[PATCH] Don't accept exp char without digits in scanf float parsing

[Andreas Schwab <schwab at suse dot de>]

A floating point number must have at least one digit before the exponent
character, so scanf should not parse beyond the exponent character when
no digits were seen yet.

Andreas.

	[BZ #13988]
	* stdio-common/vfscanf.c (_IO_vfwscanf): When parsing a float
	accept exponent character only when digits were seen.
	* stdio-common/Makefile (tests): Add bug26.
	* stdio-common/bug26.c: New file.
	* stdio-common/bug26.input: New file.

diff --git a/stdio-common/Makefile b/stdio-common/Makefile
index f64a8ba..658804b 100644
--- a/stdio-common/Makefile
+++ b/stdio-common/Makefile
@@ -57,7 +57,7 @@ tests := tstscanf test_rdwr test-popen tstgetln test-fseek \
 	 bug19 bug19a tst-popen2 scanf13 scanf14 scanf15 bug20 bug21 bug22 \
 	 scanf16 scanf17 tst-setvbuf1 tst-grouping bug23 bug24 \
 	 bug-vfprintf-nargs tst-long-dbl-fphex tst-fphex-wide tst-sprintf3 \
-	 bug25 tst-printf-round
+	 bug25 tst-printf-round bug26
 
 test-srcs = tst-unbputc tst-printf
 
diff --git a/stdio-common/bug26.c b/stdio-common/bug26.c
new file mode 100644
index 0000000..6365a33
--- /dev/null
+++ b/stdio-common/bug26.c
@@ -0,0 +1,32 @@
+/* Copyright (C) 2013 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <stdio.h>
+
+int
+main (void)
+{
+  char c;
+  int lost = 0;
+
+  lost |= (scanf ("%*f") != 0);
+  lost |= (scanf ("%c", &c) == 0);
+  if (!lost)
+    lost |= c != 'e';
+  puts (lost ? "Test FAILED!" : "Test succeeded.");
+  return lost;
+}
diff --git a/stdio-common/bug26.input b/stdio-common/bug26.input
new file mode 100644
index 0000000..edddda3
--- /dev/null
+++ b/stdio-common/bug26.input
@@ -0,0 +1 @@
++.e
diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
index 9b5c4a9..82f7eee 100644
--- a/stdio-common/vfscanf.c
+++ b/stdio-common/vfscanf.c
@@ -222,7 +222,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
   /* Errno of last failed inchar call.  */
   int inchar_errno = 0;
   /* Status for reading F-P nums.  */
-  char got_dot, got_e, negative;
+  char got_digit, got_dot, got_e, negative;
   /* If a [...] is a [^...].  */
   CHAR_T not_in;
 #define exp_char not_in
@@ -1845,7 +1845,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 	  if (__builtin_expect (c == EOF, 0))
 	    input_error ();
 
-	  got_dot = got_e = 0;
+	  got_digit = got_dot = got_e = 0;
 
 	  /* Check for a sign.  */
 	  if (c == L_('-') || c == L_('+'))
@@ -1971,13 +1971,19 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 	  while (1)
 	    {
 	      if (ISDIGIT (c))
-		ADDW (c);
+		{
+		  ADDW (c);
+		  got_digit = 1;
+		}
 	      else if (!got_e && (flags & HEXA_FLOAT) && ISXDIGIT (c))
-		ADDW (c);
+		{
+		  ADDW (c);
+		  got_digit = 1;
+		}
 	      else if (got_e && wp[wpsize - 1] == exp_char
 		       && (c == L_('-') || c == L_('+')))
 		ADDW (c);
-	      else if (wpsize > 0 && !got_e
+	      else if (got_digit && !got_e
 		       && (CHAR_T) TOLOWER (c) == exp_char)
 		{
 		  ADDW (exp_char);
-- 
1.8.2.1

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."