| //===- ScanfSupport.cpp - Secure scanf() replacement ------------===// |
| // |
| // The SAFECode Compiler Project |
| // |
| // This file was developed by the LLVM research group and is distributed under |
| // the University of Illinois Open Source License. See LICENSE.TXT for details. |
| // |
| //===----------------------------------------------------------------------===// |
| // |
| // This file implements a secure runtime replacement for scanf() and similar |
| // functions. |
| // |
| //===----------------------------------------------------------------------===// |
| |
| // |
| // This code is derived from MINIX's doscan.c; original license follows: |
| // |
| // /cvsup/minix/src/lib/stdio/doscan.c,v 1.1.1.1 2005/04/21 14:56:35 beng Exp $ |
| // |
| // Copyright (c) 1987,1997,2001 Prentice Hall |
| // All rights reserved. |
| // |
| // Redistribution and use of the MINIX operating system in source and |
| // binary forms, with or without modification, are permitted provided |
| // that the following conditions are met: |
| // |
| // * Redistributions of source code must retain the above copyright |
| // notice, this list of conditions and the following disclaimer. |
| // |
| // * Redistributions in binary form must reproduce the above |
| // copyright notice, this list of conditions and the following |
| // disclaimer in the documentation and/or other materials provided |
| // with the distribution. |
| // |
| // * Neither the name of Prentice Hall nor the names of the software |
| // authors or contributors may be used to endorse or promote |
| // products derived from this software without specific prior |
| // written permission. |
| // |
| // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS, AUTHORS, AND |
| // CONTRIBUTORS ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, |
| // INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF |
| // MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
| // IN NO EVENT SHALL PRENTICE HALL OR ANY AUTHORS OR CONTRIBUTORS BE |
| // LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR |
| // CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF |
| // SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR |
| // BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, |
| // WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE |
| // OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, |
| // EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| // |
| |
| #include "safecode/Config/config.h" |
| #include "FormatStrings.h" |
| |
| #include <ctype.h> |
| #include <inttypes.h> |
| #include <limits.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <stdarg.h> |
| #include <wchar.h> |
| |
| #ifdef __x86_64__ |
| #define set_pointer(flags) (flags |= FL_LONG) |
| #else |
| #define set_pointer(flags) // nothing |
| #endif |
| |
| // Maximum allowable size for an input number. |
| #define NUMLEN 512 |
| #define NR_CHARS 256 |
| |
| // |
| // Flags describing how to process the input |
| // |
| #define FL_CHAR 0x0001 // hh length modifier |
| #define FL_SHORT 0x0002 // h length modifier |
| #define FL_LLONG 0x0004 // ll length modifier |
| #define FL_LONG 0x0008 // l length modifier |
| #define FL_LONGDOUBLE 0x0010 // L length modifier |
| #define FL_INTMAX 0x0020 // j length modifier |
| #define FL_SIZET 0x0040 // z length modifier |
| #define FL_PTRDIFF 0x0080 // t length modifier |
| #define FL_NOASSIGN 0x0100 // do not assign (* flag) |
| #define FL_WIDTHSPEC 0x0200 // field width specified |
| |
| // |
| // _getc() |
| // |
| // Get the next character from the input. |
| // Returns EOF on reading error or end of file/string. |
| // |
| static inline int |
| _getc(input_parameter *i) |
| { |
| // |
| // Get the next character from the string. |
| // |
| if (i->input_kind == input_parameter::INPUT_FROM_STRING) |
| { |
| const char *string = i->input.string.string; |
| size_t &pos = i->input.string.pos; |
| if (string[pos] == '\0') |
| return EOF; |
| else |
| return string[pos++]; |
| } |
| // |
| // Get the next character from the stream. |
| // |
