 
251 		case 'X':
252 		case 'x':
253 			flags |= PFXOK;	/* enable 0x prefixing */
254 			c = CT_INT;
255 			flags |= UNSIGNED;
256 			base = 16;
257 			break;
258 
259 #ifdef FLOATING_POINT
260 		case 'E': case 'F': case 'G':
261 		case 'e': case 'f': case 'g':
262 			c = CT_FLOAT;
263 			break;
264 #endif
265 
266 		case 'S':
267 			flags |= LONG;
268 			/* FALLTHROUGH */
269 		case 's':
270 			c = CT_STRING;
271 			break;
272 
273 		case '[':
274 			fmt = __sccl(ccltab, fmt);
275 			flags |= NOSKIP;
276 			c = CT_CCL;
277 			break;
278 
279 		case 'C':
280 			flags |= LONG;
281 			/* FALLTHROUGH */
282 		case 'c':
283 			flags |= NOSKIP;
284 			c = CT_CHAR;
285 			break;
286 
287 		case 'p':	/* pointer format is like hex */
288 			flags |= POINTER | PFXOK;
289 			c = CT_INT;		/* assumes sizeof(uintmax_t) */
290 			flags |= UNSIGNED;	/*      >= sizeof(uintptr_t) */
291 			base = 16;
292 			break;
293 
294 		case 'n':
295 			nconversions++;
296 			if (flags & SUPPRESS)	/* ??? */
297 				continue;
298 			if (flags & SHORTSHORT)
299 				*va_arg(ap, char *) = nread;
300 			else if (flags & SHORT)
301 				*va_arg(ap, short *) = nread;
302 			else if (flags & LONG)
303 				*va_arg(ap, long *) = nread;
304 			else if (flags & LONGLONG)
305 				*va_arg(ap, long long *) = nread;
306 			else if (flags & INTMAXT)
307 				*va_arg(ap, intmax_t *) = nread;
308 			else if (flags & SIZET)
309 				*va_arg(ap, size_t *) = nread;
310 			else if (flags & PTRDIFFT)
311 				*va_arg(ap, ptrdiff_t *) = nread;
312 			else
313 				*va_arg(ap, int *) = nread;
314 			continue;
315 
316 		default:
317 			goto match_failure;
318 
319 		/*
320 		 * Disgusting backwards compatibility hack.	XXX
321 		 */
322 		case '\0':	/* compat */
323 			return (EOF);
324 		}
325 
326 		/*
327 		 * We have a conversion that requires input.
328 		 */
329 		if (fp->_r <= 0 && __srefill(fp))
330 			goto input_failure;
331 
332 		/*
333 		 * Consume leading white space, except for formats
334 		 * that suppress this.
335 		 */
336 		if ((flags & NOSKIP) == 0) {
337 			while (isspace(*fp->_p)) {
338 				nread++;
339 				if (--fp->_r > 0)
340 					fp->_p++;
341 				else if (__srefill(fp))
342 					goto input_failure;
343 			}
344 			/*
345 			 * Note that there is at least one character in
346 			 * the buffer, so conversions that do not set NOSKIP
347 			 * ca no longer result in an input failure.
348 			 */
349 		}
350 
351 		/*
352 		 * Do the conversion.
