xref: /freebsd/lib/libc/stdio/vfscanf.c (revision 4b2eaea43fec8e8792be611dea204071a10b655a)
1 /*-
2  * Copyright (c) 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from software contributed to Berkeley by
6  * Chris Torek.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. All advertising materials mentioning features or use of this software
17  *    must display the following acknowledgement:
18  *	This product includes software developed by the University of
19  *	California, Berkeley and its contributors.
20  * 4. Neither the name of the University nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  */
36 
37 #if defined(LIBC_SCCS) && !defined(lint)
38 static char sccsid[] = "@(#)vfscanf.c	8.1 (Berkeley) 6/4/93";
39 #endif /* LIBC_SCCS and not lint */
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD$");
42 
43 #include "namespace.h"
44 #include <ctype.h>
45 #include <inttypes.h>
46 #include <stdio.h>
47 #include <stdlib.h>
48 #include <stddef.h>
49 #include <stdarg.h>
50 #include <string.h>
51 #include <wchar.h>
52 #include <wctype.h>
53 #include "un-namespace.h"
54 
55 #include "collate.h"
56 #include "libc_private.h"
57 #include "local.h"
58 
59 #define FLOATING_POINT
60 
61 #ifdef FLOATING_POINT
62 #include <locale.h>
63 #endif
64 
65 #define	BUF		513	/* Maximum length of numeric string. */
66 
67 /*
68  * Flags used during conversion.
69  */
70 #define	LONG		0x01	/* l: long or double */
71 #define	LONGDBL		0x02	/* L: long double */
72 #define	SHORT		0x04	/* h: short */
73 #define	SUPPRESS	0x08	/* *: suppress assignment */
74 #define	POINTER		0x10	/* p: void * (as hex) */
75 #define	NOSKIP		0x20	/* [ or c: do not skip blanks */
76 #define	LONGLONG	0x400	/* ll: long long (+ deprecated q: quad) */
77 #define	INTMAXT		0x800	/* j: intmax_t */
78 #define	PTRDIFFT	0x1000	/* t: ptrdiff_t */
79 #define	SIZET		0x2000	/* z: size_t */
80 #define	SHORTSHORT	0x4000	/* hh: char */
81 #define	UNSIGNED	0x8000	/* %[oupxX] conversions */
82 
83 /*
84  * The following are used in numeric conversions only:
85  * SIGNOK, NDIGITS, DPTOK, and EXPOK are for floating point;
86  * SIGNOK, NDIGITS, PFXOK, and NZDIGITS are for integral.
87  */
88 #define	SIGNOK		0x40	/* +/- is (still) legal */
89 #define	NDIGITS		0x80	/* no digits detected */
90 
91 #define	DPTOK		0x100	/* (float) decimal point is still legal */
92 #define	EXPOK		0x200	/* (float) exponent (e+3, etc) still legal */
93 
94 #define	PFXOK		0x100	/* 0x prefix is (still) legal */
95 #define	NZDIGITS	0x200	/* no zero digits detected */
96 
97 /*
98  * Conversion types.
