public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
From: "bugdal at aerifal dot cx" <sourceware-bugzilla@sourceware.org> To: glibc-bugs@sources.redhat.com Subject: [Bug stdio/13988] New: scanf %f reads too many characters on non-matching "+.e" input Date: Wed, 18 Apr 2012 05:42:00 -0000 [thread overview] Message-ID: <bug-13988-131@http.sourceware.org/bugzilla/> (raw) http://sourceware.org/bugzilla/show_bug.cgi?id=13988 Bug #: 13988 Summary: scanf %f reads too many characters on non-matching "+.e" input Product: glibc Version: unspecified Status: NEW Severity: normal Priority: P2 Component: stdio AssignedTo: unassigned@sourceware.org ReportedBy: bugdal@aerifal.cx Classification: Unclassified I found this bug while investigating bug #12701 (my test cases attached there will reproduce it), but it seems to be a separate issue. Bug #12701 involves scanf wrongly accepting non-matching inputs. Given the input "+.e", scanf (using %f) will correctly reject it as non-matching, but will leave the file position at an incorrect offset of 3 rather than 2. In other words, it's recognizing that a degenerate floating point value with no mantissa digits is invalid, but only after trying to parse all the way to the end of the exponent. This is incorrect per ISO C, which defines the input item as "the longest sequence of input characters which does not exceed any specified field width and which is, or is a prefix of, a matching input sequence". The correct behavior would be to, upon encountering the "e" which is invalid after a degenerate mantissa, end the scan and leave the "e" unread in the stream. Also, I just realized this error can be enlarged seemingly arbitrarily by appending a pseudo-exponent. For example, given "+.e" followed by N zeros, scanf will offset the file position by N+3 instead of by 2, an error of N+1, and thereby thoroughly consume an integer which could otherwise be read by the next call to scanf. -- Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
next reply other threads:[~2012-04-18 5:42 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top 2012-04-18 5:42 bugdal at aerifal dot cx [this message] 2013-04-11 8:39 ` [Bug stdio/13988] " schwab@linux-m68k.org 2014-06-25 11:15 ` fweimer at redhat dot com
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-13988-131@http.sourceware.org/bugzilla/ \ --to=sourceware-bugzilla@sourceware.org \ --cc=glibc-bugs@sources.redhat.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).