xref: /freebsd/lib/libc/stdio/vfscanf.c (revision 884d26c84cba3ffc3d4e626306098fcdfe6a0c2b)
1 /*-
2  * Copyright (c) 1990, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Copyright (c) 2011 The FreeBSD Foundation
6  * All rights reserved.
7  * Portions of this software were developed by David Chisnall
8  * under sponsorship from the FreeBSD Foundation.
9  *
10  * This code is derived from software contributed to Berkeley by
11  * Chris Torek.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  */
37 
38 #if defined(LIBC_SCCS) && !defined(lint)
39 static char sccsid[] = "@(#)vfscanf.c	8.1 (Berkeley) 6/4/93";
40 #endif /* LIBC_SCCS and not lint */
41 #include <sys/cdefs.h>
42 __FBSDID("$FreeBSD$");
43 
44 #include "namespace.h"
45 #include <ctype.h>
46 #include <inttypes.h>
47 #include <stdio.h>
48 #include <stdlib.h>
49 #include <stddef.h>
50 #include <stdarg.h>
51 #include <string.h>
52 #include <wchar.h>
53 #include <wctype.h>
54 #include "un-namespace.h"
55 
56 #include "libc_private.h"
57 #include "local.h"
58 #include "xlocale_private.h"
59 
60 #ifndef NO_FLOATING_POINT
61 #include <locale.h>
62 #endif
63 
64 #define	BUF		513	/* Maximum length of numeric string. */
65 
66 /*
67  * Flags used during conversion.
68  */
69 #define	LONG		0x01	/* l: long or double */
70 #define	LONGDBL		0x02	/* L: long double */
71 #define	SHORT		0x04	/* h: short */
72 #define	SUPPRESS	0x08	/* *: suppress assignment */
73 #define	POINTER		0x10	/* p: void * (as hex) */
74 #define	NOSKIP		0x20	/* [ or c: do not skip blanks */
75 #define	LONGLONG	0x400	/* ll: long long (+ deprecated q: quad) */
76 #define	INTMAXT		0x800	/* j: intmax_t */
77 #define	PTRDIFFT	0x1000	/* t: ptrdiff_t */
78 #define	SIZET		0x2000	/* z: size_t */
79 #define	SHORTSHORT	0x4000	/* hh: char */
80 #define	UNSIGNED	0x8000	/* %[oupxX] conversions */
81 
82 /*
83  * The following are used in integral conversions only:
84  * SIGNOK, NDIGITS, PFXOK, and NZDIGITS
85  */
86 #define	SIGNOK		0x40	/* +/- is (still) legal */
87 #define	NDIGITS		0x80	/* no digits detected */
88 #define	PFXOK		0x100	/* 0x prefix is (still) legal */
89 #define	NZDIGITS	0x200	/* no zero digits detected */
90 #define	HAVESIGN	0x10000	/* sign detected */
91 
92 /*
93  * Conversion types.
94  */
95 #define	CT_CHAR		0	/* %c conversion */
96 #define	CT_CCL		1	/* %[...] conversion */
97 #define	CT_STRING	2	/* %s conversion */
98 #define	CT_INT		3	/* %[dioupxX] conversion */
99 #define	CT_FLOAT	4	/* %[efgEFG] conversion */
100 
101 static const u_char *__sccl(char *, const u_char *);
102 #ifndef NO_FLOATING_POINT
103 static int parsefloat(FILE *, char *, char *, locale_t);
104 #endif
105 
106 __weak_reference(__vfscanf, vfscanf);
107 
108 /*
109  * Conversion functions are passed a pointer to this object instead of
110  * a real parameter to indicate that the assignment-suppression (*)
111  * flag was specified.  We could use a NULL pointer to indicate this,
112  * but that would mask bugs in applications that call scanf() with a
113  * NULL pointer.
114  */
115 static const int suppress;
116 #define	SUPPRESS_PTR	((void *)&suppress)
117 
118 static const mbstate_t initial_mbs;
119 
120 /*
121  * The following conversion functions return the number of characters consumed,
122  * or -1 on input failure.  Character class conversion returns 0 on match
123  * failure.