353 		 */
354 		switch (c) {
355 
356 		case CT_CHAR:
357 			/* scan arbitrary characters (sets NOSKIP) */
358 			if (width == 0)
359 				width = 1;
360 			if (flags & SUPPRESS) {
361 				size_t sum = 0;
362 				for (;;) {
363 					if ((n = fp->_r) < width) {
364 						sum += n;
365 						width -= n;
366 						fp->_p += n;
367 						if (__srefill(fp)) {
368 							if (sum == 0)
369 							    goto input_failure;
370 							break;
371 						}
372 					} else {
373 						sum += width;
374 						fp->_r -= width;
375 						fp->_p += width;
376 						break;
377 					}
378 				}
379 				nread += sum;
380 			} else if (flags & LONG) {
381 				wcp = va_arg(ap, wchar_t *);
382 				n = 0;
383 				while (width != 0) {
384 					if (n == MB_CUR_MAX)
385 						goto input_failure;
386 					buf[n++] = *fp->_p;
387 					fp->_p++;
388 					fp->_r--;
389 					memset(&mbs, 0, sizeof(mbs));
390 					nconv = mbrtowc(wcp, buf, n, &mbs);
391 					if (nconv == 0 || nconv == (size_t)-1)
392 						goto input_failure;
393 					if (nconv != (size_t)-2) {
394 						nread += n;
395 						width--;
396 						wcp++;
397 						n = 0;
398 					}
399 					if (fp->_r <= 0 && __srefill(fp)) {
400 						if (n != 0)
401 							goto input_failure;
402 						break;
403 					}
404 				}
405 				nassigned++;
406 			} else {
407 				size_t r = fread((void *)va_arg(ap, char *), 1,
408 				    width, fp);
409 
410 				if (r == 0)
411 					goto input_failure;
412 				nread += r;
413 				nassigned++;
414 			}
415 			nconversions++;
416 			break;
417 
418 		case CT_CCL:
419 			/* scan a (nonempty) character class (sets NOSKIP) */
420 			if (width == 0)
421 				width = (size_t)~0;	/* `infinity' */
422 			/* take only those things in the class */
423 			if (flags & SUPPRESS) {
424 				n = 0;
425 				while (ccltab[*fp->_p]) {
426 					n++, fp->_r--, fp->_p++;
427 					if (--width == 0)
428 						break;
429 					if (fp->_r <= 0 && __srefill(fp)) {
430 						if (n == 0)
431 							goto input_failure;
432 						break;
433 					}
434 				}
435 				if (n == 0)
436 					goto match_failure;
437 			} else if (flags & LONG) {
438 				wcp = wcp0 = va_arg(ap, wchar_t *);
439 				n = 0;
440 				while (width != 0) {
441 					if (n == MB_CUR_MAX)
442 						goto input_failure;
443 					buf[n++] = *fp->_p;
444 					fp->_p++;
445 					fp->_r--;
446 					memset(&mbs, 0, sizeof(mbs));
447 					nconv = mbrtowc(wcp, buf, n, &mbs);
448 					if (nconv == 0 || nconv == (size_t)-1)
449 						goto input_failure;
450 					if (nconv != (size_t)-2) {
451 						if (wctob(*wcp) != EOF &&
452 						    !ccltab[wctob(*wcp)]) {
453 							while (--n > 0)
454 								__ungetc(buf[n],
455 								    fp);
456 							break;
457 						}
458 						nread += n;
459 						width--;
460 						wcp++;
461 						n = 0;
462 					}
463 					if (fp->_r <= 0 && __srefill(fp)) {
464 						if (n != 0)
465 							goto input_failure;
466 						break;
467 					}
468 				}
469 				if (n != 0)
470 					goto input_failure;
471 				n = wcp - wcp0;
472 				if (n == 0)
473 					goto match_failure;
474 				*wcp = L'\0';
475 				nassigned++;
476 			} else {
477 				p0 = p = va_arg(ap, char *);
478 				while (ccltab[*fp->_p]) {
479 					fp->_r--;
480 					*p++ = *fp->_p++;
481 					if (--width == 0)
482 						break;
483 					if (fp->_r <= 0 && __srefill(fp)) {
484 						if (p == p0)
485 							goto input_failure;
486 						break;
487 					}
488 				}
489 				n = p - p0;
490 				if (n == 0)
491 					goto match_failure;
492 				*p = 0;
493 				nassigned++;
494 			}
495 			nread += n;
496 			nconversions++;
497 			break;
498 
499 		case CT_STRING:
500 			/* like CCL, but zero-length string OK, & no NOSKIP */
501 			if (width == 0)
502 				width = (size_t)~0;
503 			if (flags & SUPPRESS) {
504 				n = 0;
505 				while (!isspace(*fp->_p)) {
506 					n++, fp->_r--, fp->_p++;
507 					if (--width == 0)
508 						break;
509 					if (fp->_r <= 0 && __srefill(fp))
510 						break;
511 				}
512 				nread += n;
513 			} else if (flags & LONG) {
514 				wcp = va_arg(ap, wchar_t *);
515 				n = 0;
516 				while (!isspace(*fp->_p) && width != 0) {
517 					if (n == MB_CUR_MAX)
518 						goto input_failure;
519 					buf[n++] = *fp->_p;
