Coverage Report

Created: 2026-10-14 06:52

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/ffmpeg/libavutil/avsscanf.c
Line
Count
Source
1
/*
2
 * Copyright (c) 2005-2014 Rich Felker, et al.
3
 *
4
 * Permission is hereby granted, free of charge, to any person obtaining
5
 * a copy of this software and associated documentation files (the
6
 * "Software"), to deal in the Software without restriction, including
7
 * without limitation the rights to use, copy, modify, merge, publish,
8
 * distribute, sublicense, and/or sell copies of the Software, and to
9
 * permit persons to whom the Software is furnished to do so, subject to
10
 * the following conditions:
11
 *
12
 * The above copyright notice and this permission notice shall be
13
 * included in all copies or substantial portions of the Software.
14
 *
15
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16
 * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17
 * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
18
 * IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
19
 * CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
20
 * TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
21
 * SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
22
 */
23
24
#include <errno.h>
25
#include <limits.h>
26
#include <math.h>
27
#include <stdarg.h>
28
#include <stddef.h>
29
#include <stdint.h>
30
#include <stdio.h>
31
#include <string.h>
32
#include <float.h>
33
34
#include "avstring.h"
35
36
typedef struct FFFILE {
37
    size_t buf_size;
38
    unsigned char *buf;
39
    unsigned char *rpos, *rend;
40
    unsigned char *shend;
41
    ptrdiff_t shlim, shcnt;
42
    void *cookie;
43
    size_t (*read)(struct FFFILE *, unsigned char *, size_t);
44
} FFFILE;
45
46
0
#define SIZE_hh -2
47
0
#define SIZE_h  -1
48
0
#define SIZE_def 0
49
0
#define SIZE_l   1
50
0
#define SIZE_L   2
51
0
#define SIZE_ll  3
52
53
0
#define shcnt(f) ((f)->shcnt + ((f)->rpos - (f)->buf))
54
55
static int fftoread(FFFILE *f)
56
0
{
57
0
    f->rpos = f->rend = f->buf + f->buf_size;
58
0
    return 0;
59
0
}
60
61
static size_t ffstring_read(FFFILE *f, unsigned char *buf, size_t len)
62
0
{
63
0
    char *src = f->cookie;
64
0
    size_t k = len+256;
65
0
    char *end = memchr(src, 0, k);
66
67
0
    if (end) k = end-src;
68
0
    if (k < len) len = k;
69
0
    memcpy(buf, src, len);
70
0
    f->rpos = (void *)(src+len);
71
0
    f->rend = (void *)(src+k);
72
0
    f->cookie = src+k;
73
74
0
    return len;
75
0
}
76
77
static int ffuflow(FFFILE *f)
78
0
{
79
0
    unsigned char c;
80
0
    if (!fftoread(f) && f->read(f, &c, 1)==1) return c;
81
0
    return EOF;
82
0
}
83
84
static void ffshlim(FFFILE *f, ptrdiff_t lim)
85
0
{
86
0
    f->shlim = lim;
87
0
    f->shcnt = f->buf - f->rpos;
88
    /* If lim is nonzero, rend must be a valid pointer. */
89
0
    if (lim && f->rend - f->rpos > lim)
90
0
        f->shend = f->rpos + lim;
91
0
    else
92
0
        f->shend = f->rend;
93
0
}
94
95
static int ffshgetc(FFFILE *f)
96
0
{
97
0
    int c;
98
0
    ptrdiff_t cnt = shcnt(f);
99
0
    if (f->shlim && cnt >= f->shlim || (c=ffuflow(f)) < 0) {
100
0
        f->shcnt = f->buf - f->rpos + cnt;
101
0
        f->shend = 0;
102
0
        return EOF;
103
0
    }
104
0
    cnt++;
105
0
    if (f->shlim && f->rend - f->rpos > f->shlim - cnt)
106
0
        f->shend = f->rpos + (f->shlim - cnt);
107
0
    else
108
0
        f->shend = f->rend;
109
0
    f->shcnt = f->buf - f->rpos + cnt;
110
0
    if (f->rpos[-1] != c) f->rpos[-1] = c;
111
0
    return c;
112
0
}
113
114
0
#define shlim(f, lim) ffshlim((f), (lim))
115
0
#define shgetc(f) (((f)->rpos < (f)->shend) ? *(f)->rpos++ : ffshgetc(f))
116
0
#define shunget(f) ((f)->shend ? (void)(f)->rpos-- : (void)0)
117
118
static const unsigned char table[] = { -1,
119
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
