snprintf/vfprintf.c

   1 /*      $OpenBSD: vfprintf.c,v 1.57 2009/10/28 21:15:02 naddy Exp $     */
   2 /*-
   3  * Copyright (c) 1990 The Regents of the University of California.
   4  * All rights reserved.
   5  *
   6  * This code is derived from software contributed to Berkeley by
   7  * Chris Torek.
   8  *
   9  * Redistribution and use in source and binary forms, with or without
  10  * modification, are permitted provided that the following conditions
  11  * are met:
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  * 2. Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in the
  16  *    documentation and/or other materials provided with the distribution.
  17  * 3. Neither the name of the University nor the names of its contributors
  18  *    may be used to endorse or promote products derived from this software
  19  *    without specific prior written permission.
  20  *
  21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  31  * SUCH DAMAGE.
  32  */
  33
  34 /*
  35  * Actual printf innards.
  36  *
  37  * This code is large and complicated...
  38  */
  39
  40 //#define FLOATING_POINT
  41
  42 #include <sys/types.h>
  43 #include <sys/mman.h>
  44
  45 #include <errno.h>
  46 #include <limits.h>
  47 #include <stdarg.h>
  48 #include <stddef.h>
  49 #include <stdio.h>
  50 #include <stdint.h>
  51 #include <stdlib.h>
  52 #include <string.h>
  53 #include <unistd.h>
  54 #include <wchar.h>
  55
  56 #include "local.h"
  57 #include "fvwrite.h"
  58
  59 union arg {
  60         int                     intarg;
  61         unsigned int            uintarg;
  62         long                    longarg;
  63         unsigned long           ulongarg;
  64         long long               longlongarg;
  65         unsigned long long      ulonglongarg;
  66         ptrdiff_t               ptrdiffarg;
  67         size_t                  sizearg;
  68         size_t                  ssizearg;
  69         intmax_t                intmaxarg;
  70         uintmax_t               uintmaxarg;
  71         void                    *pvoidarg;
  72         char                    *pchararg;
  73         signed char             *pschararg;
  74         short                   *pshortarg;
  75         int                     *pintarg;
  76         long                    *plongarg;
  77         long long               *plonglongarg;
  78         ptrdiff_t               *pptrdiffarg;
  79         ssize_t                 *pssizearg;
  80         intmax_t                *pintmaxarg;
  81 #ifdef FLOATING_POINT
  82         double                  doublearg;
  83         long double             longdoublearg;
  84 #endif
  85 };
  86
  87 static int __find_arguments(const char *fmt0, va_list ap, union arg **argtable,
  88     size_t *argtablesiz);
  89 static int __grow_type_table(unsigned char **typetable, int *tablesize);
  90
  91 /*
  92  * Flush out all the vectors defined by the given uio,
  93  * then reset it so that it can be reused.
  94  */
  95 static int
  96 __sprint(LTTNG_UST_LFILE *fp, struct __lttng_ust_suio *uio)
  97 {
  98         int err;
  99
 100         if (uio->uio_resid == 0) {
 101                 uio->uio_iovcnt = 0;
 102                 return (0);
 103         }
 104         err = __sfvwrite(fp, uio);
 105         uio->uio_resid = 0;
 106         uio->uio_iovcnt = 0;
 107         return (err);
 108 }
 109
 110 /*
 111  * Helper function for `fprintf to unbuffered unix file': creates a
 112  * temporary buffer.  We only work on write-only files; this avoids
 113  * worries about ungetc buffers and so forth.
 114  */
 115 //static int
 116 //__sbprintf(LTTNG_UST_LFILE *fp, const char *fmt, va_list ap)
 117 //{
 118 //      int ret;
 119 //      LTTNG_UST_LFILE fake;
 120 //      struct __sfileext fakeext;
 121 //      unsigned char buf[BUFSIZ];
 122 //
 123 //      _FILEEXT_SETUP(&fake, &fakeext);
 124 //      /* copy the important variables */
 125 //      fake._flags = fp->_flags & ~__SNBF;
 126 //      fake._file = fp->_file;
 127 //      fake._cookie = fp->_cookie;
 128 //      fake._write = fp->_write;
 129 //
 130 //      /* set up the buffer */
 131 //      fake._bf._base = fake._p = buf;
 132 //      fake._bf._size = fake._w = sizeof(buf);
 133 //      fake._lbfsize = 0;      /* not actually used, but Just In Case */
 134 //
 135 //      /* do the work, then copy any error status */
 136 //      ret = ust_safe_vfprintf(&fake, fmt, ap);
 137 //      if (ret >= 0 && fflush(&fake))
 138 //              ret = EOF;
 139 //      if (fake._flags & __SERR)
 140 //              fp->_flags |= __SERR;
 141 //      return (ret);
 142 //}
 143
 144
 145 #ifdef FLOATING_POINT
 146 #include <float.h>
 147 #include <locale.h>
 148 #include <math.h>
 149 #include "floatio.h"
 150
 151 #define DEFPREC         6
 152
 153 extern char *__dtoa(double, int, int, int *, int *, char **);
 154 extern void  __freedtoa(char *);
 155 static int exponent(char *, int, int);
 156 #endif /* FLOATING_POINT */
 157
 158 /*
 159  * The size of the buffer we use as scratch space for integer
 160  * conversions, among other things.  Technically, we would need the
 161  * most space for base 10 conversions with thousands' grouping
 162  * characters between each pair of digits.  100 bytes is a
 163  * conservative overestimate even for a 128-bit uintmax_t.
 164  */
 165 #define BUF     100
 166
 167 #define STATIC_ARG_TBL_SIZE 8   /* Size of static argument table. */
 168
 169
 170 /*
 171  * Macros for converting digits to letters and vice versa
 172  */
 173 #define to_digit(c)     ((c) - '0')
 174 #define is_digit(c)     ((unsigned)to_digit(c) <= 9)
 175 #define to_char(n)      ((n) + '0')
 176
 177 /*
 178  * Flags used during conversion.
