stdio-common/vfprintf.c

   1 /* Copyright (C) 1991-2015 Free Software Foundation, Inc.
   2    This file is part of the GNU C Library.
   3
   4    The GNU C Library is free software; you can redistribute it and/or
   5    modify it under the terms of the GNU Lesser General Public
   6    License as published by the Free Software Foundation; either
   7    version 2.1 of the License, or (at your option) any later version.
   8
   9    The GNU C Library is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12    Lesser General Public License for more details.
  13
  14    You should have received a copy of the GNU Lesser General Public
  15    License along with the GNU C Library; if not, see
  16    <http://www.gnu.org/licenses/>.  */
  17
  18 #include <ctype.h>
  19 #include <limits.h>
  20 #include <printf.h>
  21 #include <stdarg.h>
  22 #include <stdint.h>
  23 #include <stdlib.h>
  24 #include <string.h>
  25 #include <errno.h>
  26 #include <wchar.h>
  27 #include <bits/libc-lock.h>
  28 #include <sys/param.h>
  29 #include <_itoa.h>
  30 #include <locale/localeinfo.h>
  31 #include <stdio.h>
  32
  33 /* This code is shared between the standard stdio implementation found
  34    in GNU C library and the libio implementation originally found in
  35    GNU libg++.
  36
  37    Beside this it is also shared between the normal and wide character
  38    implementation as defined in ISO/IEC 9899:1990/Amendment 1:1995.  */
  39
  40
  41 #include <libioP.h>
  42 #define FILE            _IO_FILE
  43 #undef va_list
  44 #define va_list _IO_va_list
  45 #undef BUFSIZ
  46 #define BUFSIZ          _IO_BUFSIZ
  47 #define ARGCHECK(S, Format) \
  48   do                                                                          \
  49     {                                                                         \
  50       /* Check file argument for consistence.  */                             \
  51       CHECK_FILE (S, -1);                                                     \
  52       if (S->_flags & _IO_NO_WRITES)                                          \
  53         {                                                                     \
  54           S->_flags |= _IO_ERR_SEEN;                                          \
  55           __set_errno (EBADF);                                                \
  56           return -1;                                                          \
  57         }                                                                     \
  58       if (Format == NULL)                                                     \
  59         {                                                                     \
  60           MAYBE_SET_EINVAL;                                                   \
  61           return -1;                                                          \
  62         }                                                                     \
  63     } while (0)
  64 #define UNBUFFERED_P(S) ((S)->_IO_file_flags & _IO_UNBUFFERED)
  65
  66 #define done_add(val) \
  67   do {                                                                        \
  68     unsigned int _val = val;                                                  \
  69     assert ((unsigned int) done < (unsigned int) INT_MAX);                    \
  70     if (__glibc_unlikely (INT_MAX - done < _val))                             \
  71       {                                                                       \
  72         done = -1;                                                            \
  73          __set_errno (EOVERFLOW);                                             \
  74         goto all_done;                                                        \
  75       }                                                                       \
  76     done += _val;                                                             \
  77   } while (0)
  78
  79 #ifndef COMPILE_WPRINTF
  80 # define vfprintf       _IO_vfprintf_internal
  81 # define CHAR_T         char
  82 # define UCHAR_T        unsigned char
  83 # define INT_T          int
  84 # define L_(Str)        Str
  85 # define ISDIGIT(Ch)    ((unsigned int) ((Ch) - '0') < 10)
  86 # define STR_LEN(Str)   strlen (Str)
  87
  88 # define PUT(F, S, N)   _IO_sputn ((F), (S), (N))
  89 # define PAD(Padchar) \
  90   do {                                                                        \
  91     if (width > 0)                                                            \
  92       {                                                                       \
  93         _IO_ssize_t written = _IO_padn (s, (Padchar), width);                 \
  94         if (__glibc_unlikely (written != width))                              \
  95           {                                                                   \
  96             done = -1;                                                        \
  97             goto all_done;                                                    \
  98           }                                                                   \
  99         done_add (written);                                                   \
 100       }                                                                       \
 101   } while (0)
 102 # define PUTC(C, F)     _IO_putc_unlocked (C, F)
 103 # define ORIENT         if (_IO_vtable_offset (s) == 0 && _IO_fwide (s, -1) != -1)\
 104                           return -1
 105 #else
 106 # define vfprintf       _IO_vfwprintf
 107 # define CHAR_T         wchar_t
 108 /* This is a hack!!!  There should be a type uwchar_t.  */
 109 # define UCHAR_T        unsigned int /* uwchar_t */
 110 # define INT_T          wint_t
 111 # define L_(Str)        L##Str
 112 # define ISDIGIT(Ch)    ((unsigned int) ((Ch) - L'0') < 10)
 113 # define STR_LEN(Str)   __wcslen (Str)
 114
 115 # include <_itowa.h>
 116
 117 # define PUT(F, S, N)   _IO_sputn ((F), (S), (N))
 118 # define PAD(Padchar) \
 119   do {                                                                        \
 120     if (width > 0)                                                            \
 121       {                                                                       \
 122         _IO_ssize_t written = _IO_wpadn (s, (Padchar), width);                \
 123         if (__glibc_unlikely (written != width))                              \
 124           {                                                                   \
 125             done = -1;                                                        \
 126             goto all_done;                                                    \
 127           }                                                                   \
 128         done_add (written);                                                   \
 129       }                                                                       \
 130   } while (0)
 131 # define PUTC(C, F)     _IO_putwc_unlocked (C, F)
 132 # define ORIENT         if (_IO_fwide (s, 1) != 1) return -1
 133
 134 # undef _itoa
 135 # define _itoa(Val, Buf, Base, Case) _itowa (Val, Buf, Base, Case)
 136 # define _itoa_word(Val, Buf, Base, Case) _itowa_word (Val, Buf, Base, Case)
 137 # undef EOF
 138 # define EOF WEOF
 139 #endif
 140
 141 #include "_i18n_number.h"
 142
 143 /* Include the shared code for parsing the format string.  */
 144 #include "printf-parse.h"
 145
 146
 147 #define outchar(Ch)                                                           \
 148   do                                                                          \
 149     {                                                                         \
 150       const INT_T outc = (Ch);                                                \
 151       if (PUTC (outc, s) == EOF || done == INT_MAX)                           \
 152         {                                                                     \
 153           done = -1;                                                          \
 154           goto all_done;                                                      \
 155         }                                                                     \
 156       ++done;                                                                 \
 157     }                                                                         \
 158   while (0)
 159
 160 #define outstring(String, Len)                                                \
 161   do                                                                          \
 162     {                                                                         \
 163       assert ((size_t) done <= (size_t) INT_MAX);                             \
 164       if ((size_t) PUT (s, (String), (Len)) != (size_t) (Len))                \
 165         {                                                                     \
 166           done = -1;                                                          \
 167           goto all_done;                                                      \
 168         }                                                                     \
 169       if (__glibc_unlikely (INT_MAX - done < (Len)))                          \
 170       {                                                                       \
 171         done = -1;                                                            \
 172          __set_errno (EOVERFLOW);                                             \
 173         goto all_done;                                                        \
 174       }                                                                       \
 175       done += (Len);                                                          \
 176     }                                                                         \
 177   while (0)
 178
 179 /* For handling long_double and longlong we use the same flag.  If
 180    `long' and `long long' are effectively the same type define it to
 181    zero.  */
 182 #if LONG_MAX == LONG_LONG_MAX
 183 # define is_longlong 0
 184 #else
 185 # define is_longlong is_long_double
 186 #endif
 187
 188 /* If `long' and `int' is effectively the same type we don't have to
 189    handle `long separately.  */
 190 #if INT_MAX == LONG_MAX
 191 # define is_long_num    0
 192 #else
 193 # define is_long_num    is_long
 194 #endif
 195
 196
 197 /* Global variables.  */
 198 static const CHAR_T null[] = L_("(null)");
 199
 200
 201 /* Helper function to provide temporary buffering for unbuffered streams.  */
 202 static int buffered_vfprintf (FILE *stream, const CHAR_T *fmt, va_list)
 203      __THROW __attribute__ ((noinline)) internal_function;
 204
 205 /* Handle unknown format specifier.  */
 206 static int printf_unknown (FILE *, const struct printf_info *,
 207                            const void *const *) __THROW;
 208
 209 /* Group digits of number string.  */
 210 #ifdef COMPILE_WPRINTF
 211 static CHAR_T *group_number (CHAR_T *, CHAR_T *, const char *, wchar_t)
 212      __THROW internal_function;
 213 #else
 214 static CHAR_T *group_number (CHAR_T *, CHAR_T *, const char *, const char *)
 215      __THROW internal_function;
 216 #endif
 217
 218
 219 /* The function itself.  */
 220 int
 221 vfprintf (FILE *s, const CHAR_T *format, va_list ap)
 222 {
 223   /* The character used as thousands separator.  */
 224 #ifdef COMPILE_WPRINTF
 225   wchar_t thousands_sep = L'\0';
 226 #else
 227   const char *thousands_sep = NULL;
 228 #endif
 229
 230   /* The string describing the size of groups of digits.  */
 231   const char *grouping;
 232
 233   /* Place to accumulate the result.  */
 234   int done;
 235
 236   /* Current character in format string.  */
 237   const UCHAR_T *f;
 238
 239   /* End of leading constant string.  */
 240   const UCHAR_T *lead_str_end;
 241
 242   /* Points to next format specifier.  */
 243   const UCHAR_T *end_of_spec;
 244
 245   /* Buffer intermediate results.  */
 246   CHAR_T work_buffer[1000];
 247   CHAR_T *workstart = NULL;
 248   CHAR_T *workend;
 249
 250   /* We have to save the original argument pointer.  */
 251   va_list ap_save;
 252
 253   /* Count number of specifiers we already processed.  */
 254   int nspecs_done;
 255
 256   /* For the %m format we may need the current `errno' value.  */
 257   int save_errno = errno;
 258
 259   /* 1 if format is in read-only memory, -1 if it is in writable memory,
 260      0 if unknown.  */
 261   int readonly_format = 0;
 262
 263   /* For the argument descriptions, which may be allocated on the heap.  */
 264   void *args_malloced = NULL;
 265
 266   /* For positional argument handling.  */
 267   struct printf_spec *specs;
 268
 269   /* Track if we malloced the SPECS array and thus must free it.  */
 270   bool specs_malloced = false;
 271
 272   /* This table maps a character into a number representing a
 273      class.  In each step there is a destination label for each
 274      class.  */
 275   static const uint8_t jump_table[] =
 276   {
 277     /* ' ' */  1,            0,            0, /* '#' */  4,
 278                0, /* '%' */ 14,            0, /* '\''*/  6,
 279                0,            0, /* '*' */  7, /* '+' */  2,
 280                0, /* '-' */  3, /* '.' */  9,            0,
 281     /* '0' */  5, /* '1' */  8, /* '2' */  8, /* '3' */  8,
 282     /* '4' */  8, /* '5' */  8, /* '6' */  8, /* '7' */  8,
 283     /* '8' */  8, /* '9' */  8,            0,            0,
 284                0,            0,            0,            0,
 285                0, /* 'A' */ 26,            0, /* 'C' */ 25,
 286                0, /* 'E' */ 19, /* F */   19, /* 'G' */ 19,
 287                0, /* 'I' */ 29,            0,            0,
 288     /* 'L' */ 12,            0,            0,            0,
 289                0,            0,            0, /* 'S' */ 21,
 290                0,            0,            0,            0,
 291     /* 'X' */ 18,            0, /* 'Z' */ 13,            0,
 292                0,            0,            0,            0,
 293                0, /* 'a' */ 26,            0, /* 'c' */ 20,
 294     /* 'd' */ 15, /* 'e' */ 19, /* 'f' */ 19, /* 'g' */ 19,
 295     /* 'h' */ 10, /* 'i' */ 15, /* 'j' */ 28,            0,
 296     /* 'l' */ 11, /* 'm' */ 24, /* 'n' */ 23, /* 'o' */ 17,
 297     /* 'p' */ 22, /* 'q' */ 12,            0, /* 's' */ 21,
 298     /* 't' */ 27, /* 'u' */ 16,            0,            0,
 299     /* 'x' */ 18,            0, /* 'z' */ 13
 300   };
 301
 302 #define NOT_IN_JUMP_RANGE(Ch) ((Ch) < L_(' ') || (Ch) > L_('z'))
 303 #define CHAR_CLASS(Ch) (jump_table[(INT_T) (Ch) - L_(' ')])
 304 #ifdef SHARED
 305   /* 'int' is enough and it saves some space on 64 bit systems.  */
 306 # define JUMP_TABLE_TYPE const int
 307 # define JUMP(ChExpr, table)                                                  \
 308       do                                                                      \
 309         {                                                                     \
 310           int offset;                                                         \
 311           void *ptr;                                                          \
 312           spec = (ChExpr);                                                    \
 313           offset = NOT_IN_JUMP_RANGE (spec) ? REF (form_unknown)              \
 314             : table[CHAR_CLASS (spec)];                                       \
 315           ptr = &&do_form_unknown + offset;                                   \
 316           goto *ptr;                                                          \
 317         }                                                                     \
 318       while (0)
 319 #else
 320 # define JUMP_TABLE_TYPE const void *const
 321 # define JUMP(ChExpr, table)                                                  \
 322       do                                                                      \
 323         {                                                                     \
 324           const void *ptr;                                                    \
 325           spec = (ChExpr);                                                    \
 326           ptr = NOT_IN_JUMP_RANGE (spec) ? REF (form_unknown)                 \
 327             : table[CHAR_CLASS (spec)];                                       \
 328           goto *ptr;                                                          \
 329         }                                                                     \
 330       while (0)
 331 #endif
 332
 333 #define STEP0_3_TABLE                                                         \
 334     /* Step 0: at the beginning.  */                                          \
 335     static JUMP_TABLE_TYPE step0_jumps[30] =                                  \
 336     {                                                                         \
 337       REF (form_unknown),                                                     \
 338       REF (flag_space),         /* for ' ' */                                 \
 339       REF (flag_plus),          /* for '+' */                                 \
 340       REF (flag_minus),         /* for '-' */                                 \
 341       REF (flag_hash),          /* for '<hash>' */                            \
 342       REF (flag_zero),          /* for '0' */                                 \
 343       REF (flag_quote),         /* for '\'' */                                \
 344       REF (width_asterics),     /* for '*' */                                 \
 345       REF (width),              /* for '1'...'9' */                           \
 346       REF (precision),          /* for '.' */                                 \
 347       REF (mod_half),           /* for 'h' */                                 \
 348       REF (mod_long),           /* for 'l' */                                 \
 349       REF (mod_longlong),       /* for 'L', 'q' */                            \
 350       REF (mod_size_t),         /* for 'z', 'Z' */                            \
 351       REF (form_percent),       /* for '%' */                                 \
 352       REF (form_integer),       /* for 'd', 'i' */                            \
 353       REF (form_unsigned),      /* for 'u' */                                 \
 354       REF (form_octal),         /* for 'o' */                                 \
 355       REF (form_hexa),          /* for 'X', 'x' */                            \
 356       REF (form_float),         /* for 'E', 'e', 'F', 'f', 'G', 'g' */        \
 357       REF (form_character),     /* for 'c' */                                 \
 358       REF (form_string),        /* for 's', 'S' */                            \
 359       REF (form_pointer),       /* for 'p' */                                 \
 360       REF (form_number),        /* for 'n' */                                 \
 361       REF (form_strerror),      /* for 'm' */                                 \
 362       REF (form_wcharacter),    /* for 'C' */                                 \
 363       REF (form_floathex),      /* for 'A', 'a' */                            \