120
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
121
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
122
    0, 1, 2, 3, 4, 5, 6, 7, 8, 9,-1,-1,-1,-1,-1,-1,
123
    -1,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
124
    25,26,27,28,29,30,31,32,33,34,35,-1,-1,-1,-1,-1,
125
    -1,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,
126
    25,26,27,28,29,30,31,32,33,34,35,-1,-1,-1,-1,-1,
127
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
128
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
129
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
130
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
131
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
132
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
133
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
134
    -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,
135
};
136
137
static unsigned long long ffintscan(FFFILE *f, unsigned base, int pok, unsigned long long lim)
138
0
{
139
0
    const unsigned char *val = table+1;
140
0
    int c, neg=0;
141
0
    unsigned x;
142
0
    unsigned long long y;
143
0
    if (base > 36 || base == 1) {
144
0
        errno = EINVAL;
145
0
        return 0;
146
0
    }
147
0
    while (av_isspace((c=shgetc(f))));
148
0
    if (c=='+' || c=='-') {
149
0
        neg = -(c=='-');
150
0
        c = shgetc(f);
151
0
    }
152
0
    if ((base == 0 || base == 16) && c=='0') {
153
0
        c = shgetc(f);
154
0
        if ((c|32)=='x') {
155
0
            c = shgetc(f);
156
0
            if (val[c]>=16) {
157
0
                shunget(f);
158
0
                if (pok) shunget(f);
159
0
                else shlim(f, 0);
160
0
                return 0;
161
0
            }
162
0
            base = 16;
163
0
        } else if (base == 0) {
164
0
            base = 8;
165
0
        }
166
0
    } else {
167
0
        if (base == 0) base = 10;
168
0
        if (val[c] >= base) {
169
0
            shunget(f);
170
0
            shlim(f, 0);
171
0
            errno = EINVAL;
172
0
            return 0;
173
0
        }
174
0
    }
175
0
    if (base == 10) {
176
0
        for (x=0; c-'0'<10U && x<=UINT_MAX/10-1; c=shgetc(f))
177
0
            x = x*10 + (c-'0');
178
0
        for (y=x; c-'0'<10U && y<=ULLONG_MAX/10 && 10*y<=ULLONG_MAX-(c-'0'); c=shgetc(f))
179
0
            y = y*10 + (c-'0');
180
0
        if (c-'0'>=10U) goto done;
181
0
    } else if (!(base & base-1)) {
182
0
        int bs = "\0\1\2\4\7\3\6\5"[(0x17*base)>>5&7];
183
0
        for (x=0; val[c]<base && x<=UINT_MAX/32; c=shgetc(f))
184
0
            x = x<<bs | val[c];
185
0
        for (y=x; val[c]<base && y<=ULLONG_MAX>>bs; c=shgetc(f))
186
0
            y = y<<bs | val[c];
187
0
    } else {
188
0
        for (x=0; val[c]<base && x<=UINT_MAX/36-1; c=shgetc(f))
189
0
            x = x*base + val[c];
190
0
        for (y=x; val[c]<base && y<=ULLONG_MAX/base && base*y<=ULLONG_MAX-val[c]; c=shgetc(f))
191
0
            y = y*base + val[c];
192
0
    }
193
0
    if (val[c]<base) {
194
0
        for (; val[c]<base; c=shgetc(f));
195
0
        errno = ERANGE;
196
0
        y = lim;
197
0
        if (lim&1) neg = 0;
198
0
    }
199
0
done:
200
0
    shunget(f);
201
0
    if (y>=lim) {
202
0
        if (!(lim&1) && !neg) {
203
0
            errno = ERANGE;
204
0
            return lim-1;
205
0
        } else if (y>lim) {
206
0
            errno = ERANGE;
207
0
            return lim;
208
0
        }
209
0
    }
210
0
    return (y^neg)-neg;
211
0
}
212
213
static long long scanexp(FFFILE *f, int pok)
214
0
{
215
0
    int c;
216
0
    int x;
217
0
    long long y;
218
0
    int neg = 0;
219
220
0
    c = shgetc(f);
221
0
    if (c=='+' || c=='-') {
222
0
        neg = (c=='-');
223
0
        c = shgetc(f);
224
0
        if (c-'0'>=10U && pok) shunget(f);