 179  */
 180 #define ALT             0x0001          /* alternate form */
 181 #define LADJUST         0x0004          /* left adjustment */
 182 #define LONGDBL         0x0008          /* long double; unimplemented */
 183 #define LONGINT         0x0010          /* long integer */
 184 #define LLONGINT        0x0020          /* long long integer */
 185 #define SHORTINT        0x0040          /* short integer */
 186 #define ZEROPAD         0x0080          /* zero (as opposed to blank) pad */
 187 #define FPT             0x0100          /* Floating point number */
 188 #define PTRINT          0x0200          /* (unsigned) ptrdiff_t */
 189 #define SIZEINT         0x0400          /* (signed) size_t */
 190 #define CHARINT         0x0800          /* 8 bit integer */
 191 #define MAXINT          0x1000          /* largest integer size (intmax_t) */
 192
 193 int ust_safe_vfprintf(LTTNG_UST_LFILE *fp, const char *fmt0, va_list ap)
 194 {
 195         char *fmt;              /* format string */
 196         int ch;                 /* character from fmt */
 197         int n, n2;              /* handy integers (short term usage) */
 198         char *cp;               /* handy char pointer (short term usage) */
 199         struct __lttng_ust_siov *iovp;  /* for PRINT macro */
 200         int flags;              /* flags as above */
 201         int ret;                /* return value accumulator */
 202         int width;              /* width from format (%8d), or 0 */
 203         int prec;               /* precision from format; <0 for N/A */
 204         char sign;              /* sign prefix (' ', '+', '-', or \0) */
 205         wchar_t wc;
 206         mbstate_t ps;
 207 #ifdef FLOATING_POINT
 208         /*
 209          * We can decompose the printed representation of floating
 210          * point numbers into several parts, some of which may be empty:
 211          *
 212          * [+|-| ] [0x|0X] MMM . NNN [e|E|p|P] [+|-] ZZ
 213          *    A       B     ---C---      D       E   F
 214          *
 215          * A:   'sign' holds this value if present; '\0' otherwise
 216          * B:   ox[1] holds the 'x' or 'X'; '\0' if not hexadecimal
 217          * C:   cp points to the string MMMNNN.  Leading and trailing
 218          *      zeros are not in the string and must be added.
 219          * D:   expchar holds this character; '\0' if no exponent, e.g. %f
 220          * F:   at least two digits for decimal, at least one digit for hex
 221          */
 222         char *decimal_point = localeconv()->decimal_point;
 223         int signflag;           /* true if float is negative */
 224         union {                 /* floating point arguments %[aAeEfFgG] */
 225                 double dbl;
 226                 long double ldbl;
 227         } fparg;
 228         int expt;               /* integer value of exponent */
 229         char expchar;           /* exponent character: [eEpP\0] */
 230         char *dtoaend;          /* pointer to end of converted digits */
 231         int expsize;            /* character count for expstr */
 232         int lead;               /* sig figs before decimal or group sep */
 233         int ndig;               /* actual number of digits returned by dtoa */
 234         char expstr[MAXEXPDIG+2];       /* buffer for exponent string: e+ZZZ */
 235         char *dtoaresult = NULL;
 236 #endif
 237
 238         uintmax_t _umax;        /* integer arguments %[diouxX] */
 239         enum { OCT, DEC, HEX } base;    /* base for %[diouxX] conversion */
 240         int dprec;              /* a copy of prec if %[diouxX], 0 otherwise */
 241         int realsz;             /* field size expanded by dprec */
 242         int size;               /* size of converted field or string */
 243         const char *xdigs = NULL;       /* digits for %[xX] conversion */
 244 #define NIOV 8
 245         struct __lttng_ust_suio uio;    /* output information: summary */
 246         struct __lttng_ust_siov iov[NIOV];/* ... and individual io vectors */
 247         char buf[BUF];          /* buffer with space for digits of uintmax_t */
 248         char ox[2];             /* space for 0x; ox[1] is either x, X, or \0 */
 249         union arg *argtable;    /* args, built due to positional arg */
 250         union arg statargtable[STATIC_ARG_TBL_SIZE];
 251         size_t argtablesiz;
 252         int nextarg;            /* 1-based argument index */
 253         va_list orgap;          /* original argument pointer */
 254
 255         /*
 256          * Choose PADSIZE to trade efficiency vs. size.  If larger printf
 257          * fields occur frequently, increase PADSIZE and make the initialisers
 258          * below longer.
 259          */
 260 #define PADSIZE 16              /* pad chunk size */
 261         static char blanks[PADSIZE] =
 262          {' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' ',' '};
 263         static char zeroes[PADSIZE] =
 264          {'0','0','0','0','0','0','0','0','0','0','0','0','0','0','0','0'};
 265
 266         static const char xdigs_lower[16] = "0123456789abcdef";
 267         static const char xdigs_upper[16] = "0123456789ABCDEF";
 268
 269         /*
 270          * BEWARE, these `goto error' on error, and PAD uses `n'.
 271          */
 272 #define PRINT(ptr, len) do { \
 273         iovp->iov_base = (ptr); \
 274         iovp->iov_len = (len); \
 275         uio.uio_resid += (len); \
 276         iovp++; \
 277         if (++uio.uio_iovcnt >= NIOV) { \
 278                 if (__sprint(fp, &uio)) \
 279                         goto error; \
 280                 iovp = iov; \
 281         } \
 282 } while (0)
 283 #define PAD(howmany, with) do { \
 284         if ((n = (howmany)) > 0) { \
 285                 while (n > PADSIZE) { \
 286                         PRINT(with, PADSIZE); \
 287                         n -= PADSIZE; \
 288                 } \
 289                 PRINT(with, n); \
 290         } \
 291 } while (0)
 292 #define PRINTANDPAD(p, ep, len, with) do {      \
 293         n2 = (ep) - (p);                        \
 294         if (n2 > (len))                         \
 295                 n2 = (len);                     \
 296         if (n2 > 0)                             \
 297                 PRINT((p), n2);                 \
 298         PAD((len) - (n2 > 0 ? n2 : 0), (with)); \
 299 } while(0)
 300 #define FLUSH() do { \
 301         if (uio.uio_resid && __sprint(fp, &uio)) \
 302                 goto error; \
 303         uio.uio_iovcnt = 0; \
 304         iovp = iov; \
 305 } while (0)
 306
 307         /*
 308          * To extend shorts properly, we need both signed and unsigned
 309          * argument extraction methods.
 310          */
 311 #define SARG() \
 312         ((intmax_t)(flags&MAXINT ? GETARG(intmax_t) : \
 313             flags&LLONGINT ? GETARG(long long) : \
 314             flags&LONGINT ? GETARG(long) : \
 315             flags&PTRINT ? GETARG(ptrdiff_t) : \
 316             flags&SIZEINT ? GETARG(ssize_t) : \
 317             flags&SHORTINT ? (short)GETARG(int) : \
 318             flags&CHARINT ? (__signed char)GETARG(int) : \
 319             GETARG(int)))
 320 #define UARG() \
 321         ((uintmax_t)(flags&MAXINT ? GETARG(uintmax_t) : \
 322             flags&LLONGINT ? GETARG(unsigned long long) : \
 323             flags&LONGINT ? GETARG(unsigned long) : \
 324             flags&PTRINT ? (uintptr_t)GETARG(ptrdiff_t) : /* XXX */ \
 325             flags&SIZEINT ? GETARG(size_t) : \
 326             flags&SHORTINT ? (unsigned short)GETARG(int) : \
 327             flags&CHARINT ? (unsigned char)GETARG(int) : \
 328             GETARG(unsigned int)))
 329
 330         /*
 331          * Append a digit to a value and check for overflow.