124  */
125 
126 static __inline int
127 convert_char(FILE *fp, char * p, int width)
128 {
129 	int n;
130 
131 	if (p == SUPPRESS_PTR) {
132 		size_t sum = 0;
133 		for (;;) {
134 			if ((n = fp->_r) < width) {
135 				sum += n;
136 				width -= n;
137 				fp->_p += n;
138 				if (__srefill(fp)) {
139 					if (sum == 0)
140 						return (-1);
141 					break;
142 				}
143 			} else {
144 				sum += width;
145 				fp->_r -= width;
146 				fp->_p += width;
147 				break;
148 			}
149 		}
150 		return (sum);
151 	} else {
152 		size_t r = __fread(p, 1, width, fp);
153 
154 		if (r == 0)
155 			return (-1);
156 		return (r);
157 	}
158 }
159 
160 static __inline int
161 convert_wchar(FILE *fp, wchar_t *wcp, int width, locale_t locale)
162 {
163 	mbstate_t mbs;
164 	int n, nread;
165 	wint_t wi;
166 
167 	mbs = initial_mbs;
168 	n = 0;
169 	while (width-- != 0 &&
170 	    (wi = __fgetwc_mbs(fp, &mbs, &nread, locale)) != WEOF) {
171 		if (wcp != SUPPRESS_PTR)
172 			*wcp++ = (wchar_t)wi;
173 		n += nread;
174 	}
175 	if (n == 0)
176 		return (-1);
177 	return (n);
178 }
179 
180 static __inline int
181 convert_ccl(FILE *fp, char * p, int width, const char *ccltab)
182 {
183 	char *p0;
184 	int n;
185 
186 	if (p == SUPPRESS_PTR) {
187 		n = 0;
188 		while (ccltab[*fp->_p]) {
189 			n++, fp->_r--, fp->_p++;
190 			if (--width == 0)
191 				break;
192 			if (fp->_r <= 0 && __srefill(fp)) {
193 				if (n == 0)
194 					return (-1);
195 				break;
196 			}
197 		}
198 	} else {
199 		p0 = p;
200 		while (ccltab[*fp->_p]) {
201 			fp->_r--;
202 			*p++ = *fp->_p++;
203 			if (--width == 0)
204 				break;
205 			if (fp->_r <= 0 && __srefill(fp)) {
206 				if (p == p0)
207 					return (-1);
208 				break;
209 			}
210 		}
211 		n = p - p0;
212 		if (n == 0)
213 			return (0);
214 		*p = 0;
215 	}
216 	return (n);
217 }
218 
219 static __inline int
220 convert_wccl(FILE *fp, wchar_t *wcp, int width, const char *ccltab,
221     locale_t locale)
222 {
223 	mbstate_t mbs;
224 	wint_t wi;
225 	int n, nread;
226 
227 	mbs = initial_mbs;
228 	n = 0;
229 	if (wcp == SUPPRESS_PTR) {
230 		while ((wi = __fgetwc_mbs(fp, &mbs, &nread, locale)) != WEOF &&
231 		    width-- != 0 && ccltab[wctob(wi)])
232 			n += nread;
233 		if (wi != WEOF)
234 			__ungetwc(wi, fp, __get_locale());
235 	} else {
236 		while ((wi = __fgetwc_mbs(fp, &mbs, &nread, locale)) != WEOF &&
237 		    width-- != 0 && ccltab[wctob(wi)]) {
238 			*wcp++ = (wchar_t)wi;
239 			n += nread;
240 		}
241 		if (wi != WEOF)
242 			__ungetwc(wi, fp, __get_locale());
243 		if (n == 0)
244 			return (0);
245 		*wcp = 0;
246 	}
247 	return (n);
248 }
249 
250 static __inline int
251 convert_string(FILE *fp, char * p, int width)
252 {
253 	char *p0;
254 	int n;
255 
256 	if (p == SUPPRESS_PTR) {
257 		n = 0;
258 		while (!isspace(*fp->_p)) {
259 			n++, fp->_r--, fp->_p++;
260 			if (--width == 0)
261 				break;
262 			if (fp->_r <= 0 && __srefill(fp))
263 				break;
264 		}
265 	} else {
266 		p0 = p;
267 		while (!isspace(*fp->_p)) {
268 			fp->_r--;
269 			*p++ = *fp->_p++;
270 			if (--width == 0)
271 				break;
272 			if (fp->_r <= 0 && __srefill(fp))
273 				break;
274 		}
275 		*p = 0;
276 		n = p - p0;
277 	}
278 	return (n);
279 }
280 
281 static __inline int
282 convert_wstring(FILE *fp, wchar_t *wcp, int width, locale_t locale)
283 {
284 	mbstate_t mbs;
285 	wint_t wi;
286 	int n, nread;
287 
288 	mbs = initial_mbs;
289 	n = 0;
290 	if (wcp == SUPPRESS_PTR) {
291 		while ((wi = __fgetwc_mbs(fp, &mbs, &nread, locale)) != WEOF &&
292 		    width-- != 0 && !iswspace(wi))
293 			n += nread;
294 		if (wi != WEOF)
295 			__ungetwc(wi, fp, __get_locale());
296 	} else {
297 		while ((wi = __fgetwc_mbs(fp, &mbs, &nread, locale)) != WEOF &&
298 		    width-- != 0 && !iswspace(wi)) {
299 			*wcp++ = (wchar_t)wi;
300 			n += nread;
301 		}
302 		if (wi != WEOF)
303 			__ungetwc(wi, fp, __get_locale());
304 		*wcp = '\0';
305 	}
306 	return (n);
307 }
308 
309 /*
310  * Read an integer, storing it in buf.  The only relevant bit in the
311  * flags argument is PFXOK.