225
0
    }
226
0
    if (c-'0'>=10U) {
227
0
        shunget(f);
228
0
        return LLONG_MIN;
229
0
    }
230
0
    for (x=0; c-'0'<10U && x<INT_MAX/10; c = shgetc(f))
231
0
        x = 10*x + (c-'0');
232
0
    for (y=x; c-'0'<10U && y<LLONG_MAX/100; c = shgetc(f))
233
0
        y = 10*y + (c-'0');
234
0
    for (; c-'0'<10U; c = shgetc(f));
235
0
    shunget(f);
236
0
    return neg ? -y : y;
237
0
}
238
239
0
#define LD_B1B_DIG 2
240
0
#define LD_B1B_MAX 9007199, 254740991
241
0
#define KMAX 128
242
0
#define MASK (KMAX-1)
243
244
static double decfloat(FFFILE *f, int c, int bits, int emin, int sign, int pok)
245
0
{
246
0
    uint32_t x[KMAX];
247
0
    static const uint32_t th[] = { LD_B1B_MAX };
248
0
    int i, j, k, a, z;
249
0
    long long lrp=0, dc=0;
250
0
    long long e10=0;
251
0
    int lnz = 0;
252
0
    int gotdig = 0, gotrad = 0;
253
0
    int rp;
254
0
    int e2;
255
0
    int emax = -emin-bits+3;
256
0
    int denormal = 0;
257
0
    double y;
258
0
    double frac=0;
259
0
    double bias=0;
260
0
    static const int p10s[] = { 10, 100, 1000, 10000,
261
0
        100000, 1000000, 10000000, 100000000 };
262
263
0
    j=0;
264
0
    k=0;
265
266
    /* Don't let leading zeros consume buffer space */
267
0
    for (; c=='0'; c = shgetc(f)) gotdig=1;
268
0
    if (c=='.') {
269
0
        gotrad = 1;
270
0
        for (c = shgetc(f); c=='0'; c = shgetc(f)) gotdig=1, lrp--;
271
0
    }
272
273
0
    x[0] = 0;
274
0
    for (; c-'0'<10U || c=='.'; c = shgetc(f)) {
275
0
        if (c == '.') {
276
0
            if (gotrad) break;
277
0
            gotrad = 1;
278
0
            lrp = dc;
279
0
        } else if (k < KMAX-3) {
280
0
            dc++;
281
0
            if (c!='0') lnz = dc;
282
0
            if (j) x[k] = x[k]*10 + c-'0';
283
0
            else x[k] = c-'0';
284
0
            if (++j==9) {
285
0
                k++;
286
0
                j=0;
287
0
            }
288
0
            gotdig=1;
289
0
        } else {
290
0
            dc++;
291
0
            if (c!='0') {
292
0
                lnz = (KMAX-4)*9;
293
0
                x[KMAX-4] |= 1;
294
0
            }
295
0
        }
296
0
    }
297
0
    if (!gotrad) lrp=dc;
298
299
0
    if (gotdig && (c|32)=='e') {
300
0
        e10 = scanexp(f, pok);
301
0
        if (e10 == LLONG_MIN) {
302
0
            if (pok) {
303
0
                shunget(f);
304
0
            } else {
305
0
                shlim(f, 0);
306
0
                return 0;
307
0
            }
308
0
            e10 = 0;
309
0
        }
310
0
        lrp += e10;
311
0
    } else if (c>=0) {
312
0
        shunget(f);
313
0
    }
314
0
    if (!gotdig) {
315
0
        errno = EINVAL;
316
0
        shlim(f, 0);
317
0
        return 0;
318
0
    }
319
320
    /* Handle zero specially to avoid nasty special cases later */
321
0
    if (!x[0]) return sign * 0.0;
322
323
    /* Optimize small integers (w/no exponent) and over/under-flow */
324
0
    if (lrp==dc && dc<10 && (bits>30 || x[0]>>bits==0))
325
0
        return sign * (double)x[0];
326
0
    if (lrp > -emin/2) {
327
0
        errno = ERANGE;
328
0
        return sign * DBL_MAX * DBL_MAX;
329
0
    }
330
0
    if (lrp < emin-2*DBL_MANT_DIG) {
331
0
        errno = ERANGE;
332
0
        return sign * DBL_MIN * DBL_MIN;
333
0
    }
334
335
    /* Align incomplete final B1B digit */
336
0
    if (j) {
337
0
        for (; j<9; j++) x[k]*=10;
338
0
        k++;
339
0
        j=0;
340
0
    }
341
342
0
    a = 0;
343
0
    z = k;
344
0
    e2 = 0;
345
0
    rp = lrp;
346
347
    /* Optimize small to mid-size integers (even in exp. notation) */
348
0
    if (lnz<9 && lnz<=rp && rp < 18) {
349
0
        int bitlim;
350
0
        if (rp == 9) return sign * (double)x[0];
351
0
        if (rp < 9) return sign * (double)x[0] / p10s[8-rp];
352
0
        bitlim = bits-3*(int)(rp-9);
353
