avoid crash in scanf when invalid %m format is encountered
[musl] / src / stdio / vfscanf.c
1 #include <stdlib.h>
2 #include <stdarg.h>
3 #include <ctype.h>
4 #include <wchar.h>
5 #include <wctype.h>
6 #include <limits.h>
7 #include <string.h>
8 #include <errno.h>
9 #include <math.h>
10 #include <float.h>
11 #include <inttypes.h>
12
13 #include "stdio_impl.h"
14 #include "shgetc.h"
15 #include "intscan.h"
16 #include "floatscan.h"
17
18 #define SIZE_hh -2
19 #define SIZE_h  -1
20 #define SIZE_def 0
21 #define SIZE_l   1
22 #define SIZE_L   2
23 #define SIZE_ll  3
24
25 static void store_int(void *dest, int size, unsigned long long i)
26 {
27         if (!dest) return;
28         switch (size) {
29         case SIZE_hh:
30                 *(char *)dest = i;
31                 break;
32         case SIZE_h:
33                 *(short *)dest = i;
34                 break;
35         case SIZE_def:
36                 *(int *)dest = i;
37                 break;
38         case SIZE_l:
39                 *(long *)dest = i;
40                 break;
41         case SIZE_ll:
42                 *(long long *)dest = i;
43                 break;
44         }
45 }
46
47 static void *arg_n(va_list ap, unsigned int n)
48 {
49         void *p;
50         unsigned int i;
51         va_list ap2;
52         va_copy(ap2, ap);
53         for (i=n; i>1; i--) va_arg(ap2, void *);
54         p = va_arg(ap2, void *);
55         va_end(ap2);
56         return p;
57 }
58
59 int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
60 {
61         int width;
62         int size;
63         int alloc;
64         int base;
65         const unsigned char *p;
66         int c, t;
67         char *s;
68         wchar_t *wcs;
69         mbstate_t st;
70         void *dest=NULL;
71         int invert;
72         int matches=0;
73         unsigned long long x;
74         long double y;
75         off_t pos = 0;
76         unsigned char scanset[257];
77         size_t i, k;
78         wchar_t wc;
79
80         FLOCK(f);
81
82         for (p=(const unsigned char *)fmt; *p; p++) {
83
84                 alloc = 0;
85
86                 if (isspace(*p)) {
87                         while (isspace(p[1])) p++;
88                         shlim(f, 0);
89                         while (isspace(shgetc(f)));
90                         shunget(f);
91                         pos += shcnt(f);
92                         continue;
93                 }
94                 if (*p != '%' || p[1] == '%') {
95                         p += *p=='%';
96                         shlim(f, 0);
97                         c = shgetc(f);
98                         if (c!=*p) {
99                                 shunget(f);
100                                 if (c<0) goto input_fail;
101                                 goto match_fail;
102                         }
103                         pos++;
104                         continue;
105                 }
106
107                 p++;
108                 if (*p=='*') {
109                         dest = 0; p++;
110                 } else if (isdigit(*p) && p[1]=='$') {
111                         dest = arg_n(ap, *p-'0'); p+=2;
112                 } else {
113                         dest = va_arg(ap, void *);
114                 }
115
116                 for (width=0; isdigit(*p); p++) {
117                         width = 10*width + *p - '0';
118                 }
119
120                 if (*p=='m') {
121                         wcs = 0;
122                         s = 0;
123                         alloc = !!dest;
124                         p++;
125                 } else {
126                         alloc = 0;
127                 }
128
129                 size = SIZE_def;
130                 switch (*p++) {
131                 case 'h':
132                         if (*p == 'h') p++, size = SIZE_hh;
133                         else size = SIZE_h;
134                         break;
135                 case 'l':
136                         if (*p == 'l') p++, size = SIZE_ll;
137                         else size = SIZE_l;
138                         break;
139                 case 'j':
140                         size = SIZE_ll;
141                         break;
142                 case 'z':
143                 case 't':
144                         size = SIZE_l;
145                         break;
146                 case 'L':
147                         size = SIZE_L;
148                         break;
149                 case 'd': case 'i': case 'o': case 'u': case 'x':
150                 case 'a': case 'e': case 'f': case 'g':
151                 case 'A': case 'E': case 'F': case 'G': case 'X':
152                 case 's': case 'c': case '[':
153                 case 'S': case 'C':
154                 case 'p': case 'n':
155                         p--;
156                         break;
157                 default:
158                         goto fmt_fail;
159                 }
160
161                 t = *p;
162
163                 /* C or S */
164                 if ((t&0x2f) == 3) {
165                         t |= 32;
166                         size = SIZE_l;
167                 }
168
169                 switch (t) {
170                 case 'c':
171                         if (width < 1) width = 1;
172                 case '[':
173                         break;
174                 case 'n':
175                         store_int(dest, size, pos);
176                         /* do not increment match count, etc! */
177                         continue;
178                 default:
179                         shlim(f, 0);
180                         while (isspace(shgetc(f)));
181                         shunget(f);
182                         pos += shcnt(f);
183                 }
184
185                 shlim(f, width);
186                 if (shgetc(f) < 0) goto input_fail;
187                 shunget(f);
188
189                 switch (t) {
190                 case 's':
191                 case 'c':
192                 case '[':
193                         if (t == 'c' || t == 's') {
194                                 memset(scanset, -1, sizeof scanset);
195                                 scanset[0] = 0;
196                                 if (t == 's') {
197                                         scanset[1+'\t'] = 0;
198                                         scanset[1+'\n'] = 0;
199                                         scanset[1+'\v'] = 0;
200                                         scanset[1+'\f'] = 0;