312  *
313  * Return 0 on a match failure, and the number of characters read
314  * otherwise.
315  */
316 static __inline int
317 parseint(FILE *fp, char * __restrict buf, int width, int base, int flags)
318 {
319 	/* `basefix' is used to avoid `if' tests */
320 	static const short basefix[17] =
321 		{ 10, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16 };
322 	char *p;
323 	int c;
324 
325 	flags |= SIGNOK | NDIGITS | NZDIGITS;
326 	for (p = buf; width; width--) {
327 		c = *fp->_p;
328 		/*
329 		 * Switch on the character; `goto ok' if we accept it
330 		 * as a part of number.
331 		 */
332 		switch (c) {
333 
334 		/*
335 		 * The digit 0 is always legal, but is special.  For
336 		 * %i conversions, if no digits (zero or nonzero) have
337 		 * been scanned (only signs), we will have base==0.
338 		 * In that case, we should set it to 8 and enable 0x
339 		 * prefixing.  Also, if we have not scanned zero
340 		 * digits before this, do not turn off prefixing
341 		 * (someone else will turn it off if we have scanned
342 		 * any nonzero digits).
343 		 */
344 		case '0':
345 			if (base == 0) {
346 				base = 8;
347 				flags |= PFXOK;
348 			}
349 			if (flags & NZDIGITS)
350 				flags &= ~(SIGNOK|NZDIGITS|NDIGITS);
351 			else
352 				flags &= ~(SIGNOK|PFXOK|NDIGITS);
353 			goto ok;
354 
355 		/* 1 through 7 always legal */
356 		case '1': case '2': case '3':
357 		case '4': case '5': case '6': case '7':
358 			base = basefix[base];
359 			flags &= ~(SIGNOK | PFXOK | NDIGITS);
360 			goto ok;
361 
362 		/* digits 8 and 9 ok iff decimal or hex */
363 		case '8': case '9':
364 			base = basefix[base];
365 			if (base <= 8)
366 				break;	/* not legal here */
367 			flags &= ~(SIGNOK | PFXOK | NDIGITS);
368 			goto ok;
369 
370 		/* letters ok iff hex */
371 		case 'A': case 'B': case 'C':
372 		case 'D': case 'E': case 'F':
373 		case 'a': case 'b': case 'c':
374 		case 'd': case 'e': case 'f':
375 			/* no need to fix base here */
376 			if (base <= 10)
377 				break;	/* not legal here */
378 			flags &= ~(SIGNOK | PFXOK | NDIGITS);
379 			goto ok;
380 
381 		/* sign ok only as first character */
382 		case '+': case '-':
383 			if (flags & SIGNOK) {
384 				flags &= ~SIGNOK;
385 				flags |= HAVESIGN;
386 				goto ok;
387 			}
388 			break;
389 
390 		/*
391 		 * x ok iff flag still set & 2nd char (or 3rd char if
392 		 * we have a sign).
393 		 */
394 		case 'x': case 'X':
395 			if (flags & PFXOK && p ==
396 			    buf + 1 + !!(flags & HAVESIGN)) {
397 				base = 16;	/* if %i */
398 				flags &= ~PFXOK;
399 				goto ok;
400 			}
401 			break;
402 		}
403 
404 		/*
405 		 * If we got here, c is not a legal character for a
406 		 * number.  Stop accumulating digits.