 364       REF (mod_ptrdiff_t),      /* for 't' */                                 \
 365       REF (mod_intmax_t),       /* for 'j' */                                 \
 366       REF (flag_i18n),          /* for 'I' */                                 \
 367     };                                                                        \
 368     /* Step 1: after processing width.  */                                    \
 369     static JUMP_TABLE_TYPE step1_jumps[30] =                                  \
 370     {                                                                         \
 371       REF (form_unknown),                                                     \
 372       REF (form_unknown),       /* for ' ' */                                 \
 373       REF (form_unknown),       /* for '+' */                                 \
 374       REF (form_unknown),       /* for '-' */                                 \
 375       REF (form_unknown),       /* for '<hash>' */                            \
 376       REF (form_unknown),       /* for '0' */                                 \
 377       REF (form_unknown),       /* for '\'' */                                \
 378       REF (form_unknown),       /* for '*' */                                 \
 379       REF (form_unknown),       /* for '1'...'9' */                           \
 380       REF (precision),          /* for '.' */                                 \
 381       REF (mod_half),           /* for 'h' */                                 \
 382       REF (mod_long),           /* for 'l' */                                 \
 383       REF (mod_longlong),       /* for 'L', 'q' */                            \
 384       REF (mod_size_t),         /* for 'z', 'Z' */                            \
 385       REF (form_percent),       /* for '%' */                                 \
 386       REF (form_integer),       /* for 'd', 'i' */                            \
 387       REF (form_unsigned),      /* for 'u' */                                 \
 388       REF (form_octal),         /* for 'o' */                                 \
 389       REF (form_hexa),          /* for 'X', 'x' */                            \
 390       REF (form_float),         /* for 'E', 'e', 'F', 'f', 'G', 'g' */        \
 391       REF (form_character),     /* for 'c' */                                 \
 392       REF (form_string),        /* for 's', 'S' */                            \
 393       REF (form_pointer),       /* for 'p' */                                 \
 394       REF (form_number),        /* for 'n' */                                 \
 395       REF (form_strerror),      /* for 'm' */                                 \
 396       REF (form_wcharacter),    /* for 'C' */                                 \
 397       REF (form_floathex),      /* for 'A', 'a' */                            \
 398       REF (mod_ptrdiff_t),      /* for 't' */                                 \
 399       REF (mod_intmax_t),       /* for 'j' */                                 \
 400       REF (form_unknown)        /* for 'I' */                                 \
 401     };                                                                        \
 402     /* Step 2: after processing precision.  */                                \
 403     static JUMP_TABLE_TYPE step2_jumps[30] =                                  \
 404     {                                                                         \
 405       REF (form_unknown),                                                     \
 406       REF (form_unknown),       /* for ' ' */                                 \
 407       REF (form_unknown),       /* for '+' */                                 \
 408       REF (form_unknown),       /* for '-' */                                 \
 409       REF (form_unknown),       /* for '<hash>' */                            \
 410       REF (form_unknown),       /* for '0' */                                 \
 411       REF (form_unknown),       /* for '\'' */                                \
 412       REF (form_unknown),       /* for '*' */                                 \
 413       REF (form_unknown),       /* for '1'...'9' */                           \
 414       REF (form_unknown),       /* for '.' */                                 \
 415       REF (mod_half),           /* for 'h' */                                 \
 416       REF (mod_long),           /* for 'l' */                                 \
 417       REF (mod_longlong),       /* for 'L', 'q' */                            \
 418       REF (mod_size_t),         /* for 'z', 'Z' */                            \
 419       REF (form_percent),       /* for '%' */                                 \
 420       REF (form_integer),       /* for 'd', 'i' */                            \
 421       REF (form_unsigned),      /* for 'u' */                                 \
 422       REF (form_octal),         /* for 'o' */                                 \
 423       REF (form_hexa),          /* for 'X', 'x' */                            \
 424       REF (form_float),         /* for 'E', 'e', 'F', 'f', 'G', 'g' */        \
 425       REF (form_character),     /* for 'c' */                                 \
 426       REF (form_string),        /* for 's', 'S' */                            \
 427       REF (form_pointer),       /* for 'p' */                                 \
 428       REF (form_number),        /* for 'n' */                                 \
 429       REF (form_strerror),      /* for 'm' */                                 \
 430       REF (form_wcharacter),    /* for 'C' */                                 \
 431       REF (form_floathex),      /* for 'A', 'a' */                            \
 432       REF (mod_ptrdiff_t),      /* for 't' */                                 \
 433       REF (mod_intmax_t),       /* for 'j' */                                 \
 434       REF (form_unknown)        /* for 'I' */                                 \
 435     };                                                                        \
 436     /* Step 3a: after processing first 'h' modifier.  */                      \
 437     static JUMP_TABLE_TYPE step3a_jumps[30] =                                 \
 438     {                                                                         \
 439       REF (form_unknown),                                                     \
 440       REF (form_unknown),       /* for ' ' */                                 \
 441       REF (form_unknown),       /* for '+' */                                 \
 442       REF (form_unknown),       /* for '-' */                                 \
 443       REF (form_unknown),       /* for '<hash>' */                            \
 444       REF (form_unknown),       /* for '0' */                                 \
 445       REF (form_unknown),       /* for '\'' */                                \
 446       REF (form_unknown),       /* for '*' */                                 \
 447       REF (form_unknown),       /* for '1'...'9' */                           \
 448       REF (form_unknown),       /* for '.' */                                 \
 449       REF (mod_halfhalf),       /* for 'h' */                                 \
 450       REF (form_unknown),       /* for 'l' */                                 \
 451       REF (form_unknown),       /* for 'L', 'q' */                            \
 452       REF (form_unknown),       /* for 'z', 'Z' */                            \
 453       REF (form_percent),       /* for '%' */                                 \
 454       REF (form_integer),       /* for 'd', 'i' */                            \
 455       REF (form_unsigned),      /* for 'u' */                                 \
 456       REF (form_octal),         /* for 'o' */                                 \
 457       REF (form_hexa),          /* for 'X', 'x' */                            \
 458       REF (form_unknown),       /* for 'E', 'e', 'F', 'f', 'G', 'g' */        \
 459       REF (form_unknown),       /* for 'c' */                                 \
 460       REF (form_unknown),       /* for 's', 'S' */                            \
 461       REF (form_unknown),       /* for 'p' */                                 \
 462       REF (form_number),        /* for 'n' */                                 \
 463       REF (form_unknown),       /* for 'm' */                                 \
 464       REF (form_unknown),       /* for 'C' */                                 \
 465       REF (form_unknown),       /* for 'A', 'a' */                            \
 466       REF (form_unknown),       /* for 't' */                                 \
 467       REF (form_unknown),       /* for 'j' */                                 \
 468       REF (form_unknown)        /* for 'I' */                                 \
 469     };                                                                        \
 470     /* Step 3b: after processing first 'l' modifier.  */                      \
 471     static JUMP_TABLE_TYPE step3b_jumps[30] =                                 \
 472     {                                                                         \
 473       REF (form_unknown),                                                     \
 474       REF (form_unknown),       /* for ' ' */                                 \
 475       REF (form_unknown),       /* for '+' */                                 \
 476       REF (form_unknown),       /* for '-' */                                 \
 477       REF (form_unknown),       /* for '<hash>' */                            \
 478       REF (form_unknown),       /* for '0' */                                 \
 479       REF (form_unknown),       /* for '\'' */                                \
 480       REF (form_unknown),       /* for '*' */                                 \
 481       REF (form_unknown),       /* for '1'...'9' */                           \
 482       REF (form_unknown),       /* for '.' */                                 \
 483       REF (form_unknown),       /* for 'h' */                                 \
 484       REF (mod_longlong),       /* for 'l' */                                 \
 485       REF (form_unknown),       /* for 'L', 'q' */                            \
 486       REF (form_unknown),       /* for 'z', 'Z' */                            \
 487       REF (form_percent),       /* for '%' */                                 \
 488       REF (form_integer),       /* for 'd', 'i' */                            \
 489       REF (form_unsigned),      /* for 'u' */                                 \
 490       REF (form_octal),         /* for 'o' */                                 \
 491       REF (form_hexa),          /* for 'X', 'x' */                            \
 492       REF (form_float),         /* for 'E', 'e', 'F', 'f', 'G', 'g' */        \
 493       REF (form_character),     /* for 'c' */                                 \
 494       REF (form_string),        /* for 's', 'S' */                            \
 495       REF (form_pointer),       /* for 'p' */                                 \
 496       REF (form_number),        /* for 'n' */                                 \
 497       REF (form_strerror),      /* for 'm' */                                 \
 498       REF (form_wcharacter),    /* for 'C' */                                 \
 499       REF (form_floathex),      /* for 'A', 'a' */                            \
 500       REF (form_unknown),       /* for 't' */                                 \
 501       REF (form_unknown),       /* for 'j' */                                 \
 502       REF (form_unknown)        /* for 'I' */                                 \
 503     }
 504
 505 #define STEP4_TABLE                                                           \
 506     /* Step 4: processing format specifier.  */                               \
 507     static JUMP_TABLE_TYPE step4_jumps[30] =                                  \
 508     {                                                                         \
 509       REF (form_unknown),                                                     \
 510       REF (form_unknown),       /* for ' ' */                                 \
 511       REF (form_unknown),       /* for '+' */                                 \
 512       REF (form_unknown),       /* for '-' */                                 \
 513       REF (form_unknown),       /* for '<hash>' */                            \
 514       REF (form_unknown),       /* for '0' */                                 \
 515       REF (form_unknown),       /* for '\'' */                                \
 516       REF (form_unknown),       /* for '*' */                                 \
 517       REF (form_unknown),       /* for '1'...'9' */                           \
 518       REF (form_unknown),       /* for '.' */                                 \
 519       REF (form_unknown),       /* for 'h' */                                 \
 520       REF (form_unknown),       /* for 'l' */                                 \
 521       REF (form_unknown),       /* for 'L', 'q' */                            \
 522       REF (form_unknown),       /* for 'z', 'Z' */                            \
 523       REF (form_percent),       /* for '%' */                                 \
 524       REF (form_integer),       /* for 'd', 'i' */                            \
 525       REF (form_unsigned),      /* for 'u' */                                 \
 526       REF (form_octal),         /* for 'o' */                                 \
 527       REF (form_hexa),          /* for 'X', 'x' */                            \
 528       REF (form_float),         /* for 'E', 'e', 'F', 'f', 'G', 'g' */        \
 529       REF (form_character),     /* for 'c' */                                 \
 530       REF (form_string),        /* for 's', 'S' */                            \
 531       REF (form_pointer),       /* for 'p' */                                 \
 532       REF (form_number),        /* for 'n' */                                 \
 533       REF (form_strerror),      /* for 'm' */                                 \
 534       REF (form_wcharacter),    /* for 'C' */                                 \
 535       REF (form_floathex),      /* for 'A', 'a' */                            \
 536       REF (form_unknown),       /* for 't' */                                 \
 537       REF (form_unknown),       /* for 'j' */                                 \
 538       REF (form_unknown)        /* for 'I' */                                 \
 539     }
 540
 541
 542 #define process_arg(fspec)                                                    \
 543       /* Start real work.  We know about all flags and modifiers and          \
 544          now process the wanted format specifier.  */                         \
 545     LABEL (form_percent):                                                     \
 546       /* Write a literal "%".  */                                             \
 547       outchar (L_('%'));                                                      \
 548       break;                                                                  \
 549                                                                               \
 550     LABEL (form_integer):                                                     \
 551       /* Signed decimal integer.  */                                          \
 552       base = 10;                                                              \
 553                                                                               \
 554       if (is_longlong)                                                        \
 555         {                                                                     \
 556           long long int signed_number;                                        \
 557                                                                               \
 558           if (fspec == NULL)                                                  \
 559             signed_number = va_arg (ap, long long int);                       \
 560           else                                                                \
 561             signed_number = args_value[fspec->data_arg].pa_long_long_int;     \
 562                                                                               \
 563           is_negative = signed_number < 0;                                    \
 564           number.longlong = is_negative ? (- signed_number) : signed_number;  \
 565                                                                               \
 566           goto LABEL (longlong_number);                                       \
 567         }                                                                     \
 568       else                                                                    \
 569         {                                                                     \
 570           long int signed_number;                                             \
 571                                                                               \
 572           if (fspec == NULL)                                                  \
 573             {                                                                 \
 574               if (is_long_num)                                                \
 575                 signed_number = va_arg (ap, long int);                        \
 576               else if (is_char)                                               \
 577                 signed_number = (signed char) va_arg (ap, unsigned int);      \
 578               else if (!is_short)                                             \
 579                 signed_number = va_arg (ap, int);                             \
 580               else                                                            \
 581                 signed_number = (short int) va_arg (ap, unsigned int);        \
 582             }                                                                 \
 583           else                                                                \
 584             if (is_long_num)                                                  \
 585               signed_number = args_value[fspec->data_arg].pa_long_int;        \
 586             else if (is_char)                                                 \
 587               signed_number = (signed char)                                   \
 588                 args_value[fspec->data_arg].pa_u_int;                         \
 589             else if (!is_short)                                               \
 590               signed_number = args_value[fspec->data_arg].pa_int;             \
 591             else                                                              \
 592               signed_number = (short int)                                     \
 593                 args_value[fspec->data_arg].pa_u_int;                         \
 594                                                                               \
