src/doprnt.c

   1 /* Output like sprintf to a buffer of specified size.    -*- coding: utf-8 -*-
   2    Also takes args differently: pass one pointer to the end
   3    of the format string in addition to the format string itself.
   4    Copyright (C) 1985, 2001-2016 Free Software Foundation, Inc.
   5
   6 This file is part of GNU Emacs.
   7
   8 GNU Emacs is free software: you can redistribute it and/or modify
   9 it under the terms of the GNU General Public License as published by
  10 the Free Software Foundation, either version 3 of the License, or (at
  11 your option) any later version.
  12
  13 GNU Emacs is distributed in the hope that it will be useful,
  14 but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 GNU General Public License for more details.
  17
  18 You should have received a copy of the GNU General Public License
  19 along with GNU Emacs.  If not, see <http://www.gnu.org/licenses/>.  */
  20
  21 /* If you think about replacing this with some similar standard C function of
  22    the printf family (such as vsnprintf), please note that this function
  23    supports the following Emacs-specific features:
  24
  25    . For %c conversions, it produces a string with the multibyte representation
  26      of the (`int') argument, suitable for display in an Emacs buffer.
  27
  28    . For %s and %c, when field width is specified (e.g., %25s), it accounts for
  29      the display width of each character, according to char-width-table.  That
  30      is, it does not assume that each character takes one column on display.
  31
  32    . If the size of the buffer is not enough to produce the formatted string in
  33      its entirety, it makes sure that truncation does not chop the last
  34      character in the middle of its multibyte sequence, producing an invalid
  35      sequence.
  36
  37    . It accepts a pointer to the end of the format string, so the format string
  38      could include embedded null characters.
  39
  40    . It signals an error if the length of the formatted string is about to
  41      overflow ptrdiff_t or size_t, to avoid producing strings longer than what
  42      Emacs can handle.
  43
  44    OTOH, this function supports only a small subset of the standard C formatted
  45    output facilities.  E.g., %u and %ll are not supported, and precision is
  46    ignored %s and %c conversions.  (See below for the detailed documentation of
  47    what is supported.)  However, this is okay, as this function is supposed to
  48    be called from `error' and similar functions, and thus does not need to
  49    support features beyond those in `Fformat_message', which is used
  50    by `error' on the Lisp level.  */
  51
  52 /* In the FORMAT argument this function supports ` and ' as directives
  53    that output left and right quotes as per ‘text-quoting style’.  It
  54    also supports the following %-sequences:
  55
  56    %s means print a string argument.
  57    %S is treated as %s, for loose compatibility with `Fformat_message'.
  58    %d means print a `signed int' argument in decimal.
  59    %o means print an `unsigned int' argument in octal.
  60    %x means print an `unsigned int' argument in hex.
  61    %e means print a `double' argument in exponential notation.
  62    %f means print a `double' argument in decimal-point notation.
  63    %g means print a `double' argument in exponential notation
  64       or in decimal-point notation, whichever uses fewer characters.
  65    %c means print a `signed int' argument as a single character.
  66    %% means produce a literal % character.
  67
  68    A %-sequence may contain optional flag, width, and precision specifiers, and
  69    a length modifier, as follows:
  70
  71      %<flags><width><precision><length>character
  72
  73    where flags is [+ -0], width is [0-9]+, precision is .[0-9]+, and length
  74    is empty or l or the value of the pD or pI or pMd (sans "d") macros.
  75    Also, %% in a format stands for a single % in the output.  A % that
  76    does not introduce a valid %-sequence causes undefined behavior.
  77
  78    The + flag character inserts a + before any positive number, while a space
  79    inserts a space before any positive number; these flags only affect %d, %o,
  80    %x, %e, %f, and %g sequences.  The - and 0 flags affect the width specifier,
  81    as described below.  For signed numerical arguments only, the ` ' (space)
  82    flag causes the result to be prefixed with a space character if it does not
  83    start with a sign (+ or -).
  84
  85    The l (lower-case letter ell) length modifier is a `long' data type
  86    modifier: it is supported for %d, %o, and %x conversions of integral
  87    arguments, must immediately precede the conversion specifier, and means that
  88    the respective argument is to be treated as `long int' or `unsigned long
  89    int'.  Similarly, the value of the pD macro means to use ptrdiff_t,
  90    the value of the pI macro means to use EMACS_INT or EMACS_UINT, the
  91    value of the pMd etc. macros means to use intmax_t or uintmax_t,
  92    and the empty length modifier means `int' or `unsigned int'.
