1#include "stdio_impl.h" 2#include <errno.h> 3#include <ctype.h> 4#include <limits.h> 5#include <string.h> 6#include <stdarg.h> 7#include <stddef.h> 8#include <stdlib.h> 9#include <wchar.h> 10#include <inttypes.h> 11 12/* Convenient bit representation for modifier flags, which all fall 13 * within 31 codepoints of the space character. */ 14 15#define ALT_FORM (1U<<'#'-' ') 16#define ZERO_PAD (1U<<'0'-' ') 17#define LEFT_ADJ (1U<<'-'-' ') 18#define PAD_POS (1U<<' '-' ') 19#define MARK_POS (1U<<'+'-' ') 20#define GROUPED (1U<<'\''-' ') 21 22#define FLAGMASK (ALT_FORM|ZERO_PAD|LEFT_ADJ|PAD_POS|MARK_POS|GROUPED) 23 24/* State machine to accept length modifiers + conversion specifiers. 25 * Result is 0 on failure, or an argument type to pop on success. */ 26 27enum { 28 BARE, LPRE, LLPRE, HPRE, HHPRE, BIGLPRE, 29 ZTPRE, JPRE, 30 STOP, 31 PTR, INT, UINT, ULLONG, 32 LONG, ULONG, 33 SHORT, USHORT, CHAR, UCHAR, 34 LLONG, SIZET, IMAX, UMAX, PDIFF, UIPTR, 35 DBL, LDBL, 36 NOARG, 37 MAXSTATE 38}; 39 40#define S(x) [(x)-'A'] 41 42static const unsigned char states[]['z'-'A'+1] = { 43 { /* 0: bare types */ 44 S('d') = INT, S('i') = INT, 45 S('o') = UINT, S('u') = UINT, S('x') = UINT, S('X') = UINT, 46 S('e') = DBL, S('f') = DBL, S('g') = DBL, S('a') = DBL, 47 S('E') = DBL, S('F') = DBL, S('G') = DBL, S('A') = DBL, 48 S('c') = INT, S('C') = UINT, 49 S('s') = PTR, S('S') = PTR, S('p') = UIPTR, S('n') = PTR, 50 S('m') = NOARG, 51 S('l') = LPRE, S('h') = HPRE, S('L') = BIGLPRE, 52 S('z') = ZTPRE, S('j') = JPRE, S('t') = ZTPRE, 53 }, { /* 1: l-prefixed */ 54 S('d') = LONG, S('i') = LONG, 55 S('o') = ULONG, S('u') = ULONG, S('x') = ULONG, S('X') = ULONG, 56 S('e') = DBL, S('f') = DBL, S('g') = DBL, S('a') = DBL, 57 S('E') = DBL, S('F') = DBL, S('G') = DBL, S('A') = DBL, 58 S('c') = UINT, S('s') = PTR, S('n') = PTR, 59 S('l') = LLPRE, 60 }, { /* 2: ll-prefixed */ 61 S('d') = LLONG, S('i') = LLONG, 62 S('o') = ULLONG, S('u') = ULLONG, 63 S('x') = ULLONG, S('X') = ULLONG, 64 S('n') = PTR, 65 }, { /* 3: h-prefixed */ 66 S('d') = SHORT, S('i') = SHORT, 67 S('o') = USHORT, S('u') = USHORT, 68 S('x') = USHORT, S('X') = USHORT, 69 S('n') = PTR, 70 S('h') = HHPRE, 71 }, { /* 4: hh-prefixed */ 72 S('d') = CHAR, S('i') = CHAR, 73 S('o') = UCHAR, S('u') = UCHAR, 74 S('x') = UCHAR, S('X') = UCHAR, 75 S('n') = PTR, 76 }, { /* 5: L-prefixed */ 77 S('e') = LDBL, S('f') = LDBL, S('g') = LDBL, S('a') = LDBL, 78 S('E') = LDBL, S('F') = LDBL, S('G') = LDBL, S('A') = LDBL, 79 S('n') = PTR, 80 }, { /* 6: z- or t-prefixed (assumed to be same size) */ 81 S('d') = PDIFF, S('i') = PDIFF, 82 S('o') = SIZET, S('u') = SIZET, 83 S('x') = SIZET, S('X') = SIZET, 84 S('n') = PTR, 85 }, { /* 7: j-prefixed */ 86 S('d') = IMAX, S('i') = IMAX, 87 S('o') = UMAX, S('u') = UMAX, 88 S('x') = UMAX, S('X') = UMAX, 89 S('n') = PTR, 90 } 91}; 92 93#define OOB(x) ((unsigned)(x)-'A' > 'z'-'A') 94 95union arg 96{ 97 uintmax_t i; 98 long double f; 99 void *p; 100}; 101 102static void pop_arg(union arg *arg, int type, va_list *ap) 103{ 104 switch (type) { 105 case PTR: arg->p = va_arg(*ap, void *); 106 break; case INT: arg->i = va_arg(*ap, int); 107 break; case UINT: arg->i = va_arg(*ap, unsigned int); 108 break; case LONG: arg->i = va_arg(*ap, long); 109 break; case ULONG: arg->i = va_arg(*ap, unsigned long); 110 break; case ULLONG: arg->i = va_arg(*ap, unsigned