lib/vasnprintf.c

   1 /* vsprintf with automatic memory allocation.
   2    Copyright (C) 1999, 2002-2007 Free Software Foundation, Inc.
   3
   4    This program is free software; you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation; either version 2, or (at your option)
   7    any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License along
  15    with this program; if not, write to the Free Software Foundation,
  16    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  17
  18 /* Tell glibc's <stdio.h> to provide a prototype for snprintf().
  19    This must come before <config.h> because <config.h> may include
  20    <features.h>, and once <features.h> has been included, it's too late.  */
  21 #ifndef _GNU_SOURCE
  22 # define _GNU_SOURCE    1
  23 #endif
  24
  25 #include <config.h>
  26 #ifndef IN_LIBINTL
  27 # include <alloca.h>
  28 #endif
  29
  30 /* Specification.  */
  31 #if WIDE_CHAR_VERSION
  32 # include "vasnwprintf.h"
  33 #else
  34 # include "vasnprintf.h"
  35 #endif
  36
  37 #include <locale.h>     /* localeconv() */
  38 #include <stdio.h>      /* snprintf(), sprintf() */
  39 #include <stdlib.h>     /* abort(), malloc(), realloc(), free() */
  40 #include <string.h>     /* memcpy(), strlen() */
  41 #include <errno.h>      /* errno */
  42 #include <limits.h>     /* CHAR_BIT */
  43 #include <float.h>      /* DBL_MAX_EXP, LDBL_MAX_EXP */
  44 #if HAVE_NL_LANGINFO
  45 # include <langinfo.h>
  46 #endif
  47 #if WIDE_CHAR_VERSION
  48 # include "wprintf-parse.h"
  49 #else
  50 # include "printf-parse.h"
  51 #endif
  52
  53 /* Checked size_t computations.  */
  54 #include "xsize.h"
  55
  56 #if NEED_PRINTF_DIRECTIVE_A && !defined IN_LIBINTL
  57 # include <math.h>
  58 # include "isnan.h"
  59 # include "printf-frexp.h"
  60 # include "isnanl-nolibm.h"
  61 # include "printf-frexpl.h"
  62 # include "fpucw.h"
  63 #endif
  64
  65 /* Some systems, like OSF/1 4.0 and Woe32, don't have EOVERFLOW.  */
  66 #ifndef EOVERFLOW
  67 # define EOVERFLOW E2BIG
  68 #endif
  69
  70 #if HAVE_WCHAR_T
  71 # if HAVE_WCSLEN
  72 #  define local_wcslen wcslen
  73 # else
  74    /* Solaris 2.5.1 has wcslen() in a separate library libw.so. To avoid
  75       a dependency towards this library, here is a local substitute.
  76       Define this substitute only once, even if this file is included
  77       twice in the same compilation unit.  */
  78 #  ifndef local_wcslen_defined
  79 #   define local_wcslen_defined 1
  80 static size_t
  81 local_wcslen (const wchar_t *s)
  82 {
  83   const wchar_t *ptr;
  84
  85   for (ptr = s; *ptr != (wchar_t) 0; ptr++)
  86     ;
  87   return ptr - s;
  88 }
  89 #  endif
  90 # endif
  91 #endif
  92
  93 #if WIDE_CHAR_VERSION
  94 # define VASNPRINTF vasnwprintf
  95 # define CHAR_T wchar_t
  96 # define DIRECTIVE wchar_t_directive
  97 # define DIRECTIVES wchar_t_directives
  98 # define PRINTF_PARSE wprintf_parse
  99 # define USE_SNPRINTF 1
 100 # if HAVE_DECL__SNWPRINTF
 101    /* On Windows, the function swprintf() has a different signature than
 102       on Unix; we use the _snwprintf() function instead.  */
 103 #  define SNPRINTF _snwprintf
 104 # else
 105    /* Unix.  */
 106 #  define SNPRINTF swprintf
 107 # endif
 108 #else
 109 # define VASNPRINTF vasnprintf
 110 # define CHAR_T char
 111 # define DIRECTIVE char_directive
 112 # define DIRECTIVES char_directives
 113 # define PRINTF_PARSE printf_parse
 114 # define USE_SNPRINTF (HAVE_DECL__SNPRINTF || HAVE_SNPRINTF)
 115 # if HAVE_DECL__SNPRINTF
 116    /* Windows.  */
 117 #  define SNPRINTF _snprintf
 118 # else
 119    /* Unix.  */
 120 #  define SNPRINTF snprintf
 121    /* Here we need to call the native snprintf, not rpl_snprintf.  */
 122 #  undef snprintf
 123 # endif
 124 #endif
 125 /* Here we need to call the native sprintf, not rpl_sprintf.  */
 126 #undef sprintf
 127
 128 #if NEED_PRINTF_DIRECTIVE_A && !defined IN_LIBINTL
 129 /* Determine the decimal-point character according to the current locale.  */
 130 # ifndef decimal_point_char_defined
 131 #  define decimal_point_char_defined 1
 132 static char
 133 decimal_point_char ()
 134 {
 135   const char *point;
 136   /* Determine it in a multithread-safe way.  We know nl_langinfo is
 137      multithread-safe on glibc systems, but is not required to be multithread-
 138      safe by POSIX.  sprintf(), however, is multithread-safe.  localeconv()
 139      is rarely multithread-safe.  */
 140 #  if HAVE_NL_LANGINFO && __GLIBC__
 141   point = nl_langinfo (RADIXCHAR);
 142 #  elif 1
 143   char pointbuf[5];
 144   sprintf (pointbuf, "%#.0f", 1.0);
 145   point = &pointbuf[1];
 146 #  else
 147   point = localeconv () -> decimal_point;
 148 #  endif
 149   /* The decimal point is always a single byte: either '.' or ','.  */
 150   return (point[0] != '\0' ? point[0] : '.');
 151 }
 152 # endif
 153 #endif
 154
 155 CHAR_T *
 156 VASNPRINTF (CHAR_T *resultbuf, size_t *lengthp, const CHAR_T *format, va_list args)
 157 {
 158   DIRECTIVES d;
 159   arguments a;
 160
 161   if (PRINTF_PARSE (format, &d, &a) < 0)
 162     {
 163       errno = EINVAL;
 164       return NULL;
 165     }
 166
 167 #define CLEANUP() \
 168   free (d.dir);                                                         \
 169   if (a.arg)                                                            \
 170     free (a.arg);
 171
 172   if (printf_fetchargs (args, &a) < 0)
 173     {
 174       CLEANUP ();
 175       errno = EINVAL;
 176       return NULL;
 177     }
 178
 179   {
 180     size_t buf_neededlength;
 181     CHAR_T *buf;
 182     CHAR_T *buf_malloced;
 183     const CHAR_T *cp;
 184     size_t i;
 185     DIRECTIVE *dp;
 186     /* Output string accumulator.  */
 187     CHAR_T *result;
 188     size_t allocated;
 189     size_t length;
 190
 191     /* Allocate a small buffer that will hold a directive passed to
 192        sprintf or snprintf.  */
 193     buf_neededlength =
 194       xsum4 (7, d.max_width_length, d.max_precision_length, 6);
 195 #if HAVE_ALLOCA
 196     if (buf_neededlength < 4000 / sizeof (CHAR_T))
 197       {
 198         buf = (CHAR_T *) alloca (buf_neededlength * sizeof (CHAR_T));
 199         buf_malloced = NULL;
 200       }
 201     else
 202 #endif
 203       {
 204         size_t buf_memsize = xtimes (buf_neededlength, sizeof (CHAR_T));
 205         if (size_overflow_p (buf_memsize))
 206           goto out_of_memory_1;
 207         buf = (CHAR_T *) malloc (buf_memsize);
 208         if (buf == NULL)
 209           goto out_of_memory_1;
 210         buf_malloced = buf;
 211       }
 212
 213     if (resultbuf != NULL)
 214       {
 215         result = resultbuf;
 216         allocated = *lengthp;
 217       }
 218     else
 219       {
 220         result = NULL;
 221         allocated = 0;
 222       }
 223     length = 0;
 224     /* Invariants:
 225        result is either == resultbuf or == NULL or malloc-allocated.
