Use C99-compliant scanf under _GNU_SOURCE.

  The only difference between noncompliant and C99-compliant scanf is
that the former accepts the archaic GNU extension '%as' (also %aS and
%a[...]) meaning to allocate space for the input string with malloc.
This extension conflicts with C99's use of %a as a format _type_
meaning to read a floating-point number; POSIX.1-2001 standardized
equivalent functionality using the modifier letter 'm' instead (%ms,
%mS, %m[...]).

The extension was already disabled in most conformance modes:
specifically, any mode that doesn't involve _GNU_SOURCE and _does_
involve either strict conformance to C99 or loose conformance to both
C99 and POSIX.1-2001 would get the C99-compliant scanf.  With
compilers new enough to use -std=gnu11 instead of -std=gnu89, or
equivalent, that includes the default mode.  Moreover, GCC isn't aware
of the subtleties of the above paragraph when issuing -Wformat
warnings; if you give -std=gnu99 or above you get dinged for using %a
with the archaic-GNU meaning.

This change is fiddlier than just changing a couple of #if
expressions, for several reasons.  The most obvious of these is that
we need to be able to compile the noncompliant scanf itself.  This is
the same problem we had when we removed 'gets' from _GNU_SOURCE and
it's dealt with the same way: there's a new __GLIBC_USE symbol,
DEPRECATED_SCANF, which defaults to off under the appropriate
conditions for external code, but can be overridden by individual
files within stdio.

We also run into problems with PLT bypass, because libc_hidden_proto
uses __REDIRECT and so does the logic in stdio.h for choosing which
implementation of scanf to use; __REDIRECT isn't transitive, so a
couple of files that use sscanf internally have to bridge the gap with
macros.  I'm open to better ideas if anyone has one (N.B. I would
accept "internal code shouldn't call *scanf ever" as a better idea,
but I'm not gonna make that decision unilaterally).  Fortunately,
elf/check-localplt will catch any new internal uses of *scanf that
aren't shimmed.

Finally, there are several tests in stdio-common that use the
extension.  bug21 is a regression test for a crash, and still
exercises the relevant code if changed to use %ms instead of %as.
scanf14 through scanf17 are more complicated since they are actually
testing the subtleties of the extension - under what circumstances is
'a' treated as a modifier letter, etc.  My approach here is to
duplicate scanf14.c and scanf16.c; the originals change to use %ms
instead, the copies select precisely the right conformance mode to get
%as with the old GNU meaning, plus everything else they need (it's not
as simple as saying -std=gnu89, unfortunately).  scanf15 and scanf17
become simpler because they no longer need to avoid _GNU_SOURCE, and
all of them no longer need diagnostic overrides.  Yay!

I kinda want to relax the condition for C99-compliant scanf a bit
further, from

+#if defined __USE_ISOC99 && (defined __USE_XOPEN2K || defined __STRICT_ANSI__)

to

+#if defined __USE_ISOC99 || defined __USE_XOPEN2K

The major problem with that is, there would then be no way to get the
noncompliant *v*scanf without overriding __GLIBC_USE_DEPRECATED_SCANF,
because vscanf/vfscanf/vsscanf themselves are only available under
__USE_ISOC99.  Not a problem we have to solve today, though.

--
	* include/features.h (__GLIBC_USE_DEPRECATED_SCANF): New macro.
	Don't consider __USE_GNU when deciding whether to use deprecated scanf.
        * include/stdio.h: Provide libc_hidden_proto for __isoc99_sscanf,
	not sscanf.
	* libio/stdio.h, libio/bits/stdio-ldbl.h: Use
	__GLIBC_USE(DEPRECATED_SCANF) to decide whether or not to redirect
	scanf, fscanf, sscanf, vscanf, vfscanf, and vsscanf to their
	__isoc99_ variants.

	* libio/iovsscanf.c, libio/vscanf.c, stdio-common/fscanf.c
	* stdio-common/scanf.c, stdio-common/vfscanf.c:
	Override __GLIBC_USE_DEPRECATED_SCANF to 1.
	* stdio-common/sscanf.c: Likewise.  Remove ldbl_hidden_def for
	__sscanf.
	* stdio-common/isoc99_sscanf.c: Add libc_hidden_def for __isoc99_sscanf.

	* misc/mntent_r.c, time/tzset.c: Redirect sscanf to __isoc99_scanf
	with a macro.

	* stdio-common/bug21.c, stdio-common/scanf14.c:
	Use %ms instead of %as, %mS instead of %aS, %m[] instead of %a[];
	remove DIAG_IGNORE_NEEDS_COMMENT for -Wformat.
	* stdio-common/scanf16.c: Likewise.  Add __attribute__((format(scanf)))
	to xscanf, xfscanf, xsscanf.

	* stdio-common/scanf14a.c: New copy of scanf14.c which still uses
	%as, %aS, %a[].  Use conformance mode -std=gnu89,
	_POSIX_C_SOURCE=199506L, _XOPEN_SOURCE=1, _XOPEN_SOURCE_EXTENDED=1,
	which will use the nonconformant scanf implementation.
	Remove DIAG_IGNORE_NEEDS_COMMENT for -Wformat.
	* stdio-common/scanf16a.c: New copy of scanf16.c which still uses
	%as, %aS, %a[].  Use conformance mode -std=gnu89,
	_POSIX_C_SOURCE=199506L, _XOPEN_SOURCE=1, _XOPEN_SOURCE_EXTENDED=1,
	_ISOC99_SOURCE=1, which will use the nonconformant scanf
	implementation.  Add __attribute__((format(scanf))) to xscanf,
	xfscanf, xsscanf.

	* stdio-common/scanf15.c, stdio-common/scanf17.c: No need to
	override feature selection macros or provide definitions of u_char etc.
	* stdio-common/Makefile (tests): Add scanf14a and scanf16a.
	(CFLAGS-scanf15.c, CFLAGS-scanf17.c): Remove.
	(CFLAGS-scanf14a.c, CFLAGS-scanf16a.c): New.
---
 NEWS                         |  15 ++++
 include/features.h           |  15 ++++
 include/stdio.h              |   2 +-
 libio/bits/stdio-ldbl.h      |   7 +-
 libio/iovsscanf.c            |   5 ++
 libio/stdio.h                |  26 +++----
 libio/vscanf.c               |   5 ++
 misc/mntent_r.c              |   4 ++
 stdio-common/Makefile        |  13 ++--
 stdio-common/bug21.c         |  11 +--
 stdio-common/fscanf.c        |   5 ++
 stdio-common/isoc99_sscanf.c |   1 +
 stdio-common/scanf.c         |   5 ++
 stdio-common/scanf14.c       |  31 ++------
 stdio-common/scanf14a.c      | 133 ++++++++++++++++++++++++++++++++++
 stdio-common/scanf15.c       |  10 ---
 stdio-common/scanf16.c       |  16 ++---
 stdio-common/scanf16a.c      | 165 +++++++++++++++++++++++++++++++++++++++++++
 stdio-common/scanf17.c       |  10 ---
 stdio-common/sscanf.c        |   6 +-
 stdio-common/vfscanf.c       |   5 ++
 time/tzset.c                 |   4 ++
 22 files changed, 400 insertions(+), 94 deletions(-)
 create mode 100644 stdio-common/scanf14a.c
 create mode 100644 stdio-common/scanf16a.c

Use C99-compliant scanf under _GNU_SOURCE.

Commit Message

Comments

Patch