| else // i->InputKind == input_parameter::INPUT_FROM_STREAM |
| { |
| FILE *file = i->input.stream.stream; |
| char &lastch = i->input.stream.lastch; |
| int ch; |
| // |
| // Call fgetc_unlocked() for performance because the given input stream |
| // should already be locked by the thread. |
| // |
| // Use fgetc() on platforms without fgetc_unlocked(). |
| // |
| #ifndef HAVE_FGETC_UNLOCKED |
| #define fgetc_unlocked fgetc |
| #endif |
| if ((ch = fgetc_unlocked(file)) == EOF) |
| return EOF; |
| else |
| { |
| // Save the character we got in case it is pushed back via _ungetc(). |
| lastch = ch; |
| return ch; |
| } |
| } |
| } |
| |
| // |
| // _ungetc() |
| // |
| // 'Push back' the last character that was read from the input source. |
| // This function assumes at least one character has been read via _getc(). |
| // This function should be called at most once between calls to _getc(), |
| // so that at most one character is pushed back at any given time. |
| // |
| static inline void |
| _ungetc(input_parameter *i) |
| { |
| if (i->input_kind == input_parameter::INPUT_FROM_STRING) |
| // |
| // 'Push back' the string by just decrementing the position. |
| // |
| i->input.string.pos--; |
| else if (i->input_kind == input_parameter::INPUT_FROM_STREAM) |
| { |
| const char lastch = i->input.stream.lastch; |
| // |
| // Use ungetc() to push the last character back into the stream. |
| // See the note over internal_scanf() about the portability of this |
| // operation. |
| // |
| ungetc(lastch, i->input.stream.stream); |
| } |
| } |
| |
| // |
| // input_failure() |
| // |
| // Check if the parameter has had an input failure. |
| // This is defined as EOF or a read error, according to the standard. |
| // For strings an input error is the same as the end of the string. |
| // |
| // Returns: True if the parameter is said to have an input failure, false |
| // otherwise. |
| // |
| static inline bool |
| input_failure(input_parameter *i) |
| { |
| if (i->input_kind == input_parameter::INPUT_FROM_STRING) |
| return i->input.string.string[i->input.string.pos] == 0; |
| else // i->InputKind == input_parameter::INPUT_FROM_STREAM |
| { |
| FILE *f = i->input.stream.stream; |
| return ferror(f) || feof(f); |
| } |
| } |
| |
| // |
| // o_collect() |
| // |
| // Collect a number of characters which constitite an ordinal number. |
| // When the type is 'i', the base can be 8, 10, or 16, depending on the |
| // first 1 or 2 characters. This means that the base must be adjusted |
| // according to the format of the number. At the end of the function, base |
| // is then set to 0, so strtol() will get the right argument. |
| // |
| // Inputs: |
| // |
| // c - the first character to read as an input item |
| // stream - the input_parameter object which contains the rest of the |
| // characters to be read as input items |
| // inp_buf - the buffer into which the number should be written |
| // type - the type of the specifier associated with this conversion, one of |
| // 'i', 'p', 'x', 'X', 'd', 'o', or 'b' |
| // width - the maximum field width |
| // basep - A pointer to an integer. This value is written into with the |
| // numerical base of the value in the buffer, suitable for a call to |
| // strtol() or other function, as determined by this function. |
| // |
| // This function returns NULL if the input buffer was not filled with a valid |
| // integer that could be converted; and otherwise if the input buffer contains |
| // the digits of a valid integer, the function returns the last nonnul position |
| // of the buffer that was written. |
| // |
| // On success, the buffer is suited for a call to strtol() or other integer |
| // conversion function, with the base given in *basep. |
| // |
| static char * |
| o_collect(int c, |
| input_parameter *stream, |
| char *inp_buf, |
| char type, |
| unsigned int width, |
| int *basep) |
| { |
| char *bufp = inp_buf; |
| int base = 0; |
| |
| switch (type) |
| { |
| case 'i': // i means octal, decimal or hexadecimal |
| case 'p': |
| case 'x': |
| case 'X': base = 16; break; |
| case 'd': |
| case 'u': base = 10; break; |