 226        If length > 0, then result != NULL.  */
 227
 228     /* Ensures that allocated >= needed.  Aborts through a jump to
 229        out_of_memory if needed is SIZE_MAX or otherwise too big.  */
 230 #define ENSURE_ALLOCATION(needed) \
 231     if ((needed) > allocated)                                                \
 232       {                                                                      \
 233         size_t memory_size;                                                  \
 234         CHAR_T *memory;                                                      \
 235                                                                              \
 236         allocated = (allocated > 0 ? xtimes (allocated, 2) : 12);            \
 237         if ((needed) > allocated)                                            \
 238           allocated = (needed);                                              \
 239         memory_size = xtimes (allocated, sizeof (CHAR_T));                   \
 240         if (size_overflow_p (memory_size))                                   \
 241           goto out_of_memory;                                                \
 242         if (result == resultbuf || result == NULL)                           \
 243           memory = (CHAR_T *) malloc (memory_size);                          \
 244         else                                                                 \
 245           memory = (CHAR_T *) realloc (result, memory_size);                 \
 246         if (memory == NULL)                                                  \
 247           goto out_of_memory;                                                \
 248         if (result == resultbuf && length > 0)                               \
 249           memcpy (memory, result, length * sizeof (CHAR_T));                 \
 250         result = memory;                                                     \
 251       }
 252
 253     for (cp = format, i = 0, dp = &d.dir[0]; ; cp = dp->dir_end, i++, dp++)
 254       {
 255         if (cp != dp->dir_start)
 256           {
 257             size_t n = dp->dir_start - cp;
 258             size_t augmented_length = xsum (length, n);
 259
 260             ENSURE_ALLOCATION (augmented_length);
 261             memcpy (result + length, cp, n * sizeof (CHAR_T));
 262             length = augmented_length;
 263           }
 264         if (i == d.count)
 265           break;
 266
 267         /* Execute a single directive.  */
 268         if (dp->conversion == '%')
 269           {
 270             size_t augmented_length;
 271
 272             if (!(dp->arg_index == ARG_NONE))
 273               abort ();
 274             augmented_length = xsum (length, 1);
 275             ENSURE_ALLOCATION (augmented_length);
 276             result[length] = '%';
 277             length = augmented_length;
 278           }
 279         else
 280           {
 281             if (!(dp->arg_index != ARG_NONE))
 282               abort ();
 283
 284             if (dp->conversion == 'n')
 285               {
 286                 switch (a.arg[dp->arg_index].type)
 287                   {
 288                   case TYPE_COUNT_SCHAR_POINTER:
 289                     *a.arg[dp->arg_index].a.a_count_schar_pointer = length;
 290                     break;
 291                   case TYPE_COUNT_SHORT_POINTER:
 292                     *a.arg[dp->arg_index].a.a_count_short_pointer = length;
 293                     break;
 294                   case TYPE_COUNT_INT_POINTER:
 295                     *a.arg[dp->arg_index].a.a_count_int_pointer = length;
 296                     break;
 297                   case TYPE_COUNT_LONGINT_POINTER:
 298                     *a.arg[dp->arg_index].a.a_count_longint_pointer = length;
 299                     break;
 300 #if HAVE_LONG_LONG_INT
 301                   case TYPE_COUNT_LONGLONGINT_POINTER:
 302                     *a.arg[dp->arg_index].a.a_count_longlongint_pointer = length;
 303                     break;
 304 #endif
 305                   default:
 306                     abort ();
 307                   }
 308               }
 309 #if NEED_PRINTF_DIRECTIVE_A && !defined IN_LIBINTL
 310             else if (dp->conversion == 'a' || dp->conversion == 'A')
 311               {
 312                 arg_type type = a.arg[dp->arg_index].type;
 313                 int flags = dp->flags;
 314                 int has_width;
 315                 size_t width;
 316                 int has_precision;
 317                 size_t precision;
 318                 size_t tmp_length;
 319                 CHAR_T tmpbuf[700];
 320                 CHAR_T *tmp;
 321                 CHAR_T *pad_ptr;
 322                 CHAR_T *p;
 323
 324                 has_width = 0;
 325                 width = 0;
 326                 if (dp->width_start != dp->width_end)
 327                   {
 328                     if (dp->width_arg_index != ARG_NONE)
 329                       {
 330                         int arg;
 331
 332                         if (!(a.arg[dp->width_arg_index].type == TYPE_INT))
 333                           abort ();
 334                         arg = a.arg[dp->width_arg_index].a.a_int;
 335                         if (arg < 0)
 336                           {
 337                             /* "A negative field width is taken as a '-' flag
 338                                 followed by a positive field width."  */
 339                             flags |= FLAG_LEFT;
 340                             width = (unsigned int) (-arg);
 341                           }
 342                         else
 343                           width = arg;
 344                       }
 345                     else
 346                       {
 347                         const CHAR_T *digitp = dp->width_start;
 348
 349                         do
 350                           width = xsum (xtimes (width, 10), *digitp++ - '0');
 351                         while (digitp != dp->width_end);
 352                       }
 353                     has_width = 1;
 354                   }
 355
 356                 has_precision = 0;
 357                 precision = 0;
 358                 if (dp->precision_start != dp->precision_end)
 359                   {
 360                     if (dp->precision_arg_index != ARG_NONE)
 361                       {
 362                         int arg;
 363
 364                         if (!(a.arg[dp->precision_arg_index].type == TYPE_INT))
 365                           abort ();
 366                         arg = a.arg[dp->precision_arg_index].a.a_int;
 367                         /* "A negative precision is taken as if the precision
 368                             were omitted."  */
 369                         if (arg >= 0)
 370                           {
 371                             precision = arg;
 372                             has_precision = 1;
 373                           }
 374                       }
 375                     else
 376                       {
 377                         const CHAR_T *digitp = dp->precision_start + 1;
 378
 379                         precision = 0;
 380                         while (digitp != dp->precision_end)
 381                           precision = xsum (xtimes (precision, 10), *digitp++ - '0');
 382                         has_precision = 1;
 383                       }
 384                   }
 385
 386                 /* Allocate a temporary buffer of sufficient size.  */
 387                 if (type == TYPE_LONGDOUBLE)
 388                   tmp_length =
 389                     (unsigned int) ((LDBL_DIG + 1)
 390                                     * 0.831 /* decimal -> hexadecimal */
 391                                    )
 392                     + 1; /* turn floor into ceil */
 393                 else
 394                   tmp_length =
 395                     (unsigned int) ((DBL_DIG + 1)
 396                                     * 0.831 /* decimal -> hexadecimal */
 397                                    )
 398                     + 1; /* turn floor into ceil */
 399                 if (tmp_length < precision)
 400                   tmp_length = precision;
 401                 /* Account for sign, decimal point etc. */
 402                 tmp_length = xsum (tmp_length, 12);
 403
 404                 if (tmp_length < width)
 405                   tmp_length = width;
 406
 407                 tmp_length = xsum (tmp_length, 1); /* account for trailing NUL */
 408