  93
  94    The width specifier supplies a lower limit for the length of the printed
  95    representation.  The padding, if any, normally goes on the left, but it goes
  96    on the right if the - flag is present.  The padding character is normally a
  97    space, but (for numerical arguments only) it is 0 if the 0 flag is present.
  98    The - flag takes precedence over the 0 flag.
  99
 100    For %e, %f, and %g sequences, the number after the "." in the precision
 101    specifier says how many decimal places to show; if zero, the decimal point
 102    itself is omitted.  For %s and %S, the precision specifier is ignored.  */
 103
 104 #include <config.h>
 105 #include <stdio.h>
 106 #include <float.h>
 107 #include <unistd.h>
 108 #include <limits.h>
 109
 110 #include "lisp.h"
 111
 112 /* Since we use the macro CHAR_HEAD_P, we have to include this, but
 113    don't have to include others because CHAR_HEAD_P does not contains
 114    another macro.  */
 115 #include "character.h"
 116
 117 /* Generate output from a format-spec FORMAT,
 118    terminated at position FORMAT_END.
 119    (*FORMAT_END is not part of the format, but must exist and be readable.)
 120    Output goes in BUFFER, which has room for BUFSIZE chars.
 121    BUFSIZE must be positive.  If the output does not fit, truncate it
 122    to fit and return BUFSIZE - 1; if this truncates a multibyte
 123    sequence, store '\0' into the sequence's first byte.
 124    Returns the number of bytes stored into BUFFER, excluding
 125    the terminating null byte.  Output is always null-terminated.
 126    String arguments are passed as C strings.
 127    Integers are passed as C integers.  */
 128
 129 ptrdiff_t
 130 doprnt (char *buffer, ptrdiff_t bufsize, const char *format,
 131         const char *format_end, va_list ap)
 132 {
 133   const char *fmt = format;     /* Pointer into format string.  */
 134   char *bufptr = buffer;        /* Pointer into output buffer.  */
 135
 136   /* Use this for sprintf unless we need something really big.  */
 137   char tembuf[DBL_MAX_10_EXP + 100];
 138
 139   /* Size of sprintf_buffer.  */
 140   ptrdiff_t size_allocated = sizeof (tembuf);
 141
 142   /* Buffer to use for sprintf.  Either tembuf or same as BIG_BUFFER.  */
 143   char *sprintf_buffer = tembuf;
 144
 145   /* Buffer we have got with malloc.  */
 146   char *big_buffer = NULL;
 147
 148   enum text_quoting_style quoting_style = text_quoting_style ();
 149   ptrdiff_t tem = -1;
 150   char *string;
 151   char fixed_buffer[20];        /* Default buffer for small formatting. */
 152   char *fmtcpy;
 153   int minlen;
 154   char charbuf[MAX_MULTIBYTE_LENGTH + 1];       /* Used for %c.  */
 155   USE_SAFE_ALLOCA;
 156
 157   if (format_end == 0)
 158     format_end = format + strlen (format);
 159
 160   fmtcpy = (format_end - format < sizeof (fixed_buffer) - 1
 161             ? fixed_buffer
 162             : SAFE_ALLOCA (format_end - format + 1));
 163
 164   bufsize--;
 165
 166   /* Loop until end of format string or buffer full. */
 167   while (fmt < format_end && bufsize > 0)
 168     {
 169       char const *fmt0 = fmt;
 170       char fmtchar = *fmt++;
 171       if (fmtchar == '%')
 172         {
 173           ptrdiff_t size_bound = 0;
 174           ptrdiff_t width;  /* Columns occupied by STRING on display.  */
 175           enum {
 176             pDlen = sizeof pD - 1,
 177             pIlen = sizeof pI - 1,
 178             pMlen = sizeof pMd - 2
 179           };
 180           enum {
 181             no_modifier, long_modifier, pD_modifier, pI_modifier, pM_modifier
 182           } length_modifier = no_modifier;
 183           static char const modifier_len[] = { 0, 1, pDlen, pIlen, pMlen };
 184           int maxmlen = max (max (1, pDlen), max (pIlen, pMlen));
 185           int mlen;
 186
 187           /* Copy this one %-spec into fmtcpy.  */
 188           string = fmtcpy;
 189           *string++ = '%';
 190           while (fmt < format_end)
 191             {
 192               *string++ = *fmt;
 193               if ('0' <= *fmt && *fmt <= '9')
 194                 {
 195                   /* Get an idea of how much space we might need.