 595           is_negative = signed_number < 0;                                    \
 596           number.word = is_negative ? (- signed_number) : signed_number;      \
 597                                                                               \
 598           goto LABEL (number);                                                \
 599         }                                                                     \
 600       /* NOTREACHED */                                                        \
 601                                                                               \
 602     LABEL (form_unsigned):                                                    \
 603       /* Unsigned decimal integer.  */                                        \
 604       base = 10;                                                              \
 605       goto LABEL (unsigned_number);                                           \
 606       /* NOTREACHED */                                                        \
 607                                                                               \
 608     LABEL (form_octal):                                                       \
 609       /* Unsigned octal integer.  */                                          \
 610       base = 8;                                                               \
 611       goto LABEL (unsigned_number);                                           \
 612       /* NOTREACHED */                                                        \
 613                                                                               \
 614     LABEL (form_hexa):                                                        \
 615       /* Unsigned hexadecimal integer.  */                                    \
 616       base = 16;                                                              \
 617                                                                               \
 618     LABEL (unsigned_number):      /* Unsigned number of base BASE.  */        \
 619                                                                               \
 620       /* ISO specifies the `+' and ` ' flags only for signed                  \
 621          conversions.  */                                                     \
 622       is_negative = 0;                                                        \
 623       showsign = 0;                                                           \
 624       space = 0;                                                              \
 625                                                                               \
 626       if (is_longlong)                                                        \
 627         {                                                                     \
 628           if (fspec == NULL)                                                  \
 629             number.longlong = va_arg (ap, unsigned long long int);            \
 630           else                                                                \
 631             number.longlong = args_value[fspec->data_arg].pa_u_long_long_int; \
 632                                                                               \
 633         LABEL (longlong_number):                                              \
 634           if (prec < 0)                                                       \
 635             /* Supply a default precision if none was given.  */              \
 636             prec = 1;                                                         \
 637           else                                                                \
 638             /* We have to take care for the '0' flag.  If a precision         \
 639                is given it must be ignored.  */                               \
 640             pad = L_(' ');                                                    \
 641                                                                               \
 642           /* If the precision is 0 and the number is 0 nothing has to         \
 643              be written for the number, except for the 'o' format in          \
 644              alternate form.  */                                              \
 645           if (prec == 0 && number.longlong == 0)                              \
 646             {                                                                 \
 647               string = workend;                                               \
 648               if (base == 8 && alt)                                           \
 649                 *--string = L_('0');                                          \
 650             }                                                                 \
 651           else                                                                \
 652             {                                                                 \
 653               /* Put the number in WORK.  */                                  \
 654               string = _itoa (number.longlong, workend, base,                 \
 655                               spec == L_('X'));                               \
 656               if (group && grouping)                                          \
 657                 string = group_number (string, workend, grouping,             \
 658                                        thousands_sep);                        \
 659                                                                               \
 660               if (use_outdigits && base == 10)                                \
 661                 string = _i18n_number_rewrite (string, workend, workend);     \
 662             }                                                                 \
 663           /* Simplify further test for num != 0.  */                          \
 664           number.word = number.longlong != 0;                                 \
 665         }                                                                     \
 666       else                                                                    \
 667         {                                                                     \
 668           if (fspec == NULL)                                                  \
 669             {                                                                 \
 670               if (is_long_num)                                                \
 671                 number.word = va_arg (ap, unsigned long int);                 \
 672               else if (is_char)                                               \
 673                 number.word = (unsigned char) va_arg (ap, unsigned int);      \
 674               else if (!is_short)                                             \
 675                 number.word = va_arg (ap, unsigned int);                      \
 676               else                                                            \
 677                 number.word = (unsigned short int) va_arg (ap, unsigned int); \
 678             }                                                                 \
 679           else                                                                \
 680             if (is_long_num)                                                  \
 681               number.word = args_value[fspec->data_arg].pa_u_long_int;        \
 682             else if (is_char)                                                 \
 683               number.word = (unsigned char)                                   \
 684                 args_value[fspec->data_arg].pa_u_int;                         \
 685             else if (!is_short)                                               \
 686               number.word = args_value[fspec->data_arg].pa_u_int;             \
 687             else                                                              \
 688               number.word = (unsigned short int)                              \
 689                 args_value[fspec->data_arg].pa_u_int;                         \
 690                                                                               \
 691         LABEL (number):                                                       \
 692           if (prec < 0)                                                       \
 693             /* Supply a default precision if none was given.  */              \
 694             prec = 1;                                                         \
 695           else                                                                \
 696             /* We have to take care for the '0' flag.  If a precision         \
 697                is given it must be ignored.  */                               \
 698             pad = L_(' ');                                                    \
 699                                                                               \
 700           /* If the precision is 0 and the number is 0 nothing has to         \
 701              be written for the number, except for the 'o' format in          \
 702              alternate form.  */                                              \
 703           if (prec == 0 && number.word == 0)                                  \
 704             {                                                                 \
 705               string = workend;                                               \
 706               if (base == 8 && alt)                                           \
 707                 *--string = L_('0');                                          \
 708             }                                                                 \
 709           else                                                                \
 710             {                                                                 \
 711               /* Put the number in WORK.  */                                  \
 712               string = _itoa_word (number.word, workend, base,                \
 713                                    spec == L_('X'));                          \
 714               if (group && grouping)                                          \
 715                 string = group_number (string, workend, grouping,             \
 716                                        thousands_sep);                        \
 717                                                                               \
 718               if (use_outdigits && base == 10)                                \
 719                 string = _i18n_number_rewrite (string, workend, workend);     \
 720             }                                                                 \
 721         }                                                                     \
 722                                                                               \
 723       if (prec <= workend - string && number.word != 0 && alt && base == 8)   \
 724         /* Add octal marker.  */                                              \
 725         *--string = L_('0');                                                  \
 726                                                                               \
 727       prec = MAX (0, prec - (workend - string));                              \
 728                                                                               \
 729       if (!left)                                                              \
 730         {                                                                     \
 731           width -= workend - string + prec;                                   \
 732                                                                               \
 733           if (number.word != 0 && alt && base == 16)                          \
 734             /* Account for 0X hex marker.  */                                 \
 735             width -= 2;                                                       \
 736                                                                               \
 737           if (is_negative || showsign || space)                               \
 738             --width;                                                          \
 739                                                                               \
 740           if (pad == L_(' '))                                                 \
 741             {                                                                 \
 742               PAD (L_(' '));                                                  \
 743               width = 0;                                                      \
 744             }                                                                 \
 745                                                                               \
 746           if (is_negative)                                                    \
 747             outchar (L_('-'));                                                \
 748           else if (showsign)                                                  \
 749             outchar (L_('+'));                                                \
 750           else if (space)                                                     \
 751             outchar (L_(' '));                                                \
 752                                                                               \
 753           if (number.word != 0 && alt && base == 16)                          \
 754             {                                                                 \
 755               outchar (L_('0'));                                              \
 756               outchar (spec);                                                 \
 757             }                                                                 \
 758                                                                               \
 759           width += prec;                                                      \
 760           PAD (L_('0'));                                                      \
 761                                                                               \
 762           outstring (string, workend - string);                               \
 763                                                                               \
 764           break;                                                              \
 765         }                                                                     \
 766       else                                                                    \
 767         {                                                                     \
 768           if (is_negative)                                                    \
 769             {                                                                 \
 770               outchar (L_('-'));                                              \
 771               --width;                                                        \
 772             }                                                                 \
 773           else if (showsign)                                                  \
 774             {                                                                 \
 775               outchar (L_('+'));                                              \
 776               --width;                                                        \
 777             }                                                                 \
 778           else if (space)                                                     \
 779             {                                                                 \
 780               outchar (L_(' '));                                              \
 781               --width;                                                        \
 782             }                                                                 \
 783                                                                               \
 784           if (number.word != 0 && alt && base == 16)                          \
 785             {                                                                 \
 786               outchar (L_('0'));                                              \
 787               outchar (spec);                                                 \
 788               width -= 2;                                                     \
 789             }                                                                 \
 790                                                                               \
 791           width -= workend - string + prec;                                   \
 792                                                                               \
 793           if (prec > 0)                                                       \
 794             {                                                                 \
 795               int temp = width;                                               \
 796               width = prec;                                                   \
 797               PAD (L_('0'));                                                  \
 798               width = temp;                                                   \
 799             }                                                                 \
 800                                                                               \
 801           outstring (string, workend - string);                               \
 802                                                                               \
 803           PAD (L_(' '));                                                      \
 804           break;                                                              \
 805         }                                                                     \
 806                                                                               \
 807     LABEL (form_float):                                                       \
 808       {                                                                       \
 809         /* Floating-point number.  This is handled by printf_fp.c.  */        \
 810         const void *ptr;                                                      \
 811         int function_done;                                                    \
 812                                                                               \
 813         if (fspec == NULL)                                                    \
 814           {                                                                   \
 815             if (__ldbl_is_dbl)                                                \
 816               is_long_double = 0;                                             \
 817                                                                               \
 818             struct printf_info info = { .prec = prec,                         \
 819                                         .width = width,                       \
 820                                         .spec = spec,                         \
 821                                         .is_long_double = is_long_double,     \
