Use C99-compliant scanf under _GNU_SOURCE with C99/C++11 and higher.

  This is a rebased version of a patch I posted back in February.  There
are no substantial code changes.  I would like to see this get into 2.29
as it removes a C99 conformance defect for programs using _GNU_SOURCE.

Implementation notes:

There needs to be an internal override so we can compile the
noncompliant scanf itself.  This is the same problem we had when we
removed 'gets' from _GNU_SOURCE and it's dealt with the same way:
there's a new __GLIBC_USE symbol, DEPRECATED_SCANF, which defaults to
off under the appropriate conditions for external code, but can be
overridden by individual files within stdio.

We also run into problems with PLT bypass, because libc_hidden_proto
uses __REDIRECT and so does the logic in stdio.h for choosing which
implementation of scanf to use; __REDIRECT isn't transitive, so a
couple of files that use sscanf internally have to bridge the gap
with macros.  I'm open to better ideas if anyone has one.  (I would
be in favor of a general policy that internal code should not use
any of the *scanf functions, but that would be nontrivial for
tzset.c.)  Fortunately, elf/check-localplt will catch any new
internal uses of *scanf that aren't shimmed.

On a related note, the interaction of the C99/not-C99 scanf redirect
with the __LDBL_COMPAT scanf redirect was complicated, confusing,
and possibly wrong.  The __ldbl_is_dbl cleanup (thanks to Gabriel
Gomes for finishing that for me) has made it less complicated, but
I'm still not 100% sure it's correct, and I do not have access to
physical hardware for which __LDBL_COMPAT is relevant, so my ability
to test it is limited.  Careful review (you'll want to read all of
libio/bits/stdio-ldbl.h to understand what's going on, not just
the diff) and maybe even some volunteer testing would be appreciated.

Finally, there are several tests in stdio-common that use the
extension.  bug21 is a regression test for a crash, and still
exercises the relevant code if changed to use %ms instead of %as.
scanf14 through scanf17 are more complicated since they are actually
testing the subtleties of the extension - under what circumstances is
'a' treated as a modifier letter, etc.  My approach here is to
duplicate scanf14.c and scanf16.c; the originals change to use %ms
instead, the copies select precisely the right conformance mode to get
%as with the old GNU meaning, plus everything else they need (it's not
as simple as saying -std=gnu89, unfortunately).  scanf15 and scanf17
become simpler because they no longer need to avoid _GNU_SOURCE, and
all of them no longer need diagnostic overrides.  Yay!

--- 8< ---
The only difference between noncompliant and C99-compliant scanf is
that the former accepts the archaic GNU extension '%as' (also %aS and
%a[...]) meaning to allocate space for the input string with malloc.
This extension conflicts with C99's use of %a as a format _type_
meaning to read a floating-point number; POSIX.1-2008 standardized
equivalent functionality using the modifier letter 'm' instead (%ms,
%mS, %m[...]).

The extension was already disabled in most conformance modes:
specifically, any mode that doesn't involve _GNU_SOURCE and _does_
involve either strict conformance to C99 or loose conformance to both
C99 and POSIX.1-2001 would get the C99-compliant scanf.  With
compilers new enough to use -std=gnu11 instead of -std=gnu89, or
equivalent, that includes the default mode.

This patch tightens things up further: you now get C99-compliant scanf
in all configurations except when _GNU_SOURCE is defined *and*
__STDC_VERSION__ or __cplusplus (whichever is relevant) indicates
C89/C++98.  This leaves the old scanf available under e.g. -std=c89
-D_GNU_SOURCE, but removes it from e.g. -std=gnu11 -D_GNU_SOURCE (it
was already not present under -std=gnu11 without -D_GNU_SOURCE) and
from -std=gnu89 without -D_GNU_SOURCE.

	* include/features.h (__GLIBC_USE_DEPRECATED_SCANF): New __GLIBC_USE
        parameter.  Only use deprecated scanf when __USE_GNU is defined
        and __STDC_VERSION__ is less than 199901L or __cplusplus is less
        than 201103L, whichever is relevant for the language being compiled.