 196                      This might be a field width or a precision; e.g.
 197                      %1.1000f and %1000.1f both might need 1000+ bytes.
 198                      Parse the width or precision, checking for overflow.  */
 199                   ptrdiff_t n = *fmt - '0';
 200                   while (fmt + 1 < format_end
 201                          && '0' <= fmt[1] && fmt[1] <= '9')
 202                     {
 203                       /* Avoid ptrdiff_t, size_t, and int overflow, as
 204                          many sprintfs mishandle widths greater than INT_MAX.
 205                          This test is simple but slightly conservative: e.g.,
 206                          (INT_MAX - INT_MAX % 10) is reported as an overflow
 207                          even when it's not.  */
 208                       if (n >= min (INT_MAX, min (PTRDIFF_MAX, SIZE_MAX)) / 10)
 209                         error ("Format width or precision too large");
 210                       n = n * 10 + fmt[1] - '0';
 211                       *string++ = *++fmt;
 212                     }
 213
 214                   if (size_bound < n)
 215                     size_bound = n;
 216                 }
 217               else if (! (*fmt == '-' || *fmt == ' ' || *fmt == '.'
 218                           || *fmt == '+'))
 219                 break;
 220               fmt++;
 221             }
 222
 223           /* Check for the length modifiers in textual length order, so
 224              that longer modifiers override shorter ones.  */
 225           for (mlen = 1; mlen <= maxmlen; mlen++)
 226             {
 227               if (format_end - fmt < mlen)
 228                 break;
 229               if (mlen == 1 && *fmt == 'l')
 230                 length_modifier = long_modifier;
 231               if (mlen == pDlen && memcmp (fmt, pD, pDlen) == 0)
 232                 length_modifier = pD_modifier;
 233               if (mlen == pIlen && memcmp (fmt, pI, pIlen) == 0)
 234                 length_modifier = pI_modifier;
 235               if (mlen == pMlen && memcmp (fmt, pMd, pMlen) == 0)
 236                 length_modifier = pM_modifier;
 237             }
 238
 239           mlen = modifier_len[length_modifier];
 240           memcpy (string, fmt + 1, mlen);
 241           string += mlen;
 242           fmt += mlen;
 243           *string = 0;
 244
 245           /* Make the size bound large enough to handle floating point formats
 246              with large numbers.  */
 247           if (size_bound > min (PTRDIFF_MAX, SIZE_MAX) - DBL_MAX_10_EXP - 50)
 248             error ("Format width or precision too large");
 249           size_bound += DBL_MAX_10_EXP + 50;
 250
 251           /* Make sure we have that much.  */
 252           if (size_bound > size_allocated)
 253             {
 254               if (big_buffer)
 255                 xfree (big_buffer);
 256               big_buffer = xmalloc (size_bound);
 257               sprintf_buffer = big_buffer;
 258               size_allocated = size_bound;
 259             }
 260           minlen = 0;
 261           switch (*fmt++)
 262             {
 263             default:
 264               error ("Invalid format operation %s", fmtcpy);
 265
 266 /*          case 'b': */
 267             case 'l':
 268             case 'd':
 269               switch (length_modifier)
 270                 {
 271                 case no_modifier:
 272                   {
 273                     int v = va_arg (ap, int);
 274                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 275                   }
 276                   break;
 277                 case long_modifier:
 278                   {
 279                     long v = va_arg (ap, long);
 280                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 281                   }
 282                   break;
 283                 case pD_modifier:
 284                 signed_pD_modifier:
 285                   {
 286                     ptrdiff_t v = va_arg (ap, ptrdiff_t);
 287                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 288                   }
 289                   break;
 290                 case pI_modifier:
 291                   {
 292                     EMACS_INT v = va_arg (ap, EMACS_INT);
 293                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 294                   }
 295                   break;
 296                 case pM_modifier:
 297                   {
 298                     intmax_t v = va_arg (ap, intmax_t);
 299                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 300                   }
