]> git.saurik.com Git - apple/libc.git/blame_incremental - stdio/printf.3
Libc-594.9.5.tar.gz
[apple/libc.git] / stdio / printf.3
... / ...
CommitLineData
1.\" Copyright (c) 1990, 1991, 1993
2.\" The Regents of the University of California. All rights reserved.
3.\"
4.\" This code is derived from software contributed to Berkeley by
5.\" Chris Torek and the American National Standards Committee X3,
6.\" on Information Processing Systems.
7.\"
8.\" Redistribution and use in source and binary forms, with or without
9.\" modification, are permitted provided that the following conditions
10.\" are met:
11.\" 1. Redistributions of source code must retain the above copyright
12.\" notice, this list of conditions and the following disclaimer.
13.\" 2. Redistributions in binary form must reproduce the above copyright
14.\" notice, this list of conditions and the following disclaimer in the
15.\" documentation and/or other materials provided with the distribution.
16.\" 3. All advertising materials mentioning features or use of this software
17.\" must display the following acknowledgement:
18.\" This product includes software developed by the University of
19.\" California, Berkeley and its contributors.
20.\" 4. Neither the name of the University nor the names of its contributors
21.\" may be used to endorse or promote products derived from this software
22.\" without specific prior written permission.
23.\"
24.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34.\" SUCH DAMAGE.
35.\"
36.\" @(#)printf.3 8.1 (Berkeley) 6/4/93
37.\" $FreeBSD: src/lib/libc/stdio/printf.3,v 1.58 2004/10/16 16:00:01 stefanf Exp $
38.\"
39.Dd October 16, 2004
40.Dt PRINTF 3
41.Os
42.Sh NAME
43.Nm asprintf ,
44.Nm fprintf ,
45.Nm printf ,
46.Nm snprintf ,
47.Nm sprintf ,
48.Nm vasprintf ,
49.Nm vfprintf,
50.Nm vprintf ,
51.Nm vsnprintf ,
52.Nm vsprintf
53.Nd formatted output conversion
54.Sh LIBRARY
55.Lb libc
56.Sh SYNOPSIS
57.In stdio.h
58.Ft int
59.Fo asprintf
60.Fa "char **ret"
61.Fa "const char *format" ...
62.Fc
63.Ft int
64.Fo fprintf
65.Fa "FILE *restrict stream"
66.Fa "const char *restrict format" ...
67.Fc
68.Ft int
69.Fo printf
70.Fa "const char *restrict format" ...
71.Fc
72.Ft int
73.Fo snprintf
74.Fa "char *restrict s"
75.Fa "size_t n"
76.Fa "const char *restrict format" ...
77.Fc
78.Ft int
79.Fo sprintf
80.Fa "char *restrict s"
81.Fa "const char *restrict format" ...
82.Fc
83.In stdarg.h
84.In stdio.h
85.Ft int
86.Fo vasprintf
87.Fa "char **ret"
88.Fa "const char *format"
89.Fa "va_list ap"
90.Fc
91.Ft int
92.Fo vfprintf
93.Fa "FILE *restrict stream"
94.Fa "const char *restrict format"
95.Fa "va_list ap"
96.Fc
97.Ft int
98.Fo vprintf
99.Fa "const char *restrict format"
100.Fa "va_list ap"
101.Fc
102.Ft int
103.Fo vsnprintf
104.Fa "char *restrict s"
105.Fa "size_t n"
106.Fa "const char *restrict format"
107.Fa "va_list ap"
108.Fc
109.Ft int
110.Fo vsprintf
111.Fa "char *restrict s"
112.Fa "const char *restrict format"
113.Fa "va_list ap"
114.Fc
115.Sh DESCRIPTION
116The
117.Fn printf
118family of functions produces output according to a
119.Fa format ,
120as described below.