407 		 */
408 		break;
409 	ok:
410 		/*
411 		 * c is legal: store it and look at the next.
412 		 */
413 		*p++ = c;
414 		if (--fp->_r > 0)
415 			fp->_p++;
416 		else if (__srefill(fp))
417 			break;		/* EOF */
418 	}
419 	/*
420 	 * If we had only a sign, it is no good; push back the sign.
421 	 * If the number ends in `x', it was [sign] '0' 'x', so push
422 	 * back the x and treat it as [sign] '0'.
423 	 */
424 	if (flags & NDIGITS) {
425 		if (p > buf)
426 			(void) __ungetc(*(u_char *)--p, fp);
427 		return (0);
428 	}
429 	c = ((u_char *)p)[-1];
430 	if (c == 'x' || c == 'X') {
431 		--p;
432 		(void) __ungetc(c, fp);
433 	}
434 	return (p - buf);
435 }
436 
437 /*
438  * __vfscanf - MT-safe version
439  */
440 int
441 __vfscanf(FILE *fp, char const *fmt0, va_list ap)
442 {
443 	int ret;
444 
445 	FLOCKFILE(fp);
446 	ret = __svfscanf(fp, __get_locale(), fmt0, ap);
447 	FUNLOCKFILE(fp);
448 	return (ret);
449 }
450 int
451 vfscanf_l(FILE *fp, locale_t locale, char const *fmt0, va_list ap)
452 {
453 	int ret;
454 	FIX_LOCALE(locale);
455 
456 	FLOCKFILE(fp);
457 	ret = __svfscanf(fp, locale, fmt0, ap);
458 	FUNLOCKFILE(fp);
459 	return (ret);
460 }
461 
462 /*
463  * __svfscanf - non-MT-safe version of __vfscanf
464  */
465 int
466 __svfscanf(FILE *fp, locale_t locale, const char *fmt0, va_list ap)
467 {
468 #define	GETARG(type)	((flags & SUPPRESS) ? SUPPRESS_PTR : va_arg(ap, type))
469 	const u_char *fmt = (const u_char *)fmt0;
470 	int c;			/* character from format, or conversion */
471 	size_t width;		/* field width, or 0 */
472 	int flags;		/* flags as defined above */
473 	int nassigned;		/* number of fields assigned */
474 	int nconversions;	/* number of conversions */
475 	int nr;			/* characters read by the current conversion */
476 	int nread;		/* number of characters consumed from fp */
477 	int base;		/* base argument to conversion function */
478 	char ccltab[256];	/* character class table for %[...] */
479 	char buf[BUF];		/* buffer for numeric conversions */
480 
481 	ORIENT(fp, -1);
482 
483 	nassigned = 0;
484 	nconversions = 0;
485 	nread = 0;
486 	for (;;) {
487 		c = *fmt++;
488 		if (c == 0)
489 			return (nassigned);
490 		if (isspace(c)) {
491 			while ((fp->_r > 0 || __srefill(fp) == 0) && isspace(*fp->_p))
492 				nread++, fp->_r--, fp->_p++;
493 			continue;
494 		}
495 		if (c != '%')
496 			goto literal;
497 		width = 0;
498 		flags = 0;
499 		/*
500 		 * switch on the format.  continue if done;
501 		 * break once format type is derived.
502 		 */
503 again:		c = *fmt++;
504 		switch (c) {
505 		case '%':
506 literal:
507 			if (fp->_r <= 0 && __srefill(fp))
508 				goto input_failure;
509 			if (*fp->_p != c)
510 				goto match_failure;
511 			fp->_r--, fp->_p++;
512 			nread++;
513 			continue;
514 
515 		case '*':
516 			flags |= SUPPRESS;
517 			goto again;
518 		case 'j':
519 			flags |= INTMAXT;
520 			goto again;
521 		case 'l':
522 			if (flags & LONG) {
523 				flags &= ~LONG;
524 				flags |= LONGLONG;
525 			} else
526 				flags |= LONG;
527 			goto again;
528 		case 'q':
529 			flags |= LONGLONG;	/* not quite */
530 			goto again;
531 		case 't':
532 			flags |= PTRDIFFT;
533 			goto again;
534 		case 'z':
535 			flags |= SIZET;
536 			goto again;
537 		case 'L':
538 			flags |= LONGDBL;
539 			goto again;
540 		case 'h':
541 			if (flags & SHORT) {
542 				flags &= ~SHORT;
543 				flags |= SHORTSHORT;
544 			} else
545 				flags |= SHORT;
546 			goto again;
547 
548 		case '0': case '1': case '2': case '3': case '4':
549 		case '5': case '6': case '7': case '8': case '9':
550 			width = width * 10 + c - '0';
551 			goto again;
552 
553 		/*
554 		 * Conversions.