 332          */
 333 #define APPEND_DIGIT(val, dig) do { \
 334         if ((val) > INT_MAX / 10) \
 335                 goto overflow; \
 336         (val) *= 10; \
 337         if ((val) > INT_MAX - to_digit((dig))) \
 338                 goto overflow; \
 339         (val) += to_digit((dig)); \
 340 } while (0)
 341
 342          /*
 343           * Get * arguments, including the form *nn$.  Preserve the nextarg
 344           * that the argument can be gotten once the type is determined.
 345           */
 346 #define GETASTER(val) \
 347         n2 = 0; \
 348         cp = fmt; \
 349         while (is_digit(*cp)) { \
 350                 APPEND_DIGIT(n2, *cp); \
 351                 cp++; \
 352         } \
 353         if (*cp == '$') { \
 354                 int hold = nextarg; \
 355                 if (argtable == NULL) { \
 356                         argtable = statargtable; \
 357                         __find_arguments(fmt0, orgap, &argtable, &argtablesiz); \
 358                 } \
 359                 nextarg = n2; \
 360                 val = GETARG(int); \
 361                 nextarg = hold; \
 362                 fmt = ++cp; \
 363         } else { \
 364                 val = GETARG(int); \
 365         }
 366
 367 /*
 368 * Get the argument indexed by nextarg.   If the argument table is
 369 * built, use it to get the argument.  If its not, get the next
 370 * argument (and arguments must be gotten sequentially).
 371 */
 372 #define GETARG(type) \
 373         ((argtable != NULL) ? *((type*)(&argtable[nextarg++])) : \
 374                 (nextarg++, va_arg(ap, type)))
 375
 376         _SET_ORIENTATION(fp, -1);
 377         /* sorry, fprintf(read_only_file, "") returns EOF, not 0 */
 378         if (cantwrite(fp)) {
 379                 errno = EBADF;
 380                 return (EOF);
 381         }
 382
 383         /* optimise fprintf(stderr) (and other unbuffered Unix files) */
 384 //      if ((fp->_flags & (__SNBF|__SWR|__SRW)) == (__SNBF|__SWR) &&
 385 //          fp->_file >= 0)
 386 //              return (__sbprintf(fp, fmt0, ap));
 387
 388         fmt = (char *)fmt0;
 389         argtable = NULL;
 390         nextarg = 1;
 391         va_copy(orgap, ap);
 392         uio.uio_iov = iovp = iov;
 393         uio.uio_resid = 0;
 394         uio.uio_iovcnt = 0;
 395         ret = 0;
 396
 397         memset(&ps, 0, sizeof(ps));
 398         /*
 399          * Scan the format for conversions (`%' character).
 400          */
 401         for (;;) {
 402                 cp = fmt;
 403                 while ((n = ust_safe_mbrtowc(&wc, fmt, MB_CUR_MAX, &ps)) > 0) {
 404                         fmt += n;
 405                         if (wc == '%') {
 406                                 fmt--;
 407                                 break;
 408                         }
 409                 }
 410                 if (fmt != cp) {
 411                         ptrdiff_t m = fmt - cp;
 412                         if (m < 0 || m > INT_MAX - ret)
 413                                 goto overflow;
 414                         PRINT(cp, m);
 415                         ret += m;
 416                 }
 417                 if (n <= 0)
 418                         goto done;
 419                 fmt++;          /* skip over '%' */
 420
 421                 flags = 0;
 422                 dprec = 0;
 423                 width = 0;
 424                 prec = -1;
 425                 sign = '\0';
 426                 ox[1] = '\0';
 427
 428 rflag:          ch = *fmt++;
 429 reswitch:       switch (ch) {
 430                 case ' ':
 431                         /*
 432                          * ``If the space and + flags both appear, the space
 433                          * flag will be ignored.''
 434                          *      -- ANSI X3J11
 435                          */
 436                         if (!sign)
 437                                 sign = ' ';
 438                         goto rflag;
 439                 case '#':
 440                         flags |= ALT;
 441                         goto rflag;
 442                 case '\'':
 443                         /* grouping not implemented */
 444                         goto rflag;
 445                 case '*':
 446                         /*
 447                          * ``A negative field width argument is taken as a
 448                          * - flag followed by a positive field width.''
 449                          *      -- ANSI X3J11
 450                          * They don't exclude field widths read from args.
 451                          */
 452                         GETASTER(width);
 453                         if (width >= 0)
 454                                 goto rflag;
 455                         if (width == INT_MIN)
 456                                 goto overflow;
 457                         width = -width;
 458                         /* FALLTHROUGH */
 459                 case '-':
 460                         flags |= LADJUST;
 461                         goto rflag;
 462                 case '+':
 463                         sign = '+';
 464                         goto rflag;
 465                 case '.':
 466                         if ((ch = *fmt++) == '*') {
 467                                 GETASTER(n);
 468                                 prec = n < 0 ? -1 : n;
 469                                 goto rflag;
 470                         }
 471                         n = 0;
 472                         while (is_digit(ch)) {
 473                                 APPEND_DIGIT(n, ch);
 474                                 ch = *fmt++;
 475                         }
 476                         if (ch == '$') {
 477                                 nextarg = n;
 478                                 if (argtable == NULL) {
 479                                         argtable = statargtable;
 480                                         __find_arguments(fmt0, orgap,
 481                                             &argtable, &argtablesiz);
 482                                 }
 483                                 goto rflag;
 484                         }
 485                         prec = n;
 486                         goto reswitch;
 487                 case '0':
 488                         /*
 489                          * ``Note that 0 is taken as a flag, not as the
 490                          * beginning of a field width.''