 409                 if (tmp_length <= sizeof (tmpbuf) / sizeof (CHAR_T))
 410                   tmp = tmpbuf;
 411                 else
 412                   {
 413                     size_t tmp_memsize = xtimes (tmp_length, sizeof (CHAR_T));
 414
 415                     if (size_overflow_p (tmp_memsize))
 416                       /* Overflow, would lead to out of memory.  */
 417                       goto out_of_memory;
 418                     tmp = (CHAR_T *) malloc (tmp_memsize);
 419                     if (tmp == NULL)
 420                       /* Out of memory.  */
 421                       goto out_of_memory;
 422                   }
 423
 424                 pad_ptr = NULL;
 425                 p = tmp;
 426                 if (type == TYPE_LONGDOUBLE)
 427                   {
 428                     long double arg = a.arg[dp->arg_index].a.a_longdouble;
 429
 430                     if (isnanl (arg))
 431                       {
 432                         if (dp->conversion == 'A')
 433                           {
 434                             *p++ = 'N'; *p++ = 'A'; *p++ = 'N';
 435                           }
 436                         else
 437                           {
 438                             *p++ = 'n'; *p++ = 'a'; *p++ = 'n';
 439                           }
 440                       }
 441                     else
 442                       {
 443                         int sign = 0;
 444                         DECL_LONG_DOUBLE_ROUNDING
 445
 446                         BEGIN_LONG_DOUBLE_ROUNDING ();
 447
 448                         if (signbit (arg)) /* arg < 0.0L or negative zero */
 449                           {
 450                             sign = -1;
 451                             arg = -arg;
 452                           }
 453
 454                         if (sign < 0)
 455                           *p++ = '-';
 456                         else if (flags & FLAG_SHOWSIGN)
 457                           *p++ = '+';
 458                         else if (flags & FLAG_SPACE)
 459                           *p++ = ' ';
 460
 461                         if (arg > 0.0L && arg + arg == arg)
 462                           {
 463                             if (dp->conversion == 'A')
 464                               {
 465                                 *p++ = 'I'; *p++ = 'N'; *p++ = 'F';
 466                               }
 467                             else
 468                               {
 469                                 *p++ = 'i'; *p++ = 'n'; *p++ = 'f';
 470                               }
 471                           }
 472                         else
 473                           {
 474                             int exponent;
 475                             long double mantissa;
 476
 477                             if (arg > 0.0L)
 478                               mantissa = printf_frexpl (arg, &exponent);
 479                             else
 480                               {
 481                                 exponent = 0;
 482                                 mantissa = 0.0L;
 483                               }
 484
 485                             if (has_precision
 486                                 && precision < (unsigned int) ((LDBL_DIG + 1) * 0.831) + 1)
 487                               {
 488                                 /* Round the mantissa.  */
 489                                 long double tail = mantissa;
 490                                 size_t q;
 491
 492                                 for (q = precision; ; q--)
 493                                   {
 494                                     int digit = (int) tail;
 495                                     tail -= digit;
 496                                     if (q == 0)
 497                                       {
 498                                         if (digit & 1 ? tail >= 0.5L : tail > 0.5L)
 499                                           tail = 1 - tail;
 500                                         else
 501                                           tail = - tail;
 502                                         break;
 503                                       }
 504                                     tail *= 16.0L;
 505                                   }
 506                                 if (tail != 0.0L)
 507                                   for (q = precision; q > 0; q--)
 508                                     tail *= 0.0625L;
 509                                 mantissa += tail;
 510                               }
 511
 512                             *p++ = '0';
 513                             *p++ = dp->conversion - 'A' + 'X';
 514                             pad_ptr = p;
 515                             {
 516                               int digit;
 517
 518                               digit = (int) mantissa;
 519                               mantissa -= digit;
 520                               *p++ = '0' + digit;
 521                               if ((flags & FLAG_ALT)
 522                                   || mantissa > 0.0L || precision > 0)
 523                                 {
 524                                   *p++ = decimal_point_char ();
 525                                   /* This loop terminates because we assume
 526                                      that FLT_RADIX is a power of 2.  */
 527                                   while (mantissa > 0.0L)
 528                                     {
 529                                       mantissa *= 16.0L;
 530                                       digit = (int) mantissa;
 531                                       mantissa -= digit;
 532                                       *p++ = digit
 533                                              + (digit < 10
 534                                                 ? '0'
 535                                                 : dp->conversion - 10);
 536                                       if (precision > 0)
 537                                         precision--;
 538                                     }
 539                                   while (precision > 0)
 540                                     {
 541                                       *p++ = '0';
 542                                       precision--;
 543                                     }
 544                                 }
 545                               }
 546                               *p++ = dp->conversion - 'A' + 'P';
 547 # if WIDE_CHAR_VERSION
 548                               {
 549                                 static const wchar_t decimal_format[] =
 550                                   { '%', '+', 'd', '\0' };
 551                                 SNPRINTF (p, 6 + 1, decimal_format, exponent);
 552                               }
 553 # else
 554                               sprintf (p, "%+d", exponent);
 555 # endif
 556                               while (*p != '\0')
 557                                 p++;
 558                           }
 559
 560                         END_LONG_DOUBLE_ROUNDING ();
 561                       }
 562                   }
 563                 else
 564                   {
 565                     double arg = a.arg[dp->arg_index].a.a_double;
 566
 567                     if (isnan (arg))
 568                       {
 569                         if (dp->conversion == 'A')
 570                           {
 571                             *p++ = 'N'; *p++ = 'A'; *p++ = 'N';
 572                           }
 573                         else
 574                           {
 575                             *p++ = 'n'; *p++ = 'a'; *p++ = 'n';
 576                           }
 577                       }
 578                     else
 579                       {
 580                         int sign = 0;
 581
 582                         if (signbit (arg)) /* arg < 0.0 or negative zero */
 583                           {
 584                             sign = -1;
 585                             arg = -arg;
 586                           }
 587
 588                         if (sign < 0)
 589                           *p++ = '-';
 590                         else if (flags & FLAG_SHOWSIGN)
 591                           *p++ = '+';
 592                         else if (flags & FLAG_SPACE)
 593                           *p++ = ' ';
 594
 595                         if (arg > 0.0 && arg + arg == arg)
 596                           {
 597                             if (dp->conversion == 'A')