520 					fp->_p++;
521 					fp->_r--;
522 					memset(&mbs, 0, sizeof(mbs));
523 					nconv = mbrtowc(wcp, buf, n, &mbs);
524 					if (nconv == 0 || nconv == (size_t)-1)
525 						goto input_failure;
526 					if (nconv != (size_t)-2) {
527 						if (iswspace(*wcp)) {
528 							while (--n > 0)
529 								__ungetc(buf[n],
530 								    fp);
531 							break;
532 						}
533 						nread += n;
534 						width--;
535 						wcp++;
536 						n = 0;
537 					}
538 					if (fp->_r <= 0 && __srefill(fp)) {
539 						if (n != 0)
540 							goto input_failure;
541 						break;
542 					}
543 				}
544 				*wcp = L'\0';
545 				nassigned++;
546 			} else {
547 				p0 = p = va_arg(ap, char *);
548 				while (!isspace(*fp->_p)) {
549 					fp->_r--;
550 					*p++ = *fp->_p++;
551 					if (--width == 0)
552 						break;
553 					if (fp->_r <= 0 && __srefill(fp))
554 						break;
555 				}
556 				*p = 0;
557 				nread += p - p0;
558 				nassigned++;
559 			}
560 			nconversions++;
561 			continue;
562 
563 		case CT_INT:
564 			/* scan an integer as if by the conversion function */
565 #ifdef hardway
566 			if (width == 0 || width > sizeof(buf) - 1)
567 				width = sizeof(buf) - 1;
568 #else
569 			/* size_t is unsigned, hence this optimisation */
570 			if (--width > sizeof(buf) - 2)
571 				width = sizeof(buf) - 2;
572 			width++;
573 #endif
574 			flags |= SIGNOK | NDIGITS | NZDIGITS;
575 			for (p = buf; width; width--) {
576 				c = *fp->_p;
577 				/*
578 				 * Switch on the character; `goto ok'
579 				 * if we accept it as a part of number.
580 				 */
581 				switch (c) {
582 
583 				/*
584 				 * The digit 0 is always legal, but is
585 				 * special.  For %i conversions, if no
586 				 * digits (zero or nonzero) have been
587 				 * scanned (only signs), we will have
588 				 * base==0.  In that case, we should set
589 				 * it to 8 and enable 0x prefixing.
590 				 * Also, if we have not scanned zero digits
591 				 * before this, do not turn off prefixing
592 				 * (someone else will turn it off if we
593 				 * have scanned any nonzero digits).
594 				 */
595 				case '0':
596 					if (base == 0) {
597 						base = 8;
598 						flags |= PFXOK;
599 					}
600 					if (flags & NZDIGITS)
601 					    flags &= ~(SIGNOK|NZDIGITS|NDIGITS);
602 					else
603 					    flags &= ~(SIGNOK|PFXOK|NDIGITS);
604 					goto ok;
605 
606 				/* 1 through 7 always legal */
607 				case '1': case '2': case '3':
608 				case '4': case '5': case '6': case '7':
609 					base = basefix[base];
610 					flags &= ~(SIGNOK | PFXOK | NDIGITS);
611 					goto ok;
612 
613 				/* digits 8 and 9 ok iff decimal or hex */
614 				case '8': case '9':
615 					base = basefix[base];
616 					if (base <= 8)
617 						break;	/* not legal here */
618 					flags &= ~(SIGNOK | PFXOK | NDIGITS);
619 					goto ok;
620 
621 				/* letters ok iff hex */
622 				case 'A': case 'B': case 'C':
623 				case 'D': case 'E': case 'F':
624 				case 'a': case 'b': case 'c':
625 				case 'd': case 'e': case 'f':
626 					/* no need to fix base here */
627 					if (base <= 10)
628 						break;	/* not legal here */
629 					flags &= ~(SIGNOK | PFXOK | NDIGITS);
630 					goto ok;
631 
632 				/* sign ok only as first character */
633 				case '+': case '-':
634 					if (flags & SIGNOK) {
635 						flags &= ~SIGNOK;
636 						goto ok;
637 					}
638 					break;
639 
640 				/* x ok iff flag still set & 2nd char */
641 				case 'x': case 'X':
642 					if (flags & PFXOK && p == buf + 1) {
643 						base = 16;	/* if %i */
644 						flags &= ~PFXOK;
645 						goto ok;
646 					}
647 					break;
648 				}
649 
650 				/*
651 				 * If we got here, c is not a legal character
652 				 * for a number.  Stop accumulating digits.
653 				 */
654 				break;
655 		ok:
656 				/*
657 				 * c is legal: store it and look at the next.
658 				 */
659 				*p++ = c;
660 				if (--fp->_r > 0)
661 					fp->_p++;
662 				else if (__srefill(fp))
663 					break;		/* EOF */
664 			}
665 			/*
666 			 * If we had only a sign, it is no good; push
667 			 * back the sign.  If the number ends in `x',
668 			 * it was [sign] '0' 'x', so push back the x
669 			 * and treat it as [sign] '0'.