121The
122.Fn printf
123and
124.Fn vprintf
125functions
126write output to
127.Dv stdout ,
128the standard output stream;
129.Fn fprintf
130and
131.Fn vfprintf
132write output to the given output
133.Fa stream ;
134.Fn sprintf ,
135.Fn snprintf ,
136.Fn vsprintf ,
137and
138.Fn vsnprintf
139write to the character string
140.Fa s ;
141and
142.Fn asprintf
143and
144.Fn vasprintf
145dynamically allocate a new string with
146.Xr malloc 3 .
147.Pp
148Extended locale versions of these functions are documented in
149.Xr printf_l 3 .
150See
151.Xr xlocale 3
152for more information.
153.Pp
154These functions write the output under the control of a
155.Fa format
156string that specifies how subsequent arguments
157(or arguments accessed via the variable-length argument facilities of
158.Xr stdarg 3 )
159are converted for output.
160.Pp
161These functions return the number of characters printed
162(not including the trailing
163.Ql \e0
164used to end output to strings) or a negative value if an output error occurs,
165except for
166.Fn snprintf
167and
168.Fn vsnprintf ,
169which return the number of characters that would have been printed if the
170.Fa n
171were unlimited
172(again, not including the final
173.Ql \e0 ) .
174.Pp
175The
176.Fn asprintf
177and
178.Fn vasprintf
179functions
180set
181.Fa *ret
182to be a pointer to a buffer sufficiently large to hold the formatted string.
183This pointer should be passed to
184.Xr free 3
185to release the allocated storage when it is no longer needed.
186If sufficient space cannot be allocated,
187.Fn asprintf
188and
189.Fn vasprintf
190will return \-1 and set
191.Fa ret
192to be a
193.Dv NULL
194pointer.
195.Pp
196The
197.Fn snprintf
198and
199.Fn vsnprintf
200functions
201will write at most
202.Fa n Ns \-1
203of the characters printed into the output string
204(the
205.Fa n Ns \'th
206character then gets the terminating
207.Ql \e0 ) ;
208if the return value is greater than or equal to the
209.Fa n
210argument, the string was too short
211and some of the printed characters were discarded.
212The output is always null-terminated.
213.Pp
214The
215.Fn sprintf
216and
217.Fn vsprintf
218functions
219effectively assume an infinite
220.Fa n .
221.Pp
222For those routines that write to a user-provided character string,
223that string and the format strings should not overlap, as the
224behavior is undefined.
225.Pp
226The format string is composed of zero or more directives:
227ordinary
228.\" multibyte
229characters (not
230.Cm % ) ,
231which are copied unchanged to the output stream;
232and conversion specifications, each of which results
233in fetching zero or more subsequent arguments.
234Each conversion specification is introduced by
235the
236.Cm %
237character.
238The arguments must correspond properly (after type promotion)
239with the conversion specifier.
240After the
241.Cm % ,
242the following appear in sequence:
243.Bl -bullet
244.It
245An optional field, consisting of a decimal digit string followed by a
246.Cm $ ,
247specifying the next argument to access.
248If this field is not provided, the argument following the last
249argument accessed will be used.
250Arguments are numbered starting at
251.Cm 1 .
252If unaccessed arguments in the format string are interspersed with ones that
253are accessed the results will be indeterminate.
254.It
255Zero or more of the following flags:
256.Bl -tag -width ".So \ Sc (space)"
257.It Sq Cm #
258The value should be converted to an
259.Dq alternate form .
260For
261.Cm c , d , i , n , p , s ,
262and
263.Cm u
264conversions, this option has no effect.
265For
266.Cm o
267conversions, the precision of the number is increased to force the first
268character of the output string to a zero (except if a zero value is printed
269with an explicit precision of zero).
270For
271.Cm x
272and
273.Cm X
274conversions, a non-zero result has the string
275.Ql 0x
276(or
277.Ql 0X
278for
279.Cm X
280conversions) prepended to it.
281For
282.Cm a , A , e , E , f , F , g ,
283and
284.Cm G
285conversions, the result will always contain a decimal point, even if no
286digits follow it (normally, a decimal point appears in the results of
287those conversions only if a digit follows).