0
        if (bitlim>30 || x[0]>>bitlim==0)
354
0
            return sign * (double)x[0] * p10s[rp-10];
355
0
    }
356
357
    /* Drop trailing zeros */
358
0
    for (; !x[z-1]; z--);
359
360
    /* Align radix point to B1B digit boundary */
361
0
    if (rp % 9) {
362
0
        int rpm9 = rp>=0 ? rp%9 : rp%9+9;
363
0
        int p10 = p10s[8-rpm9];
364
0
        uint32_t carry = 0;
365
0
        for (k=a; k!=z; k++) {
366
0
            uint32_t tmp = x[k] % p10;
367
0
            x[k] = x[k]/p10 + carry;
368
0
            carry = 1000000000/p10 * tmp;
369
0
            if (k==a && !x[k]) {
370
0
                a = (a+1 & MASK);
371
0
                rp -= 9;
372
0
            }
373
0
        }
374
0
        if (carry) x[z++] = carry;
375
0
        rp += 9-rpm9;
376
0
    }
377
378
    /* Upscale until desired number of bits are left of radix point */
379
0
    while (rp < 9*LD_B1B_DIG || (rp == 9*LD_B1B_DIG && x[a]<th[0])) {
380
0
        uint32_t carry = 0;
381
0
        e2 -= 29;
382
0
        for (k=(z-1 & MASK); ; k=(k-1 & MASK)) {
383
0
            uint64_t tmp = ((uint64_t)x[k] << 29) + carry;
384
0
            if (tmp > 1000000000) {
385
0
                carry = tmp / 1000000000;
386
0
                x[k] = tmp % 1000000000;
387
0
            } else {
388
0
                carry = 0;
389
0
                x[k] = tmp;
390
0
            }
391
0
            if (k==(z-1 & MASK) && k!=a && !x[k]) z = k;
392
0
            if (k==a) break;
393
0
        }
394
0
        if (carry) {
395
0
            rp += 9;
396
0
            a = (a-1 & MASK);
397
0
            if (a == z) {
398
0
                z = (z-1 & MASK);
399
0
                x[z-1 & MASK] |= x[z];
400
0
            }
401
0
            x[a] = carry;
402
0
        }
403
0
    }
404
405
    /* Downscale until exactly number of bits are left of radix point */
406
0
    for (;;) {
407
0
        uint32_t carry = 0;
408
0
        int sh = 1;
409
0
        for (i=0; i<LD_B1B_DIG; i++) {
410
0
            k = (a+i & MASK);
411
0
            if (k == z || x[k] < th[i]) {
412
0
                i=LD_B1B_DIG;
413
0
                break;
414
0
            }
415
0
            if (x[a+i & MASK] > th[i]) break;
416
0
        }
417
0
        if (i==LD_B1B_DIG && rp==9*LD_B1B_DIG) break;
418
        /* FIXME: find a way to compute optimal sh */
419
0
        if (rp > 9+9*LD_B1B_DIG) sh = 9;
420
0
        e2 += sh;
421
0
        for (k=a; k!=z; k=(k+1 & MASK)) {
422
0
            uint32_t tmp = x[k] & (1<<sh)-1;
423
0
            x[k] = (x[k]>>sh) + carry;
424
0
            carry = (1000000000>>sh) * tmp;
425
0
            if (k==a && !x[k]) {
426
0
                a = (a+1 & MASK);
427
0
                i--;
428
0
                rp -= 9;
429
0
            }
430
0
        }
431
0
        if (carry) {
432
0
            if ((z+1 & MASK) != a) {
433
0
                x[z] = carry;
434
0
                z = (z+1 & MASK);
435
0
            } else x[z-1 & MASK] |= 1;
436
0
        }
437
0
    }
438
439
    /* Assemble desired bits into floating point variable */
440
0
    for (y=i=0; i<LD_B1B_DIG; i++) {
441
0
        if ((a+i & MASK)==z) x[(z=(z+1 & MASK))-1 & MASK] = 0;
442
0
        y = 1000000000.0L * y + x[a+i & MASK];
443
0
    }
444
445
0
    y *= sign;
446
447
    /* Limit precision for denormal results */
448
0
    if (bits > DBL_MANT_DIG+e2-emin) {
449
0
        bits = DBL_MANT_DIG+e2-emin;
450
0
        if (bits<0) bits=0;
451
0
        denormal = 1;
452
0
    }
453
454
    /* Calculate bias term to force rounding, move out lower bits */
455
0
    if (bits < DBL_MANT_DIG) {
456
0
        bias = copysign(scalbn(1, 2*DBL_MANT_DIG-bits-1), y);
457
0
        frac = fmod(y, scalbn(1, DBL_MANT_DIG-bits));
458
0
        y -= frac;
459
0
        y += bias;
460
0
    }
461
462
    /* Process tail of decimal input so it can affect rounding */