99  */
100 #define	CT_CHAR		0	/* %c conversion */
101 #define	CT_CCL		1	/* %[...] conversion */
102 #define	CT_STRING	2	/* %s conversion */
103 #define	CT_INT		3	/* %[dioupxX] conversion */
104 #define	CT_FLOAT	4	/* %[efgEFG] conversion */
105 
106 static const u_char *__sccl(char *, const u_char *);
107 
108 __weak_reference(__vfscanf, vfscanf);
109 
110 /*
111  * __vfscanf - MT-safe version
112  */
113 int
114 __vfscanf(FILE *fp, char const *fmt0, va_list ap)
115 {
116 	int ret;
117 
118 	FLOCKFILE(fp);
119 	ret = __svfscanf(fp, fmt0, ap);
120 	FUNLOCKFILE(fp);
121 	return (ret);
122 }
123 
124 /*
125  * __svfscanf - non-MT-safe version of __vfscanf
126  */
127 int
128 __svfscanf(FILE *fp, const char *fmt0, va_list ap)
129 {
130 	const u_char *fmt = (const u_char *)fmt0;
131 	int c;			/* character from format, or conversion */
132 	size_t width;		/* field width, or 0 */
133 	char *p;		/* points into all kinds of strings */
134 	int n;			/* handy integer */
135 	int flags;		/* flags as defined above */
136 	char *p0;		/* saves original value of p when necessary */
137 	int nassigned;		/* number of fields assigned */
138 	int nconversions;	/* number of conversions */
139 	int nread;		/* number of characters consumed from fp */
140 	int base;		/* base argument to conversion function */
141 	char ccltab[256];	/* character class table for %[...] */
142 	char buf[BUF];		/* buffer for numeric and mb conversions */
143 	wchar_t *wcp;		/* handy wide character pointer */
144 	wchar_t *wcp0;		/* saves original value of wcp */
145 	mbstate_t mbs;		/* multibyte conversion state */
146 	size_t nconv;		/* length of multibyte sequence converted */
147 
148 	/* `basefix' is used to avoid `if' tests in the integer scanner */
149 	static short basefix[17] =
150 		{ 10, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 };
151 #ifdef FLOATING_POINT
152 	char decimal_point = localeconv()->decimal_point[0];
153 #endif
154 
155 	ORIENT(fp, -1);
156 
157 	nassigned = 0;
158 	nconversions = 0;
159 	nread = 0;
160 	for (;;) {
161 		c = *fmt++;
162 		if (c == 0)
163 			return (nassigned);
164 		if (isspace(c)) {
165 			while ((fp->_r > 0 || __srefill(fp) == 0) && isspace(*fp->_p))
166 				nread++, fp->_r--, fp->_p++;
167 			continue;
168 		}
169 		if (c != '%')
170 			goto literal;
171 		width = 0;
172 		flags = 0;
173 		/*
174 		 * switch on the format.  continue if done;
175 		 * break once format type is derived.
176 		 */
177 again:		c = *fmt++;
178 		switch (c) {
179 		case '%':
180 literal:
181 			if (fp->_r <= 0 && __srefill(fp))
182 				goto input_failure;
183 			if (*fp->_p != c)
184 				goto match_failure;
185 			fp->_r--, fp->_p++;
186 			nread++;
187 			continue;
188 
189 		case '*':
190 			flags |= SUPPRESS;
191 			goto again;
192 		case 'j':
193 			flags |= INTMAXT;
194 			goto again;
195 		case 'l':
196 			if (flags & LONG) {
197 				flags &= ~LONG;
198 				flags |= LONGLONG;
199 			} else
200 				flags |= LONG;
201 			goto again;
202 		case 'q':
203 			flags |= LONGLONG;	/* not quite */
204 			goto again;
205 		case 't':
206 			flags |= PTRDIFFT;
207 			goto again;
208 		case 'z':
209 			flags |= SIZET;
210 			goto again;
211 		case 'L':
212 			flags |= LONGDBL;
213 			goto again;
214 		case 'h':
215 			if (flags & SHORT) {
216 				flags &= ~SHORT;
217 				flags |= SHORTSHORT;
218 			} else
219 				flags |= SHORT;
220 			goto again;
221 
222 		case '0': case '1': case '2': case '3': case '4':
223 		case '5': case '6': case '7': case '8': case '9':
224 			width = width * 10 + c - '0';
225 			goto again;
226 
227 		/*
228 		 * Conversions.