 598                               {
 599                                 *p++ = 'I'; *p++ = 'N'; *p++ = 'F';
 600                               }
 601                             else
 602                               {
 603                                 *p++ = 'i'; *p++ = 'n'; *p++ = 'f';
 604                               }
 605                           }
 606                         else
 607                           {
 608                             int exponent;
 609                             double mantissa;
 610
 611                             if (arg > 0.0)
 612                               mantissa = printf_frexp (arg, &exponent);
 613                             else
 614                               {
 615                                 exponent = 0;
 616                                 mantissa = 0.0;
 617                               }
 618
 619                             if (has_precision
 620                                 && precision < (unsigned int) ((DBL_DIG + 1) * 0.831) + 1)
 621                               {
 622                                 /* Round the mantissa.  */
 623                                 double tail = mantissa;
 624                                 size_t q;
 625
 626                                 for (q = precision; ; q--)
 627                                   {
 628                                     int digit = (int) tail;
 629                                     tail -= digit;
 630                                     if (q == 0)
 631                                       {
 632                                         if (digit & 1 ? tail >= 0.5 : tail > 0.5)
 633                                           tail = 1 - tail;
 634                                         else
 635                                           tail = - tail;
 636                                         break;
 637                                       }
 638                                     tail *= 16.0;
 639                                   }
 640                                 if (tail != 0.0)
 641                                   for (q = precision; q > 0; q--)
 642                                     tail *= 0.0625;
 643                                 mantissa += tail;
 644                               }
 645
 646                             *p++ = '0';
 647                             *p++ = dp->conversion - 'A' + 'X';
 648                             pad_ptr = p;
 649                             {
 650                               int digit;
 651
 652                               digit = (int) mantissa;
 653                               mantissa -= digit;
 654                               *p++ = '0' + digit;
 655                               if ((flags & FLAG_ALT)
 656                                   || mantissa > 0.0 || precision > 0)
 657                                 {
 658                                   *p++ = decimal_point_char ();
 659                                   /* This loop terminates because we assume
 660                                      that FLT_RADIX is a power of 2.  */
 661                                   while (mantissa > 0.0)
 662                                     {
 663                                       mantissa *= 16.0;
 664                                       digit = (int) mantissa;
 665                                       mantissa -= digit;
 666                                       *p++ = digit
 667                                              + (digit < 10
 668                                                 ? '0'
 669                                                 : dp->conversion - 10);
 670                                       if (precision > 0)
 671                                         precision--;
 672                                     }
 673                                   while (precision > 0)
 674                                     {
 675                                       *p++ = '0';
 676                                       precision--;
 677                                     }
 678                                 }
 679                               }
 680                               *p++ = dp->conversion - 'A' + 'P';
 681 # if WIDE_CHAR_VERSION
 682                               {
 683                                 static const wchar_t decimal_format[] =
 684                                   { '%', '+', 'd', '\0' };
 685                                 SNPRINTF (p, 6 + 1, decimal_format, exponent);
 686                               }
 687 # else
 688                               sprintf (p, "%+d", exponent);
 689 # endif
 690                               while (*p != '\0')
 691                                 p++;
 692                           }
 693                       }
 694                   }
 695                 /* The generated string now extends from tmp to p, with the
 696                    zero padding insertion point being at pad_ptr.  */
 697                 if (has_width && p - tmp < width)
 698                   {
 699                     size_t pad = width - (p - tmp);
 700                     CHAR_T *end = p + pad;
 701
 702                     if (flags & FLAG_LEFT)
 703                       {
 704                         /* Pad with spaces on the right.  */
 705                         for (; pad > 0; pad--)
 706                           *p++ = ' ';
 707                       }
 708                     else if ((flags & FLAG_ZERO) && pad_ptr != NULL)
 709                       {
 710                         /* Pad with zeroes.  */
 711                         CHAR_T *q = end;
 712
 713                         while (p > pad_ptr)
 714                           *--q = *--p;
 715                         for (; pad > 0; pad--)
 716                           *p++ = '0';
 717                       }
 718                     else
 719                       {
 720                         /* Pad with spaces on the left.  */
 721                         CHAR_T *q = end;
 722
 723                         while (p > tmp)
 724                           *--q = *--p;
 725                         for (; pad > 0; pad--)
 726                           *p++ = ' ';
 727                       }
 728
 729                     p = end;
 730                   }
 731
 732                 {
 733                   size_t count = p - tmp;
 734
 735                   if (count >= tmp_length)
 736                     /* tmp_length was incorrectly calculated - fix the
 737                        code above!  */
 738                     abort ();
 739
 740                   /* Make room for the result.  */
 741                   if (count >= allocated - length)
 742                     {
 743                       size_t n = xsum (length, count);
 744
 745                       ENSURE_ALLOCATION (n);
 746                     }
 747
 748                   /* Append the result.  */
 749                   memcpy (result + length, tmp, count * sizeof (CHAR_T));
 750                   if (tmp != tmpbuf)
 751                     free (tmp);
 752                   length += count;
 753                 }
 754               }
 755 #endif
 756             else
 757               {
 758                 arg_type type = a.arg[dp->arg_index].type;
 759                 int flags = dp->flags;
 760 #if !USE_SNPRINTF || NEED_PRINTF_FLAG_ZERO
 761                 int has_width;
 762                 size_t width;
 763 #endif
 764 #if NEED_PRINTF_FLAG_ZERO
 765                 int pad_ourselves;
 766 #else
 767 #               define pad_ourselves 0
 768 #endif
 769                 CHAR_T *fbp;
 770                 unsigned int prefix_count;
 771                 int prefixes[2];
 772 #if !USE_SNPRINTF
 773                 size_t tmp_length;
 774                 CHAR_T tmpbuf[700];
 775                 CHAR_T *tmp;
 776 #endif
 777
 778 #if !USE_SNPRINTF || NEED_PRINTF_FLAG_ZERO
 779                 has_width = 0;
 780                 width = 0;
 781                 if (dp->width_start != dp->width_end)
 782                   {
 783                     if (dp->width_arg_index != ARG_NONE)
 784                       {
 785                         int arg;
 786
 787                         if (!(a.arg[dp->width_arg_index].type == TYPE_INT))
 788                           abort ();
 789                         arg = a.arg[dp->width_arg_index].a.a_int;
 790                         if (arg < 0)
 791                           {
 792                             /* "A negative field width is taken as a '-' flag