| case 'o': base = 8; break; |
| case 'b': base = 2; break; |
| } |
| // |
| // Process any initial +/- sign. |
| // |
| if (c == '-' || c == '+') |
| { |
| *bufp++ = c; |
| if (--width) |
| c = _getc(stream); |
| else |
| return 0; // An initial [+-] is not a valid number. |
| } |
| // |
| // Determine whether an initial '0' means to process the number in |
| // hexadecimal or octal, if we are given a choice between the two. |
| // |
| if (width && c == '0' && base == 16) |
| { |
| *bufp++ = c; |
| if (--width) |
| c = _getc(stream); |
| if (c != 'x' && c != 'X') |
| { |
| if (type == 'i') base = 8; |
| } |
| else if (width) |
| { |
| *bufp++ = c; |
| if (--width) |
| c = _getc(stream); |
| } |
| else |
| return 0; // Don't accept only an initial [+-]?0[xX] as a valid number. |
| } |
| else if (type == 'i') |
| base = 10; |
| // |
| // Read as many digits as we can. |
| // |
| while (width) |
| { |
| if ( ((base == 10) && isdigit(c) ) |
| || ((base == 16) && isxdigit(c) ) |
| || ((base == 8) && isdigit(c) && (c < '8')) |
| || ((base == 2) && isdigit(c) && (c < '2'))) |
| { |
| *bufp++ = c; |
| if (--width) |
| c = _getc(stream); |
| } |
| else |
| break; |
| } |
| // |
| // Push back any extra read characters that aren't part of an integer. |
| // |
| if (width && c != EOF) |
| _ungetc(stream); |
| if (type == 'i') |
| base = 0; |
| *basep = base; |
| *bufp = '\0'; |
| return bufp == inp_buf ? 0 : bufp - 1; |
| } |
| |
| #ifdef FLOATING_POINT |
| |
| #include "ScanfTables.h" |
| |
| // |
| // f_collect() |
| // |
| // Read the longest valid floating point number prefix from the input buffer. |
| // Upon encountering an error, the function returns and leaves the character |
| // to have caused the error in the input stream. |
| // |
| // Inputs: |
| // c - the first character to read |
| // stream - the parameter from which to get the rest of the characters |
| // inp_buf - the buffer into which to write the number |
| // width - the maximum number of characters to read |
| // |
| // Returns: |
| // On error, the function returns NULL. On success, it returns a pointer to the |
| // last non-nul position in the input buffer. |
| // |
| char * |
| f_collect(int c, input_parameter *stream, char *inp_buf, unsigned int width) |
| { |
| int state = 1; // The start state from the scanner |
| char *buf = inp_buf; |
| int ch; |
| int accept; |
| |
| ch = c; |
| // |
| // This loop matches the input with the transition table. |
| // |
| while (width && state > 0) |
| { |
| // |
| // Handle an 8 bit character or EOF character by breaking immediately. |
| // |
| if (ch == EOF || ch > 127) |
| break; |
| state = yy_nxt[state][ch]; |
| // |
| // Advance to the next state and save the current character, if valid. |
| // |
| if (state > 0) |
| *buf++ = ch; |
| // |
| // Get the next character. |
| // |
| if (--width) |
| ch = _getc(stream); |
| } |
| // |
| // Push back the next character if it was a valid character not part of the |
| // input sequence. |
| // |
| if (width > 0 && ch != EOF) |
| _ungetc(stream); |
| // |
| // Get information about the next action of the scanner. |
| // |
| accept = yy_accept[state < 0 ? -state : state]; |
| // |
| // A value of 0 for accept indicates failure/that the scanner should revert |
| // to the previous accepting state. Since this is not possible without |
| // pushing back more than one character, we should just fail. |
| // |
| // A value of DEFAULT_RULE indicates to the scanner to echo the output |
| // since it is unmatched. This also indicates failure. |
| // |
| #define DEFAULT_RULE 5 |
| if (accept == 0 || accept == DEFAULT_RULE) |
| return 0; |
| else if (buf == inp_buf) |
| return 0; |
| else |
| { |
| *buf = '\0'; |
| return buf - 1; |
| } |
| } |
| #endif // FLOATING_POINT |
| |
| // |
| // eat_whitespace() |
| // |
| // Read all initial whitespace from the input stream. |
| // |
| // Inputs: |
| // stream - the input stream |
| // count - a reference to a counter of the number of characters read |
| // |
| // Returns: |
| // This function returns the first non whitespace character encountered in the |