229 		 */
230 		case 'd':
231 			c = CT_INT;
232 			base = 10;
233 			break;
234 
235 		case 'i':
236 			c = CT_INT;
237 			base = 0;
238 			break;
239 
240 		case 'o':
241 			c = CT_INT;
242 			flags |= UNSIGNED;
243 			base = 8;
244 			break;
245 
246 		case 'u':
247 			c = CT_INT;
248 			flags |= UNSIGNED;
249 			base = 10;
250 			break;
251 
252 		case 'X':
253 		case 'x':
254 			flags |= PFXOK;	/* enable 0x prefixing */
255 			c = CT_INT;
256 			flags |= UNSIGNED;
257 			base = 16;
258 			break;
259 
260 #ifdef FLOATING_POINT
261 		case 'E': case 'F': case 'G':
262 		case 'e': case 'f': case 'g':
263 			c = CT_FLOAT;
264 			break;
265 #endif
266 
267 		case 'S':
268 			flags |= LONG;
269 			/* FALLTHROUGH */
270 		case 's':
271 			c = CT_STRING;
272 			break;
273 
274 		case '[':
275 			fmt = __sccl(ccltab, fmt);
276 			flags |= NOSKIP;
277 			c = CT_CCL;
278 			break;
279 
280 		case 'C':
281 			flags |= LONG;
282 			/* FALLTHROUGH */
283 		case 'c':
284 			flags |= NOSKIP;
285 			c = CT_CHAR;
286 			break;
287 
288 		case 'p':	/* pointer format is like hex */
289 			flags |= POINTER | PFXOK;
290 			c = CT_INT;		/* assumes sizeof(uintmax_t) */
291 			flags |= UNSIGNED;	/*      >= sizeof(uintptr_t) */
292 			base = 16;
293 			break;
294 
295 		case 'n':
296 			nconversions++;
297 			if (flags & SUPPRESS)	/* ??? */
298 				continue;
299 			if (flags & SHORTSHORT)
300 				*va_arg(ap, char *) = nread;
301 			else if (flags & SHORT)
302 				*va_arg(ap, short *) = nread;
303 			else if (flags & LONG)
304 				*va_arg(ap, long *) = nread;
305 			else if (flags & LONGLONG)
306 				*va_arg(ap, long long *) = nread;
307 			else if (flags & INTMAXT)
308 				*va_arg(ap, intmax_t *) = nread;
309 			else if (flags & SIZET)
310 				*va_arg(ap, size_t *) = nread;
311 			else if (flags & PTRDIFFT)
312 				*va_arg(ap, ptrdiff_t *) = nread;
313 			else
314 				*va_arg(ap, int *) = nread;
315 			continue;
316 
317 		default:
318 			goto match_failure;
319 
320 		/*
321 		 * Disgusting backwards compatibility hack.	XXX
322 		 */
323 		case '\0':	/* compat */
324 			return (EOF);
325 		}
326 
327 		/*
328 		 * We have a conversion that requires input.
329 		 */
330 		if (fp->_r <= 0 && __srefill(fp))
331 			goto input_failure;
332 
333 		/*
334 		 * Consume leading white space, except for formats
335 		 * that suppress this.
336 		 */
337 		if ((flags & NOSKIP) == 0) {
338 			while (isspace(*fp->_p)) {
339 				nread++;
340 				if (--fp->_r > 0)
341 					fp->_p++;
342 				else if (__srefill(fp))
343 					goto input_failure;
344 			}
345 			/*
346 			 * Note that there is at least one character in
347 			 * the buffer, so conversions that do not set NOSKIP
348 			 * ca no longer result in an input failure.
349 			 */
350 		}
351 
352 		/*
353 		 * Do the conversion.