555 		 */
556 		case 'd':
557 			c = CT_INT;
558 			base = 10;
559 			break;
560 
561 		case 'i':
562 			c = CT_INT;
563 			base = 0;
564 			break;
565 
566 		case 'o':
567 			c = CT_INT;
568 			flags |= UNSIGNED;
569 			base = 8;
570 			break;
571 
572 		case 'u':
573 			c = CT_INT;
574 			flags |= UNSIGNED;
575 			base = 10;
576 			break;
577 
578 		case 'X':
579 		case 'x':
580 			flags |= PFXOK;	/* enable 0x prefixing */
581 			c = CT_INT;
582 			flags |= UNSIGNED;
583 			base = 16;
584 			break;
585 
586 #ifndef NO_FLOATING_POINT
587 		case 'A': case 'E': case 'F': case 'G':
588 		case 'a': case 'e': case 'f': case 'g':
589 			c = CT_FLOAT;
590 			break;
591 #endif
592 
593 		case 'S':
594 			flags |= LONG;
595 			/* FALLTHROUGH */
596 		case 's':
597 			c = CT_STRING;
598 			break;
599 
600 		case '[':
601 			fmt = __sccl(ccltab, fmt);
602 			flags |= NOSKIP;
603 			c = CT_CCL;
604 			break;
605 
606 		case 'C':
607 			flags |= LONG;
608 			/* FALLTHROUGH */
609 		case 'c':
610 			flags |= NOSKIP;
611 			c = CT_CHAR;
612 			break;
613 
614 		case 'p':	/* pointer format is like hex */
615 			flags |= POINTER | PFXOK;
616 			c = CT_INT;		/* assumes sizeof(uintmax_t) */
617 			flags |= UNSIGNED;	/*      >= sizeof(uintptr_t) */
618 			base = 16;
619 			break;
620 
621 		case 'n':
622 			if (flags & SUPPRESS)	/* ??? */
623 				continue;
624 			if (flags & SHORTSHORT)
625 				*va_arg(ap, char *) = nread;
626 			else if (flags & SHORT)
627 				*va_arg(ap, short *) = nread;
628 			else if (flags & LONG)
629 				*va_arg(ap, long *) = nread;
630 			else if (flags & LONGLONG)
631 				*va_arg(ap, long long *) = nread;
632 			else if (flags & INTMAXT)
633 				*va_arg(ap, intmax_t *) = nread;
634 			else if (flags & SIZET)
635 				*va_arg(ap, size_t *) = nread;
636 			else if (flags & PTRDIFFT)
637 				*va_arg(ap, ptrdiff_t *) = nread;
638 			else
639 				*va_arg(ap, int *) = nread;
640 			continue;
641 
642 		default:
643 			goto match_failure;
644 
645 		/*
646 		 * Disgusting backwards compatibility hack.	XXX
647 		 */
648 		case '\0':	/* compat */
649 			return (EOF);
650 		}
651 
652 		/*
653 		 * We have a conversion that requires input.
654 		 */
655 		if (fp->_r <= 0 && __srefill(fp))
656 			goto input_failure;
657 
658 		/*
659 		 * Consume leading white space, except for formats
660 		 * that suppress this.
661 		 */
662 		if ((flags & NOSKIP) == 0) {
663 			while (isspace(*fp->_p)) {
664 				nread++;
665 				if (--fp->_r > 0)
666 					fp->_p++;
667 				else if (__srefill(fp))
668 					goto input_failure;
669 			}
670 			/*
671 			 * Note that there is at least one character in
672 			 * the buffer, so conversions that do not set NOSKIP
673 			 * ca no longer result in an input failure.
674 			 */
675 		}
676 
677 		/*
678 		 * Do the conversion.