 793                                 followed by a positive field width."  */
 794                             flags |= FLAG_LEFT;
 795                             width = (unsigned int) (-arg);
 796                           }
 797                         else
 798                           width = arg;
 799                       }
 800                     else
 801                       {
 802                         const CHAR_T *digitp = dp->width_start;
 803
 804                         do
 805                           width = xsum (xtimes (width, 10), *digitp++ - '0');
 806                         while (digitp != dp->width_end);
 807                       }
 808                     has_width = 1;
 809                   }
 810 #endif
 811
 812 #if !USE_SNPRINTF
 813                 /* Allocate a temporary buffer of sufficient size for calling
 814                    sprintf.  */
 815                 {
 816                   size_t precision;
 817
 818                   precision = 6;
 819                   if (dp->precision_start != dp->precision_end)
 820                     {
 821                       if (dp->precision_arg_index != ARG_NONE)
 822                         {
 823                           int arg;
 824
 825                           if (!(a.arg[dp->precision_arg_index].type == TYPE_INT))
 826                             abort ();
 827                           arg = a.arg[dp->precision_arg_index].a.a_int;
 828                           precision = (arg < 0 ? 0 : arg);
 829                         }
 830                       else
 831                         {
 832                           const CHAR_T *digitp = dp->precision_start + 1;
 833
 834                           precision = 0;
 835                           while (digitp != dp->precision_end)
 836                             precision = xsum (xtimes (precision, 10), *digitp++ - '0');
 837                         }
 838                     }
 839
 840                   switch (dp->conversion)
 841                     {
 842
 843                     case 'd': case 'i': case 'u':
 844 # if HAVE_LONG_LONG_INT
 845                       if (type == TYPE_LONGLONGINT || type == TYPE_ULONGLONGINT)
 846                         tmp_length =
 847                           (unsigned int) (sizeof (unsigned long long) * CHAR_BIT
 848                                           * 0.30103 /* binary -> decimal */
 849                                          )
 850                           + 1; /* turn floor into ceil */
 851                       else
 852 # endif
 853                       if (type == TYPE_LONGINT || type == TYPE_ULONGINT)
 854                         tmp_length =
 855                           (unsigned int) (sizeof (unsigned long) * CHAR_BIT
 856                                           * 0.30103 /* binary -> decimal */
 857                                          )
 858                           + 1; /* turn floor into ceil */
 859                       else
 860                         tmp_length =
 861                           (unsigned int) (sizeof (unsigned int) * CHAR_BIT
 862                                           * 0.30103 /* binary -> decimal */
 863                                          )
 864                           + 1; /* turn floor into ceil */
 865                       if (tmp_length < precision)
 866                         tmp_length = precision;
 867                       /* Multiply by 2, as an estimate for FLAG_GROUP.  */
 868                       tmp_length = xsum (tmp_length, tmp_length);
 869                       /* Add 1, to account for a leading sign.  */
 870                       tmp_length = xsum (tmp_length, 1);
 871                       break;
 872
 873                     case 'o':
 874 # if HAVE_LONG_LONG_INT
 875                       if (type == TYPE_LONGLONGINT || type == TYPE_ULONGLONGINT)
 876                         tmp_length =
 877                           (unsigned int) (sizeof (unsigned long long) * CHAR_BIT
 878                                           * 0.333334 /* binary -> octal */
 879                                          )
 880                           + 1; /* turn floor into ceil */
 881                       else
 882 # endif
 883                       if (type == TYPE_LONGINT || type == TYPE_ULONGINT)
 884                         tmp_length =
 885                           (unsigned int) (sizeof (unsigned long) * CHAR_BIT
 886                                           * 0.333334 /* binary -> octal */
 887                                          )
 888                           + 1; /* turn floor into ceil */
 889                       else
 890                         tmp_length =
 891                           (unsigned int) (sizeof (unsigned int) * CHAR_BIT
 892                                           * 0.333334 /* binary -> octal */
 893                                          )
 894                           + 1; /* turn floor into ceil */
 895                       if (tmp_length < precision)
 896                         tmp_length = precision;
 897                       /* Add 1, to account for a leading sign.  */
 898                       tmp_length = xsum (tmp_length, 1);
 899                       break;
 900
 901                     case 'x': case 'X':
 902 # if HAVE_LONG_LONG_INT
 903                       if (type == TYPE_LONGLONGINT || type == TYPE_ULONGLONGINT)
 904                         tmp_length =
 905                           (unsigned int) (sizeof (unsigned long long) * CHAR_BIT
 906                                           * 0.25 /* binary -> hexadecimal */
 907                                          )
 908                           + 1; /* turn floor into ceil */
 909                       else
 910 # endif
 911                       if (type == TYPE_LONGINT || type == TYPE_ULONGINT)
 912                         tmp_length =
 913                           (unsigned int) (sizeof (unsigned long) * CHAR_BIT
 914                                           * 0.25 /* binary -> hexadecimal */
 915                                          )
 916                           + 1; /* turn floor into ceil */
 917                       else
 918                         tmp_length =
 919                           (unsigned int) (sizeof (unsigned int) * CHAR_BIT
 920                                           * 0.25 /* binary -> hexadecimal */
 921                                          )
 922                           + 1; /* turn floor into ceil */
 923                       if (tmp_length < precision)
 924                         tmp_length = precision;
 925                       /* Add 2, to account for a leading sign or alternate form.  */
 926                       tmp_length = xsum (tmp_length, 2);
 927                       break;
 928
 929                     case 'f': case 'F':
 930                       if (type == TYPE_LONGDOUBLE)
 931                         tmp_length =
 932                           (unsigned int) (LDBL_MAX_EXP
 933                                           * 0.30103 /* binary -> decimal */
 934                                           * 2 /* estimate for FLAG_GROUP */
 935                                          )
 936                           + 1 /* turn floor into ceil */
 937                           + 10; /* sign, decimal point etc. */
 938                       else
 939                         tmp_length =
 940                           (unsigned int) (DBL_MAX_EXP
 941                                           * 0.30103 /* binary -> decimal */
 942                                           * 2 /* estimate for FLAG_GROUP */
 943                                          )
 944                           + 1 /* turn floor into ceil */
 945                           + 10; /* sign, decimal point etc. */
 946                       tmp_length = xsum (tmp_length, precision);
 947                       break;
 948
 949                     case 'e': case 'E': case 'g': case 'G':
 950                       tmp_length =
 951                         12; /* sign, decimal point, exponent etc. */
 952                       tmp_length = xsum (tmp_length, precision);
 953                       break;
 954
 955                     case 'a': case 'A':
 956                       if (type == TYPE_LONGDOUBLE)
 957                         tmp_length =
 958                           (unsigned int) (LDBL_DIG
 959                                           * 0.831 /* decimal -> hexadecimal */