354 		 */
355 		switch (c) {
356 
357 		case CT_CHAR:
358 			/* scan arbitrary characters (sets NOSKIP) */
359 			if (width == 0)
360 				width = 1;
361 			if (flags & LONG) {
362 				if ((flags & SUPPRESS) == 0)
363 					wcp = va_arg(ap, wchar_t *);
364 				else
365 					wcp = NULL;
366 				n = 0;
367 				while (width != 0) {
368 					if (n == MB_CUR_MAX) {
369 						fp->_flags |= __SERR;
370 						goto input_failure;
371 					}
372 					buf[n++] = *fp->_p;
373 					fp->_p++;
374 					fp->_r--;
375 					memset(&mbs, 0, sizeof(mbs));
376 					nconv = mbrtowc(wcp, buf, n, &mbs);
377 					if (nconv == (size_t)-1) {
378 						fp->_flags |= __SERR;
379 						goto input_failure;
380 					}
381 					if (nconv == 0 && !(flags & SUPPRESS))
382 						*wcp = L'\0';
383 					if (nconv != (size_t)-2) {
384 						nread += n;
385 						width--;
386 						if (!(flags & SUPPRESS))
387 							wcp++;
388 						n = 0;
389 					}
390 					if (fp->_r <= 0 && __srefill(fp)) {
391 						if (n != 0) {
392 							fp->_flags |= __SERR;
393 							goto input_failure;
394 						}
395 						break;
396 					}
397 				}
398 				if (!(flags & SUPPRESS))
399 					nassigned++;
400 			} else if (flags & SUPPRESS) {
401 				size_t sum = 0;
402 				for (;;) {
403 					if ((n = fp->_r) < width) {
404 						sum += n;
405 						width -= n;
406 						fp->_p += n;
407 						if (__srefill(fp)) {
408 							if (sum == 0)
409 							    goto input_failure;
410 							break;
411 						}
412 					} else {
413 						sum += width;
414 						fp->_r -= width;
415 						fp->_p += width;
416 						break;
417 					}
418 				}
419 				nread += sum;
420 			} else {
421 				size_t r = fread((void *)va_arg(ap, char *), 1,
422 				    width, fp);
423 
424 				if (r == 0)
425 					goto input_failure;
426 				nread += r;
427 				nassigned++;
428 			}
429 			nconversions++;
430 			break;
431 
432 		case CT_CCL:
433 			/* scan a (nonempty) character class (sets NOSKIP) */
434 			if (width == 0)
435 				width = (size_t)~0;	/* `infinity' */
436 			/* take only those things in the class */
437 			if (flags & LONG) {
438 				wchar_t twc;
439 				int nchars;
440 
441 				if ((flags & SUPPRESS) == 0)
442 					wcp = wcp0 = va_arg(ap, wchar_t *);
443 				else
444 					wcp = wcp0 = &twc;
445 				n = 0;
446 				nchars = 0;
447 				while (width != 0) {
448 					if (n == MB_CUR_MAX) {
449 						fp->_flags |= __SERR;
450 						goto input_failure;
451 					}
452 					buf[n++] = *fp->_p;
453 					fp->_p++;
454 					fp->_r--;
455 					memset(&mbs, 0, sizeof(mbs));
456 					nconv = mbrtowc(wcp, buf, n, &mbs);
457 					if (nconv == (size_t)-1) {
458 						fp->_flags |= __SERR;
459 						goto input_failure;
460 					}
461 					if (nconv == 0)
462 						*wcp = L'\0';
463 					if (nconv != (size_t)-2) {
464 						if (wctob(*wcp) != EOF &&
465 						    !ccltab[wctob(*wcp)]) {
466 							while (n != 0) {
467 								n--;
468 								__ungetc(buf[n],
469 								    fp);
470 							}
471 							break;
472 						}
473 						nread += n;
474 						width--;
475 						if (!(flags & SUPPRESS))
476 							wcp++;
477 						nchars++;
478 						n = 0;
479 					}
480 					if (fp->_r <= 0 && __srefill(fp)) {
481 						if (n != 0) {
482 							fp->_flags |= __SERR;
483 							goto input_failure;
484 						}
485 						break;
486 					}
487 				}
488 				if (n != 0) {
489 					fp->_flags |= __SERR;
490 					goto input_failure;
491 				}
492 				n = nchars;
493 				if (n == 0)
494 					goto match_failure;
