fix uninitialized/stale use of alloc (%m modifier) flag in scanf
[musl] / src / stdio / vfwscanf.c
index de74fe0..44fac78 100644 (file)
@@ -14,6 +14,7 @@
 #include "shgetc.h"
 #include "intscan.h"
 #include "floatscan.h"
+#include "libc.h"
 
 #define SIZE_hh -2
 #define SIZE_h  -1
@@ -86,7 +87,7 @@ static int in_set(const wchar_t *set, int c)
        ((f)->rend && (c)<128U ? *--(f)->rpos : ungetwc((c),(f)))
 #endif
 
-int vfwscanf(FILE *f, const wchar_t *fmt, va_list ap)
+int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
 {
        int width;
        int size;
@@ -101,11 +102,15 @@ int vfwscanf(FILE *f, const wchar_t *fmt, va_list ap)
        off_t pos = 0, cnt;
        static const char size_pfx[][3] = { "hh", "h", "", "l", "L", "ll" };
        char tmp[3*sizeof(int)+10];
+       const wchar_t *set;
+       size_t i, k;
 
        FLOCK(f);
 
        for (p=fmt; *p; p++) {
 
+               alloc = 0;
+
                if (iswspace(*p)) {
                        while (iswspace(p[1])) p++;
                        while (iswspace((c=getwc(f)))) pos++;
@@ -138,7 +143,7 @@ int vfwscanf(FILE *f, const wchar_t *fmt, va_list ap)
                }
 
                if (*p=='m') {
-                       alloc = 1;
+                       alloc = !!dest;
                        p++;
                } else {
                        alloc = 0;
@@ -178,8 +183,11 @@ int vfwscanf(FILE *f, const wchar_t *fmt, va_list ap)
 
                t = *p;
 
-               /* Transform ls,lc -> S,C */
-               if (size==SIZE_l && (t&15)==3) t&=~32;
+               /* Transform S,C -> ls,lc */
+               if ((t&0x2f)==3) {
+                       size = SIZE_l;
+                       t |= 32;
+               }
 
                if (t != 'n') {
                        if (t != '[' && (t|32) != 'c')
@@ -196,87 +204,89 @@ int vfwscanf(FILE *f, const wchar_t *fmt, va_list ap)
                        /* do not increment match count, etc! */
                        continue;
 
-               case 'c':
-                       if (width < 1) width = 1;
-                       s = dest;
-                       for (; width && (c=getwc(f)) >= 0; width--) {
-                               int l = wctomb(s?s:tmp, c);
-                               if (l<0) goto input_fail;
-                               if (s) s+=l;
-                               pos++;
-                       }
-                       if (width) goto match_fail;
-                       break;
-
-               case 'C':
-                       if (width < 1) width = 1;
-                       wcs = dest;
-                       for (; width && (c=getwc(f)) >= 0; width--)
-                               pos++, wcs && (*wcs++ = c);
-                       if (width) goto match_fail;
-                       break;
-
                case 's':
-                       if (width < 1) width = -1;
-                       s = dest;
-                       while (width && !iswspace(c=getwc(f)) && c!=EOF) {
-                               int l = wctomb(s?s:tmp, c);
-                               if (l<0) goto input_fail;
-                               if (s) s+=l;
-                               pos++;
-                               width-=(width>0);
+               case 'c':
+               case '[':
+                       if (t == 'c') {
+                               if (width<1) width = 1;
+                               invert = 1;
+                               set = L"";
+                       } else if (t == 's') {
+                               invert = 1;
+                               set = (const wchar_t[]){
+                                       ' ', '\t', '\n', '\r', 11, 12,  0x0085,
+                                       0x2000, 0x2001, 0x2002, 0x2003, 0x2004, 0x2005,
+                                       0x2006, 0x2008, 0x2009, 0x200a,
+                                       0x2028, 0x2029, 0x205f, 0x3000, 0 };
+                       } else {
+                               if (*++p == '^') p++, invert = 1;
+                               else invert = 0;
+                               set = p;
+                               if (*p==']') p++;
+                               while (*p!=']') {
+                                       if (!*p) goto fmt_fail;
+                                       p++;
+                               }
                        }
-                       if (width) ungetwc(c, f);
-                       if (s) *s = 0;
-                       break;
 