 822                                         .is_short = is_short,                 \
 823                                         .is_long = is_long,                   \
 824                                         .alt = alt,                           \
 825                                         .space = space,                       \
 826                                         .left = left,                         \
 827                                         .showsign = showsign,                 \
 828                                         .group = group,                       \
 829                                         .pad = pad,                           \
 830                                         .extra = 0,                           \
 831                                         .i18n = use_outdigits,                \
 832                                         .wide = sizeof (CHAR_T) != 1 };       \
 833                                                                               \
 834             if (is_long_double)                                               \
 835               the_arg.pa_long_double = va_arg (ap, long double);              \
 836             else                                                              \
 837               the_arg.pa_double = va_arg (ap, double);                        \
 838             ptr = (const void *) &the_arg;                                    \
 839                                                                               \
 840             function_done = __printf_fp (s, &info, &ptr);                     \
 841           }                                                                   \
 842         else                                                                  \
 843           {                                                                   \
 844             ptr = (const void *) &args_value[fspec->data_arg];                \
 845             if (__ldbl_is_dbl)                                                \
 846               {                                                               \
 847                 fspec->data_arg_type = PA_DOUBLE;                             \
 848                 fspec->info.is_long_double = 0;                               \
 849               }                                                               \
 850                                                                               \
 851             function_done = __printf_fp (s, &fspec->info, &ptr);              \
 852           }                                                                   \
 853                                                                               \
 854         if (function_done < 0)                                                \
 855           {                                                                   \
 856             /* Error in print handler; up to handler to set errno.  */        \
 857             done = -1;                                                        \
 858             goto all_done;                                                    \
 859           }                                                                   \
 860                                                                               \
 861         done_add (function_done);                                             \
 862       }                                                                       \
 863       break;                                                                  \
 864                                                                               \
 865     LABEL (form_floathex):                                                    \
 866       {                                                                       \
 867         /* Floating point number printed as hexadecimal number.  */           \
 868         const void *ptr;                                                      \
 869         int function_done;                                                    \
 870                                                                               \
 871         if (fspec == NULL)                                                    \
 872           {                                                                   \
 873             if (__ldbl_is_dbl)                                                \
 874               is_long_double = 0;                                             \
 875                                                                               \
 876             struct printf_info info = { .prec = prec,                         \
 877                                         .width = width,                       \
 878                                         .spec = spec,                         \
 879                                         .is_long_double = is_long_double,     \
 880                                         .is_short = is_short,                 \
 881                                         .is_long = is_long,                   \
 882                                         .alt = alt,                           \
 883                                         .space = space,                       \
 884                                         .left = left,                         \
 885                                         .showsign = showsign,                 \
 886                                         .group = group,                       \
 887                                         .pad = pad,                           \
 888                                         .extra = 0,                           \
 889                                         .wide = sizeof (CHAR_T) != 1 };       \
 890                                                                               \
 891             if (is_long_double)                                               \
 892               the_arg.pa_long_double = va_arg (ap, long double);              \
 893             else                                                              \
 894               the_arg.pa_double = va_arg (ap, double);                        \
 895             ptr = (const void *) &the_arg;                                    \
 896                                                                               \
 897             function_done = __printf_fphex (s, &info, &ptr);                  \
 898           }                                                                   \
 899         else                                                                  \
 900           {                                                                   \
 901             ptr = (const void *) &args_value[fspec->data_arg];                \
 902             if (__ldbl_is_dbl)                                                \
 903               fspec->info.is_long_double = 0;                                 \
 904                                                                               \
 905             function_done = __printf_fphex (s, &fspec->info, &ptr);           \
 906           }                                                                   \
 907                                                                               \
 908         if (function_done < 0)                                                \
 909           {                                                                   \
 910             /* Error in print handler; up to handler to set errno.  */        \
 911             done = -1;                                                        \
 912             goto all_done;                                                    \
 913           }                                                                   \
 914                                                                               \
 915         done_add (function_done);                                             \
 916       }                                                                       \
 917       break;                                                                  \
 918                                                                               \
 919     LABEL (form_pointer):                                                     \
 920       /* Generic pointer.  */                                                 \
 921       {                                                                       \
 922         const void *ptr;                                                      \
 923         if (fspec == NULL)                                                    \
 924           ptr = va_arg (ap, void *);                                          \
 925         else                                                                  \
 926           ptr = args_value[fspec->data_arg].pa_pointer;                       \
 927         if (ptr != NULL)                                                      \
 928           {                                                                   \
 929             /* If the pointer is not NULL, write it as a %#x spec.  */        \
 930             base = 16;                                                        \
 931             number.word = (unsigned long int) ptr;                            \
 932             is_negative = 0;                                                  \
 933             alt = 1;                                                          \
 934             group = 0;                                                        \
 935             spec = L_('x');                                                   \
 936             goto LABEL (number);                                              \
 937           }                                                                   \
 938         else                                                                  \
 939           {                                                                   \
 940             /* Write "(nil)" for a nil pointer.  */                           \
 941             string = (CHAR_T *) L_("(nil)");                                  \
 942             /* Make sure the full string "(nil)" is printed.  */              \
 943             if (prec < 5)                                                     \
 944               prec = 5;                                                       \
 945             /* This is a wide string iff compiling wprintf.  */               \
 946             is_long = sizeof (CHAR_T) > 1;                                    \
 947             goto LABEL (print_string);                                        \
 948           }                                                                   \
 949       }                                                                       \
 950       /* NOTREACHED */                                                        \
 951                                                                               \
 952     LABEL (form_number):                                                      \
 953       if (s->_flags2 & _IO_FLAGS2_FORTIFY)                                    \
 954         {                                                                     \
 955           if (! readonly_format)                                              \
 956             {                                                                 \
 957               extern int __readonly_area (const void *, size_t)               \
 958                 attribute_hidden;                                             \
 959               readonly_format                                                 \
 960                 = __readonly_area (format, ((STR_LEN (format) + 1)            \
 961                                             * sizeof (CHAR_T)));              \
 962             }                                                                 \
 963           if (readonly_format < 0)                                            \
 964             __libc_fatal ("*** %n in writable segment detected ***\n");       \
 965         }                                                                     \
 966       /* Answer the count of characters written.  */                          \
 967       if (fspec == NULL)                                                      \
 968         {                                                                     \
 969           if (is_longlong)                                                    \
 970             *(long long int *) va_arg (ap, void *) = done;                    \
 971           else if (is_long_num)                                               \
 972             *(long int *) va_arg (ap, void *) = done;                         \
 973           else if (is_char)                                                   \
 974             *(char *) va_arg (ap, void *) = done;                             \
 975           else if (!is_short)                                                 \
 976             *(int *) va_arg (ap, void *) = done;                              \
 977           else                                                                \
 978             *(short int *) va_arg (ap, void *) = done;                        \
 979         }                                                                     \
 980       else                                                                    \
 981         if (is_longlong)                                                      \
 982           *(long long int *) args_value[fspec->data_arg].pa_pointer = done;   \
 983         else if (is_long_num)                                                 \
 984           *(long int *) args_value[fspec->data_arg].pa_pointer = done;        \
 985         else if (is_char)                                                     \
 986           *(char *) args_value[fspec->data_arg].pa_pointer = done;            \
 987         else if (!is_short)                                                   \
 988           *(int *) args_value[fspec->data_arg].pa_pointer = done;             \
 989         else                                                                  \
 990           *(short int *) args_value[fspec->data_arg].pa_pointer = done;       \
 991       break;                                                                  \
 992                                                                               \
 993     LABEL (form_strerror):                                                    \
 994       /* Print description of error ERRNO.  */                                \
 995       string =                                                                \
 996         (CHAR_T *) __strerror_r (save_errno, (char *) work_buffer,            \
 997                                  sizeof work_buffer);                         \
 998       is_long = 0;              /* This is no wide-char string.  */           \
 999       goto LABEL (print_string)
1000
1001 #ifdef COMPILE_WPRINTF
1002 # define process_string_arg(fspec) \
1003     LABEL (form_character):                                                   \
1004       /* Character.  */                                                       \
1005       if (is_long)                                                            \
1006         goto LABEL (form_wcharacter);                                         \
1007       --width;  /* Account for the character itself.  */                      \
1008       if (!left)                                                              \
1009         PAD (L' ');                                                           \
1010       if (fspec == NULL)                                                      \
1011         outchar (__btowc ((unsigned char) va_arg (ap, int))); /* Promoted. */ \
1012       else                                                                    \
1013         outchar (__btowc ((unsigned char)                                     \
1014                           args_value[fspec->data_arg].pa_int));               \
1015       if (left)                                                               \
1016         PAD (L' ');                                                           \
1017       break;                                                                  \
1018                                                                               \
1019     LABEL (form_wcharacter):                                                  \
1020       {                                                                       \
1021         /* Wide character.  */                                                \
1022         --width;                                                              \
1023         if (!left)                                                            \
1024           PAD (L' ');                                                         \
1025         if (fspec == NULL)                                                    \
1026           outchar (va_arg (ap, wchar_t));                                     \
1027         else                                                                  \
1028           outchar (args_value[fspec->data_arg].pa_wchar);                     \
1029         if (left)                                                             \
1030           PAD (L' ');                                                         \
1031       }                                                                       \
1032       break;                                                                  \
1033                                                                               \
1034     LABEL (form_string):                                                      \
1035       {                                                                       \
1036         size_t len;                                                           \
1037         int string_malloced;                                                  \
1038                                                                               \
1039         /* The string argument could in fact be `char *' or `wchar_t *'.      \
1040            But this should not make a difference here.  */                    \
1041         if (fspec == NULL)                                                    \
1042           string = (CHAR_T *) va_arg (ap, const wchar_t *);                   \
1043         else                                                                  \
1044           string = (CHAR_T *) args_value[fspec->data_arg].pa_wstring;         \
1045                                                                               \
1046         /* Entry point for printing other strings.  */                        \
1047       LABEL (print_string):                                                   \
1048                                                                               \
1049         string_malloced = 0;                                                  \
1050         if (string == NULL)                                                   \
1051           {                                                                   \
