1 .\" Copyright (c) 1990, 1991, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" This code is derived from software contributed to Berkeley by
5 .\" Chris Torek and the American National Standards Committee X3,
6 .\" on Information Processing Systems.
8 .\" Redistribution and use in source and binary forms, with or without
9 .\" modification, are permitted provided that the following conditions
11 .\" 1. Redistributions of source code must retain the above copyright
12 .\" notice, this list of conditions and the following disclaimer.
13 .\" 2. Redistributions in binary form must reproduce the above copyright
14 .\" notice, this list of conditions and the following disclaimer in the
15 .\" documentation and/or other materials provided with the distribution.
16 .\" 4. Neither the name of the University nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" @(#)printf.3 8.1 (Berkeley) 6/4/93
33 .\" $FreeBSD: src/lib/libc/stdio/printf.3,v 1.64 2009/12/02 07:51:25 brueffer Exp $
39 .Nm printf , fprintf , sprintf , snprintf , asprintf , dprintf ,
40 .Nm vprintf , vfprintf, vsprintf , vsnprintf , vasprintf, vdprintf
41 .Nd formatted output conversion
47 .Fn printf "const char * restrict format" ...
49 .Fn fprintf "FILE * restrict stream" "const char * restrict format" ...
51 .Fn sprintf "char * restrict str" "const char * restrict format" ...
53 .Fn snprintf "char * restrict str" "size_t size" "const char * restrict format" ...
55 .Fn asprintf "char **ret" "const char *format" ...
57 .Fn dprintf "int fd" "const char * restrict format" ...
60 .Fn vprintf "const char * restrict format" "va_list ap"
62 .Fn vfprintf "FILE * restrict stream" "const char * restrict format" "va_list ap"
64 .Fn vsprintf "char * restrict str" "const char * restrict format" "va_list ap"
66 .Fn vsnprintf "char * restrict str" "size_t size" "const char * restrict format" "va_list ap"
68 .Fn vasprintf "char **ret" "const char *format" "va_list ap"
70 .Fn vdprintf "int fd" "const char * restrict format" "va_list ap"
74 family of functions produces output according to a
84 the standard output stream;
88 write output to the given output
93 write output to the given file descriptor;
99 write to the character string
105 dynamically allocate a new string with
108 Extended locale versions of these functions are documented in
112 for more information.
114 These functions write the output under the control of a
116 string that specifies how subsequent arguments
117 (or arguments accessed via the variable-length argument facilities of
119 are converted for output.
121 These functions return the number of characters printed
122 (not including the trailing
124 used to end output to strings) or a negative value if an output error occurs,
129 which return the number of characters that would have been printed if the
132 (again, not including the final
142 to be a pointer to a buffer sufficiently large to hold the formatted string.
143 This pointer should be passed to
145 to release the allocated storage when it is no longer needed.
146 If sufficient space cannot be allocated,
150 will return \-1 and set
163 of the characters printed into the output string
166 character then gets the terminating
168 if the return value is greater than or equal to the
170 argument, the string was too short
171 and some of the printed characters were discarded.
172 The output is always null-terminated.
179 effectively assume an infinite
182 For those routines that write to a user-provided character string,
183 that string and the format strings should not overlap, as the
184 behavior is undefined.
186 The format string is composed of zero or more directives:
191 which are copied unchanged to the output stream;
192 and conversion specifications, each of which results
193 in fetching zero or more subsequent arguments.
194 Each conversion specification is introduced by
198 The arguments must correspond properly (after type promotion)
199 with the conversion specifier.
202 the following appear in sequence:
205 An optional field, consisting of a decimal digit string followed by a
207 specifying the next argument to access.
208 If this field is not provided, the argument following the last
209 argument accessed will be used.
210 Arguments are numbered starting at
212 If unaccessed arguments in the format string are interspersed with ones that
213 are accessed the results will be indeterminate.
215 Zero or more of the following flags:
216 .Bl -tag -width ".So \ Sc (space)"
218 The value should be converted to an
221 .Cm c , d , i , n , p , s ,
224 conversions, this option has no effect.
227 conversions, the precision of the number is increased to force the first
228 character of the output string to a zero.
233 conversions, a non-zero result has the string
239 conversions) prepended to it.
241 .Cm a , A , e , E , f , F , g ,
244 conversions, the result will always contain a decimal point, even if no
245 digits follow it (normally, a decimal point appears in the results of
246 those conversions only if a digit follows).
251 conversions, trailing zeros are not removed from the result as they
253 .It So Cm 0 Sc (zero)
255 For all conversions except
257 the converted value is padded on the left with zeros rather than blanks.
258 If a precision is given with a numeric conversion
259 .Cm ( d , i , o , u , i , x ,
266 A negative field width flag;
267 the converted value is to be left adjusted on the field boundary.
270 conversions, the converted value is padded on the right with blanks,
271 rather than on the left with blanks or zeros.
277 .It So "\ " Sc (space)
278 A blank should be left before a positive number
279 produced by a signed conversion
280 .Cm ( a , A , d , e , E , f , F , g , G ,
284 A sign must always be placed before a
285 number produced by a signed conversion.