288For
289.Cm g
290and
291.Cm G
292conversions, trailing zeros are not removed from the result as they
293would otherwise be.
294.It So Cm 0 Sc (zero)
295Zero padding.
296For all conversions except
297.Cm n ,
298the converted value is padded on the left with zeros rather than blanks.
299If a precision is given with a numeric conversion
300.Cm ( d , i , o , u , i , x ,
301and
302.Cm X ) ,
303the
304.Cm 0
305flag is ignored.
306.It Sq Cm \-
307A negative field width flag;
308the converted value is to be left adjusted on the field boundary.
309Except for
310.Cm n
311conversions, the converted value is padded on the right with blanks,
312rather than on the left with blanks or zeros.
313A
314.Cm \-
315overrides a
316.Cm 0
317if both are given.
318.It So "\ " Sc (space)
319A blank should be left before a positive number
320produced by a signed conversion
321.Cm ( a , A , d , e , E , f , F , g , G ,
322or
323.Cm i ) .
324.It Sq Cm +
325A sign must always be placed before a
326number produced by a signed conversion.
327A
328.Cm +
329overrides a space if both are used.
330.It Sq Cm '
331Decimal conversions
332.Cm ( d , u ,
333or
334.Cm i )
335or the integral portion of a floating point conversion
336.Cm ( f
337or
338.Cm F )
339should be grouped and separated by thousands using
340the non-monetary separator returned by
341.Xr localeconv 3 .
342.El
343.It
344An optional separator character (
345.Cm \ , | \; | \ : | _
346) used for separating multiple values when printing an AltiVec or SSE vector,
347or other multi-value unit.
348.Pp
349NOTE: This is an extension to the
350.Fn printf
351specification.
352Behaviour of these values for
353.Fn printf
354is only defined for operating systems conforming to the
355AltiVec Technology Programming Interface Manual.
356(At time of writing this includes only Mac OS X 10.2 and later.)
357.It
358An optional decimal digit string specifying a minimum field width.
359If the converted value has fewer characters than the field width, it will
360be padded with spaces on the left (or right, if the left-adjustment
361flag has been given) to fill out
362the field width.
363.It
364An optional precision, in the form of a period
365.Cm \&.
366followed by an
367optional digit string.
368If the digit string is omitted, the precision is taken as zero.
369This gives the minimum number of digits to appear for
370.Cm d , i , o , u , x ,
371and
372.Cm X
373conversions, the number of digits to appear after the decimal-point for
374.Cm a , A , e , E , f ,
375and
376.Cm F
377conversions, the maximum number of significant digits for
378.Cm g
379and
380.Cm G
381conversions, or the maximum number of characters to be printed from a
382string for
383.Cm s
384conversions.
385.It
386An optional length modifier, that specifies the size of the argument.
387The following length modifiers are valid for the
388.Cm d , i , n , o , u , x ,
389or
390.Cm X
391conversion:
392.Bl -column ".Cm q Em (deprecated)" ".Vt signed char" ".Vt unsigned long long" ".Vt long long *"
393.It Sy Modifier Ta Cm d , i Ta Cm o , u , x , X Ta Cm n
394.It Cm hh Ta Vt "signed char" Ta Vt "unsigned char" Ta Vt "signed char *"
395.It Cm h Ta Vt short Ta Vt "unsigned short" Ta Vt "short *"
396.It Cm l No (ell) Ta Vt long Ta Vt "unsigned long" Ta Vt "long *"
397.It Cm ll No (ell ell) Ta Vt "long long" Ta Vt "unsigned long long" Ta Vt "long long *"
398.It Cm j Ta Vt intmax_t Ta Vt uintmax_t Ta Vt "intmax_t *"
399.It Cm t Ta Vt ptrdiff_t Ta (see note) Ta Vt "ptrdiff_t *"
400.It Cm z Ta (see note) Ta Vt size_t Ta (see note)
401.It Cm q Em (deprecated) Ta Vt quad_t Ta Vt u_quad_t Ta Vt "quad_t *"
402.El
403.Pp
404Note:
405the
406.Cm t
407modifier, when applied to a
408.Cm o , u , x ,
409or
410.Cm X
411conversion, indicates that the argument is of an unsigned type
412equivalent in size to a
413.Vt ptrdiff_t .