 491                          *      -- ANSI X3J11
 492                          */
 493                         flags |= ZEROPAD;
 494                         goto rflag;
 495                 case '1': case '2': case '3': case '4':
 496                 case '5': case '6': case '7': case '8': case '9':
 497                         n = 0;
 498                         do {
 499                                 APPEND_DIGIT(n, ch);
 500                                 ch = *fmt++;
 501                         } while (is_digit(ch));
 502                         if (ch == '$') {
 503                                 nextarg = n;
 504                                 if (argtable == NULL) {
 505                                         argtable = statargtable;
 506                                         __find_arguments(fmt0, orgap,
 507                                             &argtable, &argtablesiz);
 508                                 }
 509                                 goto rflag;
 510                         }
 511                         width = n;
 512                         goto reswitch;
 513 #ifdef FLOATING_POINT
 514                 case 'L':
 515                         flags |= LONGDBL;
 516                         goto rflag;
 517 #endif
 518                 case 'h':
 519                         if (*fmt == 'h') {
 520                                 fmt++;
 521                                 flags |= CHARINT;
 522                         } else {
 523                                 flags |= SHORTINT;
 524                         }
 525                         goto rflag;
 526                 case 'j':
 527                         flags |= MAXINT;
 528                         goto rflag;
 529                 case 'l':
 530                         if (*fmt == 'l') {
 531                                 fmt++;
 532                                 flags |= LLONGINT;
 533                         } else {
 534                                 flags |= LONGINT;
 535                         }
 536                         goto rflag;
 537                 case 'q':
 538                         flags |= LLONGINT;
 539                         goto rflag;
 540                 case 't':
 541                         flags |= PTRINT;
 542                         goto rflag;
 543                 case 'z':
 544                         flags |= SIZEINT;
 545                         goto rflag;
 546                 case 'c':
 547                         *(cp = buf) = GETARG(int);
 548                         size = 1;
 549                         sign = '\0';
 550                         break;
 551                 case 'D':
 552                         flags |= LONGINT;
 553                         /*FALLTHROUGH*/
 554                 case 'd':
 555                 case 'i':
 556                         _umax = SARG();
 557                         if ((intmax_t)_umax < 0) {
 558                                 _umax = -_umax;
 559                                 sign = '-';
 560                         }
 561                         base = DEC;
 562                         goto number;
 563 #ifdef FLOATING_POINT
 564                 case 'a':
 565                 case 'A':
 566                         if (ch == 'a') {
 567                                 ox[1] = 'x';
 568                                 xdigs = xdigs_lower;
 569                                 expchar = 'p';
 570                         } else {
 571                                 ox[1] = 'X';
 572                                 xdigs = xdigs_upper;
 573                                 expchar = 'P';
 574                         }
 575                         if (prec >= 0)
 576                                 prec++;
 577                         if (dtoaresult)
 578                                 __freedtoa(dtoaresult);
 579                         if (flags & LONGDBL) {
 580                                 fparg.ldbl = GETARG(long double);
 581                                 dtoaresult = cp =
 582                                     __hldtoa(fparg.ldbl, xdigs, prec,
 583                                     &expt, &signflag, &dtoaend);
 584                                 if (dtoaresult == NULL) {
 585                                         errno = ENOMEM;
 586                                         goto error;
 587                                 }
 588                         } else {
 589                                 fparg.dbl = GETARG(double);
 590                                 dtoaresult = cp =
 591                                     __hdtoa(fparg.dbl, xdigs, prec,
 592                                     &expt, &signflag, &dtoaend);
 593                                 if (dtoaresult == NULL) {
 594                                         errno = ENOMEM;
 595                                         goto error;
 596                                 }
 597                         }
 598                         if (prec < 0)
 599                                 prec = dtoaend - cp;
 600                         if (expt == INT_MAX)
 601                                 ox[1] = '\0';
 602                         goto fp_common;
 603                 case 'e':
 604                 case 'E':
 605                         expchar = ch;
 606                         if (prec < 0)   /* account for digit before decpt */
 607                                 prec = DEFPREC + 1;
 608                         else
 609                                 prec++;
 610                         goto fp_begin;
 611                 case 'f':
 612                 case 'F':
 613                         expchar = '\0';
 614                         goto fp_begin;
 615                 case 'g':
 616                 case 'G':
 617                         expchar = ch - ('g' - 'e');
 618                         if (prec == 0)
 619                                 prec = 1;
 620 fp_begin:
 621                         if (prec < 0)
 622                                 prec = DEFPREC;
 623                         if (dtoaresult)
 624                                 __freedtoa(dtoaresult);
 625                         if (flags & LONGDBL) {
 626                                 fparg.ldbl = GETARG(long double);
 627                                 dtoaresult = cp =
 628                                     __ldtoa(&fparg.ldbl, expchar ? 2 : 3, prec,
 629                                     &expt, &signflag, &dtoaend);
 630                                 if (dtoaresult == NULL) {
 631                                         errno = ENOMEM;
 632                                         goto error;
 633                                 }
 634                         } else {
 635                                 fparg.dbl = GETARG(double);
 636                                 dtoaresult = cp =
 637                                     __dtoa(fparg.dbl, expchar ? 2 : 3, prec,
 638                                     &expt, &signflag, &dtoaend);
 639                                 if (dtoaresult == NULL) {
 640                                         errno = ENOMEM;
 641                                         goto error;
 642                                 }
 643                                 if (expt == 9999)
 644                                         expt = INT_MAX;
 645                         }
 646 fp_common:
 647                         if (signflag)
 648                                 sign = '-';
 649                         if (expt == INT_MAX) {  /* inf or nan */
 650                                 if (*cp == 'N') {
 651                                         cp = (ch >= 'a') ? "nan" : "NAN";
 652                                         sign = '\0';
 653                                 } else
 654                                         cp = (ch >= 'a') ? "inf" : "INF";
 655                                 size = 3;
 656                                 flags &= ~ZEROPAD;
 657                                 break;
 658                         }
 659                         flags |= FPT;
 660                         ndig = dtoaend - cp;
 661                         if (ch == 'g' || ch == 'G') {
 662                                 if (expt > -4 && expt <= prec) {
 663                                         /* Make %[gG] smell like %[fF] */
 664                                         expchar = '\0';
 665                                         if (flags & ALT)
 666                                                 prec -= expt;
 667                                         else
 668                                                 prec = ndig - expt;
 669                                         if (prec < 0)
 670                                                 prec = 0;
 671                                 } else {
 672                                         /*
 673                                          * Make %[gG] smell like %[eE], but
 674                                          * trim trailing zeroes if no # flag.