| // input stream (which could be EOF). |
| // |
| static inline int |
| eat_whitespace(input_parameter *stream, int &count) |
| { |
| int ch; |
| do |
| { |
| ch = _getc(stream); |
| count++; |
| } while (isspace(ch)); |
| return ch; |
| } |
| |
| // |
| // This is a bitvector which specifies a set of characters to match. |
| // |
| typedef struct |
| { |
| enum { FUNCTION, TABLE } kind; |
| union |
| { |
| uint64_t t[4]; |
| int (*f)(int); |
| } s; |
| } scanset_t; |
| |
| const scanset_t all_chars = |
| { |
| scanset_t::TABLE, |
| { { 0xfffffffffffffffful, |
| 0xfffffffffffffffful, |
| 0xfffffffffffffffful, |
| 0xfffffffffffffffful } } |
| }; |
| |
| // Clear the scanset. |
| #define clear_scanset(set) \ |
| for (int i = 0; i < 4; i++) (set)->s.t[i] = 0ul |
| // Add a character to the scanset. |
| #define add_to_scanset(set, c) \ |
| (set)->s.t[((unsigned char) c) >> 6] |= ((uint64_t)1) << (c & 0x3f) |
| // Take the complement of the scanset. |
| #define invert_scanset(set) \ |
| for (int i = 0; i < 4; i++) (set)->s.t[i] = ~(set)->s.t[i] |
| // Query if a character is in the scanset. |
| #define is_in_scanset(set, c) \ |
| ( \ |
| (set)->kind == scanset_t::TABLE ? \ |
| (set)->s.t[((unsigned char) c) >> 6] & (((uint64_t) 1) << (c & 0x3f)) : \ |
| (set)->s.f(c) \ |
| ) |
| |
| // |
| // read_scanset() |
| // |
| // Read the %[...]-style directive embedded in the given format string, and |
| // construct the resuling scanset into *scanset. |
| // |
| // Inputs: |
| // format - the format string, assumed to be pointing to the next character |
| // after the sequence "%[" |
| // scanset - the scanset to fill with the characters in the sequence |
| // |
| // Returns: |
| // The function returns a pointer to the first subsequent character in the |
| // format string that is considered not part of the scanset. This character |
| // will be ']' in a valid directive, or '\0' if the directive is somehow |
| // malformed. |
| // |
| static inline const char * |
| read_scanset(const char *format, scanset_t *scanset) |
| { |
| int reverse; |
| const char *start = format; |
| // |
| // Determine if we take the complement of the scanset. |
| // |
| if (*++format == '^') |
| { |
| reverse = 1; |
| format++; |
| } |
| else |
| reverse = 0; |
| // |
| // Clear the scanset first. |
| // |
| clear_scanset(scanset); |
| // |
| // ']' appearing as the first character in the set does not close the |
| // directive, but rather adds ']' to the scanset. |
| // |
| if (*format == ']') |
| { |
| add_to_scanset(scanset, ']'); |
| format++; |
| } |
| // |
| // Parse the rest of the directive. |
| // |
| while (*format != '\0' && *format != ']') |
| { |
| // |
| // Add a character range to the scanset... |
| // |
| if (*format == '-') |
| { |
| format++; |
| // |
| // ...unless we're in a boundary condition, in which case just add '-'. |
| // |
| if (*format == ']' || &format[-2] == start || |
| (&format[-2] == &start[1] && start[1] == '^')) |
| { |
| add_to_scanset(scanset, '-'); |
| } |
| else if (*format >= format[-2]) |
| { |
| int c; |
| for (c = format[-2] + 1; c <= *format; c++) |
| add_to_scanset(scanset, c); |
| format++; |
| } |
| } |
| else |
| { |
| add_to_scanset(scanset, *format); |
| format++; |
| } |
| } |
| // |
| // Take the complement, if necessary. |
| // |
| if (reverse) |
| invert_scanset(scanset); |
| return format; |
| } |
| |
| // |
| // isnspace() |
| // |
| // Used by the %s directive for reading input. |
| // |
| int isnspace(int c) |
| { |
| return !isspace(c); |
| } |
| |
| // |
| // match_string() |
| // |
| // Read a string of characters that belong in the given scanset, up to size |
| // width. If 'dowrite' is true, write the string (with a nul terminator) into |
| // the buffer associated with the pointer_info argument. Report if there are |
| // any memory safety errors due to writing into the buffer. |
| // |
| // Inputs: |
| // |
| // ci - a pointer to the call_info structure for this function call |
| // p - a pointer to the pointer_info structure that contains the buffer |
| // to write into |
| // flags - the set of flags associated with the current conversion |