414The
415.Cm z
416modifier, when applied to a
417.Cm d
418or
419.Cm i
420conversion, indicates that the argument is of a signed type equivalent in
421size to a
422.Vt size_t .
423Similarly, when applied to an
424.Cm n
425conversion, it indicates that the argument is a pointer to a signed type
426equivalent in size to a
427.Vt size_t .
428.Pp
429The following length modifier is valid for the
430.Cm a , A , e , E , f , F , g ,
431or
432.Cm G
433conversion:
434.Bl -column ".Sy Modifier" ".Cm a , A , e , E , f , F , g , G"
435.It Sy Modifier Ta Cm a , A , e , E , f , F , g , G
436.It Cm l No (ell) Ta Vt double
437(ignored, same behavior as without it)
438.It Cm L Ta Vt "long double"
439.El
440.Pp
441The following length modifier is valid for the
442.Cm c
443or
444.Cm s
445conversion:
446.Bl -column ".Sy Modifier" ".Vt wint_t" ".Vt wchar_t *"
447.It Sy Modifier Ta Cm c Ta Cm s
448.It Cm l No (ell) Ta Vt wint_t Ta Vt "wchar_t *"
449.El
450.Pp
451The AltiVec Technology Programming Interface Manual also defines five additional length modifiers
452which can be used (in place of the conventional length modifiers) for the printing of AltiVec or SSE vectors:
453.Bl -tag -compact
454.It Cm v
455Treat the argument as a vector value, unit length will be determined by the conversion
456specifier (default = 16 8-bit units for all integer conversions,
4574 32-bit units for floating point conversions).
458.It Cm vh, hv
459Treat the argument as a vector of 8 16-bit units.
460.It Cm vl, lv
461Treat the argument as a vector of 4 32-bit units.
462.El
463.Pp
464NOTE: The vector length specifiers are extensions to the
465.Fn printf
466specification.
467Behaviour of these values for
468.Fn printf
469is only defined for operating systems conforming to the
470AltiVec Technology Programming Interface Manual.
471(At time of writing this includes only Mac OS X 10.2 and later.)
472.Pp
473As a further extension, for SSE2 64-bit units:
474.Bl -tag -compact
475.It Cm vll, llv
476Treat the argument as a vector of 2 64-bit units.
477.El
478.It
479A character that specifies the type of conversion to be applied.
480.El
481.Pp
482A field width or precision, or both, may be indicated by
483an asterisk
484.Ql *
485or an asterisk followed by one or more decimal digits and a
486.Ql $
487instead of a
488digit string.
489In this case, an
490.Vt int
491argument supplies the field width or precision.
492A negative field width is treated as a left adjustment flag followed by a
493positive field width; a negative precision is treated as though it were
494missing.
495If a single format directive mixes positional
496.Pq Li nn$
497and non-positional arguments, the results are undefined.
498.Pp
499The conversion specifiers and their meanings are:
500.Bl -tag -width ".Cm diouxX"
501.It Cm diouxX
502The
503.Vt int
504(or appropriate variant) argument is converted to signed decimal
505.Cm ( d
506and
507.Cm i ) ,
508unsigned octal
509.Pq Cm o ,
510unsigned decimal
511.Pq Cm u ,
512or unsigned hexadecimal
513.Cm ( x
514and
515.Cm X )
516notation.
517The letters
518.Dq Li abcdef
519are used for
520.Cm x
521conversions; the letters
522.Dq Li ABCDEF
523are used for
524.Cm X
525conversions.
526The precision, if any, gives the minimum number of digits that must
527appear; if the converted value requires fewer digits, it is padded on
528the left with zeros.
