1 #include "stdio_impl.h"
2 #include <errno.h>
3 #include <ctype.h>
4 #include <limits.h>
5 #include <string.h>
6 #include <stdarg.h>
7 #include <stddef.h>
8 #include <stdlib.h>
9 #include <wchar.h>
10 #include <inttypes.h>
11
12 /* Convenient bit representation for modifier flags, which all fall
13 * within 31 codepoints of the space character. */
14
15 #define ALT_FORM (1U<<'#'-' ')
16 #define ZERO_PAD (1U<<'0'-' ')
17 #define LEFT_ADJ (1U<<'-'-' ')
18 #define PAD_POS (1U<<' '-' ')
19 #define MARK_POS (1U<<'+'-' ')
20 #define GROUPED (1U<<'\''-' ')
21
22 #define FLAGMASK (ALT_FORM|ZERO_PAD|LEFT_ADJ|PAD_POS|MARK_POS|GROUPED)
23
24 /* State machine to accept length modifiers + conversion specifiers.
25 * Result is 0 on failure, or an argument type to pop on success. */
26
27 enum {
28 BARE, LPRE, LLPRE, HPRE, HHPRE, BIGLPRE,
29 ZTPRE, JPRE,
30 STOP,
31 PTR, INT, UINT, ULLONG,
32 LONG, ULONG,
33 SHORT, USHORT, CHAR, UCHAR,
34 LLONG, SIZET, IMAX, UMAX, PDIFF, UIPTR,
35 DBL, LDBL,
36 NOARG,
37 MAXSTATE
38 };
39
40 #define S(x) [(x)-'A']
41
42 static const unsigned char states[]['z'-'A'+1] = {
43 { /* 0: bare types */
44 S('d') = INT, S('i') = INT,
45 S('o') = UINT, S('u') = UINT, S('x') = UINT, S('X') = UINT,
46 S('e') = DBL, S('f') = DBL, S('g') = DBL, S('a') = DBL,
47 S('E') = DBL, S('F') = DBL, S('G') = DBL, S('A') = DBL,
48 S('c') = INT, S('C') = UINT,
49 S('s') = PTR, S('S') = PTR, S('p') = UIPTR, S('n') = PTR,
50 S('m') = NOARG,
51 S('l') = LPRE, S('h') = HPRE, S('L') = BIGLPRE,
52 S('z') = ZTPRE, S('j') = JPRE, S('t') = ZTPRE,
53 }, { /* 1: l-prefixed */
54 S('d') = LONG, S('i') = LONG,
55 S('o') = ULONG, S('u') = ULONG, S('x') = ULONG, S('X') = ULONG,
56 S('e') = DBL, S('f') = DBL, S('g') = DBL, S('a') = DBL,
57 S('E') = DBL, S('F') = DBL, S('G') = DBL, S('A') = DBL,
58 S('c') = UINT, S('s') = PTR, S('n') = PTR,
59 S('l') = LLPRE,
60 }, { /* 2: ll-prefixed */
61 S('d') = LLONG, S('i') = LLONG,
62 S('o') = ULLONG, S('u') = ULLONG,
63 S('x') = ULLONG, S('X') = ULLONG,
64 S('n') = PTR,
65 }, { /* 3: h-prefixed */
66 S('d') = SHORT, S('i') = SHORT,
67 S('o') = USHORT, S('u') = USHORT,
68 S('x') = USHORT, S('X') = USHORT,
69 S('n') = PTR,
70 S('h') = HHPRE,
71 }, { /* 4: hh-prefixed */
72 S('d') = CHAR, S('i') = CHAR,
73 S('o') = UCHAR, S('u') = UCHAR,
74 S('x') = UCHAR, S('X') = UCHAR,
75 S('n') = PTR,
76 }, { /* 5: L-prefixed */
77 S('e') = LDBL, S('f') = LDBL, S('g') = LDBL, S('a') = LDBL,
78 S('E') = LDBL, S('F') = LDBL, S('G') = LDBL, S('A') = LDBL,
79 S('n') = PTR,
80 }, { /* 6: z- or t-prefixed (assumed to be same size) */
81 S('d') = PDIFF, S('i') = PDIFF,