| // c - the first character to read |
| // stream - the input stream which contains the rest of the characters |
| // width - the maximum number of characters to read |
| // dowrite - a boolean, if true, the string is written into a buffer |
| // termin - a boolean, if true, the buffer is terminated |
| // nrchars - a reference to a relevant counter of the number of characters |
| // read |
| // set - the set of permissible characters in the string |
| // |
| // Returns: |
| // This function returns the number of characters that it has read. |
| // Reading 0 characters indicates a conversion error. |
| // |
| // If dowrite is true and (flags&FL_LONG) is true, then the buffer is filled |
| // with wide characters converted from the multibyte input stream. Otherwise, |
| // the buffer is filled with the same characters that composed the input, if |
| // dowrite is true. |
| // |
| static inline size_t |
| match_string(call_info *ci, |
| pointer_info *p, |
| int flags, |
| int c, |
| input_parameter *stream, |
| size_t width, |
| const bool dowrite, |
| const bool termin, |
| int &nrchars, |
| const scanset_t *set) |
| { |
| size_t maxwrite = SIZE_MAX; |
| size_t writecount = 0; |
| size_t readcount = 1; // We've "read" c already. |
| char *buf = 0; |
| char mbbuf[MB_LEN_MAX]; |
| size_t mbbufpos = 0; |
| wchar_t wc; |
| size_t wclen; |
| const bool wcs = flags & FL_LONG; |
| mbstate_t ps; |
| if (wcs) |
| memset(&ps, 0, sizeof(mbstate_t)); |
| // |
| // Read the input string. |
| // |
| while (width > 0 && c != EOF && is_in_scanset(set, c)) |
| { |
| // |
| // If after reading a character, the buffer is ready for writing, prepare |
| // it for writing. |
| // |
| if (readcount++ == 1 && dowrite) |
| { |
| // |
| // Get the output buffer. |
| // |
| buf = (char *) p; |
| if (p == NULL) |
| { |
| cerr << "Writing into a NULL object!" << endl; |
| c_library_error(ci, "scanf"); |
| } |
| else if (is_in_whitelist(ci, p) == false) |
| { |
| cerr << "Writing into a non-pointer!" << endl; |
| c_library_error(ci, "scanf"); |
| } |
| else |
| { |
| find_object(ci, p); |
| if (p->flags & HAVEBOUNDS) |
| maxwrite = (size_t) 1 + (char *)p->bounds[1] - (char *) p->ptr; |
| buf = (char *) p->ptr; |
| if (buf == 0) |
| { |
| cerr << "Writing into a NULL object!" << endl; |
| c_library_error(ci, "scanf"); |
| } |
| } |
| } |
| if (dowrite) |
| { |
| if (!wcs) |
| { |
| // |
| // Write directly into the output buffer. |
| // |
| // |
| // Check if this write will go out of bounds. Only report this the first |
| // time that it occurs. |
| // |
| if ((++writecount - maxwrite) == 1) |
| { |
| cerr << "Writing out of bounds!" << endl; |
| write_out_of_bounds_error(ci, p, maxwrite, writecount); |
| } |
| *buf++ = c; |
| } |
| else |
| { |
| // |
| // Read the next multibyte character incrementally. Write it into the |
| // output buffer once we've encountered a valid character. |
| // |
| mbbuf[mbbufpos++] = (char) c; |
| // |
| // Attempt a multibyte to wide character conversion. |
| // |
| wclen = mbrtowc(&wc, &mbbuf[0], mbbufpos, &ps); |
| if (wclen == (size_t) -1) // Conversion error |
| break; |
| else if (wclen == (size_t) -2) |
| ; // The buffer might be holding the prefix of a valid |
| // multibyte character sequence, so try reading more. |
| else |
| { |
| writecount += sizeof(wchar_t); |
| |
| // |
| // Check if the write will go out of bounds. Only report this the |
| // first time that it occurs. |
| // |
| if (writecount - maxwrite > 0 && |
| (writecount - maxwrite) <= sizeof(wchar_t)) |
| { |
| cerr << "Writing out of bounds!" << endl; |
| write_out_of_bounds_error(ci, p, maxwrite, writecount); |
| } |
| ((wchar_t *)buf)[(writecount/sizeof(wchar_t)) - 1] = wc; |
| // |
| // Reset the input buffer. |
| // |
| mbbufpos = 0; |
| } |
| } |
| } |
| if (--width > 0) |
| { |
| c = _getc(stream); |
| nrchars++; |
| } |
| } |
| // |
| // Terminate the string with the appropriate nul terminator, if necessary. |
| // |
| if (termin && dowrite && writecount > 0) |
| { |
| if (!wcs) |
| { |
| if ((++writecount - maxwrite) == 1) |
| { |