529.It Cm DOU
530The
531.Vt "long int"
532argument is converted to signed decimal, unsigned octal, or unsigned
533decimal, as if the format had been
534.Cm ld , lo ,
535or
536.Cm lu
537respectively.
538These conversion characters are deprecated, and will eventually disappear.
539.It Cm eE
540The
541.Vt double
542argument is rounded and converted in the style
543.Sm off
544.Oo \- Oc Ar d Li \&. Ar ddd Li e \\*[Pm] Ar dd
545.Sm on
546where there is one digit before the
547decimal-point character
548and the number of digits after it is equal to the precision;
549if the precision is missing,
550it is taken as 6; if the precision is
551zero, no decimal-point character appears.
552An
553.Cm E
554conversion uses the letter
555.Ql E
556(rather than
557.Ql e )
558to introduce the exponent.
559The exponent always contains at least two digits; if the value is zero,
560the exponent is 00.
561.Pp
562For
563.Cm a , A , e , E , f , F , g ,
564and
565.Cm G
566conversions, positive and negative infinity are represented as
567.Li inf
568and
569.Li -inf
570respectively when using the lowercase conversion character, and
571.Li INF
572and
573.Li -INF
574respectively when using the uppercase conversion character.
575Similarly, NaN is represented as
576.Li nan
577when using the lowercase conversion, and
578.Li NAN
579when using the uppercase conversion.
580.It Cm fF
581The
582.Vt double
583argument is rounded and converted to decimal notation in the style
584.Sm off
585.Oo \- Oc Ar ddd Li \&. Ar ddd ,
586.Sm on
587where the number of digits after the decimal-point character
588is equal to the precision specification.
589If the precision is missing, it is taken as 6; if the precision is
590explicitly zero, no decimal-point character appears.
591If a decimal point appears, at least one digit appears before it.
592.It Cm gG
593The
594.Vt double
595argument is converted in style
596.Cm f
597or
598.Cm e
599(or
600.Cm F
601or
602.Cm E
603for
604.Cm G
605conversions).
606The precision specifies the number of significant digits.
607If the precision is missing, 6 digits are given; if the precision is zero,
608it is treated as 1.
609Style
610.Cm e
611is used if the exponent from its conversion is less than \-4 or greater than
612or equal to the precision.
613Trailing zeros are removed from the fractional part of the result; a
614decimal point appears only if it is followed by at least one digit.
615.It Cm aA
616The
617.Vt double
618argument is rounded and converted to hexadecimal notation in the style
619.Sm off
620.Oo \- Oc Li 0x Ar h Li \&. Ar hhhp Oo \\*[Pm] Oc Ar d ,
621.Sm on
622where the number of digits after the hexadecimal-point character
623is equal to the precision specification.
624If the precision is missing, it is taken as enough to represent
625the floating-point number exactly, and no rounding occurs.
626If the precision is zero, no hexadecimal-point character appears.
627The
628.Cm p
629is a literal character
630.Ql p ,
631and the exponent consists of a positive or negative sign
632followed by a decimal number representing an exponent of 2.
633The
634.Cm A
635conversion uses the prefix
636.Dq Li 0X
637(rather than
638.Dq Li 0x ) ,
639the letters
640.Dq Li ABCDEF
641(rather than
642.Dq Li abcdef )
643to represent the hex digits, and the letter
644.Ql P
645(rather than
646.Ql p )
647to separate the mantissa and exponent.
648.Pp
649Note that there may be multiple valid ways to represent floating-point
650numbers in this hexadecimal format.
651For example,
652.Li 0x3.24p+0 , 0x6.48p-1
653and
654.Li 0xc.9p-2
655are all equivalent.
656The format chosen depends on the internal representation of the
657number, but the implementation guarantees that the length of the
658mantissa will be minimized.
659Zeroes are always represented with a mantissa of 0 (preceded by a
660.Ql -
661if appropriate) and an exponent of
662.Li +0 .
663.It Cm C
664Treated as
665.Cm c
666with the
667.Cm l
668(ell) modifier.
