[PATCH 01/15] stdio-common: Don't read real input beyond the field width in scanf [BZ #13988]

[Joseph Myers]

On Mon, 28 Apr 2025, Maciej W. Rozycki wrote:

> > Footnote 349 in C23 is on 7.24.5.7 The quick_exit function: "Each function 
> > is called as many times as it was registered, and in the correct order 
> > with respect to other registered functions.".  I don't see its relevance 
> > here.
> 
>  Hmm, my copy (dated April 1, 2023; not a joke presumably) has:
> 
> "349) No special provisions are made for multibyte characters in the 
> matching rules used by the c, s, and [ conversion specifiers -- the extent 
> of the input field is determined on a byte-by-byte basis.  The resulting 
> field is nevertheless a sequence of multibyte characters that begins in 
> the initial shift state."
> 
> within § 7.23.6.2 "The fscanf function" on p. 339.  I guess there are too 
> many versions around referred to as C23.

C23 was published in October 2024, so you have an early draft missing a 
year and a half of changes.  This is actually footnote 331.  And that 
footnote doesn't seem to have much to do with the determination of field 
width (which as far as I can tell, is still a count of input bytes, for 
the narrow functions such as fscanf, even when the result is converted and 
stored in an array of wchar_t).

-- 
Joseph S. Myers
josmyers@redhat.com