| cerr << "Writing out of bounds!" << endl; |
| write_out_of_bounds_error(ci, p, maxwrite, writecount); |
| } |
| *buf = '\0'; |
| } |
| else |
| { |
| writecount += sizeof(wchar_t); |
| if (writecount - maxwrite > 0 && |
| (writecount - maxwrite) <= sizeof(wchar_t)) |
| { |
| cerr << "Writing out of bounds!" << endl; |
| write_out_of_bounds_error(ci, p, maxwrite, writecount); |
| } |
| ((wchar_t *)buf)[(writecount/sizeof(wchar_t)) - 1] = L'\0'; |
| } |
| } |
| // |
| // Push back any character that was read and not in the scanset. |
| // |
| if (width > 0 && c != EOF) |
| { |
| _ungetc(stream); |
| readcount--; |
| nrchars--; |
| } |
| // |
| // Don't count EOF. |
| // |
| else if (c == EOF) |
| { |
| readcount--; |
| nrchars--; |
| } |
| return readcount; |
| } |
| |
| // |
| // SAFEWRITE() |
| // |
| // A macro that attempts to securely write a value into the next parameter. |
| // |
| // Inputs: |
| // ci - pointer to the call_info structure |
| // ap - pointer to the va_list |
| // arg - the variable argument number to be accessed |
| // item - the item to write |
| // type - the type to write the item as |
| // |
| #define SAFEWRITE(ci, ap, arg, item, type) \ |
| do \ |
| { \ |
| pointer_info *p; \ |
| void *dest; \ |
| varg_check(ci, arg++); \ |
| p = va_arg(ap, pointer_info *); \ |
| write_check(ci, p, sizeof(type)); \ |
| dest = unwrap_pointer(ci, p); \ |
| /* if (dest != 0) */ *(type *) dest = (type) item; \ |
| } while (0) |
| |
| // |
| // internal_scanf() |
| // |
| // This is the main logic for the secured scanf() family of functions. |
| // |
| // |
| // IMPLEMENTATION NOTES |
| // - This function uses ungetc() to push back characters into a stream. |
| // This is an error because at most one character can be pushed back |
| // portably, but an ungetc() call is allowed to follow a call to a scan |
| // function without any intervening I/O. Hence if this function calls |
| // ungetc() and then the caller does so again on the same stream, the |
| // result might fail. |
| // |
| // However, glibc appears to have support for consecutive 2 character |
| // pushback, so this doesn't fail on glibc. |
| // |
| // Mac OS X's libc also has support for 2 character pushback. |
| // |
| // - A nonstandard %b specifier is supported, for reading binary integers. |
| // - No support for positional arguments (%n$-style directives) (yet ?). |
| // - The maximum supported width of a numerical constant in the input is 512 |
| // bytes. |
| // |
| |
| int |
| internal_scanf(input_parameter &i, call_info &c, const char *fmt, va_list ap) |
| { |
| int done = 0; // number of items converted |
| int nrchars = 0; // number of characters read |
| int base; // conversion base |
| uintmax_t val; // an integer value |
| char *str; // temporary pointer |
| char *tmp_string; // ditto |
| unsigned width = 0; // width of field |
| int flags; // some flags |
| int kind; |
| int ic = EOF; // the input character |
| char inp_buf[NUMLEN + 1]; // buffer to hold numerical inputs |
| |
| #ifdef FLOATING_POINT |
| long double ld_val; |
| #endif |
| |
| const char *format = fmt; |
| input_parameter *stream = &i; |
| |
| str = 0; // Suppress g++ complaints about unitialized variables. |
| pointer_info *p = 0; |
| |
| // Return immediately for an empty format string. |
| if (*format == '\0') |
| return 0; |
| |
| mbstate_t ps; |
| size_t len; |
| const char *mb_pos; |
| memset(&ps, 0, sizeof(ps)); |
| |
| call_info *ci = &c; |
| unsigned int arg = 1; |
| |
| bool wr; |
| size_t sz; |
| scanset_t nonws; |
| nonws.kind = scanset_t::FUNCTION; |
| nonws.s.f = isnspace; |
| scanset_t scanset; |
| scanset.kind = scanset_t::TABLE; |
| |
| // |
| // Version of SAFEWRITE() relevant to this function. |
| // |
| #define _SAFEWRITE(item, type) SAFEWRITE(ci, ap, arg, item, type) |
| |
| // |
| // The main loop that processes the format string. |
| // At the end of the loop, the count of assignments is updated and the format |
| // string is incremented one position. |
| // |
| while (1) |
| { |
| // |
| // Whitespace in the format string indicates to match all whitespace in the |
| // input stream. |