 960                                          )
 961                           + 1; /* turn floor into ceil */
 962                       else
 963                         tmp_length =
 964                           (unsigned int) (DBL_DIG
 965                                           * 0.831 /* decimal -> hexadecimal */
 966                                          )
 967                           + 1; /* turn floor into ceil */
 968                       if (tmp_length < precision)
 969                         tmp_length = precision;
 970                       /* Account for sign, decimal point etc. */
 971                       tmp_length = xsum (tmp_length, 12);
 972                       break;
 973
 974                     case 'c':
 975 # if HAVE_WINT_T && !WIDE_CHAR_VERSION
 976                       if (type == TYPE_WIDE_CHAR)
 977                         tmp_length = MB_CUR_MAX;
 978                       else
 979 # endif
 980                         tmp_length = 1;
 981                       break;
 982
 983                     case 's':
 984 # if HAVE_WCHAR_T
 985                       if (type == TYPE_WIDE_STRING)
 986                         {
 987                           tmp_length =
 988                             local_wcslen (a.arg[dp->arg_index].a.a_wide_string);
 989
 990 #  if !WIDE_CHAR_VERSION
 991                           tmp_length = xtimes (tmp_length, MB_CUR_MAX);
 992 #  endif
 993                         }
 994                       else
 995 # endif
 996                         tmp_length = strlen (a.arg[dp->arg_index].a.a_string);
 997                       break;
 998
 999                     case 'p':
1000                       tmp_length =
1001                         (unsigned int) (sizeof (void *) * CHAR_BIT
1002                                         * 0.25 /* binary -> hexadecimal */
1003                                        )
1004                           + 1 /* turn floor into ceil */
1005                           + 2; /* account for leading 0x */
1006                       break;
1007
1008                     default:
1009                       abort ();
1010                     }
1011
1012                   if (tmp_length < width)
1013                     tmp_length = width;
1014
1015                   tmp_length = xsum (tmp_length, 1); /* account for trailing NUL */
1016                 }
1017
1018                 if (tmp_length <= sizeof (tmpbuf) / sizeof (CHAR_T))
1019                   tmp = tmpbuf;
1020                 else
1021                   {
1022                     size_t tmp_memsize = xtimes (tmp_length, sizeof (CHAR_T));
1023
1024                     if (size_overflow_p (tmp_memsize))
1025                       /* Overflow, would lead to out of memory.  */
1026                       goto out_of_memory;
1027                     tmp = (CHAR_T *) malloc (tmp_memsize);
1028                     if (tmp == NULL)
1029                       /* Out of memory.  */
1030                       goto out_of_memory;
1031                   }
1032 #endif
1033
1034                 /* Decide whether to perform the padding ourselves.  */
1035 #if NEED_PRINTF_FLAG_ZERO
1036                 switch (dp->conversion)
1037                   {
1038                   case 'f': case 'F': case 'e': case 'E': case 'g': case 'G':
1039                   case 'a': case 'A':
1040                     pad_ourselves = 1;
1041                     break;
1042                   default:
1043                     pad_ourselves = 0;
1044                     break;
1045                   }
1046 #endif
1047
1048                 /* Construct the format string for calling snprintf or
1049                    sprintf.  */
1050                 fbp = buf;
1051                 *fbp++ = '%';
1052 #if NEED_PRINTF_FLAG_GROUPING
1053                 /* The underlying implementation doesn't support the ' flag.
1054                    Produce no grouping characters in this case; this is
1055                    acceptable because the grouping is locale dependent.  */
1056 #else
1057                 if (flags & FLAG_GROUP)
1058                   *fbp++ = '\'';
1059 #endif
1060                 if (flags & FLAG_LEFT)
1061                   *fbp++ = '-';
1062                 if (flags & FLAG_SHOWSIGN)
1063                   *fbp++ = '+';
1064                 if (flags & FLAG_SPACE)
1065                   *fbp++ = ' ';
1066                 if (flags & FLAG_ALT)
1067                   *fbp++ = '#';
1068                 if (!pad_ourselves)
1069                   {
1070                     if (flags & FLAG_ZERO)
1071                       *fbp++ = '0';
1072                     if (dp->width_start != dp->width_end)
1073                       {
1074                         size_t n = dp->width_end - dp->width_start;
1075                         memcpy (fbp, dp->width_start, n * sizeof (CHAR_T));
1076                         fbp += n;
1077                       }
1078                   }
1079                 if (dp->precision_start != dp->precision_end)
1080                   {
1081                     size_t n = dp->precision_end - dp->precision_start;
1082                     memcpy (fbp, dp->precision_start, n * sizeof (CHAR_T));
1083                     fbp += n;
1084                   }
1085
1086                 switch (type)
1087                   {
1088 #if HAVE_LONG_LONG_INT
1089                   case TYPE_LONGLONGINT:
1090                   case TYPE_ULONGLONGINT:
1091 # if (defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__
1092                     *fbp++ = 'I';
1093                     *fbp++ = '6';
1094                     *fbp++ = '4';
1095                     break;
1096 # else
1097                     *fbp++ = 'l';
1098                     /*FALLTHROUGH*/
1099 # endif
1100 #endif
1101                   case TYPE_LONGINT:
1102                   case TYPE_ULONGINT:
1103 #if HAVE_WINT_T
1104                   case TYPE_WIDE_CHAR:
1105 #endif
1106 #if HAVE_WCHAR_T
1107                   case TYPE_WIDE_STRING:
1108 #endif
1109                     *fbp++ = 'l';
1110                     break;
1111                   case TYPE_LONGDOUBLE:
1112                     *fbp++ = 'L';
1113                     break;
1114                   default:
1115                     break;
1116                   }
1117 #if NEED_PRINTF_DIRECTIVE_F
1118                 if (dp->conversion == 'F')
1119                   *fbp = 'f';
1120                 else
1121 #endif
1122                   *fbp = dp->conversion;
1123 #if USE_SNPRINTF
1124                 fbp[1] = '%';
1125                 fbp[2] = 'n';
1126                 fbp[3] = '\0';
1127 #else
1128                 fbp[1] = '\0';
1129 #endif
1130
1131                 /* Construct the arguments for calling snprintf or sprintf.  */
1132                 prefix_count = 0;
1133                 if (!pad_ourselves && dp->width_arg_index != ARG_NONE)
1134                   {
1135                     if (!(a.arg[dp->width_arg_index].type == TYPE_INT))
1136                       abort ();
1137                     prefixes[prefix_count++] = a.arg[dp->width_arg_index].a.a_int;
1138                   }
1139                 if (dp->precision_arg_index != ARG_NONE)
1140                   {
1141                     if (!(a.arg[dp->precision_arg_index].type == TYPE_INT))
1142                       abort ();
1143                     prefixes[prefix_count++] = a.arg[dp->precision_arg_index].a.a_int;
1144                   }
1145
1146 #if USE_SNPRINTF
1147                 /* Prepare checking whether snprintf returns the count
1148                    via %n.  */
1149                 ENSURE_ALLOCATION (xsum (length, 1));
1150                 result[length] = '\0';
1151 #endif
1152
1153                 for (;;)
1154                   {
1155                     size_t maxlen;
1156                     int count;
1157                     int retcount;
1158
1159                     maxlen = allocated - length;
1160                     count = -1;
1161                     retcount = 0;
1162
1163 #if USE_SNPRINTF
1164                     /* SNPRINTF can fail if maxlen > INT_MAX.  */
1165                     if (maxlen > INT_MAX)
1166                       goto overflow;
1167 # define SNPRINTF_BUF(arg) \
1168                     switch (prefix_count)                                   \
1169                       {                                                     \
1170                       case 0:                                               \
1171                         retcount = SNPRINTF (result + length, maxlen, buf,  \