long long); 111 break; case SHORT: arg->i = (short)va_arg(*ap, int); 112 break; case USHORT: arg->i = (unsigned short)va_arg(*ap, int); 113 break; case CHAR: arg->i = (signed char)va_arg(*ap, int); 114 break; case UCHAR: arg->i = (unsigned char)va_arg(*ap, int); 115 break; case LLONG: arg->i = va_arg(*ap, long long); 116 break; case SIZET: arg->i = va_arg(*ap, size_t); 117 break; case IMAX: arg->i = va_arg(*ap, intmax_t); 118 break; case UMAX: arg->i = va_arg(*ap, uintmax_t); 119 break; case PDIFF: arg->i = va_arg(*ap, ptrdiff_t); 120 break; case UIPTR: arg->i = (uintptr_t)va_arg(*ap, void *); 121 break; case DBL: arg->f = va_arg(*ap, double); 122 break; case LDBL: arg->f = va_arg(*ap, long double); 123 } 124} 125 126static void out(FILE *f, const wchar_t *s, size_t l) 127{ 128 while (l-- && !ferror(f)) fputwc(*s++, f); 129} 130 131static void pad(FILE *f, int n, int fl) 132{ 133 if ((fl & LEFT_ADJ) || !n || ferror(f)) return; 134 fprintf(f, "%*s", n, ""); 135} 136 137static int getint(wchar_t **s) { 138 int i; 139 for (i=0; iswdigit(**s); (*s)++) { 140 if (i > INT_MAX/10U || **s-'0' > INT_MAX-10*i) i = -1; 141 else i = 10*i + (**s-'0'); 142 } 143 return i; 144} 145 146static const char sizeprefix['y'-'a'] = { 147['a'-'a']='L', ['e'-'a']='L', ['f'-'a']='L', ['g'-'a']='L', 148['d'-'a']='j', ['i'-'a']='j', ['o'-'a']='j', ['u'-'a']='j', ['x'-'a']='j', 149['p'-'a']='j' 150}; 151 152static int wprintf_core(FILE *f, const wchar_t *fmt, va_list *ap, union arg *nl_arg, int *nl_type) 153{ 154 wchar_t *a, *z, *s=(wchar_t *)fmt; 155 unsigned l10n=0, fl; 156 int w, p, xp; 157 union arg arg; 158 int argpos; 159 unsigned st, ps; 160 int cnt=0, l=0; 161 int i; 162 int t; 163 char *bs; 164 char charfmt[16]; 165 wchar_t wc; 166 167 for (;;) { 168 /* This error is only specified for snprintf, but since it's 169 * unspecified for other forms, do the same. Stop immediately 170 * on overflow; otherwise %n could produce wrong results. */ 171 if (l > INT_MAX - cnt) goto overflow; 172 173 /* Update output count, end loop when fmt is exhausted */ 174 cnt += l; 175 if (!*s) break; 176 177 /* Handle literal text and %% format specifiers */ 178 for (a=s; *s && *s!='%'; s++); 179 for (z=s; s[0]=='%' && s[1]=='%'; z++, s+=2); 180 if (z-a > INT_MAX-cnt) goto overflow; 181 l = z-a; 182 if (f) out(f, a, l); 183 if (l) continue; 184 185 if (iswdigit(s[1]) && s[2]=='$') { 186 l10n=1; 187 argpos = s[1]-'0'; 188 s+=3; 189 } else { 190 argpos = -1; 191 s++; 192 } 193 194 /* Read modifier flags */ 195 for (fl=0; (unsigned)*s-' '<32 && (FLAGMASK&(1U<<*s-' ')); s++) 196 fl |= 1U<<*s-' '; 197 198 /* Read field width */ 199 if (*s=='*') { 200 if (iswdigit(s[1]) && s[2]=='$') { 201 l10n=1; 202 nl_type[s[1]-'0'] = INT; 203 w = nl_arg[s[1]-'0'].i; 204 s+=3; 205 } else if (!l10n) { 206 w = f ? va_arg(*ap, int) : 0; 207 s++; 208 } else goto inval; 209 if (w<0) fl|=LEFT_ADJ, w=-w; 210 } else if ((w=getint(&s))<0) goto overflow; 211 212 /* Read precision */ 213 if (*s=='.' && s[1]=='*') { 214 if (isdigit(s[2]) && s[3]=='$') { 215 nl_type[s[2]-'0'] = INT; 216 p = nl_arg[s[2]-'0'].i; 217 s+=4; 218 } else if (!l10n) { 219 p = f ? va_arg(*ap, int) : 0; 220 s+=2; 221 } else goto inval; 222 xp = (p>=0); 223 } else if (*s=='.') { 224 s++; 225 p = getint(&s); 226 xp = 1; 227 } else { 228 p = -1; 229 xp = 0; 230 } 231 232 /* Format specifier state