0ct0pu5/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

LibC: Fix %n conversion specifier in scanf() format

Browse source 
Also add a test to prevent this from happening again. There were two
bugs:

* The number of bytes just after processing the last value was written,
  instead of the number of bytes after skipping remaining whitespace.
  Confirmed by testing against GNU's `scanf()` since the man page
  leaves something to be desired.

* The number of bytes was written to the wrong variable argument; i.e.
  the first argument was overwritten.
This commit is contained in:
Jelle Raaijmakers 2021-10-25 00:23:49 +02:00 • committed by Brian Gianforcaro
parent 00f36fc5ae
commit a44978b9b0
Notes: sideshowbarker 2024-07-18 01:54:50 +09:00
2 changed files with 4 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Tests/LibC/TestScanf.cpp
View file

@ -173,6 +173,8 @@ const TestSuite test_suites[] {
// Note: '9223372036854775806' is the max value for 'long long'.
{ "%lld", "9223372036854775805", 1, 1, { longlongarg0 }, { to_value_t(9223372036854775805LL) } },
{ "%llu", "9223372036854775810", 1, 1, { unsignedlonglongarg0 }, { to_value_t(9223372036854775810ULL) } },
{ "%n", "", 0, 1, { intarg0 }, { to_value_t(0) } },
{ "%d %n", "1 a", 1, 2, { intarg0, intarg1 }, { to_value_t(1), to_value_t(2) } },
};
bool g_any_failed = false;

3
Userland/Libraries/LibC/scanf.cpp
View file

@ -611,8 +611,9 @@ extern "C" int vsscanf(const char* input, const char* format, va_list ap)
++elements_matched;
break;
case ConversionSpecifier::OutputNumberOfBytes: {
input_lexer.ignore_while(isspace);
if (!suppress_assignment) {
auto* ptr = va_arg(ap, int*);
auto* ptr = va_arg(copy, int*);
*ptr = input_lexer.tell();
}
break;