 675                                          */
 676                                         if (!(flags & ALT))
 677                                                 prec = ndig;
 678                                 }
 679                         }
 680                         if (expchar) {
 681                                 expsize = exponent(expstr, expt - 1, expchar);
 682                                 size = expsize + prec;
 683                                 if (prec > 1 || flags & ALT)
 684                                         ++size;
 685                         } else {
 686                                 /* space for digits before decimal point */
 687                                 if (expt > 0)
 688                                         size = expt;
 689                                 else    /* "0" */
 690                                         size = 1;
 691                                 /* space for decimal pt and following digits */
 692                                 if (prec || flags & ALT)
 693                                         size += prec + 1;
 694                                 lead = expt;
 695                         }
 696                         break;
 697 #endif /* FLOATING_POINT */
 698                 case 'n':
 699                         if (flags & LLONGINT)
 700                                 *GETARG(long long *) = ret;
 701                         else if (flags & LONGINT)
 702                                 *GETARG(long *) = ret;
 703                         else if (flags & SHORTINT)
 704                                 *GETARG(short *) = ret;
 705                         else if (flags & CHARINT)
 706                                 *GETARG(__signed char *) = ret;
 707                         else if (flags & PTRINT)
 708                                 *GETARG(ptrdiff_t *) = ret;
 709                         else if (flags & SIZEINT)
 710                                 *GETARG(ssize_t *) = ret;
 711                         else if (flags & MAXINT)
 712                                 *GETARG(intmax_t *) = ret;
 713                         else
 714                                 *GETARG(int *) = ret;
 715                         continue;       /* no output */
 716                 case 'O':
 717                         flags |= LONGINT;
 718                         /*FALLTHROUGH*/
 719                 case 'o':
 720                         _umax = UARG();
 721                         base = OCT;
 722                         goto nosign;
 723                 case 'p':
 724                         /*
 725                          * ``The argument shall be a pointer to void.  The
 726                          * value of the pointer is converted to a sequence
 727                          * of printable characters, in an implementation-
 728                          * defined manner.''
 729                          *      -- ANSI X3J11
 730                          */
 731                         /* NOSTRICT */
 732                         _umax = (u_long)GETARG(void *);
 733                         base = HEX;
 734                         xdigs = xdigs_lower;
 735                         ox[1] = 'x';
 736                         goto nosign;
 737                 case 's':
 738                         if ((cp = GETARG(char *)) == NULL)
 739                                 cp = "(null)";
 740                         if (prec >= 0) {
 741                                 /*
 742                                  * can't use strlen; can only look for the
 743                                  * NUL in the first `prec' characters, and
 744                                  * strlen() will go further.
 745                                  */
 746                                 char *p = memchr(cp, 0, prec);
 747
 748                                 size = p ? (p - cp) : prec;
 749                         } else {
 750                                 size_t len;
 751
 752                                 if ((len = strlen(cp)) > INT_MAX)
 753                                         goto overflow;
 754                                 size = (int)len;
 755                         }
 756                         sign = '\0';
 757                         break;
 758                 case 'U':
 759                         flags |= LONGINT;
 760                         /*FALLTHROUGH*/
 761                 case 'u':
 762                         _umax = UARG();
 763                         base = DEC;
 764                         goto nosign;
 765                 case 'X':
 766                         xdigs = xdigs_upper;
 767                         goto hex;
 768                 case 'x':
 769                         xdigs = xdigs_lower;
 770 hex:                    _umax = UARG();
 771                         base = HEX;
 772                         /* leading 0x/X only if non-zero */
 773                         if (flags & ALT && _umax != 0)
 774                                 ox[1] = ch;
 775
 776                         /* unsigned conversions */
 777 nosign:                 sign = '\0';
 778                         /*
 779                          * ``... diouXx conversions ... if a precision is
 780                          * specified, the 0 flag will be ignored.''
 781                          *      -- ANSI X3J11
 782                          */
 783 number:                 if ((dprec = prec) >= 0)
 784                                 flags &= ~ZEROPAD;
 785
 786                         /*
 787                          * ``The result of converting a zero value with an
 788                          * explicit precision of zero is no characters.''
 789                          *      -- ANSI X3J11
 790                          */
 791                         cp = buf + BUF;
 792                         if (_umax != 0 || prec != 0) {
 793                                 /*
 794                                  * Unsigned mod is hard, and unsigned mod
 795                                  * by a constant is easier than that by
 796                                  * a variable; hence this switch.
 797                                  */
 798                                 switch (base) {
 799                                 case OCT:
 800                                         do {
 801                                                 *--cp = to_char(_umax & 7);
 802                                                 _umax >>= 3;
 803                                         } while (_umax);
 804                                         /* handle octal leading 0 */
 805                                         if (flags & ALT && *cp != '0')
 806                                                 *--cp = '0';
 807                                         break;
 808
 809                                 case DEC:
 810                                         /* many numbers are 1 digit */
 811                                         while (_umax >= 10) {
 812                                                 *--cp = to_char(_umax % 10);
 813                                                 _umax /= 10;
 814                                         }
 815                                         *--cp = to_char(_umax);
 816                                         break;
 817
 818                                 case HEX:
 819                                         do {
 820                                                 *--cp = xdigs[_umax & 15];
 821                                                 _umax >>= 4;
 822                                         } while (_umax);
 823                                         break;
 824
 825                                 default:
 826                                         cp = "bug in ust_safe_vfprintf: bad base";
 827                                         size = strlen(cp);
 828                                         goto skipsize;
 829                                 }
 830                         }
 831                         size = buf + BUF - cp;
 832                         if (size > BUF) /* should never happen */
 833                                 abort();
 834                 skipsize:
 835                         break;
 836                 default:        /* "%?" prints ?, unless ? is NUL */
 837                         if (ch == '\0')
 838                                 goto done;
 839                         /* pretend it was %c with argument ch */
 840                         cp = buf;
 841                         *cp = ch;
 842                         size = 1;
 843                         sign = '\0';
 844                         break;
 845                 }
 846
 847                 /*
 848                  * All reasonable formats wind up here.  At this point, `cp'
 849                  * points to a string which (if not flags&LADJUST) should be
 850                  * padded out to `width' places.  If flags&ZEROPAD, it should
 851                  * first be prefixed by any sign or other prefix; otherwise,
 852                  * it should be blank padded before the prefix is emitted.
 853                  * After any left-hand padding and prefixing, emit zeroes
 854                  * required by a decimal %[diouxX] precision, then print the
 855                  * string proper, then emit zeroes required by any leftover
 856                  * floating precision; finally, if LADJUST, pad with blanks.
 857                  *
 858                  * Compute actual size, so we know how much to pad.
 859                  * size excludes decimal prec; realsz includes it.