82 S('o') = SIZET, S('u') = SIZET,
83 S('x') = SIZET, S('X') = SIZET,
84 S('n') = PTR,
85 }, { /* 7: j-prefixed */
86 S('d') = IMAX, S('i') = IMAX,
87 S('o') = UMAX, S('u') = UMAX,
88 S('x') = UMAX, S('X') = UMAX,
89 S('n') = PTR,
90 }
91 };
92
93 #define OOB(x) ((unsigned)(x)-'A' > 'z'-'A')
94
95 union arg
96 {
97 uintmax_t i;
98 long double f;
99 void *p;
100 };
101
pop_arg(union arg * arg,int type,va_list * ap)102 static void pop_arg(union arg *arg, int type, va_list *ap)
103 {
104 switch (type) {
105 case PTR: arg->p = va_arg(*ap, void *);
106 break; case INT: arg->i = va_arg(*ap, int);
107 break; case UINT: arg->i = va_arg(*ap, unsigned int);
108 break; case LONG: arg->i = va_arg(*ap, long);
109 break; case ULONG: arg->i = va_arg(*ap, unsigned long);
110 break; case ULLONG: arg->i = va_arg(*ap, unsigned long long);
111 break; case SHORT: arg->i = (short)va_arg(*ap, int);
112 break; case USHORT: arg->i = (unsigned short)va_arg(*ap, int);
113 break; case CHAR: arg->i = (signed char)va_arg(*ap, int);
114 break; case UCHAR: arg->i = (unsigned char)va_arg(*ap, int);
115 break; case LLONG: arg->i = va_arg(*ap, long long);
116 break; case SIZET: arg->i = va_arg(*ap, size_t);
117 break; case IMAX: arg->i = va_arg(*ap, intmax_t);
118 break; case UMAX: arg->i = va_arg(*ap, uintmax_t);
119 break; case PDIFF: arg->i = va_arg(*ap, ptrdiff_t);
120 break; case UIPTR: arg->i = (uintptr_t)va_arg(*ap, void *);
121 break; case DBL: arg->f = va_arg(*ap, double);
122 break; case LDBL: arg->f = va_arg(*ap, long double);
123 }
124 }
125
out(FILE * f,const wchar_t * s,size_t l)126 static void out(FILE *f, const wchar_t *s, size_t l)
127 {
128 while (l-- && !ferror(f)) fputwc(*s++, f);
129 }
130
pad(FILE * f,int n,int fl)131 static void pad(FILE *f, int n, int fl)
132 {
133 if ((fl & LEFT_ADJ) || !n || ferror(f)) return;
134 fprintf(f, "%*s", n, "");
135 }
136
getint(wchar_t ** s)137 static int getint(wchar_t **s) {
138 int i;
139 for (i=0; iswdigit(**s); (*s)++) {
140 if (i > INT_MAX/10U || **s-'0' > INT_MAX-10*i) i = -1;
141 else i = 10*i + (**s-'0');
142 }
143 return i;
144 }
145
146 static const char sizeprefix['y'-'a'] = {
147 ['a'-'a']='L', ['e'-'a']='L', ['f'-'a']='L', ['g'-'a']='L',
148 ['d'-'a']='j', ['i'-'a']='j', ['o'-'a']='j', ['u'-'a']='j', ['x'-'a']='j',
149 ['p'-'a']='j'
150 };
151
wprintf_core(FILE * f,const wchar_t * fmt,va_list * ap,union arg * nl_arg,int * nl_type)152 static int wprintf_core(FILE *f, const wchar_t *fmt, va_list *ap, union arg *nl_arg, int *nl_type)
153 {
154 wchar_t *a, *z, *s=(wchar_t *)fmt;
155 unsigned l10n=0, fl;