1172                                              arg, &count);                  \
1173                         break;                                              \
1174                       case 1:                                               \
1175                         retcount = SNPRINTF (result + length, maxlen, buf,  \
1176                                              prefixes[0], arg, &count);     \
1177                         break;                                              \
1178                       case 2:                                               \
1179                         retcount = SNPRINTF (result + length, maxlen, buf,  \
1180                                              prefixes[0], prefixes[1], arg, \
1181                                              &count);                       \
1182                         break;                                              \
1183                       default:                                              \
1184                         abort ();                                           \
1185                       }
1186 #else
1187 # define SNPRINTF_BUF(arg) \
1188                     switch (prefix_count)                                   \
1189                       {                                                     \
1190                       case 0:                                               \
1191                         count = sprintf (tmp, buf, arg);                    \
1192                         break;                                              \
1193                       case 1:                                               \
1194                         count = sprintf (tmp, buf, prefixes[0], arg);       \
1195                         break;                                              \
1196                       case 2:                                               \
1197                         count = sprintf (tmp, buf, prefixes[0], prefixes[1],\
1198                                          arg);                              \
1199                         break;                                              \
1200                       default:                                              \
1201                         abort ();                                           \
1202                       }
1203 #endif
1204
1205                     switch (type)
1206                       {
1207                       case TYPE_SCHAR:
1208                         {
1209                           int arg = a.arg[dp->arg_index].a.a_schar;
1210                           SNPRINTF_BUF (arg);
1211                         }
1212                         break;
1213                       case TYPE_UCHAR:
1214                         {
1215                           unsigned int arg = a.arg[dp->arg_index].a.a_uchar;
1216                           SNPRINTF_BUF (arg);
1217                         }
1218                         break;
1219                       case TYPE_SHORT:
1220                         {
1221                           int arg = a.arg[dp->arg_index].a.a_short;
1222                           SNPRINTF_BUF (arg);
1223                         }
1224                         break;
1225                       case TYPE_USHORT:
1226                         {
1227                           unsigned int arg = a.arg[dp->arg_index].a.a_ushort;
1228                           SNPRINTF_BUF (arg);
1229                         }
1230                         break;
1231                       case TYPE_INT:
1232                         {
1233                           int arg = a.arg[dp->arg_index].a.a_int;
1234                           SNPRINTF_BUF (arg);
1235                         }
1236                         break;
1237                       case TYPE_UINT:
1238                         {
1239                           unsigned int arg = a.arg[dp->arg_index].a.a_uint;
1240                           SNPRINTF_BUF (arg);
1241                         }
1242                         break;
1243                       case TYPE_LONGINT:
1244                         {
1245                           long int arg = a.arg[dp->arg_index].a.a_longint;
1246                           SNPRINTF_BUF (arg);
1247                         }
1248                         break;
1249                       case TYPE_ULONGINT:
1250                         {
1251                           unsigned long int arg = a.arg[dp->arg_index].a.a_ulongint;
1252                           SNPRINTF_BUF (arg);
1253                         }
1254                         break;
1255 #if HAVE_LONG_LONG_INT
1256                       case TYPE_LONGLONGINT:
1257                         {
1258                           long long int arg = a.arg[dp->arg_index].a.a_longlongint;
1259                           SNPRINTF_BUF (arg);
1260                         }
1261                         break;
1262                       case TYPE_ULONGLONGINT:
1263                         {
1264                           unsigned long long int arg = a.arg[dp->arg_index].a.a_ulonglongint;
1265                           SNPRINTF_BUF (arg);
1266                         }
1267                         break;
1268 #endif
1269                       case TYPE_DOUBLE:
1270                         {
1271                           double arg = a.arg[dp->arg_index].a.a_double;
1272                           SNPRINTF_BUF (arg);
1273                         }
1274                         break;
1275                       case TYPE_LONGDOUBLE:
1276                         {
1277                           long double arg = a.arg[dp->arg_index].a.a_longdouble;
1278                           SNPRINTF_BUF (arg);
1279                         }
1280                         break;
1281                       case TYPE_CHAR:
1282                         {
1283                           int arg = a.arg[dp->arg_index].a.a_char;
1284                           SNPRINTF_BUF (arg);
1285                         }
1286                         break;
1287 #if HAVE_WINT_T
1288                       case TYPE_WIDE_CHAR:
1289                         {
1290                           wint_t arg = a.arg[dp->arg_index].a.a_wide_char;
1291                           SNPRINTF_BUF (arg);
1292                         }
1293                         break;
1294 #endif
1295                       case TYPE_STRING:
1296                         {
1297                           const char *arg = a.arg[dp->arg_index].a.a_string;
1298                           SNPRINTF_BUF (arg);
1299                         }
1300                         break;
1301 #if HAVE_WCHAR_T
1302                       case TYPE_WIDE_STRING:
1303                         {
1304                           const wchar_t *arg = a.arg[dp->arg_index].a.a_wide_string;
1305                           SNPRINTF_BUF (arg);
1306                         }
1307                         break;
1308 #endif
1309                       case TYPE_POINTER:
1310                         {
1311                           void *arg = a.arg[dp->arg_index].a.a_pointer;
1312                           SNPRINTF_BUF (arg);
1313                         }
1314                         break;
1315                       default:
1316                         abort ();
1317                       }
1318
1319 #if USE_SNPRINTF
1320                     /* Portability: Not all implementations of snprintf()
1321                        are ISO C 99 compliant.  Determine the number of
1322                        bytes that snprintf() has produced or would have
1323                        produced.  */
1324                     if (count >= 0)
1325                       {
1326                         /* Verify that snprintf() has NUL-terminated its
1327                            result.  */
1328                         if (count < maxlen && result[length + count] != '\0')
1329                           abort ();
1330                         /* Portability hack.  */
1331                         if (retcount > count)
1332                           count = retcount;
1333                       }
1334                     else
1335                       {
1336                         /* snprintf() doesn't understand the '%n'
1337                            directive.  */
1338                         if (fbp[1] != '\0')
1339                           {
1340                             /* Don't use the '%n' directive; instead, look
1341                                at the snprintf() return value.  */