machine */ 233 st=0; 234 do { 235 if (OOB(*s)) goto inval; 236 ps=st; 237 st=states[st]S(*s++); 238 } while (st-1<STOP); 239 if (!st) goto inval; 240 241 /* Check validity of argument type (nl/normal) */ 242 if (st==NOARG) { 243 if (argpos>=0) goto inval; 244 } else { 245 if (argpos>=0) nl_type[argpos]=st, arg=nl_arg[argpos]; 246 else if (f) pop_arg(&arg, st, ap); 247 else return 0; 248 } 249 250 if (!f) continue; 251 252 /* Do not process any new directives once in error state. */ 253 if (ferror(f)) return -1; 254 255 t = s[-1]; 256 if (ps && (t&15)==3) t&=~32; 257 258 switch (t) { 259 case 'n': 260 switch(ps) { 261 case BARE: *(int *)arg.p = cnt; break; 262 case LPRE: *(long *)arg.p = cnt; break; 263 case LLPRE: *(long long *)arg.p = cnt; break; 264 case HPRE: *(unsigned short *)arg.p = cnt; break; 265 case HHPRE: *(unsigned char *)arg.p = cnt; break; 266 case ZTPRE: *(size_t *)arg.p = cnt; break; 267 case JPRE: *(uintmax_t *)arg.p = cnt; break; 268 } 269 continue; 270 case 'c': 271 case 'C': 272 if (w<1) w=1; 273 pad(f, w-1, fl); 274 out(f, &(wchar_t){t=='C' ? arg.i : btowc(arg.i)}, 1); 275 pad(f, w-1, fl^LEFT_ADJ); 276 l = w; 277 continue; 278 case 'S': 279 a = arg.p; 280 z = a + wcsnlen(a, p<0 ? INT_MAX : p); 281 if (p<0 && *z) goto overflow; 282 p = z-a; 283 if (w<p) w=p; 284 pad(f, w-p, fl); 285 out(f, a, p); 286 pad(f, w-p, fl^LEFT_ADJ); 287 l=w; 288 continue; 289 case 'm': 290 arg.p = strerror(errno); 291 case 's': 292 if (!arg.p) arg.p = "(null)"; 293 bs = arg.p; 294 for (i=l=0; l<(p<0?INT_MAX:p) && (i=mbtowc(&wc, bs, MB_LEN_MAX))>0; bs+=i, l++); 295 if (i<0) return -1; 296 if (p<0 && *bs) goto overflow; 297 p=l; 298 if (w<p) w=p; 299 pad(f, w-p, fl); 300 bs = arg.p; 301 while (l--) { 302 i=mbtowc(&wc, bs, MB_LEN_MAX); 303 bs+=i; 304 out(f, &wc, 1); 305 } 306 pad(f, w-p, fl^LEFT_ADJ); 307 l=w; 308 continue; 309 } 310 311 if (xp && p<0) goto overflow; 312 snprintf(charfmt, sizeof charfmt, "%%%s%s%s%s%s*.*%c%c", 313 "#"+!(fl & ALT_FORM), 314 "+"+!(fl & MARK_POS), 315 "-"+!(fl & LEFT_ADJ), 316 " "+!(fl & PAD_POS), 317 "0"+!(fl & ZERO_PAD), 318 sizeprefix[(t|32)-'a'], t); 319 320 switch (t|32) { 321 case 'a': case 'e': case 'f': case 'g': 322 l = fprintf(f, charfmt, w, p, arg.f); 323 break; 324 case 'd': case 'i': case 'o': case 'u': case 'x': case 'p': 325 l = fprintf(f, charfmt, w, p, arg.i); 326 break; 327 } 328 } 329 330 if (f) return cnt; 331 if (!l10n) return 0; 332 333 for (i=1; i<=NL_ARGMAX && nl_type[i]; i++) 334 pop_arg(nl_arg+i, nl_type[i], ap); 335 for (; i<=NL_ARGMAX && !nl_type[i]; i++); 336 if (i<=NL_ARGMAX) return -1; 337 return 1; 338 339inval: 340 errno = EINVAL; 341 return -1; 342overflow: 343 errno = EOVERFLOW; 344 return -1; 345} 346 347int vfwprintf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap) 348{ 349 va_list ap2; 350 int nl_type[NL_ARGMAX+1] = {0}; 351 union arg nl_arg[NL_ARGMAX+1]; 352 int olderr; 353 int ret; 354 355 /* the copy allows passing va_list* even if va_list is an array */ 356 va_copy(ap2, ap); 357 if (wprintf_core(0, fmt, &ap2, nl_arg, nl_type) < 0) { 358 va_end(ap2); 359 return -1; 360 } 361 362 FLOCK(f); 363 fwide(f, 1); 364 olderr = f->flags & F_ERR; 365 f->flags &= ~F_ERR; 366 ret = wprintf_core(f, fmt, &ap2, nl_arg, nl_type); 367 if (ferror(f)) ret = -1; 368 f->flags |= olderr; 369 FUNLOCK(f); 370 va_end(ap2); 371 return ret; 372} 373