156 int w, p, xp;
157 union arg arg;
158 int argpos;
159 unsigned st, ps;
160 int cnt=0, l=0;
161 int i;
162 int t;
163 char *bs;
164 char charfmt[16];
165 wchar_t wc;
166
167 for (;;) {
168 /* This error is only specified for snprintf, but since it's
169 * unspecified for other forms, do the same. Stop immediately
170 * on overflow; otherwise %n could produce wrong results. */
171 if (l > INT_MAX - cnt) goto overflow;
172
173 /* Update output count, end loop when fmt is exhausted */
174 cnt += l;
175 if (!*s) break;
176
177 /* Handle literal text and %% format specifiers */
178 for (a=s; *s && *s!='%'; s++);
179 for (z=s; s[0]=='%' && s[1]=='%'; z++, s+=2);
180 if (z-a > INT_MAX-cnt) goto overflow;
181 l = z-a;
182 if (f) out(f, a, l);
183 if (l) continue;
184
185 if (iswdigit(s[1]) && s[2]=='$') {
186 l10n=1;
187 argpos = s[1]-'0';
188 s+=3;
189 } else {
190 argpos = -1;
191 s++;
192 }
193
194 /* Read modifier flags */
195 for (fl=0; (unsigned)*s-' '<32 && (FLAGMASK&(1U<<*s-' ')); s++)
196 fl |= 1U<<*s-' ';
197
198 /* Read field width */
199 if (*s=='*') {
200 if (iswdigit(s[1]) && s[2]=='$') {
201 l10n=1;
202 nl_type[s[1]-'0'] = INT;
203 w = nl_arg[s[1]-'0'].i;
204 s+=3;
205 } else if (!l10n) {
206 w = f ? va_arg(*ap, int) : 0;
207 s++;
208 } else goto inval;
209 if (w<0) fl|=LEFT_ADJ, w=-w;
210 } else if ((w=getint(&s))<0) goto overflow;
211
212 /* Read precision */
213 if (*s=='.' && s[1]=='*') {
214 if (isdigit(s[2]) && s[3]=='$') {
215 nl_type[s[2]-'0'] = INT;
216 p = nl_arg[s[2]-'0'].i;
217 s+=4;
218 } else if (!l10n) {
219 p = f ? va_arg(*ap, int) : 0;
220 s+=2;
221 } else goto inval;
222 xp = (p>=0);
223 } else if (*s=='.') {
224 s++;
225 p = getint(&s);
226 xp = 1;
227 } else {
228 p = -1;
229 xp = 0;
230 }
231
232 /* Format specifier state machine */
233 st=0;
234 do {
235 if (OOB(*s)) goto inval;
236 ps=st;
237 st=states[st]S(*s++);
238 } while (st-1<STOP);
239 if (!st) goto inval;
240
241 /* Check validity of argument type (nl/normal) */
242 if (st==NOARG) {
243 if (argpos>=0) goto inval;
244 } else {
245 if (argpos>=0) nl_type[argpos]=st, arg=nl_arg[argpos];
246 else if (f) pop_arg(&arg, st, ap);
247 else return 0;
248 }
249
250 if (!f) continue;
251
252 /* Do not process any new directives once in error state. */
253 if (ferror(f)) return -1;
254
255 t = s[-1];
256 if (ps && (t&15)==3) t&=~32;
257
258 switch (t) {
259 case 'n':
260 switch(ps) {
261 case BARE: *(int *)arg.p = cnt; break;
262 case LPRE: *(long *)arg.p = cnt; break;
263 case LLPRE: *(long long *)arg.p = cnt; break;
264 case HPRE: *(unsigned short *)arg.p = cnt; break;