463
0
    if ((a+i & MASK) != z) {
464
0
        uint32_t t = x[a+i & MASK];
465
0
        if (t < 500000000 && (t || (a+i+1 & MASK) != z))
466
0
            frac += 0.25*sign;
467
0
        else if (t > 500000000)
468
0
            frac += 0.75*sign;
469
0
        else if (t == 500000000) {
470
0
            if ((a+i+1 & MASK) == z)
471
0
                frac += 0.5*sign;
472
0
            else
473
0
                frac += 0.75*sign;
474
0
        }
475
0
        if (DBL_MANT_DIG-bits >= 2 && !fmod(frac, 1))
476
0
            frac++;
477
0
    }
478
479
0
    y += frac;
480
0
    y -= bias;
481
482
0
    if ((e2+DBL_MANT_DIG & INT_MAX) > emax-5) {
483
0
        if (fabs(y) >= pow(2, DBL_MANT_DIG)) {
484
0
            if (denormal && bits==DBL_MANT_DIG+e2-emin)
485
0
                denormal = 0;
486
0
            y *= 0.5;
487
0
            e2++;
488
0
        }
489
0
        if (e2+DBL_MANT_DIG>emax || (denormal && frac))
490
0
            errno = ERANGE;
491
0
    }
492
493
0
    return scalbn(y, e2);
494
0
}
495
496
static double hexfloat(FFFILE *f, int bits, int emin, int sign, int pok)
497
0
{
498
0
    uint32_t x = 0;
499
0
    double y = 0;
500
0
    double scale = 1;
501
0
    double bias = 0;
502
0
    int gottail = 0, gotrad = 0, gotdig = 0;
503
0
    long long rp = 0;
504
0
    long long dc = 0;
505
0
    long long e2 = 0;
506
0
    int d;
507
0
    int c;
508
509
0
    c = shgetc(f);
510
511
    /* Skip leading zeros */
512
0
    for (; c=='0'; c = shgetc(f))
513
0
        gotdig = 1;
514
515
0
    if (c=='.') {
516
0
        gotrad = 1;
517
0
        c = shgetc(f);
518
        /* Count zeros after the radix point before significand */
519
0
        for (rp=0; c=='0'; c = shgetc(f), rp--) gotdig = 1;
520
0
    }
521
522
0
    for (; c-'0'<10U || (c|32)-'a'<6U || c=='.'; c = shgetc(f)) {
523
0
        if (c=='.') {
524
0
            if (gotrad) break;
525
0
            rp = dc;
526
0
            gotrad = 1;
527
0
        } else {
528
0
            gotdig = 1;
529
0
            if (c > '9') d = (c|32)+10-'a';
530
0
            else d = c-'0';
531
0
            if (dc<8) {
532
0
                x = x*16 + d;
533
0
            } else if (dc < DBL_MANT_DIG/4+1) {
534
0
                y += d*(scale/=16);
535
0
            } else if (d && !gottail) {
536
0
                y += 0.5*scale;
537
0
                gottail = 1;
538
0
            }
539
0
            dc++;
540
0
        }
541
0
    }
542
0
    if (!gotdig) {
543
0
        shunget(f);
544
0
        if (pok) {
545
0
            shunget(f);
546
0
            if (gotrad) shunget(f);
547
0
        } else {
548
0
            shlim(f, 0);
549
0
        }
550
0
        return sign * 0.0;
551
0
    }
552
0
    if (!gotrad) rp = dc;
553
0
    while (dc<8) x *= 16, dc++;
554
0
    if ((c|32)=='p') {
555
0
        e2 = scanexp(f, pok);
556
0
        if (e2 == LLONG_MIN) {
557
0
            if (pok) {
558
0
                shunget(f);
559
0
            } else {
560
0
                shlim(f, 0);
561
0
                return 0;
562
0
            }
563
0
            e2 = 0;
564
0
        }
565
0
    } else {
566
0
        shunget(f);
567
0
    }
568
0
    e2 += 4*rp - 32;
569
570
0
    if (!x) return sign * 0.0;
571
0
    if (e2 > -emin) {
572
0
        errno = ERANGE;
573
0
        return sign * DBL_MAX * DBL_MAX;
574
0
    }
575
0
    if (e2 < emin-2*DBL_MANT_DIG) {
576
0
        errno = ERANGE;
577
0
        return sign * DBL_MIN * DBL_MIN;
578
0
    }
579
580
0
    while (x < 0x80000000) {
581
0
        if (y>=0.5) {
582
0
            x += x + 1;
583
0
            y += y - 1;
584
0
        } else {
585
0
            x += x;
586
0
            y += y;
587
0
        }
588
0
        e2--;
589
0
    }
590
591
0
    if (bits > 32+e2-emin) {
592
0
        bits = 32+e2-emin;
593
0
        if (bits<0) bits=0;