 301                   break;
 302                 }
 303               /* Now copy into final output, truncating as necessary.  */
 304               string = sprintf_buffer;
 305               goto doit;
 306
 307             case 'o':
 308             case 'x':
 309               switch (length_modifier)
 310                 {
 311                 case no_modifier:
 312                   {
 313                     unsigned v = va_arg (ap, unsigned);
 314                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 315                   }
 316                   break;
 317                 case long_modifier:
 318                   {
 319                     unsigned long v = va_arg (ap, unsigned long);
 320                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 321                   }
 322                   break;
 323                 case pD_modifier:
 324                   goto signed_pD_modifier;
 325                 case pI_modifier:
 326                   {
 327                     EMACS_UINT v = va_arg (ap, EMACS_UINT);
 328                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 329                   }
 330                   break;
 331                 case pM_modifier:
 332                   {
 333                     uintmax_t v = va_arg (ap, uintmax_t);
 334                     tem = sprintf (sprintf_buffer, fmtcpy, v);
 335                   }
 336                   break;
 337                 }
 338               /* Now copy into final output, truncating as necessary.  */
 339               string = sprintf_buffer;
 340               goto doit;
 341
 342             case 'f':
 343             case 'e':
 344             case 'g':
 345               {
 346                 double d = va_arg (ap, double);
 347                 tem = sprintf (sprintf_buffer, fmtcpy, d);
 348                 /* Now copy into final output, truncating as necessary.  */
 349                 string = sprintf_buffer;
 350                 goto doit;
 351               }
 352
 353             case 'S':
 354               string[-1] = 's';
 355             case 's':
 356               if (fmtcpy[1] != 's')
 357                 minlen = atoi (&fmtcpy[1]);
 358               string = va_arg (ap, char *);
 359               tem = strlen (string);
 360               if (STRING_BYTES_BOUND < tem)
 361                 error ("String for %%s or %%S format is too long");
 362               width = strwidth (string, tem);
 363               goto doit1;
 364
 365               /* Copy string into final output, truncating if no room.  */
 366             doit:
 367               eassert (0 <= tem);
 368               /* Coming here means STRING contains ASCII only.  */
 369               if (STRING_BYTES_BOUND < tem)
 370                 error ("Format width or precision too large");
 371               width = tem;
 372             doit1:
 373               /* We have already calculated:
 374                  TEM -- length of STRING,
 375                  WIDTH -- columns occupied by STRING when displayed, and
 376                  MINLEN -- minimum columns of the output.  */
 377               if (minlen > 0)
 378                 {
 379                   while (minlen > width && bufsize > 0)
 380                     {
 381                       *bufptr++ = ' ';
 382                       bufsize--;
 383                       minlen--;
 384                     }
 385                   minlen = 0;
 386                 }
 387               if (tem > bufsize)
 388                 {
 389                   /* Truncate the string at character boundary.  */
 390                   tem = bufsize;
 391                   do
 392                     {
 393                       tem--;
 394                       if (CHAR_HEAD_P (string[tem]))
 395                         {
 396                           if (BYTES_BY_CHAR_HEAD (string[tem]) <= bufsize - tem)
 397                             tem = bufsize;
 398                           break;
 399                         }
 400                     }
 401                   while (tem != 0);
 402
 403                   memcpy (bufptr, string, tem);
 404                   bufptr[tem] = 0;
 405                   /* Trigger exit from the loop, but make sure we
 406                      return to the caller a value which will indicate
 407                      that the buffer was too small.  */
 408                   bufptr += bufsize;
 409                   bufsize = 0;
 410                   continue;
 411                 }
 412               memcpy (bufptr, string, tem);