1052             /* Write "(null)" if there's space.  */                           \
1053             if (prec == -1                                                    \
1054                 || prec >= (int) (sizeof (null) / sizeof (null[0])) - 1)      \
1055               {                                                               \
1056                 string = (CHAR_T *) null;                                     \
1057                 len = (sizeof (null) / sizeof (null[0])) - 1;                 \
1058               }                                                               \
1059             else                                                              \
1060               {                                                               \
1061                 string = (CHAR_T *) L"";                                      \
1062                 len = 0;                                                      \
1063               }                                                               \
1064           }                                                                   \
1065         else if (!is_long && spec != L_('S'))                                 \
1066           {                                                                   \
1067             /* This is complicated.  We have to transform the multibyte       \
1068                string into a wide character string.  */                       \
1069             const char *mbs = (const char *) string;                          \
1070             mbstate_t mbstate;                                                \
1071                                                                               \
1072             len = prec != -1 ? __strnlen (mbs, (size_t) prec) : strlen (mbs); \
1073                                                                               \
1074             /* Allocate dynamically an array which definitely is long         \
1075                enough for the wide character version.  Each byte in the       \
1076                multi-byte string can produce at most one wide character.  */  \
1077             if (__glibc_unlikely (len > SIZE_MAX / sizeof (wchar_t)))         \
1078               {                                                               \
1079                 __set_errno (EOVERFLOW);                                      \
1080                 done = -1;                                                    \
1081                 goto all_done;                                                \
1082               }                                                               \
1083             else if (__libc_use_alloca (len * sizeof (wchar_t)))              \
1084               string = (CHAR_T *) alloca (len * sizeof (wchar_t));            \
1085             else if ((string = (CHAR_T *) malloc (len * sizeof (wchar_t)))    \
1086                      == NULL)                                                 \
1087               {                                                               \
1088                 done = -1;                                                    \
1089                 goto all_done;                                                \
1090               }                                                               \
1091             else                                                              \
1092               string_malloced = 1;                                            \
1093                                                                               \
1094             memset (&mbstate, '\0', sizeof (mbstate_t));                      \
1095             len = __mbsrtowcs (string, &mbs, len, &mbstate);                  \
1096             if (len == (size_t) -1)                                           \
1097               {                                                               \
1098                 /* Illegal multibyte character.  */                           \
1099                 done = -1;                                                    \
1100                 goto all_done;                                                \
1101               }                                                               \
1102           }                                                                   \
1103         else                                                                  \
1104           {                                                                   \
1105             if (prec != -1)                                                   \
1106               /* Search for the end of the string, but don't search past      \
1107                  the length specified by the precision.  */                   \
1108               len = __wcsnlen (string, prec);                                 \
1109             else                                                              \
1110               len = __wcslen (string);                                        \
1111           }                                                                   \
1112                                                                               \
1113         if ((width -= len) < 0)                                               \
1114           {                                                                   \
1115             outstring (string, len);                                          \
1116             break;                                                            \
1117           }                                                                   \
1118                                                                               \
1119         if (!left)                                                            \
1120           PAD (L' ');                                                         \
1121         outstring (string, len);                                              \
1122         if (left)                                                             \
1123           PAD (L' ');                                                         \
1124         if (__glibc_unlikely (string_malloced))                               \
1125           free (string);                                                      \
1126       }                                                                       \
1127       break;
1128 #else
1129 # define process_string_arg(fspec) \
1130     LABEL (form_character):                                                   \
1131       /* Character.  */                                                       \
1132       if (is_long)                                                            \
1133         goto LABEL (form_wcharacter);                                         \
1134       --width;  /* Account for the character itself.  */                      \
1135       if (!left)                                                              \
1136         PAD (' ');                                                            \
1137       if (fspec == NULL)                                                      \
1138         outchar ((unsigned char) va_arg (ap, int)); /* Promoted.  */          \
1139       else                                                                    \
1140         outchar ((unsigned char) args_value[fspec->data_arg].pa_int);         \
1141       if (left)                                                               \
1142         PAD (' ');                                                            \
1143       break;                                                                  \
1144                                                                               \
1145     LABEL (form_wcharacter):                                                  \
1146       {                                                                       \
1147         /* Wide character.  */                                                \
1148         char buf[MB_CUR_MAX];                                                 \
1149         mbstate_t mbstate;                                                    \
1150         size_t len;                                                           \
1151                                                                               \
1152         memset (&mbstate, '\0', sizeof (mbstate_t));                          \
1153         len = __wcrtomb (buf, (fspec == NULL ? va_arg (ap, wchar_t)           \
1154                                : args_value[fspec->data_arg].pa_wchar),       \
1155                          &mbstate);                                           \
1156         if (len == (size_t) -1)                                               \
1157           {                                                                   \
1158             /* Something went wrong during the conversion.  Bail out.  */     \
1159             done = -1;                                                        \
1160             goto all_done;                                                    \
1161           }                                                                   \
1162         width -= len;                                                         \
1163         if (!left)                                                            \
1164           PAD (' ');                                                          \
1165         outstring (buf, len);                                                 \
1166         if (left)                                                             \
1167           PAD (' ');                                                          \
1168       }                                                                       \
1169       break;                                                                  \
1170                                                                               \
1171     LABEL (form_string):                                                      \
1172       {                                                                       \
1173         size_t len;                                                           \
1174         int string_malloced;                                                  \
1175                                                                               \
1176         /* The string argument could in fact be `char *' or `wchar_t *'.      \
1177            But this should not make a difference here.  */                    \
1178         if (fspec == NULL)                                                    \
1179           string = (char *) va_arg (ap, const char *);                        \
1180         else                                                                  \
1181           string = (char *) args_value[fspec->data_arg].pa_string;            \
1182                                                                               \
1183         /* Entry point for printing other strings.  */                        \
1184       LABEL (print_string):                                                   \
1185                                                                               \
1186         string_malloced = 0;                                                  \
1187         if (string == NULL)                                                   \
1188           {                                                                   \
1189             /* Write "(null)" if there's space.  */                           \
1190             if (prec == -1 || prec >= (int) sizeof (null) - 1)                \
1191               {                                                               \
1192                 string = (char *) null;                                       \
1193                 len = sizeof (null) - 1;                                      \
1194               }                                                               \
1195             else                                                              \
1196               {                                                               \
1197                 string = (char *) "";                                         \
1198                 len = 0;                                                      \
1199               }                                                               \
1200           }                                                                   \
1201         else if (!is_long && spec != L_('S'))                                 \
1202           {                                                                   \
1203             if (prec != -1)                                                   \
1204               /* Search for the end of the string, but don't search past      \
1205                  the length (in bytes) specified by the precision.  */        \
1206               len = __strnlen (string, prec);                                 \
1207             else                                                              \
1208               len = strlen (string);                                          \
1209           }                                                                   \
1210         else                                                                  \
1211           {                                                                   \
1212             const wchar_t *s2 = (const wchar_t *) string;                     \
1213             mbstate_t mbstate;                                                \
1214                                                                               \
1215             memset (&mbstate, '\0', sizeof (mbstate_t));                      \
1216                                                                               \
1217             if (prec >= 0)                                                    \
1218               {                                                               \
1219                 /* The string `s2' might not be NUL terminated.  */           \
1220                 if (__libc_use_alloca (prec))                                 \
1221                   string = (char *) alloca (prec);                            \
1222                 else if ((string = (char *) malloc (prec)) == NULL)           \
1223                   {                                                           \
1224                     done = -1;                                                \
1225                     goto all_done;                                            \
1226                   }                                                           \
1227                 else                                                          \
1228                   string_malloced = 1;                                        \
1229                 len = __wcsrtombs (string, &s2, prec, &mbstate);              \
1230               }                                                               \
1231             else                                                              \
1232               {                                                               \
1233                 len = __wcsrtombs (NULL, &s2, 0, &mbstate);                   \
1234                 if (len != (size_t) -1)                                       \
1235                   {                                                           \
1236                     assert (__mbsinit (&mbstate));                            \
1237                     s2 = (const wchar_t *) string;                            \
1238                     if (__libc_use_alloca (len + 1))                          \
1239                       string = (char *) alloca (len + 1);                     \
1240                     else if ((string = (char *) malloc (len + 1)) == NULL)    \
1241                       {                                                       \
1242                         done = -1;                                            \
1243                         goto all_done;                                        \
1244                       }                                                       \
1245                     else                                                      \
1246                       string_malloced = 1;                                    \
1247                     (void) __wcsrtombs (string, &s2, len + 1, &mbstate);      \
1248                   }                                                           \
1249               }                                                               \
1250                                                                               \
1251             if (len == (size_t) -1)                                           \
1252               {                                                               \
1253                 /* Illegal wide-character string.  */                         \
1254                 done = -1;                                                    \
1255                 goto all_done;                                                \
1256               }                                                               \
1257           }                                                                   \
1258                                                                               \
1259         if ((width -= len) < 0)                                               \
1260           {                                                                   \
1261             outstring (string, len);                                          \
1262             break;                                                            \
1263           }                                                                   \
1264                                                                               \
1265         if (!left)                                                            \
1266           PAD (' ');                                                          \
1267         outstring (string, len);                                              \
1268         if (left)                                                             \
1269           PAD (' ');                                                          \
1270         if (__glibc_unlikely (string_malloced))                               \
1271           free (string);                                                      \
1272       }                                                                       \
1273       break;
1274 #endif
1275
1276   /* Orient the stream.  */
1277 #ifdef ORIENT
1278   ORIENT;
1279 #endif
1280
1281   /* Sanity check of arguments.  */
1282   ARGCHECK (s, format);
1283
1284 #ifdef ORIENT
1285   /* Check for correct orientation.  */
1286   if (_IO_vtable_offset (s) == 0 &&
1287       _IO_fwide (s, sizeof (CHAR_T) == 1 ? -1 : 1)
1288       != (sizeof (CHAR_T) == 1 ? -1 : 1))
1289     /* The stream is already oriented otherwise.  */
1290     return EOF;
1291 #endif
1292
1293   if (UNBUFFERED_P (s))
1294     /* Use a helper function which will allocate a local temporary buffer
1295        for the stream and then call us again.  */