669.It Cm c
670The
671.Vt int
672argument is converted to an
673.Vt "unsigned char" ,
674and the resulting character is written.
675.Pp
676If the
677.Cm l
678(ell) modifier is used, the
679.Vt wint_t
680argument shall be converted to a
681.Vt wchar_t ,
682and the (potentially multi-byte) sequence representing the
683single wide character is written, including any shift sequences.
684If a shift sequence is used, the shift state is also restored
685to the original state after the character.
686.It Cm S
687Treated as
688.Cm s
689with the
690.Cm l
691(ell) modifier.
692.It Cm s
693The
694.Vt "char *"
695argument is expected to be a pointer to an array of character type (pointer
696to a string).
697Characters from the array are written up to (but not including)
698a terminating
699.Dv NUL
700character;
701if a precision is specified, no more than the number specified are
702written.
703If a precision is given, no null character
704need be present; if the precision is not specified, or is greater than
705the size of the array, the array must contain a terminating
706.Dv NUL
707character.
708.Pp
709If the
710.Cm l
711(ell) modifier is used, the
712.Vt "wchar_t *"
713argument is expected to be a pointer to an array of wide characters
714(pointer to a wide string).
715For each wide character in the string, the (potentially multi-byte)
716sequence representing the
717wide character is written, including any shift sequences.
718If any shift sequence is used, the shift state is also restored
719to the original state after the string.
720Wide characters from the array are written up to (but not including)
721a terminating wide
722.Dv NUL
723character;
724if a precision is specified, no more than the number of bytes specified are
725written (including shift sequences).
726Partial characters are never written.
727If a precision is given, no null character
728need be present; if the precision is not specified, or is greater than
729the number of bytes required to render the multibyte representation of
730the string, the array must contain a terminating wide
731.Dv NUL
732character.
733.It Cm p
734The
735.Vt "void *"
736pointer argument is printed in hexadecimal (as if by
737.Ql %#x
738or
739.Ql %#lx ) .
740.It Cm n
741The number of characters written so far is stored into the
742integer indicated by the
743.Vt "int *"
744(or variant) pointer argument.
745No argument is converted.
746.It Cm %
747A
748.Ql %
749is written.
750No argument is converted.
751The complete conversion specification
752is
753.Ql %% .
754.El
755.Pp
756The decimal point
757character is defined in the program's locale (category
758.Dv LC_NUMERIC ) .
759.Pp
760In no case does a non-existent or small field width cause truncation of
761a numeric field; if the result of a conversion is wider than the field
762width, the
763field is expanded to contain the conversion result.
764.Sh EXAMPLES
765To print a date and time in the form
766.Dq Li "Sunday, July 3, 10:02" ,
767where
768.Fa weekday
769and
770.Fa month
771are pointers to strings:
772.Bd -literal -offset indent
773#include <stdio.h>
774fprintf(stdout, "%s, %s %d, %.2d:%.2d\en",
775 weekday, month, day, hour, min);
776.Ed
777.Pp
778To print \*(Pi
779to five decimal places:
780.Bd -literal -offset indent
781#include <math.h>
782#include <stdio.h>
783fprintf(stdout, "pi = %.5f\en", 4 * atan(1.0));
784.Ed
785.Pp
786To allocate a 128 byte string and print into it:
787.Bd -literal -offset indent
788#include <stdio.h>
789#include <stdlib.h>
790#include <stdarg.h>
791char *newfmt(const char *fmt, ...)
792{
793 char *p;
794 va_list ap;
795 if ((p = malloc(128)) == NULL)
796 return (NULL);
797 va_start(ap, fmt);
798 (void) vsnprintf(p, 128, fmt, ap);
799 va_end(ap);
800 return (p);
801}
802.Ed
803.Sh SECURITY CONSIDERATIONS
804The
805.Fn sprintf
806and
807.Fn vsprintf
808functions are easily misused in a manner which enables malicious users
809to arbitrarily change a running program's functionality through
810a buffer overflow attack.