670 			 */
671 			if (flags & NDIGITS) {
672 				if (p > buf)
673 					(void) __ungetc(*(u_char *)--p, fp);
674 				goto match_failure;
675 			}
676 			c = ((u_char *)p)[-1];
677 			if (c == 'x' || c == 'X') {
678 				--p;
679 				(void) __ungetc(c, fp);
680 			}
681 			if ((flags & SUPPRESS) == 0) {
682 				uintmax_t res;
683 
684 				*p = 0;
685 				if ((flags & UNSIGNED) == 0)
686 				    res = strtoimax(buf, (char **)NULL, base);
687 				else
688 				    res = strtoumax(buf, (char **)NULL, base);
689 				if (flags & POINTER)
690 					*va_arg(ap, void **) =
691 							(void *)(uintptr_t)res;
692 				else if (flags & SHORTSHORT)
693 					*va_arg(ap, char *) = res;
694 				else if (flags & SHORT)
695 					*va_arg(ap, short *) = res;
696 				else if (flags & LONG)
697 					*va_arg(ap, long *) = res;
698 				else if (flags & LONGLONG)
699 					*va_arg(ap, long long *) = res;
700 				else if (flags & INTMAXT)
701 					*va_arg(ap, intmax_t *) = res;
702 				else if (flags & PTRDIFFT)
703 					*va_arg(ap, ptrdiff_t *) = res;
704 				else if (flags & SIZET)
705 					*va_arg(ap, size_t *) = res;
706 				else
707 					*va_arg(ap, int *) = res;
708 				nassigned++;
709 			}
710 			nread += p - buf;
711 			nconversions++;
712 			break;
713 
714 #ifdef FLOATING_POINT
715 		case CT_FLOAT:
716 			/* scan a floating point number as if by strtod */
717 #ifdef hardway
718 			if (width == 0 || width > sizeof(buf) - 1)
719 				width = sizeof(buf) - 1;
720 #else
721 			/* size_t is unsigned, hence this optimisation */
722 			if (--width > sizeof(buf) - 2)
723 				width = sizeof(buf) - 2;
724 			width++;
725 #endif
726 			flags |= SIGNOK | NDIGITS | DPTOK | EXPOK;
727 			for (p = buf; width; width--) {
728 				c = *fp->_p;
729 				/*
730 				 * This code mimicks the integer conversion
731 				 * code, but is much simpler.
732 				 */
733 				switch (c) {
734 
735 				case '0': case '1': case '2': case '3':
736 				case '4': case '5': case '6': case '7':
737 				case '8': case '9':
738 					flags &= ~(SIGNOK | NDIGITS);
739 					goto fok;
740 
741 				case '+': case '-':
742 					if (flags & SIGNOK) {
743 						flags &= ~SIGNOK;
744 						goto fok;
745 					}
746 					break;
747 				case 'e': case 'E':
748 					/* no exponent without some digits */
749 					if ((flags&(NDIGITS|EXPOK)) == EXPOK) {
750 						flags =
751 						    (flags & ~(EXPOK|DPTOK)) |
752 						    SIGNOK | NDIGITS;
753 						goto fok;
754 					}
755 					break;
756 				default:
757 					if ((char)c == decimal_point &&
758 					    (flags & DPTOK)) {
759 						flags &= ~(SIGNOK | DPTOK);
760 						goto fok;
761 					}
762 					break;
763 				}
764 				break;
765 		fok:
766 				*p++ = c;
767 				if (--fp->_r > 0)
768 					fp->_p++;
769 				else if (__srefill(fp))
770 					break;	/* EOF */
771 			}
772 			/*
773 			 * If no digits, might be missing exponent digits
774 			 * (just give back the exponent) or might be missing
775 			 * regular digits, but had sign and/or decimal point.