288 overrides a space if both are used.
294 or the integral portion of a floating point conversion
298 should be grouped and separated by thousands using
299 the non-monetary separator returned by
303 An optional separator character (
304 .Cm \ , | \; | \ : | _
305 ) used for separating multiple values when printing an AltiVec or SSE vector,
306 or other multi-value unit.
308 NOTE: This is an extension to the
311 Behaviour of these values for
313 is only defined for operating systems conforming to the
314 AltiVec Technology Programming Interface Manual.
315 (At time of writing this includes only Mac OS X 10.2 and later.)
317 An optional decimal digit string specifying a minimum field width.
318 If the converted value has fewer characters than the field width, it will
319 be padded with spaces on the left (or right, if the left-adjustment
320 flag has been given) to fill out
323 An optional precision, in the form of a period
326 optional digit string.
327 If the digit string is omitted, the precision is taken as zero.
328 This gives the minimum number of digits to appear for
329 .Cm d , i , o , u , x ,
332 conversions, the number of digits to appear after the decimal-point for
333 .Cm a , A , e , E , f ,
336 conversions, the maximum number of significant digits for
340 conversions, or the maximum number of characters to be printed from a
345 An optional length modifier, that specifies the size of the argument.
346 The following length modifiers are valid for the
347 .Cm d , i , n , o , u , x ,
351 .Bl -column ".Cm q Em (deprecated)" ".Vt signed char" ".Vt unsigned long long" ".Vt long long *"
352 .It Sy Modifier Ta Cm d , i Ta Cm o , u , x , X Ta Cm n
353 .It Cm hh Ta Vt "signed char" Ta Vt "unsigned char" Ta Vt "signed char *"
354 .It Cm h Ta Vt short Ta Vt "unsigned short" Ta Vt "short *"
355 .It Cm l No (ell) Ta Vt long Ta Vt "unsigned long" Ta Vt "long *"
356 .It Cm ll No (ell ell) Ta Vt "long long" Ta Vt "unsigned long long" Ta Vt "long long *"
357 .It Cm j Ta Vt intmax_t Ta Vt uintmax_t Ta Vt "intmax_t *"
358 .It Cm t Ta Vt ptrdiff_t Ta (see note) Ta Vt "ptrdiff_t *"
359 .It Cm z Ta (see note) Ta Vt size_t Ta (see note)
360 .It Cm q Em (deprecated) Ta Vt quad_t Ta Vt u_quad_t Ta Vt "quad_t *"
366 modifier, when applied to a
370 conversion, indicates that the argument is of an unsigned type
371 equivalent in size to a
375 modifier, when applied to a
379 conversion, indicates that the argument is of a signed type equivalent in
382 Similarly, when applied to an
384 conversion, it indicates that the argument is a pointer to a signed type
385 equivalent in size to a
388 The following length modifier is valid for the
389 .Cm a , A , e , E , f , F , g ,
393 .Bl -column ".Sy Modifier" ".Cm a , A , e , E , f , F , g , G"
394 .It Sy Modifier Ta Cm a , A , e , E , f , F , g , G
395 .It Cm l No (ell) Ta Vt double
396 (ignored, same behavior as without it)
397 .It Cm L Ta Vt "long double"
400 The following length modifier is valid for the
405 .Bl -column ".Sy Modifier" ".Vt wint_t" ".Vt wchar_t *"
406 .It Sy Modifier Ta Cm c Ta Cm s
407 .It Cm l No (ell) Ta Vt wint_t Ta Vt "wchar_t *"
410 The AltiVec Technology Programming Interface Manual also defines five additional length modifiers
411 which can be used (in place of the conventional length modifiers) for the printing of AltiVec or SSE vectors:
414 Treat the argument as a vector value, unit length will be determined by the conversion
415 specifier (default = 16 8-bit units for all integer conversions,
416 4 32-bit units for floating point conversions).
418 Treat the argument as a vector of 8 16-bit units.
420 Treat the argument as a vector of 4 32-bit units.
423 NOTE: The vector length specifiers are extensions to the
426 Behaviour of these values for
428 is only defined for operating systems conforming to the
429 AltiVec Technology Programming Interface Manual.
430 (At time of writing this includes only Mac OS X 10.2 and later.)
432 As a further extension, for SSE2 64-bit units:
435 Treat the argument as a vector of 2 64-bit units.
438 A character that specifies the type of conversion to be applied.
441 A field width or precision, or both, may be indicated by
444 or an asterisk followed by one or more decimal digits and a
450 argument supplies the field width or precision.
451 A negative field width is treated as a left adjustment flag followed by a
452 positive field width; a negative precision is treated as though it were
454 If a single format directive mixes positional
456 and non-positional arguments, the results are undefined.