	* libio/stdio.h, libio/bits/stdio-ldbl.h: Decide whether or
	not to redirect scanf, fscanf, sscanf, vscanf, vfscanf, and
	vsscanf to their __isoc99_ variants based only on
        __GLIBC_USE(DEPRECATED_SCANF).

	* libio/iovsscanf.c, libio/vscanf.c, stdio-common/fscanf.c
	* stdio-common/scanf.c, stdio-common/vfscanf.c:
	Override __GLIBC_USE_DEPRECATED_SCANF to 1.
	* stdio-common/sscanf.c: Likewise.  Remove ldbl_hidden_def for
	__sscanf.
	* stdio-common/isoc99_sscanf.c: Add libc_hidden_def for __isoc99_sscanf.
        * include/stdio.h: Provide libc_hidden_proto for __isoc99_sscanf,
	not sscanf.

	* misc/mntent_r.c, time/tzset.c: Redirect sscanf to __isoc99_scanf
	with a macro.

	* stdio-common/bug21.c, stdio-common/scanf14.c:
	Use %ms instead of %as, %mS instead of %aS, %m[] instead of %a[];
	remove DIAG_IGNORE_NEEDS_COMMENT for -Wformat.
	* stdio-common/scanf16.c: Likewise.  Add __attribute__((format(scanf)))
	to xscanf, xfscanf, xsscanf.

	* stdio-common/scanf14a.c: New copy of scanf14.c which still uses
	%as, %aS, %a[].  Use conformance mode -std=gnu89,
	_POSIX_C_SOURCE=199506L, _XOPEN_SOURCE=1, _XOPEN_SOURCE_EXTENDED=1,
	which will use the nonconformant scanf implementation.
	Remove DIAG_IGNORE_NEEDS_COMMENT for -Wformat.
	* stdio-common/scanf16a.c: New copy of scanf16.c which still uses
	%as, %aS, %a[].  Use conformance mode -std=gnu89,
	_POSIX_C_SOURCE=199506L, _XOPEN_SOURCE=1, _XOPEN_SOURCE_EXTENDED=1,
	_ISOC99_SOURCE=1, which will use the nonconformant scanf
	implementation.  Add __attribute__((format(scanf))) to xscanf,
	xfscanf, xsscanf.

	* stdio-common/scanf15.c, stdio-common/scanf17.c: No need to
	override feature selection macros or provide definitions of u_char etc.
	* stdio-common/Makefile (tests): Add scanf14a and scanf16a.
	(CFLAGS-scanf15.c, CFLAGS-scanf17.c): Remove.
	(CFLAGS-scanf14a.c, CFLAGS-scanf16a.c): New.
---
 NEWS                         |  17 ++++
 include/features.h           |  22 +++++
 include/stdio.h              |   2 +-
 libio/bits/stdio-ldbl.h      |   7 +-
 libio/iovsscanf.c            |   5 ++
 libio/stdio.h                |  22 ++---
 libio/vscanf.c               |   5 ++
 misc/mntent_r.c              |   4 +
 stdio-common/Makefile        |  14 ++--
 stdio-common/bug21.c         |  11 +--
 stdio-common/fscanf.c        |   5 ++
 stdio-common/isoc99_sscanf.c |   1 +
 stdio-common/scanf.c         |   5 ++
 stdio-common/scanf14.c       |  35 ++------
 stdio-common/scanf14a.c      | 126 ++++++++++++++++++++++++++++
 stdio-common/scanf15.c       |  14 +---
 stdio-common/scanf16.c       |  20 +++--
 stdio-common/scanf16a.c      | 156 +++++++++++++++++++++++++++++++++++
 stdio-common/scanf17.c       |  14 +---
 stdio-common/sscanf.c        |   6 +-
 stdio-common/vfscanf.c       |   5 ++
 time/tzset.c                 |   4 +
 22 files changed, 408 insertions(+), 92 deletions(-)
 create mode 100644 stdio-common/scanf14a.c
 create mode 100644 stdio-common/scanf16a.c

Use C99-compliant scanf under _GNU_SOURCE with C99/C++11 and higher.

Commit Message

Comments

Patch