[RFC] scanf: add non-allocating bounded string input via %!s / %![...] / %!c (size before pointer)

[Cristian Rodríguez]

On Fri, Oct 17, 2025 at 10:22 AM Yair Lenga <yair.lenga@gmail.com> wrote:
>
> Hello glibc maintainers,
>
> I’d like to propose a small, backward-compatible GNU extension to the scanf
> family that provides a non-allocating, bounds-aware alternative to %s/%[ and
>  complements the existing %m (mallocing) extension.
>
> Problem
> -------
> The %s and %[ conversions read unbounded input unless a numeric width is
> manually supplied. In practice, many call sites omit it; this leads to
> overflows that Fortify can only catch when the buffer size is visible to
> the compiler. There is no portable, non-allocating way to make these reads
> explicitly bounded. GNU %m exists, but it always allocates; Annex K scanf_s
> requires a size argument but is not implemented in glibc.

I agree with the problem you describe and at least about the need for this.
However I think you should dump the idea of adding backward compatible
gnu extensions to scanf and add a
*new* interface with sane behaviour instead, which existence can be
easily tested by applications' build systems.