[PATCH v3 09/10] stdio-common: Reject significand prefixes in scanf [BZ #12701]

[Joseph Myers]

On Tue, 25 Mar 2025, Maciej W. Rozycki wrote:

> From: Maciej W. Rozycki <macro@redhat.com>
> 
> Reject invalid formatted scanf real input data that is comprised of a 
> hexadecimal prefix, optionally preceded by a sign, and with no actual 
> digits following owing to the field width restriction in effect.  Such 
> data is a prefix of, but not a matching input sequence and it is 
> required by ISO C to cause a matching failure.
> 
> Currently a matching success is instead incorrectly produced along with
> the conversion result of zero, with the prefix wholly consumed from
> input.  Where the end of input is marked by the end-of-file condition 
> rather than the field width restriction in effect a matching failure is 
> already correctly produced.
> 
> Enable input data that causes test failures without this fix in place.

This patch is OK, but I don't think it (plus patch 10) completely fixes 
all hex float cases of bug 12701; I think another followup patch will be 
needed to complete the fix.  Specifically, "0x." or "0X.", optionally 
preceded by a sign, is another case that's a prefix of a matching sequence 
but not a valid matching sequence itself (and I don't see any inputs 
starting with "0x." or "0X." in the recently added tests).

Reviewed-by: Joseph Myers <josmyers@redhat.com>

-- 
Joseph S. Myers
josmyers@redhat.com