776 			 */
777 			if (flags & NDIGITS) {
778 				if (flags & EXPOK) {
779 					/* no digits at all */
780 					while (p > buf)
781 						__ungetc(*(u_char *)--p, fp);
782 					goto match_failure;
783 				}
784 				/* just a bad exponent (e and maybe sign) */
785 				c = *(u_char *)--p;
786 				if (c != 'e' && c != 'E') {
787 					(void) __ungetc(c, fp);/* sign */
788 					c = *(u_char *)--p;
789 				}
790 				(void) __ungetc(c, fp);
791 			}
792 			if ((flags & SUPPRESS) == 0) {
793 				double res;
794 
795 				*p = 0;
796 				/* XXX this loses precision for long doubles. */
797 				res = strtod(buf, (char **) NULL);
798 				if (flags & LONGDBL)
799 					*va_arg(ap, long double *) = res;
800 				else if (flags & LONG)
801 					*va_arg(ap, double *) = res;
802 				else
803 					*va_arg(ap, float *) = res;
804 				nassigned++;
805 			}
806 			nread += p - buf;
807 			nconversions++;
808 			break;
809 #endif /* FLOATING_POINT */
810 		}
811 	}
812 input_failure:
813 	return (nconversions != 0 ? nassigned : EOF);
814 match_failure:
815 	return (nassigned);
816 }
817 
818 /*
819  * Fill in the given table from the scanset at the given format
820  * (just after `[').  Return a pointer to the character past the
821  * closing `]'.  The table has a 1 wherever characters should be
822  * considered part of the scanset.
823  */
824 static const u_char *
825 __sccl(tab, fmt)
826 	char *tab;
827 	const u_char *fmt;
828 {
829 	int c, n, v, i;
830 
831 	/* first `clear' the whole table */
832 	c = *fmt++;		/* first char hat => negated scanset */
833 	if (c == '^') {
834 		v = 1;		/* default => accept */
835 		c = *fmt++;	/* get new first char */
836 	} else
837 		v = 0;		/* default => reject */
838 
839 	/* XXX: Will not work if sizeof(tab*) > sizeof(char) */
840 	(void) memset(tab, v, 256);
841 
842 	if (c == 0)
843 		return (fmt - 1);/* format ended before closing ] */
844 
845 	/*
846 	 * Now set the entries corresponding to the actual scanset
847 	 * to the opposite of the above.
848 	 *
849 	 * The first character may be ']' (or '-') without being special;
850 	 * the last character may be '-'.
851 	 */
852 	v = 1 - v;
853 	for (;;) {
854 		tab[c] = v;		/* take character c */
855 doswitch:
856 		n = *fmt++;		/* and examine the next */
857 		switch (n) {
858 
859 		case 0:			/* format ended too soon */
860 			return (fmt - 1);
861 
862 		case '-':
863 			/*
864 			 * A scanset of the form
865 			 *	[01+-]
866 			 * is defined as `the digit 0, the digit 1,
867 			 * the character +, the character -', but
868 			 * the effect of a scanset such as
869 			 *	[a-zA-Z0-9]
870 			 * is implementation defined.  The V7 Unix
871 			 * scanf treats `a-z' as `the letters a through
872 			 * z', but treats `a-a' as `the letter a, the
873 			 * character -, and the letter a'.
874 			 *
875 			 * For compatibility, the `-' is not considerd
876 			 * to define a range if the character following
877 			 * it is either a close bracket (required by ANSI)
878 			 * or is not numerically greater than the character
879 			 * we just stored in the table (c).
880 			 */
881 			n = *fmt;
882 			if (n == ']'
883 			    || (__collate_load_error ? n < c :
884 				__collate_range_cmp (n, c) < 0
885 			       )
886 			   ) {
887 				c = '-';
888 				break;	/* resume the for(;;) */
889 			}
890 			fmt++;
891 			/* fill in the range */
892 			if (__collate_load_error) {
893 				do {
894 					tab[++c] = v;
895 				} while (c < n);
896 			} else {
897 				for (i = 0; i < 256; i ++)
898 					if (   __collate_range_cmp (c, i) < 0
899 					    && __collate_range_cmp (i, n) <= 0
900 					   )
901 						tab[i] = v;
902 			}
903 #if 1	/* XXX another disgusting compatibility hack */
904 			c = n;
905 			/*
906 			 * Alas, the V7 Unix scanf also treats formats
907 			 * such as [a-c-e] as `the letters a through e'.
908 			 * This too is permitted by the standard....
909 			 */
910 			goto doswitch;
911 #else
912 			c = *fmt++;
913 			if (c == 0)
914 				return (fmt - 1);
915 			if (c == ']')
916 				return (fmt);
917 #endif
918 			break;
919 
920 		case ']':		/* end of scanset */
921 			return (fmt);
922 
923 		default:		/* just another character */
924 			c = n;
925 			break;
926 		}
927 	}
928 	/* NOTREACHED */
929 }
930