scanf %x bug

scanf %x bug

[Szabolcs Nagy]

i found a scanf bug:

#include <stdio.h>
int main(){
    int n, a=7;
    n = sscanf("0", "%x", &a);
    printf("%d %d\n", n, a);
    return 0;
}

prints 0 7
instead of 1 0

Re: scanf %x bug

[Rich Felker]

On Tue, Mar 13, 2012 at 02:51:18PM +0100, Szabolcs Nagy wrote:
> i found a scanf bug:
> 
> #include <stdio.h>
> int main(){
>     int n, a=7;
>     n = sscanf("0", "%x", &a);
>     printf("%d %d\n", n, a);
>     return 0;
> }
> 
> prints 0 7
> instead of 1 0

Bleh, musl's scanf is really bad but I don't feel like rewriting it...
Maybe I'll see if I can do that at the same time I replace the strtod
code (which scanf will need to use). In the mean time I'll see if
there's a fix for this specific issue. Have you found the corner case
that triggers it?

Rich

Re: scanf %x bug

[Rich Felker]

[-- Attachment #1: Type: text/plain, Size: 532 bytes --]

On Tue, Mar 13, 2012 at 02:51:18PM +0100, Szabolcs Nagy wrote:
> i found a scanf bug:
> 
> #include <stdio.h>
> int main(){
>     int n, a=7;
>     n = sscanf("0", "%x", &a);
>     printf("%d %d\n", n, a);
>     return 0;
> }
> 
> prints 0 7
> instead of 1 0

Please tell me what you think of this patch. Note that m is the
"match" flag (m!=0 means "the sequence scanned so far is valid").

I wanted to just switch to the new __intparse code, but I feel like
it's appropriate to fix this bug first with a less invasive patch.

Rich

[-- Attachment #2: scanf_fix.diff --]
[-- Type: text/plain, Size: 1051 bytes --]

diff --git a/src/stdio/__scanf.c b/src/stdio/__scanf.c
index 062327d..7c82cca 100644
--- a/src/stdio/__scanf.c
+++ b/src/stdio/__scanf.c
@@ -319,34 +319,29 @@ int __scanf(rctx_t *r, const wchar_t *fmt, va_list ap)
 					unread(r);
 					break;
 				}
+				m = 1;
 				if (((c=read(r))|0x20) != 'x') {
-					if (t == 'i') {
-						t = 'o';
-						/* lone 0 is valid octal */
-						if ((unsigned)(c-'0') >= 8) {
-							m = 1;
-							goto int_finish;
-						}
-					}
+					if (t == 'i') t = 'o';
 					unread(r);
 					break;
 				}
 				t = 'x';
+				m = 0;
 			}
 		}
 		
 		switch (t) {
 		case 'd':
 		case 'u':
-			for (m=0; isdigit(c=read(r)); m=1)
+			for (; isdigit(c=read(r)); m=1)
 				i = 10*i + c-'0';
 			goto int_finish;
 		case 'o':
-			for (m=0; (unsigned)(c=read(r))-'0' < 8; m=1)
+			for (; (unsigned)(c=read(r))-'0' < 8; m=1)
 				i = (i<<3) + c-'0';
 			goto int_finish;
 		case 'x':
-			for (m=0; ; m=1) {
+			for (; ; m=1) {
 				if (isdigit(c=read(r))) {
 					i = (i<<4) + c-'0';
 				} else if ((unsigned)(c|0x20)-'a' < 6) {

Re: scanf %x bug

[Szabolcs Nagy]

* Rich Felker <dalias@aerifal.cx> [2012-03-13 12:24:27 -0400]:
> Please tell me what you think of this patch. Note that m is the
> "match" flag (m!=0 means "the sequence scanned so far is valid").
> 
> I wanted to just switch to the new __intparse code, but I feel like
> it's appropriate to fix this bug first with a less invasive patch.
> 
looks ok