495 				if (!(flags & SUPPRESS)) {
496 					*wcp = L'\0';
497 					nassigned++;
498 				}
499 			} else if (flags & SUPPRESS) {
500 				n = 0;
501 				while (ccltab[*fp->_p]) {
502 					n++, fp->_r--, fp->_p++;
503 					if (--width == 0)
504 						break;
505 					if (fp->_r <= 0 && __srefill(fp)) {
506 						if (n == 0)
507 							goto input_failure;
508 						break;
509 					}
510 				}
511 				if (n == 0)
512 					goto match_failure;
513 			} else {
514 				p0 = p = va_arg(ap, char *);
515 				while (ccltab[*fp->_p]) {
516 					fp->_r--;
517 					*p++ = *fp->_p++;
518 					if (--width == 0)
519 						break;
520 					if (fp->_r <= 0 && __srefill(fp)) {
521 						if (p == p0)
522 							goto input_failure;
523 						break;
524 					}
525 				}
526 				n = p - p0;
527 				if (n == 0)
528 					goto match_failure;
529 				*p = 0;
530 				nassigned++;
531 			}
532 			nread += n;
533 			nconversions++;
534 			break;
535 
536 		case CT_STRING:
537 			/* like CCL, but zero-length string OK, & no NOSKIP */
538 			if (width == 0)
539 				width = (size_t)~0;
540 			if (flags & LONG) {
541 				wchar_t twc;
542 
543 				if ((flags & SUPPRESS) == 0)
544 					wcp = va_arg(ap, wchar_t *);
545 				else
546 					wcp = &twc;
547 				n = 0;
548 				while (!isspace(*fp->_p) && width != 0) {
549 					if (n == MB_CUR_MAX) {
550 						fp->_flags |= __SERR;
551 						goto input_failure;
552 					}
553 					buf[n++] = *fp->_p;
554 					fp->_p++;
555 					fp->_r--;
556 					memset(&mbs, 0, sizeof(mbs));
557 					nconv = mbrtowc(wcp, buf, n, &mbs);
558 					if (nconv == (size_t)-1) {
559 						fp->_flags |= __SERR;
560 						goto input_failure;
561 					}
562 					if (nconv == 0)
563 						*wcp = L'\0';
564 					if (nconv != (size_t)-2) {
565 						if (iswspace(*wcp)) {
566 							while (n != 0) {
567 								n--;
568 								__ungetc(buf[n],
569 								    fp);
570 							}
571 							break;
572 						}
573 						nread += n;
574 						width--;
575 						if (!(flags & SUPPRESS))
576 							wcp++;
577 						n = 0;
578 					}
579 					if (fp->_r <= 0 && __srefill(fp)) {
580 						if (n != 0) {
581 							fp->_flags |= __SERR;
582 							goto input_failure;
583 						}
584 						break;
585 					}
586 				}
587 				if (!(flags & SUPPRESS)) {
588 					*wcp = L'\0';
589 					nassigned++;
590 				}
591 			} else if (flags & SUPPRESS) {
592 				n = 0;
593 				while (!isspace(*fp->_p)) {
594 					n++, fp->_r--, fp->_p++;
595 					if (--width == 0)
596 						break;
597 					if (fp->_r <= 0 && __srefill(fp))
598 						break;
599 				}
600 				nread += n;
601 			} else {
602 				p0 = p = va_arg(ap, char *);
603 				while (!isspace(*fp->_p)) {
604 					fp->_r--;
605 					*p++ = *fp->_p++;
606 					if (--width == 0)
607 						break;
608 					if (fp->_r <= 0 && __srefill(fp))
609 						break;
610 				}
611 				*p = 0;
612 				nread += p - p0;
613 				nassigned++;
614 			}
615 			nconversions++;
616 			continue;
617 
618 		case CT_INT:
619 			/* scan an integer as if by the conversion function */
620 #ifdef hardway
621 			if (width == 0 || width > sizeof(buf) - 1)
622 				width = sizeof(buf) - 1;
623 #else
624 			/* size_t is unsigned, hence this optimisation */
625 			if (--width > sizeof(buf) - 2)
626 				width = sizeof(buf) - 2;
627 			width++;
628 #endif
629 			flags |= SIGNOK | NDIGITS | NZDIGITS;
630 			for (p = buf; width; width--) {
631 				c = *fp->_p;
632 				/*
633 				 * Switch on the character; `goto ok'
634 				 * if we accept it as a part of number.
