Bug 18246 - scanf "%2d" can incorrectly parse "0x" same for "%2f" with "1e"
Summary: scanf "%2d" can incorrectly parse "0x" same for "%2f" with "1e"
Status: NEW
Alias: None
Product: glibc
Classification: Unclassified
Component: stdio (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-10 12:45 UTC by Szabolcs Nagy
Modified: 2015-04-27 21:26 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Szabolcs Nagy 2015-04-10 12:45:01 UTC
BZ #1765 was closed with won't fix, 0x is another similar corner case.

0x prefix should not be parsed as a valid decimal number.

following code prints:
got 1 fields (x=0), expected 0
got 1 fields (y=1), expected 0


#include <stdio.h>
int main()
{
int x;
float y;
int r;

r = sscanf("0x12", "%2d", &x);
if (r != 0)
        printf("got %d fields (x=%d), expected 0\n", r, x);

r = sscanf("1e12", "%2f", &y);
if (r != 0)
        printf("got %d fields (y=%g), expected 0\n", r, y);
}
Comment 1 Florian Weimer 2015-04-20 07:53:01 UTC
Is "0x" really the prefix of a valid input for the %d conversion specifier?  I don't thin kso.
Comment 2 Szabolcs Nagy 2015-04-20 10:18:50 UTC
sorry the bug report was wrong: it should say %2i not %2d

the behaviour of %d is correct, but the result with %i is the same and that's a conformance bug, because then 0x is a valid prefix.

the testcase should be:

#include <stdio.h>
int main()
{
int x;
int r;
r = sscanf("0x12", "%2i", &x);
if (r != 0)
        printf("got %d fields (x=%d), expected 0\n", r, x);
}
Comment 3 will bradshaw 2015-04-27 21:26:39 UTC
what is the appropriate result for:

#include <stdio.h>
int main()
{
int x,z;
int r;
char c;

r = sscanf("0x12", "%2i%c%d", &x,&c,&z);
        printf("got %d fields (x=%d,c=%c,z=%d)\n", r,x,c,z);
}

i get:

got 3 fields (x=0,c=1,z=2)

I believe I should get:

got 3 fields (x=0,c=x,z=12)

but I think the answer may also be to get 0 fields. I'm really not sure. I need input from someone intimately familiar with scanf semantics.

Additionally it does not appear that float parsing follows width specifiers for parsing of NaN inf or infinity. If someone has a careful definition of scanf semantics that would also be appreciated.