265 case HHPRE: *(unsigned char *)arg.p = cnt; break;
266 case ZTPRE: *(size_t *)arg.p = cnt; break;
267 case JPRE: *(uintmax_t *)arg.p = cnt; break;
268 }
269 continue;
270 case 'c':
271 case 'C':
272 if (w<1) w=1;
273 pad(f, w-1, fl);
274 out(f, &(wchar_t){t=='C' ? arg.i : btowc(arg.i)}, 1);
275 pad(f, w-1, fl^LEFT_ADJ);
276 l = w;
277 continue;
278 case 'S':
279 a = arg.p;
280 z = a + wcsnlen(a, p<0 ? INT_MAX : p);
281 if (p<0 && *z) goto overflow;
282 p = z-a;
283 if (w<p) w=p;
284 pad(f, w-p, fl);
285 out(f, a, p);
286 pad(f, w-p, fl^LEFT_ADJ);
287 l=w;
288 continue;
289 case 'm':
290 arg.p = strerror(errno);
291 case 's':
292 if (!arg.p) arg.p = "(null)";
293 bs = arg.p;
294 for (i=l=0; l<(p<0?INT_MAX:p) && (i=mbtowc(&wc, bs, MB_LEN_MAX))>0; bs+=i, l++);
295 if (i<0) return -1;
296 if (p<0 && *bs) goto overflow;
297 p=l;
298 if (w<p) w=p;
299 pad(f, w-p, fl);
300 bs = arg.p;
301 while (l--) {
302 i=mbtowc(&wc, bs, MB_LEN_MAX);
303 bs+=i;
304 out(f, &wc, 1);
305 }
306 pad(f, w-p, fl^LEFT_ADJ);
307 l=w;
308 continue;
309 }
310
311 if (xp && p<0) goto overflow;
312 snprintf(charfmt, sizeof charfmt, "%%%s%s%s%s%s*.*%c%c",
313 "#"+!(fl & ALT_FORM),
314 "+"+!(fl & MARK_POS),
315 "-"+!(fl & LEFT_ADJ),
316 " "+!(fl & PAD_POS),
317 "0"+!(fl & ZERO_PAD),
318 sizeprefix[(t|32)-'a'], t);
319
320 switch (t|32) {
321 case 'a': case 'e': case 'f': case 'g':
322 l = fprintf(f, charfmt, w, p, arg.f);
323 break;
324 case 'd': case 'i': case 'o': case 'u': case 'x': case 'p':
325 l = fprintf(f, charfmt, w, p, arg.i);
326 break;
327 }
328 }
329
330 if (f) return cnt;
331 if (!l10n) return 0;
332
333 for (i=1; i<=NL_ARGMAX && nl_type[i]; i++)
334 pop_arg(nl_arg+i, nl_type[i], ap);
335 for (; i<=NL_ARGMAX && !nl_type[i]; i++);
336 if (i<=NL_ARGMAX) return -1;
337 return 1;
338
339 inval:
340 errno = EINVAL;
341 return -1;
342 overflow:
343 errno = EOVERFLOW;
344 return -1;
345 }
346
vfwprintf(FILE * restrict f,const wchar_t * restrict fmt,va_list ap)347 int vfwprintf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
348 {
349 va_list ap2;
350 int nl_type[NL_ARGMAX+1] = {0};
351 union arg nl_arg[NL_ARGMAX+1];
352 int olderr;
353 int ret;
354
355 /* the copy allows passing va_list* even if va_list is an array */
356 va_copy(ap2, ap);
357 if (wprintf_core(0, fmt, &ap2, nl_arg, nl_type) < 0) {
358 va_end(ap2);
359 return -1;
360 }
361
362 FLOCK(f);
363 fwide(f, 1);
364 olderr = f->flags & F_ERR;
365 f->flags &= ~F_ERR;
366 ret = wprintf_core(f, fmt, &ap2, nl_arg, nl_type);
367 if (ferror(f)) ret = -1;
368 f->flags |= olderr;
369 FUNLOCK(f);
370 va_end(ap2);
371 return ret;
372 }
373