1296     return buffered_vfprintf (s, format, ap);
1297
1298   /* Initialize local variables.  */
1299   done = 0;
1300   grouping = (const char *) -1;
1301 #ifdef __va_copy
1302   /* This macro will be available soon in gcc's <stdarg.h>.  We need it
1303      since on some systems `va_list' is not an integral type.  */
1304   __va_copy (ap_save, ap);
1305 #else
1306   ap_save = ap;
1307 #endif
1308   nspecs_done = 0;
1309
1310 #ifdef COMPILE_WPRINTF
1311   /* Find the first format specifier.  */
1312   f = lead_str_end = __find_specwc ((const UCHAR_T *) format);
1313 #else
1314   /* Find the first format specifier.  */
1315   f = lead_str_end = __find_specmb ((const UCHAR_T *) format);
1316 #endif
1317
1318   /* Lock stream.  */
1319   _IO_cleanup_region_start ((void (*) (void *)) &_IO_funlockfile, s);
1320   _IO_flockfile (s);
1321
1322   /* Write the literal text before the first format.  */
1323   outstring ((const UCHAR_T *) format,
1324              lead_str_end - (const UCHAR_T *) format);
1325
1326   /* If we only have to print a simple string, return now.  */
1327   if (*f == L_('\0'))
1328     goto all_done;
1329
1330   /* Use the slow path in case any printf handler is registered.  */
1331   if (__glibc_unlikely (__printf_function_table != NULL
1332                         || __printf_modifier_table != NULL
1333                         || __printf_va_arg_table != NULL))
1334     goto do_positional;
1335
1336   /* Process whole format string.  */
1337   do
1338     {
1339 #ifdef SHARED
1340 # define REF(Name) &&do_##Name - &&do_form_unknown
1341 #else
1342 # define REF(Name) &&do_##Name
1343 #endif
1344 #define LABEL(Name) do_##Name
1345       STEP0_3_TABLE;
1346       STEP4_TABLE;
1347
1348       union printf_arg *args_value;     /* This is not used here but ... */
1349       int is_negative;  /* Flag for negative number.  */
1350       union
1351       {
1352         unsigned long long int longlong;
1353         unsigned long int word;
1354       } number;
1355       int base;
1356       union printf_arg the_arg;
1357       CHAR_T *string;   /* Pointer to argument string.  */
1358       int alt = 0;      /* Alternate format.  */
1359       int space = 0;    /* Use space prefix if no sign is needed.  */
1360       int left = 0;     /* Left-justify output.  */
1361       int showsign = 0; /* Always begin with plus or minus sign.  */
1362       int group = 0;    /* Print numbers according grouping rules.  */
1363       int is_long_double = 0; /* Argument is long double/ long long int.  */
1364       int is_short = 0; /* Argument is short int.  */
1365       int is_long = 0;  /* Argument is long int.  */
1366       int is_char = 0;  /* Argument is promoted (unsigned) char.  */
1367       int width = 0;    /* Width of output; 0 means none specified.  */
1368       int prec = -1;    /* Precision of output; -1 means none specified.  */
1369       /* This flag is set by the 'I' modifier and selects the use of the
1370          `outdigits' as determined by the current locale.  */
1371       int use_outdigits = 0;
1372       UCHAR_T pad = L_(' ');/* Padding character.  */
1373       CHAR_T spec;
1374
1375       workstart = NULL;
1376       workend = &work_buffer[sizeof (work_buffer) / sizeof (CHAR_T)];
1377
1378       /* Get current character in format string.  */
1379       JUMP (*++f, step0_jumps);
1380
1381       /* ' ' flag.  */
1382     LABEL (flag_space):
1383       space = 1;
1384       JUMP (*++f, step0_jumps);
1385
1386       /* '+' flag.  */
1387     LABEL (flag_plus):
1388       showsign = 1;
1389       JUMP (*++f, step0_jumps);
1390
1391       /* The '-' flag.  */
1392     LABEL (flag_minus):
1393       left = 1;
1394       pad = L_(' ');
1395       JUMP (*++f, step0_jumps);
1396
1397       /* The '#' flag.  */
1398     LABEL (flag_hash):
1399       alt = 1;
1400       JUMP (*++f, step0_jumps);
1401
1402       /* The '0' flag.  */
1403     LABEL (flag_zero):
1404       if (!left)
1405         pad = L_('0');
1406       JUMP (*++f, step0_jumps);
1407
1408       /* The '\'' flag.  */
1409     LABEL (flag_quote):
1410       group = 1;
1411
1412       if (grouping == (const char *) -1)
1413         {
1414 #ifdef COMPILE_WPRINTF
1415           thousands_sep = _NL_CURRENT_WORD (LC_NUMERIC,
1416                                             _NL_NUMERIC_THOUSANDS_SEP_WC);
1417 #else
1418           thousands_sep = _NL_CURRENT (LC_NUMERIC, THOUSANDS_SEP);
1419 #endif
1420
1421           grouping = _NL_CURRENT (LC_NUMERIC, GROUPING);
1422           if (*grouping == '\0' || *grouping == CHAR_MAX
1423 #ifdef COMPILE_WPRINTF
1424               || thousands_sep == L'\0'
1425 #else
1426               || *thousands_sep == '\0'
1427 #endif
1428               )
1429             grouping = NULL;
1430         }
1431       JUMP (*++f, step0_jumps);
1432
1433     LABEL (flag_i18n):
1434       use_outdigits = 1;
1435       JUMP (*++f, step0_jumps);
1436
1437       /* Get width from argument.  */
1438     LABEL (width_asterics):
1439       {
1440         const UCHAR_T *tmp;     /* Temporary value.  */
1441
1442         tmp = ++f;
1443         if (ISDIGIT (*tmp))
1444           {
1445             int pos = read_int (&tmp);
1446
1447             if (pos == -1)
1448               {
1449                 __set_errno (EOVERFLOW);
1450                 done = -1;
1451                 goto all_done;
1452               }
1453
1454             if (pos && *tmp == L_('$'))
1455               /* The width comes from a positional parameter.  */
1456               goto do_positional;
1457           }
1458         width = va_arg (ap, int);
1459
1460         /* Negative width means left justified.  */
1461         if (width < 0)
1462           {
1463             width = -width;
1464             pad = L_(' ');
1465             left = 1;
1466           }
1467
1468         if (__glibc_unlikely (width >= INT_MAX / sizeof (CHAR_T) - 32))
1469           {
1470             __set_errno (EOVERFLOW);
1471             done = -1;
1472             goto all_done;
1473           }
1474
1475         if (width >= sizeof (work_buffer) / sizeof (work_buffer[0]) - 32)
1476           {
1477             /* We have to use a special buffer.  The "32" is just a safe
1478                bet for all the output which is not counted in the width.  */
1479             size_t needed = ((size_t) width + 32) * sizeof (CHAR_T);
1480             if (__libc_use_alloca (needed))
1481               workend = (CHAR_T *) alloca (needed) + width + 32;
1482             else
1483               {
1484                 workstart = (CHAR_T *) malloc (needed);
1485                 if (workstart == NULL)
1486                   {
1487                     done = -1;
1488                     goto all_done;
1489                   }
1490                 workend = workstart + width + 32;
1491               }
1492           }
1493       }
1494       JUMP (*f, step1_jumps);
1495
1496       /* Given width in format string.  */
1497     LABEL (width):
1498       width = read_int (&f);
1499
1500       if (__glibc_unlikely (width == -1
1501                             || width >= INT_MAX / sizeof (CHAR_T) - 32))
1502         {
1503           __set_errno (EOVERFLOW);
1504           done = -1;
1505           goto all_done;
1506         }
1507
1508       if (width >= sizeof (work_buffer) / sizeof (work_buffer[0]) - 32)
1509         {
1510           /* We have to use a special buffer.  The "32" is just a safe
1511              bet for all the output which is not counted in the width.  */
1512           size_t needed = ((size_t) width + 32) * sizeof (CHAR_T);
1513           if (__libc_use_alloca (needed))
1514             workend = (CHAR_T *) alloca (needed) + width + 32;
1515           else
1516             {
1517               workstart = (CHAR_T *) malloc (needed);
1518               if (workstart == NULL)
1519                 {
1520                   done = -1;
1521                   goto all_done;
1522                 }
1523               workend = workstart + width + 32;
1524             }
1525         }
1526       if (*f == L_('$'))
1527         /* Oh, oh.  The argument comes from a positional parameter.  */
1528         goto do_positional;
1529       JUMP (*f, step1_jumps);
1530
1531     LABEL (precision):
1532       ++f;
1533       if (*f == L_('*'))
1534         {
1535           const UCHAR_T *tmp;   /* Temporary value.  */
1536
1537           tmp = ++f;
1538           if (ISDIGIT (*tmp))
1539             {
1540               int pos = read_int (&tmp);
1541
1542               if (pos == -1)
1543                 {
1544                   __set_errno (EOVERFLOW);
1545                   done = -1;
1546                   goto all_done;
1547                 }
1548
1549               if (pos && *tmp == L_('$'))
1550                 /* The precision comes from a positional parameter.  */
1551                 goto do_positional;
1552             }
1553           prec = va_arg (ap, int);
1554
1555           /* If the precision is negative the precision is omitted.  */
1556           if (prec < 0)
1557             prec = -1;
1558         }
1559       else if (ISDIGIT (*f))
1560         {
1561           prec = read_int (&f);
1562
1563           /* The precision was specified in this case as an extremely
1564              large positive value.  */
1565           if (prec == -1)
1566             {
1567               __set_errno (EOVERFLOW);
1568               done = -1;
1569               goto all_done;
1570             }
1571         }
1572       else
1573         prec = 0;
1574       if (prec > width
1575           && prec > sizeof (work_buffer) / sizeof (work_buffer[0]) - 32)
1576         {
1577           if (__glibc_unlikely (prec >= INT_MAX / sizeof (CHAR_T) - 32))
1578             {
1579               __set_errno (EOVERFLOW);
1580               done = -1;
1581               goto all_done;
1582             }
1583           size_t needed = ((size_t) prec + 32) * sizeof (CHAR_T);
1584
1585           if (__libc_use_alloca (needed))
1586             workend = (CHAR_T *) alloca (needed) + prec + 32;
1587           else
1588             {
1589               workstart = (CHAR_T *) malloc (needed);
1590               if (workstart == NULL)
1591                 {
1592                   done = -1;
1593                   goto all_done;
1594                 }
1595               workend = workstart + prec + 32;
1596             }
1597         }
1598       JUMP (*f, step2_jumps);
1599
1600       /* Process 'h' modifier.  There might another 'h' following.  */
1601     LABEL (mod_half):
1602       is_short = 1;
1603       JUMP (*++f, step3a_jumps);
1604
1605       /* Process 'hh' modifier.  */
1606     LABEL (mod_halfhalf):
1607       is_short = 0;
1608       is_char = 1;
1609       JUMP (*++f, step4_jumps);
1610
1611       /* Process 'l' modifier.  There might another 'l' following.  */
1612     LABEL (mod_long):
1613       is_long = 1;
1614       JUMP (*++f, step3b_jumps);
1615
1616       /* Process 'L', 'q', or 'll' modifier.  No other modifier is
1617          allowed to follow.  */
1618     LABEL (mod_longlong):
1619       is_long_double = 1;
1620       is_long = 1;
1621       JUMP (*++f, step4_jumps);
1622
1623     LABEL (mod_size_t):
1624       is_long_double = sizeof (size_t) > sizeof (unsigned long int);
1625       is_long = sizeof (size_t) > sizeof (unsigned int);
1626       JUMP (*++f, step4_jumps);
1627
1628     LABEL (mod_ptrdiff_t):
1629       is_long_double = sizeof (ptrdiff_t) > sizeof (unsigned long int);
1630       is_long = sizeof (ptrdiff_t) > sizeof (unsigned int);
1631       JUMP (*++f, step4_jumps);
1632
1633     LABEL (mod_intmax_t):
1634       is_long_double = sizeof (intmax_t) > sizeof (unsigned long int);
1635       is_long = sizeof (intmax_t) > sizeof (unsigned int);
1636       JUMP (*++f, step4_jumps);
1637
1638       /* Process current format.  */
1639       while (1)
1640         {
1641           process_arg (((struct printf_spec *) NULL));
1642           process_string_arg (((struct printf_spec *) NULL));
1643
1644         LABEL (form_unknown):
1645           if (spec == L_('\0'))
1646             {
1647               /* The format string ended before the specifier is complete.  */
1648               __set_errno (EINVAL);
1649               done = -1;
1650               goto all_done;
1651             }
1652
1653           /* If we are in the fast loop force entering the complicated
1654              one.  */
1655           goto do_positional;
1656         }
1657
1658       /* The format is correctly handled.  */
1659       ++nspecs_done;
1660
1661       if (__glibc_unlikely (workstart != NULL))
1662         free (workstart);
1663       workstart = NULL;
1664
1665       /* Look for next format specifier.  */
1666 #ifdef COMPILE_WPRINTF
1667       f = __find_specwc ((end_of_spec = ++f));
1668 #else
1669       f = __find_specmb ((end_of_spec = ++f));
1670 #endif
1671
1672       /* Write the following constant string.  */
1673       outstring (end_of_spec, f - end_of_spec);
1674     }
1675   while (*f != L_('\0'));
1676
1677   /* Unlock stream and return.  */
1678   goto all_done;
1679
1680   /* Here starts the more complex loop to handle positional parameters.  */
1681 do_positional:
1682   {
1683     /* Array with information about the needed arguments.  This has to
1684        be dynamically extensible.  */
1685     size_t nspecs = 0;
1686     /* A more or less arbitrary start value.  */
1687     size_t nspecs_size = 32 * sizeof (struct printf_spec);
1688
1689     specs = alloca (nspecs_size);
1690     /* The number of arguments the format string requests.  This will
1691        determine the size of the array needed to store the argument
1692        attributes.  */
1693     size_t nargs = 0;
1694     size_t bytes_per_arg;
1695     union printf_arg *args_value;
1696     int *args_size;
1697     int *args_type;
1698
1699     /* Positional parameters refer to arguments directly.  This could
1700        also determine the maximum number of arguments.  Track the
1701        maximum number.  */
1702     size_t max_ref_arg = 0;
1703
1704     /* Just a counter.  */
1705     size_t cnt;
1706
1707     if (__glibc_unlikely (workstart != NULL))
1708       free (workstart);
1709     workstart = NULL;
1710
1711     if (grouping == (const char *) -1)
1712       {
1713 #ifdef COMPILE_WPRINTF
1714         thousands_sep = _NL_CURRENT_WORD (LC_NUMERIC,
1715                                           _NL_NUMERIC_THOUSANDS_SEP_WC);
1716 #else
1717         thousands_sep = _NL_CURRENT (LC_NUMERIC, THOUSANDS_SEP);
1718 #endif
1719
1720         grouping = _NL_CURRENT (LC_NUMERIC, GROUPING);
1721         if (*grouping == '\0' || *grouping == CHAR_MAX)
1722           grouping = NULL;
1723       }
1724
1725     for (f = lead_str_end; *f != L_('\0'); f = specs[nspecs++].next_fmt)
1726       {
1727         if (nspecs * sizeof (*specs) >= nspecs_size)
1728           {
1729             /* Extend the array of format specifiers.  */
1730             if (nspecs_size * 2 < nspecs_size)
1731               {
1732                 __set_errno (ENOMEM);
1733                 done = -1;
1734                 goto all_done;
1735               }
1736             struct printf_spec *old = specs;
1737             if (__libc_use_alloca (2 * nspecs_size))
1738               specs = extend_alloca (specs, nspecs_size, 2 * nspecs_size);
1739             else
1740               {
1741                 nspecs_size *= 2;
1742                 specs = malloc (nspecs_size);
1743                 if (specs == NULL)
1744                   {
1745                     __set_errno (ENOMEM);
1746                     specs = old;
1747                     done = -1;
1748                     goto all_done;
1749                   }
1750               }
1751
1752             /* Copy the old array's elements to the new space.  */
1753             memmove (specs, old, nspecs * sizeof (*specs));
1754
1755             /* If we had previously malloc'd space for SPECS, then
1756                release it after the copy is complete.  */
1757             if (specs_malloced)
1758               free (old);
1759
1760             /* Now set SPECS_MALLOCED if needed.  */
1761             if (!__libc_use_alloca (nspecs_size))
1762               specs_malloced = true;
1763           }
1764
1765         /* Parse the format specifier.  */
1766 #ifdef COMPILE_WPRINTF
1767         nargs += __parse_one_specwc (f, nargs, &specs[nspecs], &max_ref_arg);
1768 #else
1769         nargs += __parse_one_specmb (f, nargs, &specs[nspecs], &max_ref_arg);
1770 #endif
1771       }
1772
1773     /* Determine the number of arguments the format string consumes.  */
1774     nargs = MAX (nargs, max_ref_arg);
1775     /* Calculate total size needed to represent a single argument across
1776        all three argument-related arrays.  */
1777     bytes_per_arg = (sizeof (*args_value) + sizeof (*args_size)
1778                      + sizeof (*args_type));
1779
1780     /* Check for potential integer overflow.  */
1781     if (__glibc_unlikely (nargs > INT_MAX / bytes_per_arg))
1782       {
1783          __set_errno (EOVERFLOW);
1784          done = -1;
1785          goto all_done;
1786       }
1787
1788     /* Allocate memory for all three argument arrays.  */
1789     if (__libc_use_alloca (nargs * bytes_per_arg))
1790         args_value = alloca (nargs * bytes_per_arg);
1791     else
1792       {
1793         args_value = args_malloced = malloc (nargs * bytes_per_arg);
1794         if (args_value == NULL)
1795           {
1796             done = -1;
1797             goto all_done;
1798           }
1799       }
1800
1801     /* Set up the remaining two arrays to each point past the end of the
1802        prior array, since space for all three has been allocated now.  */
1803     args_size = &args_value[nargs].pa_int;
1804     args_type = &args_size[nargs];
1805     memset (args_type, s->_flags2 & _IO_FLAGS2_FORTIFY ? '\xff' : '\0',
1806             nargs * sizeof (*args_type));
1807
1808     /* XXX Could do sanity check here: If any element in ARGS_TYPE is
1809        still zero after this loop, format is invalid.  For now we
1810        simply use 0 as the value.  */
1811
1812     /* Fill in the types of all the arguments.  */
1813     for (cnt = 0; cnt < nspecs; ++cnt)
1814       {
1815         /* If the width is determined by an argument this is an int.  */
1816         if (specs[cnt].width_arg != -1)
1817           args_type[specs[cnt].width_arg] = PA_INT;
1818
1819         /* If the precision is determined by an argument this is an int.  */
1820         if (specs[cnt].prec_arg != -1)
1821           args_type[specs[cnt].prec_arg] = PA_INT;
1822
1823         switch (specs[cnt].ndata_args)
1824           {
1825           case 0:               /* No arguments.  */
1826             break;
1827           case 1:               /* One argument; we already have the
1828                                    type and size.  */
1829             args_type[specs[cnt].data_arg] = specs[cnt].data_arg_type;
1830             args_size[specs[cnt].data_arg] = specs[cnt].size;
1831             break;
1832           default:
1833             /* We have more than one argument for this format spec.