| // |
| if (isspace(*format)) |
| { |
| while (isspace(*format)) |
| format++; // Skip whitespace in the format string. |
| ic = eat_whitespace(stream, nrchars); |
| if (ic != EOF) |
| _ungetc(stream); |
| } |
| if (*format == '\0') |
| break; // End of format |
| // |
| // Match a multibyte character from the input. |
| // |
| if (*format != '%') |
| { |
| len = mbrtowc(NULL, format, MB_CUR_MAX, &ps); |
| mb_pos = format; |
| format += len; |
| while (mb_pos != format) |
| { |
| ic = _getc(stream); |
| if (ic != *mb_pos) |
| break; |
| else |
| { |
| nrchars++; |
| mb_pos++; |
| } |
| } |
| if (mb_pos != format && ic != *mb_pos) |
| { |
| // |
| // A directive that is an ordinary multibyte character is executed |
| // by reading the next characters of the stream. If any of those |
| // characters differ from the ones composing the directive, the |
| // directive fails and the differing and subsequent characters |
| // remain unread. |
| // |
| // - C99 Standard |
| // |
| if (ic != EOF) |
| { |
| _ungetc(stream); |
| goto match_failure; |
| } |
| else |
| goto failure; |
| } |
| continue; |
| } |
| format++; // We've read '%'; start processing a directive. |
| flags = 0; |
| // |
| // The '%' specifier |
| // |
| if (*format == '%') |
| { |
| ic = eat_whitespace(stream, nrchars); |
| if (ic == '%') |
| { |
| format++; |
| continue; |
| } |
| else |
| { |
| _ungetc(stream); |
| goto failure; |
| } |
| } |
| // |
| // '*' flag: Suppress assignment. |
| // |
| if (*format == '*') |
| { |
| format++; |
| flags |= FL_NOASSIGN; |
| } |
| // |
| // Get the field width, if there is any. |
| // |
| if (isdigit (*format)) |
| { |
| flags |= FL_WIDTHSPEC; |
| for (width = 0; isdigit (*format);) |
| width = width * 10 + *format++ - '0'; |
| } |
| // |
| // Process length modifiers. |
| // |
| switch (*format) |
| { |
| case 'h': |
| if (*++format == 'h') |
| { |
| format++; |
| flags |= FL_CHAR; |
| } |
| else |
| flags |= FL_SHORT; |
| break; |
| case 'l': |
| if (*++format == 'l') |
| { |
| format++; |
| flags |= FL_LLONG; |
| } |
| else |
| flags |= FL_LONG; |
| break; |
| case 'j': |
| format++; |
| flags |= FL_INTMAX; |
| break; |
| case 'z': |
| format++; |
| flags |= FL_SIZET; |
| break; |
| case 't': |
| format++; |
| flags |= FL_PTRDIFF; |
| break; |
| case 'L': |
| format++; |
| flags |= FL_LONGDOUBLE; |
| break; |
| } |
| // |
| // Read the actual specifier. |
| // |
| kind = *format; |
| // |
| // Eat any initial whitespace for specifiers that allow it. |
| // |
| if ((kind != 'c') && (kind != '[') && (kind != 'n')) |
| { |
| ic = eat_whitespace(stream, nrchars); |
| if (ic == EOF) |
| goto failure; |
| } |
| // |
| // Get the initial character of the input, for non-%n specifiers. |
| // |
| else if (kind != 'n') |
| { |
| ic = _getc(stream); |
| if (ic == EOF) |
| goto failure; |
| nrchars++; |
| } |
| // |
| // Process the format specifier. |
| // |
| switch (kind) |
| { |
| default: |
| // not recognized, like %q |
| goto failure; |
| // |
| // %n specifier |
| // |
| case 'n': |
| if (!(flags & FL_NOASSIGN)) |
| { |
| if (flags & FL_CHAR) |
| _SAFEWRITE(nrchars, char); |
| else if (flags & FL_SHORT) |
| _SAFEWRITE(nrchars, short); |
| else if (flags & FL_LONG) |
| _SAFEWRITE(nrchars, long); |
| else if (flags & FL_LLONG) |
| _SAFEWRITE(nrchars, long long); |
| else if (flags & FL_INTMAX) |
| _SAFEWRITE(nrchars, intmax_t); |
| else if (flags & FL_SIZET) |
| _SAFEWRITE(nrchars, size_t); |
| else if (flags & FL_PTRDIFF) |
| _SAFEWRITE(nrchars, ptrdiff_t); |
| else |
| _SAFEWRITE(nrchars, int); |
| } |
| break; |
| // |
| // %p specifier |
| // |
| case 'p': |
| // Set any additional flags regarding pointer representation size. |
| set_pointer(flags); |
| // fallthrough |
| // |
| // Integral specifiers: %b, %d, %i, %o, %u, %x, %X |
| // |
| case 'b': // binary |
| case 'd': // decimal |
| case 'i': // general integer |
| case 'o': // octal |
| case 'u': // unsigned |
| case 'x': // hexadecimal |
| case 'X': // ditto |
| // Don't read more than NUMLEN bytes. |
| if (!(flags & FL_WIDTHSPEC) || width > NUMLEN) |
| width = NUMLEN; |
| if (width == 0) |