 860                  */
 861                 realsz = dprec > size ? dprec : size;
 862                 if (sign)
 863                         realsz++;
 864                 if (ox[1])
 865                         realsz+= 2;
 866
 867                 /* right-adjusting blank padding */
 868                 if ((flags & (LADJUST|ZEROPAD)) == 0)
 869                         PAD(width - realsz, blanks);
 870
 871                 /* prefix */
 872                 if (sign)
 873                         PRINT(&sign, 1);
 874                 if (ox[1]) {    /* ox[1] is either x, X, or \0 */
 875                         ox[0] = '0';
 876                         PRINT(ox, 2);
 877                 }
 878
 879                 /* right-adjusting zero padding */
 880                 if ((flags & (LADJUST|ZEROPAD)) == ZEROPAD)
 881                         PAD(width - realsz, zeroes);
 882
 883                 /* leading zeroes from decimal precision */
 884                 PAD(dprec - size, zeroes);
 885
 886                 /* the string or number proper */
 887 #ifdef FLOATING_POINT
 888                 if ((flags & FPT) == 0) {
 889                         PRINT(cp, size);
 890                 } else {        /* glue together f_p fragments */
 891                         if (!expchar) { /* %[fF] or sufficiently short %[gG] */
 892                                 if (expt <= 0) {
 893                                         PRINT(zeroes, 1);
 894                                         if (prec || flags & ALT)
 895                                                 PRINT(decimal_point, 1);
 896                                         PAD(-expt, zeroes);
 897                                         /* already handled initial 0's */
 898                                         prec += expt;
 899                                 } else {
 900                                         PRINTANDPAD(cp, dtoaend, lead, zeroes);
 901                                         cp += lead;
 902                                         if (prec || flags & ALT)
 903                                                 PRINT(decimal_point, 1);
 904                                 }
 905                                 PRINTANDPAD(cp, dtoaend, prec, zeroes);
 906                         } else {        /* %[eE] or sufficiently long %[gG] */
 907                                 if (prec > 1 || flags & ALT) {
 908                                         buf[0] = *cp++;
 909                                         buf[1] = *decimal_point;
 910                                         PRINT(buf, 2);
 911                                         PRINT(cp, ndig-1);
 912                                         PAD(prec - ndig, zeroes);
 913                                 } else { /* XeYYY */
 914                                         PRINT(cp, 1);
 915                                 }
 916                                 PRINT(expstr, expsize);
 917                         }
 918                 }
 919 #else
 920                 PRINT(cp, size);
 921 #endif
 922                 /* left-adjusting padding (always blank) */
 923                 if (flags & LADJUST)
 924                         PAD(width - realsz, blanks);
 925
 926                 /* finally, adjust ret */
 927                 if (width < realsz)
 928                         width = realsz;
 929                 if (width > INT_MAX - ret)
 930                         goto overflow;
 931                 ret += width;
 932
 933                 FLUSH();        /* copy out the I/O vectors */
 934         }
 935 done:
 936         FLUSH();
 937 error:
 938         if (__sferror(fp))
 939                 ret = -1;
 940         goto finish;
 941
 942 overflow:
 943         errno = ENOMEM;
 944         ret = -1;
 945
 946 finish:
 947         va_end(orgap);
 948 #ifdef FLOATING_POINT
 949         if (dtoaresult)
 950                 __freedtoa(dtoaresult);
 951 #endif
 952         if (argtable != NULL && argtable != statargtable) {
 953                 munmap(argtable, argtablesiz);
 954                 argtable = NULL;
 955         }
 956         return (ret);
 957 }
 958
 959 /*
 960  * Type ids for argument type table.
 961  */
 962 #define T_UNUSED        0
 963 #define T_SHORT         1
 964 #define T_U_SHORT       2
 965 #define TP_SHORT        3
 966 #define T_INT           4
 967 #define T_U_INT         5
 968 #define TP_INT          6
 969 #define T_LONG          7
 970 #define T_U_LONG        8
 971 #define TP_LONG         9
 972 #define T_LLONG         10
 973 #define T_U_LLONG       11
 974 #define TP_LLONG        12
 975 #define T_DOUBLE        13
 976 #define T_LONG_DOUBLE   14
 977 #define TP_CHAR         15
 978 #define TP_VOID         16
 979 #define T_PTRINT        17
 980 #define TP_PTRINT       18
 981 #define T_SIZEINT       19
 982 #define T_SSIZEINT      20
 983 #define TP_SSIZEINT     21
 984 #define T_MAXINT        22
 985 #define T_MAXUINT       23
 986 #define TP_MAXINT       24
 987 #define T_CHAR          25
 988 #define T_U_CHAR        26
 989
 990 /*
 991  * Find all arguments when a positional parameter is encountered.  Returns a
 992  * table, indexed by argument number, of pointers to each arguments.  The
 993  * initial argument table should be an array of STATIC_ARG_TBL_SIZE entries.
 994  * It will be replaced with a mmap-ed one if it overflows (malloc cannot be
 995  * used since we are attempting to make snprintf thread safe, and alloca is
 996  * problematic since we have nested functions..)
 997  */
 998 static int
 999 __find_arguments(const char *fmt0, va_list ap, union arg **argtable,
1000     size_t *argtablesiz)
1001 {
1002         char *fmt;              /* format string */
1003         int ch;                 /* character from fmt */
1004         int n, n2;              /* handy integer (short term usage) */
1005         char *cp;               /* handy char pointer (short term usage) */
1006         int flags;              /* flags as above */
1007         unsigned char *typetable; /* table of types */
1008         unsigned char stattypetable[STATIC_ARG_TBL_SIZE];
1009         int tablesize;          /* current size of type table */
1010         int tablemax;           /* largest used index in table */
1011         int nextarg;            /* 1-based argument index */
1012         int ret = 0;            /* return value */
1013         wchar_t wc;
1014         mbstate_t ps;
1015
1016         /*
1017          * Add an argument type to the table, expanding if necessary.
1018          */
1019 #define ADDTYPE(type) \
1020         ((nextarg >= tablesize) ? \
1021                 __grow_type_table(&typetable, &tablesize) : 0, \
1022         (nextarg > tablemax) ? tablemax = nextarg : 0, \
1023         typetable[nextarg++] = type)
1024
1025 #define ADDSARG() \
1026         ((flags&MAXINT) ? ADDTYPE(T_MAXINT) : \
1027             ((flags&PTRINT) ? ADDTYPE(T_PTRINT) : \
1028             ((flags&SIZEINT) ? ADDTYPE(T_SSIZEINT) : \
1029             ((flags&LLONGINT) ? ADDTYPE(T_LLONG) : \
1030             ((flags&LONGINT) ? ADDTYPE(T_LONG) : \
1031             ((flags&SHORTINT) ? ADDTYPE(T_SHORT) : \
1032             ((flags&CHARINT) ? ADDTYPE(T_CHAR) : ADDTYPE(T_INT))))))))
1033
1034 #define ADDUARG() \
1035         ((flags&MAXINT) ? ADDTYPE(T_MAXUINT) : \
1036             ((flags&PTRINT) ? ADDTYPE(T_PTRINT) : \
1037             ((flags&SIZEINT) ? ADDTYPE(T_SIZEINT) : \
1038             ((flags&LLONGINT) ? ADDTYPE(T_U_LLONG) : \
1039             ((flags&LONGINT) ? ADDTYPE(T_U_LONG) : \
1040             ((flags&SHORTINT) ? ADDTYPE(T_U_SHORT) : \
1041             ((flags&CHARINT) ? ADDTYPE(T_U_CHAR) : ADDTYPE(T_U_INT))))))))
1042
1043         /*
1044          * Add * arguments to the type array.