635 				 */
636 				switch (c) {
637 
638 				/*
639 				 * The digit 0 is always legal, but is
640 				 * special.  For %i conversions, if no
641 				 * digits (zero or nonzero) have been
642 				 * scanned (only signs), we will have
643 				 * base==0.  In that case, we should set
644 				 * it to 8 and enable 0x prefixing.
645 				 * Also, if we have not scanned zero digits
646 				 * before this, do not turn off prefixing
647 				 * (someone else will turn it off if we
648 				 * have scanned any nonzero digits).
649 				 */
650 				case '0':
651 					if (base == 0) {
652 						base = 8;
653 						flags |= PFXOK;
654 					}
655 					if (flags & NZDIGITS)
656 					    flags &= ~(SIGNOK|NZDIGITS|NDIGITS);
657 					else
658 					    flags &= ~(SIGNOK|PFXOK|NDIGITS);
659 					goto ok;
660 
661 				/* 1 through 7 always legal */
662 				case '1': case '2': case '3':
663 				case '4': case '5': case '6': case '7':
664 					base = basefix[base];
665 					flags &= ~(SIGNOK | PFXOK | NDIGITS);
666 					goto ok;
667 
668 				/* digits 8 and 9 ok iff decimal or hex */
669 				case '8': case '9':
670 					base = basefix[base];
671 					if (base <= 8)
672 						break;	/* not legal here */
673 					flags &= ~(SIGNOK | PFXOK | NDIGITS);
674 					goto ok;
675 
676 				/* letters ok iff hex */
677 				case 'A': case 'B': case 'C':
678 				case 'D': case 'E': case 'F':
679 				case 'a': case 'b': case 'c':
680 				case 'd': case 'e': case 'f':
681 					/* no need to fix base here */
682 					if (base <= 10)
683 						break;	/* not legal here */
684 					flags &= ~(SIGNOK | PFXOK | NDIGITS);
685 					goto ok;
686 
687 				/* sign ok only as first character */
688 				case '+': case '-':
689 					if (flags & SIGNOK) {
690 						flags &= ~SIGNOK;
691 						goto ok;
692 					}
693 					break;
694 
695 				/* x ok iff flag still set & 2nd char */
696 				case 'x': case 'X':
697 					if (flags & PFXOK && p == buf + 1) {
698 						base = 16;	/* if %i */
699 						flags &= ~PFXOK;
700 						goto ok;
701 					}
702 					break;
703 				}
704 
705 				/*
706 				 * If we got here, c is not a legal character
707 				 * for a number.  Stop accumulating digits.
708 				 */
709 				break;
710 		ok:
711 				/*
712 				 * c is legal: store it and look at the next.
713 				 */
714 				*p++ = c;
715 				if (--fp->_r > 0)
716 					fp->_p++;
717 				else if (__srefill(fp))
718 					break;		/* EOF */
719 			}
720 			/*
721 			 * If we had only a sign, it is no good; push
722 			 * back the sign.  If the number ends in `x',
723 			 * it was [sign] '0' 'x', so push back the x
724 			 * and treat it as [sign] '0'.