811Because
812.Fn sprintf
813and
814.Fn vsprintf
815assume an infinitely long string,
816callers must be careful not to overflow the actual space;
817this is often hard to assure.
818For safety, programmers should use the
819.Fn snprintf
820interface instead.
821For example:
822.Bd -literal
823void
824foo(const char *arbitrary_string, const char *and_another)
825{
826 char onstack[8];
827
828#ifdef BAD
829 /*
830 * This first sprintf is bad behavior. Do not use sprintf!
831 */
832 sprintf(onstack, "%s, %s", arbitrary_string, and_another);
833#else
834 /*
835 * The following two lines demonstrate better use of
836 * snprintf().
837 */
838 snprintf(onstack, sizeof(onstack), "%s, %s", arbitrary_string,
839 and_another);
840#endif
841}
842.Ed
843.Pp
844The
845.Fn printf
846and
847.Fn sprintf
848family of functions are also easily misused in a manner
849allowing malicious users to arbitrarily change a running program's
850functionality by either causing the program
851to print potentially sensitive data
852.Dq "left on the stack" ,
853or causing it to generate a memory fault or bus error
854by dereferencing an invalid pointer.
855.Pp
856.Cm %n
857can be used to write arbitrary data to potentially carefully-selected
858addresses.
859Programmers are therefore strongly advised to never pass untrusted strings
860as the
861.Fa format
862argument, as an attacker can put format specifiers in the string
863to mangle your stack,
864leading to a possible security hole.
865This holds true even if the string was built using a function like
866.Fn snprintf ,
867as the resulting string may still contain user-supplied conversion specifiers
868for later interpolation by
869.Fn printf .
870.Pp
871Always use the proper secure idiom:
872.Pp
873.Dl "snprintf(buffer, sizeof(buffer), \*q%s\*q, string);"
874.Sh ERRORS
875In addition to the errors documented for the
876.Xr write 2
877system call, the
878.Fn printf
879family of functions may fail if:
880.Bl -tag -width Er
881.It Bq Er EILSEQ
882An invalid wide character code was encountered.
883.It Bq Er ENOMEM
884Insufficient storage space is available.
885.El
886.Sh SEE ALSO
887.Xr printf 1 ,
888.Xr fmtcheck 3 ,
889.Xr printf_l 3 ,
890.Xr scanf 3 ,
891.Xr setlocale 3 ,
892.Xr stdarg 3 ,
893.Xr wprintf 3
894.Sh STANDARDS
895Subject to the caveats noted in the
896.Sx BUGS
897section below, the
898.Fn fprintf ,
899.Fn printf ,
900.Fn sprintf ,
901.Fn vprintf ,
902.Fn vfprintf ,
903and
904.Fn vsprintf
905functions
906conform to
907.St -ansiC
908and
909.St -isoC-99 .
910With the same reservation, the
911.Fn snprintf
912and
913.Fn vsnprintf
914functions conform to
915.St -isoC-99 .
916.Sh HISTORY
917The functions
918.Fn asprintf
919and
920.Fn vasprintf
921first appeared in the
922.Tn GNU C
923library.
924These were implemented by
925.An Peter Wemm Aq peter@FreeBSD.org
926in
927.Fx 2.2 ,
928but were later replaced with a different implementation
929from
930.An Todd C. Miller Aq Todd.Miller@courtesan.com
931for
932.Ox 2.3 .
933.Sh BUGS
934The conversion formats
935.Cm \&%D , \&%O ,
936and
937.Cm %U
938are not standard and
939are provided only for backward compatibility.
940The effect of padding the
941.Cm %p
942format with zeros (either by the
943.Cm 0
944flag or by specifying a precision), and the benign effect (i.e., none)
945of the
946.Cm #
947flag on
948.Cm %n
949and
950.Cm %p
951conversions, as well as other
952nonsensical combinations such as
953.Cm %Ld ,
954are not standard; such combinations
955should be avoided.
956.Pp
957The
958.Nm
959family of functions do not correctly handle multibyte characters in the
960.Fa format
961argument.