-               case 'S':
-                       wcs = dest;
-                       if (width < 1) width = -1;
-                       while (width && !iswspace(c=getwc(f)) && c!=EOF)
-                               width-=(width>0), pos++, *wcs++ = c;
-                       if (width) ungetwc(c, f);
-                       if (wcs) *wcs = 0;
-                       break;
-
-               case '[':
                        s = (size == SIZE_def) ? dest : 0;
                        wcs = (size == SIZE_l) ? dest : 0;
 
-                       if (*++p == '^') p++, invert = 1;
-                       else invert = 0;
-
                        int gotmatch = 0;
 
                        if (width < 1) width = -1;
 
+                       i = 0;
+                       if (alloc) {
+                               k = t=='c' ? width+1U : 31;
+                               if (size == SIZE_l) {
+                                       wcs = malloc(k*sizeof(wchar_t));
+                                       if (!wcs) goto alloc_fail;
+                               } else {
+                                       s = malloc(k);
+                                       if (!s) goto alloc_fail;
+                               }
+                       }
                        while (width) {
                                if ((c=getwc(f))<0) break;
-                               if (in_set(p, c) == invert)
+                               if (in_set(set, c) == invert)
                                        break;
                                if (wcs) {
-                                       *wcs++ = c;
+                                       wcs[i++] = c;
+                                       if (alloc && i==k) {
+                                               k += k+1;
+                                               wchar_t *tmp = realloc(wcs, k*sizeof(wchar_t));
+                                               if (!tmp) goto alloc_fail;
+                                               wcs = tmp;
+                                       }
                                } else if (size != SIZE_l) {
-                                       int l = wctomb(s?s:tmp, c);
+                                       int l = wctomb(s?s+i:tmp, c);
                                        if (l<0) goto input_fail;
-                                       if (s) s+=l;
+                                       i += l;
+                                       if (alloc && i > k-4) {
+                                               k += k+1;
+                                               char *tmp = realloc(s, k);
+                                               if (!tmp) goto alloc_fail;
+                                               s = tmp;
+                                       }
                                }
                                pos++;
                                width-=(width>0);
                                gotmatch=1;
                        }
-                       if (width) ungetwc(c, f);
-
-                       if (!gotmatch) goto match_fail;
-
-                       if (*p==']') p++;
-                       while (*p!=']') {
-                               if (!*p) goto fmt_fail;
-                               p++;
+                       if (width) {
+                               ungetwc(c, f);
+                               if (t == 'c' || !gotmatch) goto match_fail;
                        }
 
-                       if (wcs) *wcs++ = 0;
-                       if (s) *s++ = 0;
+                       if (alloc) {
+                               if (size == SIZE_l) *(wchar_t **)dest = wcs;
+                               else *(char **)dest = s;
+                       }
+                       if (t != 'c') {
+                               if (wcs) wcs[i] = 0;
+                               if (s) s[i] = 0;
+                       }
                        break;
 
                case 'd': case 'i': case 'o': case 'u': case 'x':
@@ -301,10 +311,17 @@ int vfwscanf(FILE *f, const wchar_t *fmt, va_list ap)
        }
        if (0) {
 fmt_fail:
+alloc_fail:
 input_fail:
                if (!matches) matches--;
-       }
 match_fail:
+               if (alloc) {
+                       free(s);
+                       free(wcs);
+               }
+       }
        FUNLOCK(f);
        return matches;
 }
+
+weak_alias(vfwscanf,__isoc99_vfwscanf);