594
0
    }
595
596
0
    if (bits < DBL_MANT_DIG)
597
0
        bias = copysign(scalbn(1, 32+DBL_MANT_DIG-bits-1), sign);
598
599
0
    if (bits<32 && y && !(x&1)) x++, y=0;
600
601
0
    y = bias + sign*(double)x + sign*y;
602
0
    y -= bias;
603
604
0
    if (!y) errno = ERANGE;
605
606
0
    return scalbn(y, e2);
607
0
}
608
609
static double fffloatscan(FFFILE *f, int prec, int pok)
610
0
{
611
0
    int sign = 1;
612
0
    size_t i;
613
0
    int bits;
614
0
    int emin;
615
0
    int c;
616
617
0
    switch (prec) {
618
0
    case 0:
619
0
        bits = FLT_MANT_DIG;
620
0
        emin = FLT_MIN_EXP-bits;
621
0
        break;
622
0
    case 1:
623
0
        bits = DBL_MANT_DIG;
624
0
        emin = DBL_MIN_EXP-bits;
625
0
        break;
626
0
    case 2:
627
0
        bits = DBL_MANT_DIG;
628
0
        emin = DBL_MIN_EXP-bits;
629
0
        break;
630
0
    default:
631
0
        return 0;
632
0
    }
633
634
0
    while (av_isspace((c = shgetc(f))));
635
636
0
    if (c=='+' || c=='-') {
637
0
        sign -= 2*(c=='-');
638
0
        c = shgetc(f);
639
0
    }
640
641
0
    for (i=0; i<8 && (c|32)=="infinity"[i]; i++)
642
0
        if (i<7) c = shgetc(f);
643
0
    if (i==3 || i==8 || (i>3 && pok)) {
644
0
        if (i!=8) {
645
0
            shunget(f);
646
0
            if (pok) for (; i>3; i--) shunget(f);
647
0
        }
648
0
        return sign * INFINITY;
649
0
    }
650
0
    if (!i) for (i=0; i<3 && (c|32)=="nan"[i]; i++)
651
0
        if (i<2) c = shgetc(f);
652
0
    if (i==3) {
653
0
        if (shgetc(f) != '(') {
654
0
            shunget(f);
655
0
            return NAN;
656
0
        }
657
0
        for (i=1; ; i++) {
658
0
            c = shgetc(f);
659
0
            if (c-'0'<10U || c-'A'<26U || c-'a'<26U || c=='_')
660
0
                continue;
661
0
            if (c==')') return NAN;
662
0
            shunget(f);
663
0
            if (!pok) {
664
0
                errno = EINVAL;
665
0
                shlim(f, 0);
666
0
                return 0;
667
0
            }
668
0
            while (i--) shunget(f);
669
0
            return NAN;
670
0
        }
671
0
    }
672
673
0
    if (i) {
674
0
        shunget(f);
675
0
        errno = EINVAL;
676
0
        shlim(f, 0);
677
0
        return 0;
678
0
    }
679
680
0
    if (c=='0') {
681
0
        c = shgetc(f);
682
0
        if ((c|32) == 'x')
683
0
            return hexfloat(f, bits, emin, sign, pok);
684
0
        shunget(f);
685
0
        c = '0';
686
0
    }
687
688
0
    return decfloat(f, c, bits, emin, sign, pok);
689
0
}
690
691
static void *arg_n(va_list ap, unsigned int n)
692
0
{
693
0
    void *p;
694
0
    unsigned int i;
695
0
    va_list ap2;
696
0
    va_copy(ap2, ap);
697
0
    for (i=n; i>1; i--) va_arg(ap2, void *);
698
0
    p = va_arg(ap2, void *);
699
0
    va_end(ap2);
700
0
    return p;
701
0
}
702
703
static void store_int(void *dest, int size, unsigned long long i)
704
0
{
705
0
    if (!dest) return;
706
0
    switch (size) {
707
0
    case SIZE_hh:
708
0
        *(char *)dest = i;
709
0
        break;
710
0
    case SIZE_h:
711
0
        *(short *)dest = i;
712
0
        break;
713
0
    case SIZE_def:
714
0
        *(int *)dest = i;
715
0
        break;
716
0
    case SIZE_l:
717
0
        *(long *)dest = i;
718
0
        break;
719
0
    case SIZE_ll:
720
0
        *(long long *)dest = i;
721
0
        break;
722
0
    }
723
0
}
724
725
static int ff_vfscanf(FFFILE *f, const char *fmt, va_list ap)
726
0
{
727
0
    int width;
728
0
    int size;
729
0
    int base;
730
0
    const unsigned char *p;
731
0
    int c, t;
732
0
    char *s;
733
0
    void *dest=NULL;
734
0
    int invert;
735
0
    int matches=0;
736
0
    unsigned long long x;
737
0
    double y;
738
0
    ptrdiff_t pos = 0;
739
0
    unsigned char scanset[257];
740
0
    size_t i;
741
742
0