1045          */
1046 #define ADDASTER() \
1047         n2 = 0; \
1048         cp = fmt; \
1049         while (is_digit(*cp)) { \
1050                 APPEND_DIGIT(n2, *cp); \
1051                 cp++; \
1052         } \
1053         if (*cp == '$') { \
1054                 int hold = nextarg; \
1055                 nextarg = n2; \
1056                 ADDTYPE(T_INT); \
1057                 nextarg = hold; \
1058                 fmt = ++cp; \
1059         } else { \
1060                 ADDTYPE(T_INT); \
1061         }
1062         fmt = (char *)fmt0;
1063         typetable = stattypetable;
1064         tablesize = STATIC_ARG_TBL_SIZE;
1065         tablemax = 0;
1066         nextarg = 1;
1067         memset(typetable, T_UNUSED, STATIC_ARG_TBL_SIZE);
1068         memset(&ps, 0, sizeof(ps));
1069
1070         /*
1071          * Scan the format for conversions (`%' character).
1072          */
1073         for (;;) {
1074                 cp = fmt;
1075                 while ((n = ust_safe_mbrtowc(&wc, fmt, MB_CUR_MAX, &ps)) > 0) {
1076                         fmt += n;
1077                         if (wc == '%') {
1078                                 fmt--;
1079                                 break;
1080                         }
1081                 }
1082                 if (n <= 0)
1083                         goto done;
1084                 fmt++;          /* skip over '%' */
1085
1086                 flags = 0;
1087
1088 rflag:          ch = *fmt++;
1089 reswitch:       switch (ch) {
1090                 case ' ':
1091                 case '#':
1092                 case '\'':
1093                         goto rflag;
1094                 case '*':
1095                         ADDASTER();
1096                         goto rflag;
1097                 case '-':
1098                 case '+':
1099                         goto rflag;
1100                 case '.':
1101                         if ((ch = *fmt++) == '*') {
1102                                 ADDASTER();
1103                                 goto rflag;
1104                         }
1105                         while (is_digit(ch)) {
1106                                 ch = *fmt++;
1107                         }
1108                         goto reswitch;
1109                 case '0':
1110                         goto rflag;
1111                 case '1': case '2': case '3': case '4':
1112                 case '5': case '6': case '7': case '8': case '9':
1113                         n = 0;
1114                         do {
1115                                 APPEND_DIGIT(n ,ch);
1116                                 ch = *fmt++;
1117                         } while (is_digit(ch));
1118                         if (ch == '$') {
1119                                 nextarg = n;
1120                                 goto rflag;
1121                         }
1122                         goto reswitch;
1123 #ifdef FLOATING_POINT
1124                 case 'L':
1125                         flags |= LONGDBL;
1126                         goto rflag;
1127 #endif
1128                 case 'h':
1129                         if (*fmt == 'h') {
1130                                 fmt++;
1131                                 flags |= CHARINT;
1132                         } else {
1133                                 flags |= SHORTINT;
1134                         }
1135                         goto rflag;
1136                 case 'l':
1137                         if (*fmt == 'l') {
1138                                 fmt++;
1139                                 flags |= LLONGINT;
1140                         } else {
1141                                 flags |= LONGINT;
1142                         }
1143                         goto rflag;
1144                 case 'q':
1145                         flags |= LLONGINT;
1146                         goto rflag;
1147                 case 't':
1148                         flags |= PTRINT;
1149                         goto rflag;
1150                 case 'z':
1151                         flags |= SIZEINT;
1152                         goto rflag;
1153                 case 'c':
1154                         ADDTYPE(T_INT);
1155                         break;
1156                 case 'D':
1157                         flags |= LONGINT;
1158                         /*FALLTHROUGH*/
1159                 case 'd':
1160                 case 'i':
1161                         ADDSARG();
1162                         break;
1163 #ifdef FLOATING_POINT
1164                 case 'a':
1165                 case 'A':
1166                 case 'e':
1167                 case 'E':
1168                 case 'f':
1169                 case 'F':
1170                 case 'g':
1171                 case 'G':
1172                         if (flags & LONGDBL)
1173                                 ADDTYPE(T_LONG_DOUBLE);
1174                         else
1175                                 ADDTYPE(T_DOUBLE);
1176                         break;
1177 #endif /* FLOATING_POINT */
1178                 case 'n':
1179                         if (flags & LLONGINT)
1180                                 ADDTYPE(TP_LLONG);
1181                         else if (flags & LONGINT)
1182                                 ADDTYPE(TP_LONG);
1183                         else if (flags & SHORTINT)
1184                                 ADDTYPE(TP_SHORT);
1185                         else if (flags & PTRINT)
1186                                 ADDTYPE(TP_PTRINT);
1187                         else if (flags & SIZEINT)
1188                                 ADDTYPE(TP_SSIZEINT);
1189                         else if (flags & MAXINT)
1190                                 ADDTYPE(TP_MAXINT);
1191                         else
1192                                 ADDTYPE(TP_INT);
1193                         continue;       /* no output */
1194                 case 'O':
1195                         flags |= LONGINT;
1196                         /*FALLTHROUGH*/
1197                 case 'o':
1198                         ADDUARG();
1199                         break;
1200                 case 'p':
1201                         ADDTYPE(TP_VOID);
1202                         break;
1203                 case 's':
1204                         ADDTYPE(TP_CHAR);
1205                         break;
1206                 case 'U':
1207                         flags |= LONGINT;
1208                         /*FALLTHROUGH*/
1209                 case 'u':
1210                 case 'X':
1211                 case 'x':
1212                         ADDUARG();
1213                         break;
1214                 default:        /* "%?" prints ?, unless ? is NUL */
1215                         if (ch == '\0')
1216                                 goto done;
1217                         break;
1218                 }
1219         }
1220 done:
1221         /*
1222          * Build the argument table.