725 			 */
726 			if (flags & NDIGITS) {
727 				if (p > buf)
728 					(void) __ungetc(*(u_char *)--p, fp);
729 				goto match_failure;
730 			}
731 			c = ((u_char *)p)[-1];
732 			if (c == 'x' || c == 'X') {
733 				--p;
734 				(void) __ungetc(c, fp);
735 			}
736 			if ((flags & SUPPRESS) == 0) {
737 				uintmax_t res;
738 
739 				*p = 0;
740 				if ((flags & UNSIGNED) == 0)
741 				    res = strtoimax(buf, (char **)NULL, base);
742 				else
743 				    res = strtoumax(buf, (char **)NULL, base);
744 				if (flags & POINTER)
745 					*va_arg(ap, void **) =
746 							(void *)(uintptr_t)res;
747 				else if (flags & SHORTSHORT)
748 					*va_arg(ap, char *) = res;
749 				else if (flags & SHORT)
750 					*va_arg(ap, short *) = res;
751 				else if (flags & LONG)
752 					*va_arg(ap, long *) = res;
753 				else if (flags & LONGLONG)
754 					*va_arg(ap, long long *) = res;
755 				else if (flags & INTMAXT)
756 					*va_arg(ap, intmax_t *) = res;
757 				else if (flags & PTRDIFFT)
758 					*va_arg(ap, ptrdiff_t *) = res;
759 				else if (flags & SIZET)
760 					*va_arg(ap, size_t *) = res;
761 				else
762 					*va_arg(ap, int *) = res;
763 				nassigned++;
764 			}
765 			nread += p - buf;
766 			nconversions++;
767 			break;
768 
769 #ifdef FLOATING_POINT
770 		case CT_FLOAT:
771 			/* scan a floating point number as if by strtod */
772 #ifdef hardway
773 			if (width == 0 || width > sizeof(buf) - 1)
774 				width = sizeof(buf) - 1;
775 #else
776 			/* size_t is unsigned, hence this optimisation */
777 			if (--width > sizeof(buf) - 2)
778 				width = sizeof(buf) - 2;
779 			width++;
780 #endif
781 			flags |= SIGNOK | NDIGITS | DPTOK | EXPOK;
782 			for (p = buf; width; width--) {
783 				c = *fp->_p;
784 				/*
785 				 * This code mimicks the integer conversion
786 				 * code, but is much simpler.
787 				 */
788 				switch (c) {
789 
790 				case '0': case '1': case '2': case '3':
791 				case '4': case '5': case '6': case '7':
792 				case '8': case '9':
793 					flags &= ~(SIGNOK | NDIGITS);
794 					goto fok;
795 
796 				case '+': case '-':
797 					if (flags & SIGNOK) {
798 						flags &= ~SIGNOK;
799 						goto fok;
800 					}
801 					break;
802 				case 'e': case 'E':
803 					/* no exponent without some digits */
804 					if ((flags&(NDIGITS|EXPOK)) == EXPOK) {
805 						flags =
806 						    (flags & ~(EXPOK|DPTOK)) |
807 						    SIGNOK | NDIGITS;
808 						goto fok;
809 					}
810 					break;
811 				default:
812 					if ((char)c == decimal_point &&
813 					    (flags & DPTOK)) {
814 						flags &= ~(SIGNOK | DPTOK);
815 						goto fok;
816 					}
817 					break;
818 				}
819 				break;
820 		fok:
821 				*p++ = c;
822 				if (--fp->_r > 0)
823 					fp->_p++;
824 				else if (__srefill(fp))
825 					break;	/* EOF */
826 			}
827 			/*
828 			 * If no digits, might be missing exponent digits
829 			 * (just give back the exponent) or might be missing
830 			 * regular digits, but had sign and/or decimal point.
831 			 */
832 			if (flags & NDIGITS) {
833 				if (flags & EXPOK) {
834 					/* no digits at all */
835 					while (p > buf)
836 						__ungetc(*(u_char *)--p, fp);
837 					goto match_failure;
838 				}
839 				/* just a bad exponent (e and maybe sign) */
840 				c = *(u_char *)--p;
841 				if (c != 'e' && c != 'E') {
842 					(void) __ungetc(c, fp);/* sign */
843 					c = *(u_char *)--p;
844 				}
845 				(void) __ungetc(c, fp);
846 			}
847 			if ((flags & SUPPRESS) == 0) {
848 				double res;
849 
850 				*p = 0;
851 				/* XXX this loses precision for long doubles. */
852 				res = strtod(buf, (char **) NULL);
853 				if (flags & LONGDBL)
854 					*va_arg(ap, long double *) = res;
855 				else if (flags & LONG)
856 					*va_arg(ap, double *) = res;
857 				else
858 					*va_arg(ap, float *) = res;
859 				nassigned++;
860 			}
861 			nread += p - buf;
862 			nconversions++;
863 			break;
864 #endif /* FLOATING_POINT */
865 		}
866 	}
867 input_failure:
868 	return (nconversions != 0 ? nassigned : EOF);
869 match_failure:
870 	return (nassigned);
871 }
872 
873 /*
874  * Fill in the given table from the scanset at the given format
875  * (just after `[').  Return a pointer to the character past the
876  * closing `]'.  The table has a 1 wherever characters should be
877  * considered part of the scanset.