1342                             fbp[1] = '\0';
1343                             continue;
1344                           }
1345                         else
1346                           {
1347                             /* Look at the snprintf() return value.  */
1348                             if (retcount < 0)
1349                               {
1350                                 /* HP-UX 10.20 snprintf() is doubly deficient:
1351                                    It doesn't understand the '%n' directive,
1352                                    *and* it returns -1 (rather than the length
1353                                    that would have been required) when the
1354                                    buffer is too small.  */
1355                                 size_t bigger_need =
1356                                   xsum (xtimes (allocated, 2), 12);
1357                                 ENSURE_ALLOCATION (bigger_need);
1358                                 continue;
1359                               }
1360                             else
1361                               count = retcount;
1362                           }
1363                       }
1364 #endif
1365
1366                     /* Attempt to handle failure.  */
1367                     if (count < 0)
1368                       {
1369                         if (!(result == resultbuf || result == NULL))
1370                           free (result);
1371                         if (buf_malloced != NULL)
1372                           free (buf_malloced);
1373                         CLEANUP ();
1374                         errno = EINVAL;
1375                         return NULL;
1376                       }
1377
1378                     /* Perform padding.  */
1379 #if NEED_PRINTF_FLAG_ZERO
1380                     if (pad_ourselves && has_width && count < width)
1381                       {
1382 # if USE_SNPRINTF
1383                         /* Make room for the result.  */
1384                         if (width >= maxlen)
1385                           {
1386                             /* Need at least width bytes.  But allocate
1387                                proportionally, to avoid looping eternally if
1388                                snprintf() reports a too small count.  */
1389                             size_t n =
1390                               xmax (xsum (length, width),
1391                                     xtimes (allocated, 2));
1392
1393                             length += count;
1394                             ENSURE_ALLOCATION (n);
1395                             length -= count;
1396                             maxlen = allocated - length; /* >= width */
1397                           }
1398 # endif
1399                         {
1400 # if USE_SNPRINTF
1401                           CHAR_T * const rp = result + length;
1402 # else
1403                           CHAR_T * const rp = tmp;
1404 # endif
1405                           CHAR_T *p = rp + count;
1406                           size_t pad = width - count;
1407                           CHAR_T *end = p + pad;
1408                           CHAR_T *pad_ptr = (*rp == '-' ? rp + 1 : rp);
1409                           /* No zero-padding of "inf" and "nan".  */
1410                           if ((*pad_ptr >= 'A' && *pad_ptr <= 'Z')
1411                               || (*pad_ptr >= 'a' && *pad_ptr <= 'z'))
1412                             pad_ptr = NULL;
1413                           /* The generated string now extends from rp to p,
1414                              with the zero padding insertion point being at
1415                              pad_ptr.  */
1416
1417                           if (flags & FLAG_LEFT)
1418                             {
1419                               /* Pad with spaces on the right.  */
1420                               for (; pad > 0; pad--)
1421                                 *p++ = ' ';
1422                             }
1423                           else if ((flags & FLAG_ZERO) && pad_ptr != NULL)
1424                             {
1425                               /* Pad with zeroes.  */
1426                               CHAR_T *q = end;
1427
1428                               while (p > pad_ptr)
1429                                 *--q = *--p;
1430                               for (; pad > 0; pad--)
1431                                 *p++ = '0';
1432                             }
1433                           else
1434                             {
1435                               /* Pad with spaces on the left.  */
1436                               CHAR_T *q = end;
1437
1438                               while (p > rp)
1439                                 *--q = *--p;
1440                               for (; pad > 0; pad--)
1441                                 *p++ = ' ';
1442                             }
1443
1444                           count = width; /* = count + pad = end - rp */
1445                         }
1446                       }
1447 #endif
1448
1449 #if !USE_SNPRINTF
1450                     if (count >= tmp_length)
1451                       /* tmp_length was incorrectly calculated - fix the
1452                          code above!  */
1453                       abort ();
1454 #endif
1455
1456                     /* Make room for the result.  */
1457                     if (count >= maxlen)
1458                       {
1459                         /* Need at least count bytes.  But allocate
1460                            proportionally, to avoid looping eternally if
1461                            snprintf() reports a too small count.  */
1462                         size_t n =
1463                           xmax (xsum (length, count), xtimes (allocated, 2));
1464
1465                         ENSURE_ALLOCATION (n);
1466 #if USE_SNPRINTF
1467                         continue;
1468 #endif
1469                       }
1470
1471 #if USE_SNPRINTF
1472                     /* The snprintf() result did fit.  */
1473 #else
1474                     /* Append the sprintf() result.  */
1475                     memcpy (result + length, tmp, count * sizeof (CHAR_T));
1476                     if (tmp != tmpbuf)
1477                       free (tmp);
1478 #endif
1479
1480 #if NEED_PRINTF_DIRECTIVE_F
1481                     if (dp->conversion == 'F')
1482                       {
1483                         /* Convert the %f result to upper case for %F.  */
1484                         CHAR_T *rp = result + length;
1485                         size_t rc;
1486                         for (rc = count; rc > 0; rc--, rp++)
1487                           if (*rp >= 'a' && *rp <= 'z')
1488                             *rp = *rp - 'a' + 'A';
1489                       }
1490 #endif
1491
1492                     length += count;
1493                     break;
1494                   }
1495               }
1496           }
1497       }
1498
1499     /* Add the final NUL.  */
1500     ENSURE_ALLOCATION (xsum (length, 1));
1501     result[length] = '\0';
1502
1503     if (result != resultbuf && length + 1 < allocated)
1504       {
1505         /* Shrink the allocated memory if possible.  */
1506         CHAR_T *memory;
1507
1508         memory = (CHAR_T *) realloc (result, (length + 1) * sizeof (CHAR_T));
1509         if (memory != NULL)
1510           result = memory;
1511       }
1512
1513     if (buf_malloced != NULL)
1514       free (buf_malloced);
1515     CLEANUP ();
1516     *lengthp = length;
1517     /* Note that we can produce a big string of a length > INT_MAX.  POSIX
1518        says that snprintf() fails with errno = EOVERFLOW in this case, but
1519        that's only because snprintf() returns an 'int'.  This function does
1520        not have this limitation.  */
1521     return result;
1522
1523   overflow:
1524     if (!(result == resultbuf || result == NULL))
1525       free (result);
1526     if (buf_malloced != NULL)
1527       free (buf_malloced);
1528     CLEANUP ();
1529     errno = EOVERFLOW;
1530     return NULL;
1531
1532   out_of_memory:
1533     if (!(result == resultbuf || result == NULL))
1534       free (result);
1535     if (buf_malloced != NULL)
1536       free (buf_malloced);
1537   out_of_memory_1:
1538     CLEANUP ();
1539     errno = ENOMEM;
1540     return NULL;
1541   }
1542 }
1543
1544 #undef SNPRINTF
1545 #undef USE_SNPRINTF
1546 #undef PRINTF_PARSE
1547 #undef DIRECTIVES
1548 #undef DIRECTIVE
1549 #undef CHAR_T
1550 #undef VASNPRINTF