679 		 */
680 		switch (c) {
681 
682 		case CT_CHAR:
683 			/* scan arbitrary characters (sets NOSKIP) */
684 			if (width == 0)
685 				width = 1;
686 			if (flags & LONG) {
687 				nr = convert_wchar(fp, GETARG(wchar_t *),
688 				    width, locale);
689 			} else {
690 				nr = convert_char(fp, GETARG(char *), width);
691 			}
692 			if (nr < 0)
693 				goto input_failure;
694 			break;
695 
696 		case CT_CCL:
697 			/* scan a (nonempty) character class (sets NOSKIP) */
698 			if (width == 0)
699 				width = (size_t)~0;	/* `infinity' */
700 			if (flags & LONG) {
701 				nr = convert_wccl(fp, GETARG(wchar_t *), width,
702 				    ccltab, locale);
703 			} else {
704 				nr = convert_ccl(fp, GETARG(char *), width,
705 				    ccltab);
706 			}
707 			if (nr <= 0) {
708 				if (nr < 0)
709 					goto input_failure;
710 				else /* nr == 0 */
711 					goto match_failure;
712 			}
713 			break;
714 
715 		case CT_STRING:
716 			/* like CCL, but zero-length string OK, & no NOSKIP */
717 			if (width == 0)
718 				width = (size_t)~0;
719 			if (flags & LONG) {
720 				nr = convert_wstring(fp, GETARG(wchar_t *),
721 				    width, locale);
722 			} else {
723 				nr = convert_string(fp, GETARG(char *), width);
724 			}
725 			if (nr < 0)
726 				goto input_failure;
727 			break;
728 
729 		case CT_INT:
730 			/* scan an integer as if by the conversion function */
731 #ifdef hardway
732 			if (width == 0 || width > sizeof(buf) - 1)
733 				width = sizeof(buf) - 1;
734 #else
735 			/* size_t is unsigned, hence this optimisation */
736 			if (--width > sizeof(buf) - 2)
737 				width = sizeof(buf) - 2;
738 			width++;
739 #endif
740 			nr = parseint(fp, buf, width, base, flags);
741 			if (nr == 0)
742 				goto match_failure;
743 			if ((flags & SUPPRESS) == 0) {
744 				uintmax_t res;
745 
746 				buf[nr] = '\0';
747 				if ((flags & UNSIGNED) == 0)
748 				    res = strtoimax_l(buf, (char **)NULL, base, locale);
749 				else
750 				    res = strtoumax_l(buf, (char **)NULL, base, locale);
751 				if (flags & POINTER)
752 					*va_arg(ap, void **) =
753 							(void *)(uintptr_t)res;
754 				else if (flags & SHORTSHORT)
755 					*va_arg(ap, char *) = res;
756 				else if (flags & SHORT)
757 					*va_arg(ap, short *) = res;
758 				else if (flags & LONG)
759 					*va_arg(ap, long *) = res;
760 				else if (flags & LONGLONG)
761 					*va_arg(ap, long long *) = res;
762 				else if (flags & INTMAXT)
763 					*va_arg(ap, intmax_t *) = res;
764 				else if (flags & PTRDIFFT)
765 					*va_arg(ap, ptrdiff_t *) = res;
766 				else if (flags & SIZET)
767 					*va_arg(ap, size_t *) = res;
768 				else
769 					*va_arg(ap, int *) = res;
770 			}
771 			break;
772 
773 #ifndef NO_FLOATING_POINT
774 		case CT_FLOAT:
775 			/* scan a floating point number as if by strtod */
776 			if (width == 0 || width > sizeof(buf) - 1)
777 				width = sizeof(buf) - 1;
778 			nr = parsefloat(fp, buf, buf + width, locale);
779 			if (nr == 0)
780 				goto match_failure;
781 			if ((flags & SUPPRESS) == 0) {
782 				if (flags & LONGDBL) {
783 					long double res = strtold_l(buf, NULL,
784 					    locale);
785 					*va_arg(ap, long double *) = res;
786 				} else if (flags & LONG) {
787 					double res = strtod_l(buf, NULL,
788 					    locale);
789 					*va_arg(ap, double *) = res;
790 				} else {
791 					float res = strtof_l(buf, NULL, locale);
792 					*va_arg(ap, float *) = res;
793 				}
794 			}
795 			break;
796 #endif /* !NO_FLOATING_POINT */
797 		}
798 		if (!(flags & SUPPRESS))
799 			nassigned++;
800 		nread += nr;
801 		nconversions++;
802 	}
803 input_failure:
804 	return (nconversions != 0 ? nassigned : EOF);
805 match_failure:
806 	return (nassigned);
807 }
808 
809 /*
810  * Fill in the given table from the scanset at the given format
811  * (just after `[').  Return a pointer to the character past the
812  * closing `]'.  The table has a 1 wherever characters should be
813  * considered part of the scanset.