| goto match_failure; |
| |
| str = o_collect(ic, stream, inp_buf, kind, width, &base); |
| |
| if (str == 0) |
| goto failure; |
| |
| // |
| // Although the length of the number is str-inp_buf+1 |
| // we don't add the 1 since we counted it already. |
| // |
| nrchars += str - inp_buf; |
| |
| if (!(flags & FL_NOASSIGN)) |
| { |
| if (kind == 'd' || kind == 'i') |
| val = strtoimax(inp_buf, &tmp_string, base); |
| else |
| val = strtoumax(inp_buf, &tmp_string, base); |
| if (flags & FL_CHAR) |
| _SAFEWRITE(val, unsigned char); |
| else if (flags & FL_SHORT) |
| _SAFEWRITE(val, unsigned short); |
| else if (flags & FL_LONG) |
| _SAFEWRITE(val, unsigned long); |
| else if (flags & FL_LLONG) |
| _SAFEWRITE(val, unsigned long long); |
| else if (flags & FL_INTMAX) |
| _SAFEWRITE(val, uintmax_t); |
| else if (flags & FL_SIZET) |
| _SAFEWRITE(val, size_t); |
| else if (flags & FL_PTRDIFF) |
| _SAFEWRITE(val, ptrdiff_t); |
| else |
| _SAFEWRITE(val, unsigned); |
| } |
| break; |
| // |
| // %c specifier |
| // |
| case 'c': |
| // |
| // No specified width means to read a single character. |
| // |
| if (!(flags & FL_WIDTHSPEC)) |
| width = 1; |
| if (width == 0) |
| goto match_failure; |
| wr = !(flags & FL_NOASSIGN); |
| if (wr) |
| { |
| varg_check(ci, arg++); |
| p = va_arg(ap, pointer_info *); |
| } |
| sz = \ |
| match_string( |
| ci, p, flags, ic, stream, width, wr, false, nrchars, &all_chars |
| ); |
| if (sz == 0) |
| goto failure; |
| break; |
| // |
| // %s specifier |
| // |
| case 's': |
| if (!(flags & FL_WIDTHSPEC)) |
| width = UINT_MAX; |
| if (width == 0) |
| goto match_failure; |
| wr = !(flags & FL_NOASSIGN); |
| if (wr) |
| { |
| varg_check(ci, arg++); |
| p = va_arg(ap, pointer_info *); |
| } |
| sz = \ |
| match_string( |
| ci, p, flags, ic, stream, width, wr, true, nrchars, &nonws |
| ); |
| if (sz == 0) |
| goto failure; |
| break; |
| // |
| // %[...] specifier |
| // |
| case '[': |
| if (!(flags & FL_WIDTHSPEC)) |
| width = UINT_MAX; |
| if (width == 0) |
| goto match_failure; |
| format = read_scanset(format, &scanset); |
| // |
| // If the format string points to a '\0', then there was an error |
| // parsing the scanset. |
| // |
| if (*format == '\0') |
| goto match_failure; |
| wr = !(flags & FL_NOASSIGN); |
| if (wr) |
| { |
| varg_check(ci, arg++); |
| p = va_arg(ap, pointer_info *); |
| } |
| sz = \ |
| match_string( |
| ci, p, flags, ic, stream, width, wr, true, nrchars, &scanset |
| ); |
| if (sz == 0) |
| goto failure; |
| break; |
| |
| #ifdef FLOATING_POINT |
| // |
| // Floating point specifiers: %a, %A, %e, %E, %f, %F, %g, %G |
| // |
| case 'a': |
| case 'A': |
| case 'e': |
| case 'E': |
| case 'f': |
| case 'F': |
| case 'g': |
| case 'G': |
| if (!(flags & FL_WIDTHSPEC) || width > NUMLEN) |
| width = NUMLEN; |
| |
| if (!width) |
| goto failure; |
| str = f_collect(ic, stream, inp_buf, width); |
| |
| if (str == 0) |
| goto failure; |
| |
| // |
| // Although the length of the number is str-inp_buf+1 |
| // we don't add the 1 since we counted it already |
| // |
| nrchars += str - inp_buf; |
| |
| if (!(flags & FL_NOASSIGN)) |
| { |
| ld_val = strtold(inp_buf, &tmp_string); |
| if (flags & FL_LONGDOUBLE) |
| _SAFEWRITE(ld_val, long double); |
| else if (flags & FL_LONG) |
| _SAFEWRITE(ld_val, double); |
| else |
| _SAFEWRITE(ld_val, float); |
| } |
| break; |
| #endif |
| |
| } |
| if (!(flags & FL_NOASSIGN) && kind != 'n') |
| done++; |
| format++; |
| } |
| |
| goto finish; |
| |
| failure: |
| // |
| // In the event of a possible input failure (=eof or read error), the |
| // directive should jump to here. |
| // |
| if (done == 0 && input_failure(stream)) |
| return EOF; |
| |
| // |
| // The fscanf function returns the value of the macro EOF if an input failure |
| // occurs before the first conversion (if any) has completed. Otherwise, the |
| // function returns the number of input items assigned, which can be fewer |
| // than provided for, or even zero, in the event of an early matching failure. |
| // |
| // - C99 Standard |
| // |
| match_failure: |
| finish: |
| return done; |
| |
| } |
