From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 22281 invoked by alias); 12 Apr 2011 13:21:34 -0000 Received: (qmail 22269 invoked by uid 22791); 12 Apr 2011 13:21:33 -0000 X-SWARE-Spam-Status: No, hits=-2.8 required=5.0 tests=ALL_TRUSTED,AWL,BAYES_00 X-Spam-Check-By: sourceware.org Received: from localhost (HELO sourceware.org) (127.0.0.1) by sourceware.org (qpsmtpd/0.43rc1) with ESMTP; Tue, 12 Apr 2011 13:21:29 +0000 From: "alexander.enchevich at yahoo dot com" To: glibc-bugs@sources.redhat.com Subject: [Bug libc/12667] New: fscanf silently converts signed to unsigned X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: glibc X-Bugzilla-Component: libc X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: alexander.enchevich at yahoo dot com X-Bugzilla-Status: NEW X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: drepper.fsp at gmail dot com X-Bugzilla-Target-Milestone: --- X-Bugzilla-Changed-Fields: Message-ID: X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Date: Tue, 12 Apr 2011 13:21:00 -0000 Mailing-List: contact glibc-bugs-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Post: List-Help: , Sender: glibc-bugs-owner@sourceware.org X-SW-Source: 2011-04/txt/msg00043.txt.bz2 http://sourceware.org/bugzilla/show_bug.cgi?id=3D12667 Summary: fscanf silently converts signed to unsigned Product: glibc Version: 2.8 Status: NEW Severity: normal Priority: P2 Component: libc AssignedTo: drepper.fsp@gmail.com ReportedBy: alexander.enchevich@yahoo.com The man page for the scanf functions says: RETURN VALUE These functions return the number of input items successfully matc= hed and assigned, which can be fewer than provided for, or even zero in = the event of an early matching failure. However, the fscanf function (I presume the other scanf funcs will behave t= he same), when given a one-line file as input, which looks like: -666666 will not detect that this is a signed number (see attached file test_fscanf= .c, around lines 84-96). So a call to fscanf that looks like this: unsigned int nInt =3D 0; ret =3D fscanf( fptr, " %u", &nInt ); will put will 4294300630 into nInt and will return 1, indicating that 1 fie= ld was successfully scanned and assigned. This is incorrect, because the number -666666 does not qualify as an "unsigned int". The above call should return EOF, indicating that the request to scan one *unsigned integer* was NOT successful, i.e. a "matching failure" occured; and nInt should not be modif= ied.=20 The matching failure is also defined in the man page as: ... matching failure, meaning that the input was inappropriate (see bel= ow). ... If the next item of input does not match the conversion specification, the conversion fails =E2=80=94 this is a matching failure. This is exactly the case - the next item (the signed int -666666) not match= ing the conversion specification (%u) and yet the call does not return EOF, as = the man page says it should on matching failure and does not even return 0 to indicate it was unable to successfully scan any fields. It simply reads the number as a *signed int* and then stores the result into the provided *unsi= gned int* which explains the value 4294300630 in the example. Interestingly, at the same time errno is set to 34 (Numerical result outsid= e of range) so some code inside the lib does have some idea that something went wrong. This is yet another proof that this is a bug - you can't have errno = set if everything is had supposedly worked fine. Also, attempting to scan a number bigger than MAXINT (signed and unsigned), e.g. 6666666666 silently returns 0xFFFFFFFF as the scanned integer, which is also a bug. (I can file a separate report for it if it is preferable?) --=20 Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=3Demail ------- You are receiving this mail because: ------- You are on the CC list for the bug.