878  */
879 static const u_char *
880 __sccl(tab, fmt)
881 	char *tab;
882 	const u_char *fmt;
883 {
884 	int c, n, v, i;
885 
886 	/* first `clear' the whole table */
887 	c = *fmt++;		/* first char hat => negated scanset */
888 	if (c == '^') {
889 		v = 1;		/* default => accept */
890 		c = *fmt++;	/* get new first char */
891 	} else
892 		v = 0;		/* default => reject */
893 
894 	/* XXX: Will not work if sizeof(tab*) > sizeof(char) */
895 	(void) memset(tab, v, 256);
896 
897 	if (c == 0)
898 		return (fmt - 1);/* format ended before closing ] */
899 
900 	/*
901 	 * Now set the entries corresponding to the actual scanset
902 	 * to the opposite of the above.
903 	 *
904 	 * The first character may be ']' (or '-') without being special;
905 	 * the last character may be '-'.
906 	 */
907 	v = 1 - v;
908 	for (;;) {
909 		tab[c] = v;		/* take character c */
910 doswitch:
911 		n = *fmt++;		/* and examine the next */
912 		switch (n) {
913 
914 		case 0:			/* format ended too soon */
915 			return (fmt - 1);
916 
917 		case '-':
918 			/*
919 			 * A scanset of the form
920 			 *	[01+-]
921 			 * is defined as `the digit 0, the digit 1,
922 			 * the character +, the character -', but
923 			 * the effect of a scanset such as
924 			 *	[a-zA-Z0-9]
925 			 * is implementation defined.  The V7 Unix
926 			 * scanf treats `a-z' as `the letters a through
927 			 * z', but treats `a-a' as `the letter a, the
928 			 * character -, and the letter a'.
929 			 *
930 			 * For compatibility, the `-' is not considerd
931 			 * to define a range if the character following
932 			 * it is either a close bracket (required by ANSI)
933 			 * or is not numerically greater than the character
934 			 * we just stored in the table (c).
935 			 */
936 			n = *fmt;
937 			if (n == ']'
938 			    || (__collate_load_error ? n < c :
939 				__collate_range_cmp (n, c) < 0
940 			       )
941 			   ) {
942 				c = '-';
943 				break;	/* resume the for(;;) */
944 			}
945 			fmt++;
946 			/* fill in the range */
947 			if (__collate_load_error) {
948 				do {
949 					tab[++c] = v;
950 				} while (c < n);
951 			} else {
952 				for (i = 0; i < 256; i ++)
953 					if (   __collate_range_cmp (c, i) < 0
954 					    && __collate_range_cmp (i, n) <= 0
955 					   )
956 						tab[i] = v;
957 			}
958 #if 1	/* XXX another disgusting compatibility hack */
959 			c = n;
960 			/*
961 			 * Alas, the V7 Unix scanf also treats formats
962 			 * such as [a-c-e] as `the letters a through e'.
963 			 * This too is permitted by the standard....
964 			 */
965 			goto doswitch;
966 #else
967 			c = *fmt++;
968 			if (c == 0)
969 				return (fmt - 1);
970 			if (c == ']')
971 				return (fmt);
972 #endif
973 			break;
974 
975 		case ']':		/* end of scanset */
976 			return (fmt);
977 
978 		default:		/* just another character */
979 			c = n;
980 			break;
981 		}
982 	}
983 	/* NOTREACHED */
984 }
985