    for (p=(const unsigned char *)fmt; *p; p++) {
743
744
0
        if (av_isspace(*p)) {
745
0
            while (av_isspace(p[1])) p++;
746
0
            shlim(f, 0);
747
0
            while (av_isspace(shgetc(f)));
748
0
            shunget(f);
749
0
            pos += shcnt(f);
750
0
            continue;
751
0
        }
752
0
        if (*p != '%' || p[1] == '%') {
753
0
            shlim(f, 0);
754
0
            if (*p == '%') {
755
0
                p++;
756
0
                while (av_isspace((c=shgetc(f))));
757
0
            } else {
758
0
                c = shgetc(f);
759
0
            }
760
0
            if (c!=*p) {
761
0
                shunget(f);
762
0
                if (c<0) goto input_fail;
763
0
                goto match_fail;
764
0
            }
765
0
            pos += shcnt(f);
766
0
            continue;
767
0
        }
768
769
0
        p++;
770
0
        if (*p=='*') {
771
0
            dest = 0; p++;
772
0
        } else if (av_isdigit(*p) && p[1]=='$') {
773
0
            dest = arg_n(ap, *p-'0'); p+=2;
774
0
        } else {
775
0
            dest = va_arg(ap, void *);
776
0
        }
777
778
0
        for (width=0; av_isdigit(*p); p++) {
779
0
            width = 10*width + *p - '0';
780
0
        }
781
782
0
        if (*p=='m') {
783
0
            s = 0;
784
0
            p++;
785
0
        }
786
787
0
        size = SIZE_def;
788
0
        switch (*p++) {
789
0
        case 'h':
790
0
            if (*p == 'h') p++, size = SIZE_hh;
791
0
            else size = SIZE_h;
792
0
            break;
793
0
        case 'l':
794
0
            if (*p == 'l') p++, size = SIZE_ll;
795
0
            else size = SIZE_l;
796
0
            break;
797
0
        case 'j':
798
0
            size = SIZE_ll;
799
0
            break;
800
0
        case 'z':
801
0
        case 't':
802
0
            size = SIZE_l;
803
0
            break;
804
0
        case 'L':
805
0
            size = SIZE_L;
806
0
            break;
807
0
        case 'd': case 'i': case 'o': case 'u': case 'x':
808
0
        case 'a': case 'e': case 'f': case 'g':
809
0
        case 'A': case 'E': case 'F': case 'G': case 'X':
810
0
        case 's': case 'c': case '[':
811
0
        case 'S': case 'C':
812
0
        case 'p': case 'n':
813
0
            p--;
814
0
            break;
815
0
        default:
816
0
            goto fmt_fail;
817
0
        }
818
819
0
        t = *p;
820
821
        /* C or S */
822
0
        if ((t&0x2f) == 3) {
823
0
            t |= 32;
824
0
            size = SIZE_l;
825
0
        }
826
827
0
        switch (t) {
828
0
            case 'c':
829
0
                if (width < 1) width = 1;
830
0
                break;
831
0
            case '[':
832
0
                break;
833
0
            case 'n':
834
0
                store_int(dest, size, pos);
835
                /* do not increment match count, etc! */
836
0
                continue;
837
0
            default:
838
0
                shlim(f, 0);
839
0
                while (av_isspace(shgetc(f)));
840
0
                shunget(f);
841
0
                pos += shcnt(f);
842
0
        }
843
844
0
        shlim(f, width);
845
0
        if (shgetc(f) < 0) goto input_fail;
846
0
        shunget(f);
847
848
0
        switch (t) {
849
0
            case 's':
850
0
            case 'c':
851
0
            case '[':
852
0
                if (t == 'c' || t == 's') {
853
0
                    memset(scanset, -1, sizeof scanset);
854
0
                    scanset[0] = 0;
855
0
                    if (t == 's') {
856
0
                        scanset[1 + '\t'] = 0;
857
0
                        scanset[1 + '\n'] = 0;
858
0
                        scanset[1 + '\v'] = 0;
859
0
                        scanset[1 + '\f'] = 0;
860
0
                        scanset[1 + '\r'] = 0;
861
0
                        scanset[1 + ' ' ] = 0;