 413               bufptr += tem;
 414               bufsize -= tem;
 415               if (minlen < 0)
 416                 {
 417                   while (minlen < - width && bufsize > 0)
 418                     {
 419                       *bufptr++ = ' ';
 420                       bufsize--;
 421                       minlen++;
 422                     }
 423                   minlen = 0;
 424                 }
 425               continue;
 426
 427             case 'c':
 428               {
 429                 int chr = va_arg (ap, int);
 430                 tem = CHAR_STRING (chr, (unsigned char *) charbuf);
 431                 string = charbuf;
 432                 string[tem] = 0;
 433                 width = strwidth (string, tem);
 434                 if (fmtcpy[1] != 'c')
 435                   minlen = atoi (&fmtcpy[1]);
 436                 goto doit1;
 437               }
 438
 439             case '%':
 440               fmt--;    /* Drop thru and this % will be treated as normal */
 441             }
 442         }
 443
 444       char const *src;
 445       ptrdiff_t srclen;
 446       if (quoting_style == CURVE_QUOTING_STYLE && fmtchar == '`')
 447         src = uLSQM, srclen = sizeof uLSQM - 1;
 448       else if (quoting_style == CURVE_QUOTING_STYLE && fmtchar == '\'')
 449         src = uRSQM, srclen = sizeof uRSQM - 1;
 450       else if (quoting_style == STRAIGHT_QUOTING_STYLE && fmtchar == '`')
 451         src = "'", srclen = 1;
 452       else
 453         {
 454           while (fmt < format_end && !CHAR_HEAD_P (*fmt))
 455             fmt++;
 456           src = fmt0, srclen = fmt - fmt0;
 457         }
 458
 459       if (bufsize < srclen)
 460         {
 461           /* Truncate, but return value that will signal to caller
 462              that the buffer was too small.  */
 463           do
 464             *bufptr++ = '\0';
 465           while (--bufsize != 0);
 466         }
 467       else
 468         {
 469           do
 470             *bufptr++ = *src++;
 471           while (--srclen != 0);
 472         }
 473     }
 474
 475   /* If we had to malloc something, free it.  */
 476   xfree (big_buffer);
 477
 478   *bufptr = 0;          /* Make sure our string ends with a '\0' */
 479
 480   SAFE_FREE ();
 481   return bufptr - buffer;
 482 }
 483
 484 /* Format to an unbounded buffer BUF.  This is like sprintf, except it
 485    is not limited to returning an 'int' so it doesn't have a silly 2
 486    GiB limit on typical 64-bit hosts.  However, it is limited to the
 487    Emacs-style formats that doprnt supports, and it requotes ` and '
 488    as per ‘text-quoting-style’.
 489
 490    Return the number of bytes put into BUF, excluding the terminating
 491    '\0'.  */
 492 ptrdiff_t
 493 esprintf (char *buf, char const *format, ...)
 494 {
 495   ptrdiff_t nbytes;
 496   va_list ap;
 497   va_start (ap, format);
 498   nbytes = doprnt (buf, TYPE_MAXIMUM (ptrdiff_t), format, 0, ap);
 499   va_end (ap);
 500   return nbytes;
 501 }
 502
 503 #if HAVE_MODULES || (defined HAVE_X_WINDOWS && defined USE_X_TOOLKIT)
 504
 505 /* Format to buffer *BUF of positive size *BUFSIZE, reallocating *BUF
 506    and updating *BUFSIZE if the buffer is too small, and otherwise
 507    behaving line esprintf.  When reallocating, free *BUF unless it is
 508    equal to NONHEAPBUF, and if BUFSIZE_MAX is nonnegative then signal
 509    memory exhaustion instead of growing the buffer size past
 510    BUFSIZE_MAX.  */
 511 ptrdiff_t
 512 exprintf (char **buf, ptrdiff_t *bufsize,
 513           char const *nonheapbuf, ptrdiff_t bufsize_max,
 514           char const *format, ...)
 515 {
 516   ptrdiff_t nbytes;
 517   va_list ap;
 518   va_start (ap, format);
 519   nbytes = evxprintf (buf, bufsize, nonheapbuf, bufsize_max, format, ap);
 520   va_end (ap);
 521   return nbytes;
 522 }
 523
 524 #endif
 525
 526 /* Act like exprintf, except take a va_list.  */
 527 ptrdiff_t
 528 evxprintf (char **buf, ptrdiff_t *bufsize,
 529            char const *nonheapbuf, ptrdiff_t bufsize_max,
 530            char const *format, va_list ap)
 531 {
 532   for (;;)
 533     {
 534       ptrdiff_t nbytes;
 535       va_list ap_copy;
 536       va_copy (ap_copy, ap);
 537       nbytes = doprnt (*buf, *bufsize, format, 0, ap_copy);
 538       va_end (ap_copy);
 539       if (nbytes < *bufsize - 1)
 540         return nbytes;
 541       if (*buf != nonheapbuf)
 542         {
 543           xfree (*buf);
 544           *buf = NULL;
 545         }
 546       *buf = xpalloc (NULL, bufsize, 1, bufsize_max, 1);
 547     }
 548 }