814  */
815 static const u_char *
816 __sccl(char *tab, const u_char *fmt)
817 {
818 	int c, n, v;
819 
820 	/* first `clear' the whole table */
821 	c = *fmt++;		/* first char hat => negated scanset */
822 	if (c == '^') {
823 		v = 1;		/* default => accept */
824 		c = *fmt++;	/* get new first char */
825 	} else
826 		v = 0;		/* default => reject */
827 
828 	/* XXX: Will not work if sizeof(tab*) > sizeof(char) */
829 	(void) memset(tab, v, 256);
830 
831 	if (c == 0)
832 		return (fmt - 1);/* format ended before closing ] */
833 
834 	/*
835 	 * Now set the entries corresponding to the actual scanset
836 	 * to the opposite of the above.
837 	 *
838 	 * The first character may be ']' (or '-') without being special;
839 	 * the last character may be '-'.
840 	 */
841 	v = 1 - v;
842 	for (;;) {
843 		tab[c] = v;		/* take character c */
844 doswitch:
845 		n = *fmt++;		/* and examine the next */
846 		switch (n) {
847 
848 		case 0:			/* format ended too soon */
849 			return (fmt - 1);
850 
851 		case '-':
852 			/*
853 			 * A scanset of the form
854 			 *	[01+-]
855 			 * is defined as `the digit 0, the digit 1,
856 			 * the character +, the character -', but
857 			 * the effect of a scanset such as
858 			 *	[a-zA-Z0-9]
859 			 * is implementation defined.  The V7 Unix
860 			 * scanf treats `a-z' as `the letters a through
861 			 * z', but treats `a-a' as `the letter a, the
862 			 * character -, and the letter a'.
863 			 *
864 			 * For compatibility, the `-' is not considered
865 			 * to define a range if the character following
866 			 * it is either a close bracket (required by ANSI)
867 			 * or is not numerically greater than the character
868 			 * we just stored in the table (c).
869 			 */
870 			n = *fmt;
871 			if (n == ']' || n < c) {
872 				c = '-';
873 				break;	/* resume the for(;;) */
874 			}
875 			fmt++;
876 			do {		/* fill in the range */
877 				tab[++c] = v;
878 			} while (c < n);
879 #if 1	/* XXX another disgusting compatibility hack */
880 			/*
881 			 * Alas, the V7 Unix scanf also treats formats
882 			 * such as [a-c-e] as `the letters a through e'.
883 			 * This too is permitted by the standard....
884 			 */
885 			goto doswitch;
886 #else
887 			c = *fmt++;
888 			if (c == 0)
889 				return (fmt - 1);
890 			if (c == ']')
891 				return (fmt);
892 #endif
893 			break;
894 
895 		case ']':		/* end of scanset */
896 			return (fmt);
897 
898 		default:		/* just another character */
899 			c = n;
900 			break;
901 		}
902 	}
903 	/* NOTREACHED */
904 }
905 
906 #ifndef NO_FLOATING_POINT
907 static int
908 parsefloat(FILE *fp, char *buf, char *end, locale_t locale)
909 {
910 	char *commit, *p;
911 	int infnanpos = 0, decptpos = 0;
912 	enum {
913 		S_START, S_GOTSIGN, S_INF, S_NAN, S_DONE, S_MAYBEHEX,
914 		S_DIGITS, S_DECPT, S_FRAC, S_EXP, S_EXPDIGITS
915 	} state = S_START;
916 	unsigned char c;
917 	const char *decpt = localeconv_l(locale)->decimal_point;
918 	_Bool gotmantdig = 0, ishex = 0;
919 
920 	/*
921 	 * We set commit = p whenever the string we have read so far
922 	 * constitutes a valid representation of a floating point
923 	 * number by itself.  At some point, the parse will complete
924 	 * or fail, and we will ungetc() back to the last commit point.
925 	 * To ensure that the file offset gets updated properly, it is
926 	 * always necessary to read at least one character that doesn't
927 	 * match; thus, we can't short-circuit "infinity" or "nan(...)".