201                                         scanset[1+'\r'] = 0;
202                                         scanset[1+' '] = 0;
203                                 }
204                         } else {
205                                 if (*++p == '^') p++, invert = 1;
206                                 else invert = 0;
207                                 memset(scanset, invert, sizeof scanset);
208                                 scanset[0] = 0;
209                                 if (*p == '-') p++, scanset[1+'-'] = 1-invert;
210                                 else if (*p == ']') p++, scanset[1+']'] = 1-invert;
211                                 for (; *p != ']'; p++) {
212                                         if (!*p) goto fmt_fail;
213                                         if (*p=='-' && p[1] && p[1] != ']')
214                                                 for (c=p++[-1]; c<*p; c++)
215                                                         scanset[1+c] = 1-invert;
216                                         scanset[1+*p] = 1-invert;
217                                 }
218                         }
219                         wcs = 0;
220                         s = 0;
221                         i = 0;
222                         k = t=='c' ? width+1U : 31;
223                         if (size == SIZE_l) {
224                                 if (alloc) {
225                                         wcs = malloc(k*sizeof(wchar_t));
226                                         if (!wcs) goto alloc_fail;
227                                 } else {
228                                         wcs = dest;
229                                 }
230                                 st = (mbstate_t){0};
231                                 while (scanset[(c=shgetc(f))+1]) {
232                                         switch (mbrtowc(&wc, &(char){c}, 1, &st)) {
233                                         case -1:
234                                                 goto input_fail;
235                                         case -2:
236                                                 continue;
237                                         }
238                                         if (wcs) wcs[i++] = wc;
239                                         if (alloc && i==k) {
240                                                 k+=k+1;
241                                                 wchar_t *tmp = realloc(wcs, k*sizeof(wchar_t));
242                                                 if (!tmp) goto alloc_fail;
243                                                 wcs = tmp;
244                                         }
245                                 }
246                                 if (!mbsinit(&st)) goto input_fail;
247                         } else if (alloc) {
248                                 s = malloc(k);
249                                 if (!s) goto alloc_fail;
250                                 while (scanset[(c=shgetc(f))+1]) {
251                                         s[i++] = c;
252                                         if (i==k) {
253                                                 k+=k+1;
254                                                 char *tmp = realloc(s, k);
255                                                 if (!tmp) goto alloc_fail;
256                                                 s = tmp;
257                                         }
258                                 }
259                         } else if ((s = dest)) {
260                                 while (scanset[(c=shgetc(f))+1])
261                                         s[i++] = c;
262                         } else {
263                                 while (scanset[(c=shgetc(f))+1]);
264                         }
265                         shunget(f);
266                         if (!shcnt(f)) goto match_fail;
267                         if (t == 'c' && shcnt(f) != width) goto match_fail;
268                         if (alloc) {
269                                 if (size == SIZE_l) *(wchar_t **)dest = wcs;
270                                 else *(char **)dest = s;
271                         }
272                         if (t != 'c') {
273                                 if (wcs) wcs[i] = 0;
274                                 if (s) s[i] = 0;
275                         }
276                         break;
277                 case 'p':
278                 case 'X':
279                 case 'x':
280                         base = 16;
281                         goto int_common;
282                 case 'o':
283                         base = 8;
284                         goto int_common;
285                 case 'd':
286                 case 'u':
287                         base = 10;
288                         goto int_common;
289                 case 'i':
290                         base = 0;
291                 int_common:
292                         x = __intscan(f, base, 0, ULLONG_MAX);
293                         if (!shcnt(f)) goto match_fail;
294                         if (t=='p' && dest) *(void **)dest = (void *)(uintptr_t)x;
295                         else store_int(dest, size, x);
296                         break;
297                 case 'a': case 'A':
298                 case 'e': case 'E':
299                 case 'f': case 'F':
300                 case 'g': case 'G':
301                         y = __floatscan(f, size, 0);
302                         if (!shcnt(f)) goto match_fail;
303                         if (dest) switch (size) {
304                         case SIZE_def:
305                                 *(float *)dest = y;
306                                 break;
307                         case SIZE_l:
308                                 *(double *)dest = y;
309                                 break;
310                         case SIZE_L:
311                                 *(long double *)dest = y;
312                                 break;
313                         }
314                         break;
315                 }
316
317                 pos += shcnt(f);
318                 if (dest) matches++;
319         }
320         if (0) {
321 fmt_fail:
322 alloc_fail:
323 input_fail:
324                 if (!matches) matches--;
325 match_fail:
326                 if (alloc) {
327                         free(s);
328                         free(wcs);
329                 }
330         }
331         FUNLOCK(f);
332         return matches;
333 }