1834                We must call the arginfo function again to determine
1835                all the types.  */
1836             (void) (*__printf_arginfo_table[specs[cnt].info.spec])
1837               (&specs[cnt].info,
1838                specs[cnt].ndata_args, &args_type[specs[cnt].data_arg],
1839                &args_size[specs[cnt].data_arg]);
1840             break;
1841           }
1842       }
1843
1844     /* Now we know all the types and the order.  Fill in the argument
1845        values.  */
1846     for (cnt = 0; cnt < nargs; ++cnt)
1847       switch (args_type[cnt])
1848         {
1849 #define T(tag, mem, type)                                                     \
1850         case tag:                                                             \
1851           args_value[cnt].mem = va_arg (ap_save, type);                       \
1852           break
1853
1854         T (PA_WCHAR, pa_wchar, wint_t);
1855         case PA_CHAR:                           /* Promoted.  */
1856         case PA_INT|PA_FLAG_SHORT:              /* Promoted.  */
1857 #if LONG_MAX == INT_MAX
1858         case PA_INT|PA_FLAG_LONG:
1859 #endif
1860         T (PA_INT, pa_int, int);
1861 #if LONG_MAX == LONG_LONG_MAX
1862         case PA_INT|PA_FLAG_LONG:
1863 #endif
1864         T (PA_INT|PA_FLAG_LONG_LONG, pa_long_long_int, long long int);
1865 #if LONG_MAX != INT_MAX && LONG_MAX != LONG_LONG_MAX
1866 # error "he?"
1867 #endif
1868         case PA_FLOAT:                          /* Promoted.  */
1869         T (PA_DOUBLE, pa_double, double);
1870         case PA_DOUBLE|PA_FLAG_LONG_DOUBLE:
1871           if (__ldbl_is_dbl)
1872             {
1873               args_value[cnt].pa_double = va_arg (ap_save, double);
1874               args_type[cnt] &= ~PA_FLAG_LONG_DOUBLE;
1875             }
1876           else
1877             args_value[cnt].pa_long_double = va_arg (ap_save, long double);
1878           break;
1879         case PA_STRING:                         /* All pointers are the same */
1880         case PA_WSTRING:                        /* All pointers are the same */
1881         T (PA_POINTER, pa_pointer, void *);
1882 #undef T
1883         default:
1884           if ((args_type[cnt] & PA_FLAG_PTR) != 0)
1885             args_value[cnt].pa_pointer = va_arg (ap_save, void *);
1886           else if (__glibc_unlikely (__printf_va_arg_table != NULL)
1887                    && __printf_va_arg_table[args_type[cnt] - PA_LAST] != NULL)
1888             {
1889               args_value[cnt].pa_user = alloca (args_size[cnt]);
1890               (*__printf_va_arg_table[args_type[cnt] - PA_LAST])
1891                 (args_value[cnt].pa_user, &ap_save);
1892             }
1893           else
1894             args_value[cnt].pa_long_double = 0.0;
1895           break;
1896         case -1:
1897           /* Error case.  Not all parameters appear in N$ format
1898              strings.  We have no way to determine their type.  */
1899           assert (s->_flags2 & _IO_FLAGS2_FORTIFY);
1900           __libc_fatal ("*** invalid %N$ use detected ***\n");
1901         }
1902
1903     /* Now walk through all format specifiers and process them.  */
1904     for (; (size_t) nspecs_done < nspecs; ++nspecs_done)
1905       {
1906 #undef REF
1907 #ifdef SHARED
1908 # define REF(Name) &&do2_##Name - &&do_form_unknown
1909 #else
1910 # define REF(Name) &&do2_##Name
1911 #endif
1912 #undef LABEL
1913 #define LABEL(Name) do2_##Name
1914         STEP4_TABLE;
1915
1916         int is_negative;
1917         union
1918         {
1919           unsigned long long int longlong;
1920           unsigned long int word;
1921         } number;
1922         int base;
1923         union printf_arg the_arg;
1924         CHAR_T *string;         /* Pointer to argument string.  */
1925
1926         /* Fill variables from values in struct.  */
1927         int alt = specs[nspecs_done].info.alt;
1928         int space = specs[nspecs_done].info.space;
1929         int left = specs[nspecs_done].info.left;
1930         int showsign = specs[nspecs_done].info.showsign;
1931         int group = specs[nspecs_done].info.group;
1932         int is_long_double = specs[nspecs_done].info.is_long_double;
1933         int is_short = specs[nspecs_done].info.is_short;
1934         int is_char = specs[nspecs_done].info.is_char;
1935         int is_long = specs[nspecs_done].info.is_long;
1936         int width = specs[nspecs_done].info.width;
1937         int prec = specs[nspecs_done].info.prec;
1938         int use_outdigits = specs[nspecs_done].info.i18n;
1939         char pad = specs[nspecs_done].info.pad;
1940         CHAR_T spec = specs[nspecs_done].info.spec;
1941
1942         workstart = NULL;
1943         workend = &work_buffer[sizeof (work_buffer) / sizeof (CHAR_T)];
1944
1945         /* Fill in last information.  */
1946         if (specs[nspecs_done].width_arg != -1)
1947           {
1948             /* Extract the field width from an argument.  */
1949             specs[nspecs_done].info.width =
1950               args_value[specs[nspecs_done].width_arg].pa_int;
1951
1952             if (specs[nspecs_done].info.width < 0)
1953               /* If the width value is negative left justification is
1954                  selected and the value is taken as being positive.  */
1955               {
1956                 specs[nspecs_done].info.width *= -1;
1957                 left = specs[nspecs_done].info.left = 1;
1958               }
1959             width = specs[nspecs_done].info.width;
1960           }
1961
1962         if (specs[nspecs_done].prec_arg != -1)
1963           {
1964             /* Extract the precision from an argument.  */
1965             specs[nspecs_done].info.prec =
1966               args_value[specs[nspecs_done].prec_arg].pa_int;
1967
1968             if (specs[nspecs_done].info.prec < 0)
1969               /* If the precision is negative the precision is
1970                  omitted.  */
1971               specs[nspecs_done].info.prec = -1;
1972
1973             prec = specs[nspecs_done].info.prec;
1974           }
1975
1976         /* Maybe the buffer is too small.  */
1977         if (MAX (prec, width) + 32 > (int) (sizeof (work_buffer)
1978                                             / sizeof (CHAR_T)))
1979           {
1980             if (__libc_use_alloca ((MAX (prec, width) + 32)
1981                                    * sizeof (CHAR_T)))
1982               workend = ((CHAR_T *) alloca ((MAX (prec, width) + 32)
1983                                             * sizeof (CHAR_T))
1984                          + (MAX (prec, width) + 32));
1985             else
1986               {
1987                 workstart = (CHAR_T *) malloc ((MAX (prec, width) + 32)
1988                                                * sizeof (CHAR_T));
1989                 if (workstart == NULL)
1990                   {
1991                     done = -1;
1992                     goto all_done;
1993                   }
1994                 workend = workstart + (MAX (prec, width) + 32);
1995               }
1996           }
1997
1998         /* Process format specifiers.  */
1999         while (1)
2000           {
2001             extern printf_function **__printf_function_table;
2002             int function_done;
2003
2004             if (spec <= UCHAR_MAX
2005                 && __printf_function_table != NULL
2006                 && __printf_function_table[(size_t) spec] != NULL)
2007               {
2008                 const void **ptr = alloca (specs[nspecs_done].ndata_args
2009                                            * sizeof (const void *));
2010
2011                 /* Fill in an array of pointers to the argument values.  */
2012                 for (unsigned int i = 0; i < specs[nspecs_done].ndata_args;
2013                      ++i)
2014                   ptr[i] = &args_value[specs[nspecs_done].data_arg + i];
2015
2016                 /* Call the function.  */
2017                 function_done = __printf_function_table[(size_t) spec]
2018                   (s, &specs[nspecs_done].info, ptr);
2019
2020                 if (function_done != -2)
2021                   {
2022                     /* If an error occurred we don't have information
2023                        about # of chars.  */
2024                     if (function_done < 0)
2025                       {
2026                         /* Function has set errno.  */
2027                         done = -1;
2028                         goto all_done;
2029                       }
2030
2031                     done_add (function_done);
2032                     break;
2033                   }
2034               }
2035
2036             JUMP (spec, step4_jumps);
2037
2038             process_arg ((&specs[nspecs_done]));
2039             process_string_arg ((&specs[nspecs_done]));
2040
2041           LABEL (form_unknown):
2042             {
2043               unsigned int i;
2044               const void **ptr;
2045
2046               ptr = alloca (specs[nspecs_done].ndata_args
2047                             * sizeof (const void *));
2048
2049               /* Fill in an array of pointers to the argument values.  */
2050               for (i = 0; i < specs[nspecs_done].ndata_args; ++i)
2051                 ptr[i] = &args_value[specs[nspecs_done].data_arg + i];
2052
2053               /* Call the function.  */
2054               function_done = printf_unknown (s, &specs[nspecs_done].info,
2055                                               ptr);
2056
2057               /* If an error occurred we don't have information about #
2058                  of chars.  */
2059               if (function_done < 0)
2060                 {
2061                   /* Function has set errno.  */
2062                   done = -1;
2063                   goto all_done;
2064                 }
2065
2066               done_add (function_done);
2067             }
2068             break;
2069           }
2070
2071         if (__glibc_unlikely (workstart != NULL))
2072           free (workstart);
2073         workstart = NULL;
2074
2075         /* Write the following constant string.  */
2076         outstring (specs[nspecs_done].end_of_fmt,
2077                    specs[nspecs_done].next_fmt
2078                    - specs[nspecs_done].end_of_fmt);
2079       }
2080   }
2081
2082 all_done:
2083   if (specs_malloced)
2084     free (specs);
2085   if (__glibc_unlikely (args_malloced != NULL))
2086     free (args_malloced);
2087   if (__glibc_unlikely (workstart != NULL))
2088     free (workstart);
2089   /* Unlock the stream.  */
2090   _IO_funlockfile (s);
2091   _IO_cleanup_region_end (0);
2092
2093   return done;
2094 }
2095 \f
2096 /* Handle an unknown format specifier.  This prints out a canonicalized
2097    representation of the format spec itself.  */
2098 static int
2099 printf_unknown (FILE *s, const struct printf_info *info,
2100                 const void *const *args)
2101
2102 {
2103   int done = 0;
2104   CHAR_T work_buffer[MAX (sizeof (info->width), sizeof (info->prec)) * 3];
2105   CHAR_T *const workend
2106     = &work_buffer[sizeof (work_buffer) / sizeof (CHAR_T)];
2107   CHAR_T *w;
2108
2109   outchar (L_('%'));
2110
2111   if (info->alt)
2112     outchar (L_('#'));
2113   if (info->group)
2114     outchar (L_('\''));
2115   if (info->showsign)
2116     outchar (L_('+'));
2117   else if (info->space)
2118     outchar (L_(' '));
2119   if (info->left)
2120     outchar (L_('-'));
2121   if (info->pad == L_('0'))
2122     outchar (L_('0'));
2123   if (info->i18n)
2124     outchar (L_('I'));
2125
2126   if (info->width != 0)
2127     {
2128       w = _itoa_word (info->width, workend, 10, 0);
2129       while (w < workend)
2130         outchar (*w++);
2131     }
2132
2133   if (info->prec != -1)
2134     {
2135       outchar (L_('.'));
2136       w = _itoa_word (info->prec, workend, 10, 0);
2137       while (w < workend)
2138         outchar (*w++);
2139     }
2140
2141   if (info->spec != L_('\0'))
2142     outchar (info->spec);
2143
2144  all_done:
2145   return done;
2146 }
2147 \f
2148 /* Group the digits according to the grouping rules of the current locale.