1223          */
1224         if (tablemax >= STATIC_ARG_TBL_SIZE) {
1225                 *argtablesiz = sizeof(union arg) * (tablemax + 1);
1226                 *argtable = mmap(NULL, *argtablesiz,
1227                     PROT_WRITE|PROT_READ, MAP_ANON|MAP_PRIVATE, -1, 0);
1228                 if (*argtable == MAP_FAILED)
1229                         return (-1);
1230         }
1231
1232 #if 0
1233         /* XXX is this required? */
1234         (*argtable)[0].intarg = 0;
1235 #endif
1236         for (n = 1; n <= tablemax; n++) {
1237                 switch (typetable[n]) {
1238                 case T_UNUSED:
1239                 case T_CHAR:
1240                 case T_U_CHAR:
1241                 case T_SHORT:
1242                 case T_U_SHORT:
1243                 case T_INT:
1244                         (*argtable)[n].intarg = va_arg(ap, int);
1245                         break;
1246                 case TP_SHORT:
1247                         (*argtable)[n].pshortarg = va_arg(ap, short *);
1248                         break;
1249                 case T_U_INT:
1250                         (*argtable)[n].uintarg = va_arg(ap, unsigned int);
1251                         break;
1252                 case TP_INT:
1253                         (*argtable)[n].pintarg = va_arg(ap, int *);
1254                         break;
1255                 case T_LONG:
1256                         (*argtable)[n].longarg = va_arg(ap, long);
1257                         break;
1258                 case T_U_LONG:
1259                         (*argtable)[n].ulongarg = va_arg(ap, unsigned long);
1260                         break;
1261                 case TP_LONG:
1262                         (*argtable)[n].plongarg = va_arg(ap, long *);
1263                         break;
1264                 case T_LLONG:
1265                         (*argtable)[n].longlongarg = va_arg(ap, long long);
1266                         break;
1267                 case T_U_LLONG:
1268                         (*argtable)[n].ulonglongarg = va_arg(ap, unsigned long long);
1269                         break;
1270                 case TP_LLONG:
1271                         (*argtable)[n].plonglongarg = va_arg(ap, long long *);
1272                         break;
1273 #ifdef FLOATING_POINT
1274                 case T_DOUBLE:
1275                         (*argtable)[n].doublearg = va_arg(ap, double);
1276                         break;
1277                 case T_LONG_DOUBLE:
1278                         (*argtable)[n].longdoublearg = va_arg(ap, long double);
1279                         break;
1280 #endif
1281                 case TP_CHAR:
1282                         (*argtable)[n].pchararg = va_arg(ap, char *);
1283                         break;
1284                 case TP_VOID:
1285                         (*argtable)[n].pvoidarg = va_arg(ap, void *);
1286                         break;
1287                 case T_PTRINT:
1288                         (*argtable)[n].ptrdiffarg = va_arg(ap, ptrdiff_t);
1289                         break;
1290                 case TP_PTRINT:
1291                         (*argtable)[n].pptrdiffarg = va_arg(ap, ptrdiff_t *);
1292                         break;
1293                 case T_SIZEINT:
1294                         (*argtable)[n].sizearg = va_arg(ap, size_t);
1295                         break;
1296                 case T_SSIZEINT:
1297                         (*argtable)[n].ssizearg = va_arg(ap, ssize_t);
1298                         break;
1299                 case TP_SSIZEINT:
1300                         (*argtable)[n].pssizearg = va_arg(ap, ssize_t *);
1301                         break;
1302                 case TP_MAXINT:
1303                         (*argtable)[n].intmaxarg = va_arg(ap, intmax_t);
1304                         break;
1305                 }
1306         }
1307         goto finish;
1308
1309 overflow:
1310         errno = ENOMEM;
1311         ret = -1;
1312
1313 finish:
1314         if (typetable != NULL && typetable != stattypetable) {
1315                 munmap(typetable, *argtablesiz);
1316                 typetable = NULL;
1317         }
1318         return (ret);
1319 }
1320
1321 /*
1322  * Increase the size of the type table.
1323  */
1324 static int
1325 __grow_type_table(unsigned char **typetable, int *tablesize)
1326 {
1327         unsigned char *oldtable = *typetable;
1328         int newsize = *tablesize * 2;
1329
1330         if (newsize < getpagesize())
1331                 newsize = getpagesize();
1332
1333         if (*tablesize == STATIC_ARG_TBL_SIZE) {
1334                 *typetable = mmap(NULL, newsize, PROT_WRITE|PROT_READ,
1335                     MAP_ANON|MAP_PRIVATE, -1, 0);
1336                 if (*typetable == MAP_FAILED)
1337                         return (-1);
1338                 bcopy(oldtable, *typetable, *tablesize);
1339         } else {
1340                 unsigned char *new = mmap(NULL, newsize, PROT_WRITE|PROT_READ,
1341                     MAP_ANON|MAP_PRIVATE, -1, 0);
1342                 if (new == MAP_FAILED)
1343                         return (-1);
1344                 memmove(new, *typetable, *tablesize);
1345                 munmap(*typetable, *tablesize);
1346                 *typetable = new;
1347         }
1348         memset(*typetable + *tablesize, T_UNUSED, (newsize - *tablesize));
1349
1350         *tablesize = newsize;
1351         return (0);
1352 }
1353
1354
1355 #ifdef FLOATING_POINT
1356 static int
1357 exponent(char *p0, int exp, int fmtch)
1358 {
1359         char *p, *t;
1360         char expbuf[MAXEXPDIG];
1361
1362         p = p0;
1363         *p++ = fmtch;
1364         if (exp < 0) {
1365                 exp = -exp;
1366                 *p++ = '-';
1367         } else
1368                 *p++ = '+';
1369         t = expbuf + MAXEXPDIG;
1370         if (exp > 9) {
1371                 do {
1372                         *--t = to_char(exp % 10);
1373                 } while ((exp /= 10) > 9);
1374                 *--t = to_char(exp);
1375                 for (; t < expbuf + MAXEXPDIG; *p++ = *t++)
1376                         /* nothing */;
1377         } else {
1378                 /*
1379                  * Exponents for decimal floating point conversions
1380                  * (%[eEgG]) must be at least two characters long,
1381                  * whereas exponents for hexadecimal conversions can
1382                  * be only one character long.
1383                  */
1384                 if (fmtch == 'e' || fmtch == 'E')
1385                         *p++ = '0';
1386                 *p++ = to_char(exp);
1387         }
1388         return (p - p0);
1389 }
1390 #endif /* FLOATING_POINT */