862
0
                    }
863
0
                } else {
864
0
                    if (*++p == '^') p++, invert = 1;
865
0
                    else invert = 0;
866
0
                    memset(scanset, invert, sizeof scanset);
867
0
                    scanset[0] = 0;
868
0
                    if (*p == '-') p++, scanset[1+'-'] = 1-invert;
869
0
                    else if (*p == ']') p++, scanset[1+']'] = 1-invert;
870
0
                    for (; *p != ']'; p++) {
871
0
                        if (!*p) goto fmt_fail;
872
0
                        if (*p=='-' && p[1] && p[1] != ']')
873
0
                            for (c=p++[-1]; c<*p; c++)
874
0
                                scanset[1+c] = 1-invert;
875
0
                        scanset[1+*p] = 1-invert;
876
0
                    }
877
0
                }
878
0
                s = 0;
879
0
                i = 0;
880
0
                if ((s = dest)) {
881
0
                    while (scanset[(c=shgetc(f))+1])
882
0
                        s[i++] = c;
883
0
                } else {
884
0
                    while (scanset[(c=shgetc(f))+1]);
885
0
                }
886
0
                shunget(f);
887
0
                if (!shcnt(f)) goto match_fail;
888
0
                if (t == 'c' && shcnt(f) != width) goto match_fail;
889
0
                if (t != 'c') {
890
0
                    if (s) s[i] = 0;
891
0
                }
892
0
                break;
893
0
            case 'p':
894
0
            case 'X':
895
0
            case 'x':
896
0
                base = 16;
897
0
                goto int_common;
898
0
            case 'o':
899
0
                base = 8;
900
0
                goto int_common;
901
0
            case 'd':
902
0
            case 'u':
903
0
                base = 10;
904
0
                goto int_common;
905
0
            case 'i':
906
0
                base = 0;
907
0
int_common:
908
0
                x = ffintscan(f, base, 0, ULLONG_MAX);
909
0
                if (!shcnt(f))
910
0
                    goto match_fail;
911
0
                if (t=='p' && dest)
912
0
                    *(void **)dest = (void *)(uintptr_t)x;
913
0
                else
914
0
                    store_int(dest, size, x);
915
0
                break;
916
0
            case 'a': case 'A':
917
0
            case 'e': case 'E':
918
0
            case 'f': case 'F':
919
0
            case 'g': case 'G':
920
0
                y = fffloatscan(f, size, 0);
921
0
                if (!shcnt(f))
922
0
                    goto match_fail;
923
0
                if (dest) {
924
0
                    switch (size) {
925
0
                    case SIZE_def:
926
0
                        *(float *)dest = y;
927
0
                        break;
928
0
                    case SIZE_l:
929
0
                        *(double *)dest = y;
930
0
                        break;
931
0
                    case SIZE_L:
932
0
                        *(double *)dest = y;
933
0
                        break;
934
0
                    }
935
0
                }
936
0
                break;
937
0
        }
938
939
0
        pos += shcnt(f);
940
0
        if (dest) matches++;
941
0
    }
942
0
    if (0) {
943
0
fmt_fail:
944
0
input_fail:
945
0
        if (!matches) matches--;
946
0
    }
947
0
match_fail:
948
0
    return matches;
949
0
}
950
951
static int ff_vsscanf(const char *s, const char *fmt, va_list ap)
952
0
{
953
0
    FFFILE f = {
954
0
        .buf = (void *)s, .cookie = (void *)s,
955
0
        .read = ffstring_read,
956
0
    };
957
958
0
    return ff_vfscanf(&f, fmt, ap);
959
0
}
960
961
int av_sscanf(const char *string, const char *format, ...)
962
0
{
963
0
    int ret;
964
0
    va_list ap;
965
0
    va_start(ap, format);
966
0
    ret = ff_vsscanf(string, format, ap);
967
    va_end(ap);
968
0
    return ret;
969
0
}