2149    The interpretation of GROUPING is as in `struct lconv' from <locale.h>.  */
2150 static CHAR_T *
2151 internal_function
2152 group_number (CHAR_T *w, CHAR_T *rear_ptr, const char *grouping,
2153 #ifdef COMPILE_WPRINTF
2154               wchar_t thousands_sep
2155 #else
2156               const char *thousands_sep
2157 #endif
2158               )
2159 {
2160   int len;
2161   CHAR_T *src, *s;
2162 #ifndef COMPILE_WPRINTF
2163   int tlen = strlen (thousands_sep);
2164 #endif
2165
2166   /* We treat all negative values like CHAR_MAX.  */
2167
2168   if (*grouping == CHAR_MAX || *grouping <= 0)
2169     /* No grouping should be done.  */
2170     return w;
2171
2172   len = *grouping++;
2173
2174   /* Copy existing string so that nothing gets overwritten.  */
2175   src = (CHAR_T *) alloca ((rear_ptr - w) * sizeof (CHAR_T));
2176   s = (CHAR_T *) __mempcpy (src, w,
2177                             (rear_ptr - w) * sizeof (CHAR_T));
2178   w = rear_ptr;
2179
2180   /* Process all characters in the string.  */
2181   while (s > src)
2182     {
2183       *--w = *--s;
2184
2185       if (--len == 0 && s > src)
2186         {
2187           /* A new group begins.  */
2188 #ifdef COMPILE_WPRINTF
2189           *--w = thousands_sep;
2190 #else
2191           int cnt = tlen;
2192           do
2193             *--w = thousands_sep[--cnt];
2194           while (cnt > 0);
2195 #endif
2196
2197           if (*grouping == CHAR_MAX
2198 #if CHAR_MIN < 0
2199                    || *grouping < 0
2200 #endif
2201                    )
2202             {
2203               /* No further grouping to be done.
2204                  Copy the rest of the number.  */
2205               do
2206                 *--w = *--s;
2207               while (s > src);
2208               break;
2209             }
2210           else if (*grouping != '\0')
2211             /* The previous grouping repeats ad infinitum.  */
2212             len = *grouping++;
2213           else
2214             len = grouping[-1];
2215         }
2216     }
2217   return w;
2218 }
2219 \f
2220 /* Helper "class" for `fprintf to unbuffered': creates a temporary buffer.  */
2221 struct helper_file
2222   {
2223     struct _IO_FILE_plus _f;
2224 #ifdef COMPILE_WPRINTF
2225     struct _IO_wide_data _wide_data;
2226 #endif
2227     _IO_FILE *_put_stream;
2228 #ifdef _IO_MTSAFE_IO
2229     _IO_lock_t lock;
2230 #endif
2231   };
2232
2233 static int
2234 _IO_helper_overflow (_IO_FILE *s, int c)
2235 {
2236   _IO_FILE *target = ((struct helper_file*) s)->_put_stream;
2237 #ifdef COMPILE_WPRINTF
2238   int used = s->_wide_data->_IO_write_ptr - s->_wide_data->_IO_write_base;
2239   if (used)
2240     {
2241       _IO_size_t written = _IO_sputn (target, s->_wide_data->_IO_write_base,
2242                                       used);
2243       if (written == 0 || written == WEOF)
2244         return WEOF;
2245       __wmemmove (s->_wide_data->_IO_write_base,
2246                   s->_wide_data->_IO_write_base + written,
2247                   used - written);
2248       s->_wide_data->_IO_write_ptr -= written;
2249     }
2250 #else
2251   int used = s->_IO_write_ptr - s->_IO_write_base;
2252   if (used)
2253     {
2254       _IO_size_t written = _IO_sputn (target, s->_IO_write_base, used);
2255       if (written == 0 || written == EOF)
2256         return EOF;
2257       memmove (s->_IO_write_base, s->_IO_write_base + written,
2258                used - written);
2259       s->_IO_write_ptr -= written;
2260     }
2261 #endif
2262   return PUTC (c, s);
2263 }
2264
2265 #ifdef COMPILE_WPRINTF
2266 static const struct _IO_jump_t _IO_helper_jumps =
2267 {
2268   JUMP_INIT_DUMMY,
2269   JUMP_INIT (finish, _IO_wdefault_finish),
2270   JUMP_INIT (overflow, _IO_helper_overflow),
2271   JUMP_INIT (underflow, _IO_default_underflow),
2272   JUMP_INIT (uflow, _IO_default_uflow),
2273   JUMP_INIT (pbackfail, (_IO_pbackfail_t) _IO_wdefault_pbackfail),
2274   JUMP_INIT (xsputn, _IO_wdefault_xsputn),
2275   JUMP_INIT (xsgetn, _IO_wdefault_xsgetn),
2276   JUMP_INIT (seekoff, _IO_default_seekoff),
2277   JUMP_INIT (seekpos, _IO_default_seekpos),
2278   JUMP_INIT (setbuf, _IO_default_setbuf),
2279   JUMP_INIT (sync, _IO_default_sync),
2280   JUMP_INIT (doallocate, _IO_wdefault_doallocate),
2281   JUMP_INIT (read, _IO_default_read),
2282   JUMP_INIT (write, _IO_default_write),
2283   JUMP_INIT (seek, _IO_default_seek),
2284   JUMP_INIT (close, _IO_default_close),
2285   JUMP_INIT (stat, _IO_default_stat)
2286 };
2287 #else
2288 static const struct _IO_jump_t _IO_helper_jumps =
2289 {
2290   JUMP_INIT_DUMMY,
2291   JUMP_INIT (finish, _IO_default_finish),
2292   JUMP_INIT (overflow, _IO_helper_overflow),
2293   JUMP_INIT (underflow, _IO_default_underflow),
2294   JUMP_INIT (uflow, _IO_default_uflow),
2295   JUMP_INIT (pbackfail, _IO_default_pbackfail),
2296   JUMP_INIT (xsputn, _IO_default_xsputn),
2297   JUMP_INIT (xsgetn, _IO_default_xsgetn),
2298   JUMP_INIT (seekoff, _IO_default_seekoff),
2299   JUMP_INIT (seekpos, _IO_default_seekpos),
2300   JUMP_INIT (setbuf, _IO_default_setbuf),
2301   JUMP_INIT (sync, _IO_default_sync),
2302   JUMP_INIT (doallocate, _IO_default_doallocate),
2303   JUMP_INIT (read, _IO_default_read),
2304   JUMP_INIT (write, _IO_default_write),
2305   JUMP_INIT (seek, _IO_default_seek),
2306   JUMP_INIT (close, _IO_default_close),
2307   JUMP_INIT (stat, _IO_default_stat)
2308 };
2309 #endif
2310
2311 static int
2312 internal_function
2313 buffered_vfprintf (_IO_FILE *s, const CHAR_T *format,
2314                    _IO_va_list args)
2315 {
2316   CHAR_T buf[_IO_BUFSIZ];
2317   struct helper_file helper;
2318   _IO_FILE *hp = (_IO_FILE *) &helper._f;
2319   int result, to_flush;
2320
2321   /* Orient the stream.  */
2322 #ifdef ORIENT
2323   ORIENT;
2324 #endif
2325
2326   /* Initialize helper.  */
2327   helper._put_stream = s;
2328 #ifdef COMPILE_WPRINTF
2329   hp->_wide_data = &helper._wide_data;
2330   _IO_wsetp (hp, buf, buf + sizeof buf / sizeof (CHAR_T));
2331   hp->_mode = 1;
2332 #else
2333   _IO_setp (hp, buf, buf + sizeof buf);
2334   hp->_mode = -1;
2335 #endif
2336   hp->_IO_file_flags = _IO_MAGIC|_IO_NO_READS|_IO_USER_LOCK;
2337 #if _IO_JUMPS_OFFSET
2338   hp->_vtable_offset = 0;
2339 #endif
2340 #ifdef _IO_MTSAFE_IO
2341   hp->_lock = NULL;
2342 #endif
2343   hp->_flags2 = s->_flags2;
2344   _IO_JUMPS (&helper._f) = (struct _IO_jump_t *) &_IO_helper_jumps;
2345
2346   /* Now print to helper instead.  */
2347 #ifndef COMPILE_WPRINTF
2348   result = _IO_vfprintf (hp, format, args);
2349 #else
2350   result = vfprintf (hp, format, args);
2351 #endif
2352
2353   /* Lock stream.  */
2354   __libc_cleanup_region_start (1, (void (*) (void *)) &_IO_funlockfile, s);
2355   _IO_flockfile (s);
2356
2357   /* Now flush anything from the helper to the S. */
2358 #ifdef COMPILE_WPRINTF
2359   if ((to_flush = (hp->_wide_data->_IO_write_ptr
2360                    - hp->_wide_data->_IO_write_base)) > 0)
2361     {
2362       if ((int) _IO_sputn (s, hp->_wide_data->_IO_write_base, to_flush)
2363           != to_flush)
2364         result = -1;
2365     }
2366 #else
2367   if ((to_flush = hp->_IO_write_ptr - hp->_IO_write_base) > 0)
2368     {
2369       if ((int) _IO_sputn (s, hp->_IO_write_base, to_flush) != to_flush)
2370         result = -1;
2371     }
2372 #endif
2373
2374   /* Unlock the stream.  */
2375   _IO_funlockfile (s);
2376   __libc_cleanup_region_end (0);
2377
2378   return result;
2379 }
2380
2381 #undef vfprintf
2382 #ifdef COMPILE_WPRINTF
2383 strong_alias (_IO_vfwprintf, __vfwprintf);
2384 ldbl_weak_alias (_IO_vfwprintf, vfwprintf);
2385 #else
2386 ldbl_strong_alias (_IO_vfprintf_internal, vfprintf);
2387 ldbl_hidden_def (_IO_vfprintf_internal, vfprintf)
2388 ldbl_strong_alias (_IO_vfprintf_internal, _IO_vfprintf);
2389 ldbl_hidden_def (_IO_vfprintf_internal, _IO_vfprintf)
2390 #endif