928 	 */
929 	commit = buf - 1;
930 	for (p = buf; p < end; ) {
931 		c = *fp->_p;
932 reswitch:
933 		switch (state) {
934 		case S_START:
935 			state = S_GOTSIGN;
936 			if (c == '-' || c == '+')
937 				break;
938 			else
939 				goto reswitch;
940 		case S_GOTSIGN:
941 			switch (c) {
942 			case '0':
943 				state = S_MAYBEHEX;
944 				commit = p;
945 				break;
946 			case 'I':
947 			case 'i':
948 				state = S_INF;
949 				break;
950 			case 'N':
951 			case 'n':
952 				state = S_NAN;
953 				break;
954 			default:
955 				state = S_DIGITS;
956 				goto reswitch;
957 			}
958 			break;
959 		case S_INF:
960 			if (infnanpos > 6 ||
961 			    (c != "nfinity"[infnanpos] &&
962 			     c != "NFINITY"[infnanpos]))
963 				goto parsedone;
964 			if (infnanpos == 1 || infnanpos == 6)
965 				commit = p;	/* inf or infinity */
966 			infnanpos++;
967 			break;
968 		case S_NAN:
969 			switch (infnanpos) {
970 			case 0:
971 				if (c != 'A' && c != 'a')
972 					goto parsedone;
973 				break;
974 			case 1:
975 				if (c != 'N' && c != 'n')
976 					goto parsedone;
977 				else
978 					commit = p;
979 				break;
980 			case 2:
981 				if (c != '(')
982 					goto parsedone;
983 				break;
984 			default:
985 				if (c == ')') {
986 					commit = p;
987 					state = S_DONE;
988 				} else if (!isalnum(c) && c != '_')
989 					goto parsedone;
990 				break;
991 			}
992 			infnanpos++;
993 			break;
994 		case S_DONE:
995 			goto parsedone;
996 		case S_MAYBEHEX:
997 			state = S_DIGITS;
998 			if (c == 'X' || c == 'x') {
999 				ishex = 1;
1000 				break;
1001 			} else {	/* we saw a '0', but no 'x' */
1002 				gotmantdig = 1;
1003 				goto reswitch;
1004 			}
1005 		case S_DIGITS:
1006 			if ((ishex && isxdigit(c)) || isdigit(c)) {
1007 				gotmantdig = 1;
1008 				commit = p;
1009 				break;
1010 			} else {
1011 				state = S_DECPT;
1012 				goto reswitch;
1013 			}
1014 		case S_DECPT:
1015 			if (c == decpt[decptpos]) {
1016 				if (decpt[++decptpos] == '\0') {
1017 					/* We read the complete decpt seq. */
1018 					state = S_FRAC;
1019 					if (gotmantdig)
1020 						commit = p;
1021 				}
1022 				break;
1023 			} else if (!decptpos) {
1024 				/* We didn't read any decpt characters. */
1025 				state = S_FRAC;
1026 				goto reswitch;
1027 			} else {
1028 				/*
1029 				 * We read part of a multibyte decimal point,
1030 				 * but the rest is invalid, so bail.
1031 				 */
1032 				goto parsedone;
1033 			}
1034 		case S_FRAC:
1035 			if (((c == 'E' || c == 'e') && !ishex) ||
1036 			    ((c == 'P' || c == 'p') && ishex)) {
1037 				if (!gotmantdig)
1038 					goto parsedone;
1039 				else
1040 					state = S_EXP;
1041 			} else if ((ishex && isxdigit(c)) || isdigit(c)) {
1042 				commit = p;
1043 				gotmantdig = 1;
1044 			} else
1045 				goto parsedone;
1046 			break;
1047 		case S_EXP:
1048 			state = S_EXPDIGITS;
1049 			if (c == '-' || c == '+')
1050 				break;
1051 			else
1052 				goto reswitch;
1053 		case S_EXPDIGITS:
1054 			if (isdigit(c))
1055 				commit = p;
1056 			else
1057 				goto parsedone;
1058 			break;
1059 		default:
1060 			abort();
1061 		}
1062 		*p++ = c;
1063 		if (--fp->_r > 0)
1064 			fp->_p++;
1065 		else if (__srefill(fp))
1066 			break;	/* EOF */
1067 	}
1068 
1069 parsedone:
1070 	while (commit < --p)
1071 		__ungetc(*(u_char *)p, fp);
1072 	*++commit = '\0';
1073 	return (commit - buf);
1074 }
1075 #endif
1076