458 The conversion specifiers and their meanings are:
459 .Bl -tag -width ".Cm diouxX"
463 (or appropriate variant) argument is converted to signed decimal
471 or unsigned hexadecimal
480 conversions; the letters
485 The precision, if any, gives the minimum number of digits that must
486 appear; if the converted value requires fewer digits, it is padded on
491 argument is converted to signed decimal, unsigned octal, or unsigned
492 decimal, as if the format had been
497 These conversion characters are deprecated, and will eventually disappear.
501 argument is rounded and converted in the style
503 .Oo \- Oc Ar d Li \&. Ar ddd Li e \\*[Pm] Ar dd
505 where there is one digit before the
506 decimal-point character
507 and the number of digits after it is equal to the precision;
508 if the precision is missing,
509 it is taken as 6; if the precision is
510 zero, no decimal-point character appears.
513 conversion uses the letter
517 to introduce the exponent.
518 The exponent always contains at least two digits; if the value is zero,
522 .Cm a , A , e , E , f , F , g ,
525 conversions, positive and negative infinity are represented as
529 respectively when using the lowercase conversion character, and
533 respectively when using the uppercase conversion character.
534 Similarly, NaN is represented as
536 when using the lowercase conversion, and
538 when using the uppercase conversion.
542 argument is rounded and converted to decimal notation in the style
544 .Oo \- Oc Ar ddd Li \&. Ar ddd ,
546 where the number of digits after the decimal-point character
547 is equal to the precision specification.
548 If the precision is missing, it is taken as 6; if the precision is
549 explicitly zero, no decimal-point character appears.
550 If a decimal point appears, at least one digit appears before it.
554 argument is converted in style
565 The precision specifies the number of significant digits.
566 If the precision is missing, 6 digits are given; if the precision is zero,
570 is used if the exponent from its conversion is less than \-4 or greater than
571 or equal to the precision.
572 Trailing zeros are removed from the fractional part of the result; a
573 decimal point appears only if it is followed by at least one digit.
577 argument is rounded and converted to hexadecimal notation in the style
579 .Oo \- Oc Li 0x Ar h Li \&. Ar hhhp Oo \\*[Pm] Oc Ar d ,
581 where the number of digits after the hexadecimal-point character
582 is equal to the precision specification.
583 If the precision is missing, it is taken as enough to represent
584 the floating-point number exactly, and no rounding occurs.
585 If the precision is zero, no hexadecimal-point character appears.
588 is a literal character
590 and the exponent consists of a positive or negative sign
591 followed by a decimal number representing an exponent of 2.
594 conversion uses the prefix
602 to represent the hex digits, and the letter
606 to separate the mantissa and exponent.
608 Note that there may be multiple valid ways to represent floating-point
609 numbers in this hexadecimal format.
611 .Li 0x1.92p+1 , 0x3.24p+0 , 0x6.48p-1 ,
615 The format chosen depends on the internal representation of the
616 number, but the implementation guarantees that the length of the
617 mantissa will be minimized.
618 Zeroes are always represented with a mantissa of 0 (preceded by a
620 if appropriate) and an exponent of
631 argument is converted to an
632 .Vt "unsigned char" ,
633 and the resulting character is written.
637 (ell) modifier is used, the
639 argument shall be converted to a
641 and the (potentially multi-byte) sequence representing the
642 single wide character is written, including any shift sequences.
643 If a shift sequence is used, the shift state is also restored
644 to the original state after the character.
654 argument is expected to be a pointer to an array of character type (pointer
656 Characters from the array are written up to (but not including)
660 if a precision is specified, no more than the number specified are
662 If a precision is given, no null character
663 need be present; if the precision is not specified, or is greater than
664 the size of the array, the array must contain a terminating
670 (ell) modifier is used, the
672 argument is expected to be a pointer to an array of wide characters
673 (pointer to a wide string).
674 For each wide character in the string, the (potentially multi-byte)
675 sequence representing the
676 wide character is written, including any shift sequences.
677 If any shift sequence is used, the shift state is also restored
678 to the original state after the string.
679 Wide characters from the array are written up to (but not including)
683 if a precision is specified, no more than the number of bytes specified are
684 written (including shift sequences).
685 Partial characters are never written.
686 If a precision is given, no null character
687 need be present; if the precision is not specified, or is greater than
688 the number of bytes required to render the multibyte representation of
689 the string, the array must contain a terminating wide
695 pointer argument is printed in hexadecimal (as if by
700 The number of characters written so far is stored into the
701 integer indicated by the
703 (or variant) pointer argument.
704 No argument is converted.
709 No argument is converted.
710 The complete conversion specification
716 character is defined in the program's locale (category
719 In no case does a non-existent or small field width cause truncation of
720 a numeric field; if the result of a conversion is wider than the field
722 field is expanded to contain the conversion result.
724 To print a date and time in the form
725 .Dq Li "Sunday, July 3, 10:02" ,
730 are pointers to strings:
731 .Bd -literal -offset indent
733 fprintf(stdout, "%s, %s %d, %.2d:%.2d\en",
734 weekday, month, day, hour, min);
738 to five decimal places:
739 .Bd -literal -offset indent
742 fprintf(stdout, "pi = %.5f\en", 4 * atan(1.0));
745 To allocate a 128 byte string and print into it:
746 .Bd -literal -offset indent
750 char *newfmt(const char *fmt, ...)
754 if ((p = malloc(128)) == NULL)
757 (void) vsnprintf(p, 128, fmt, ap);
762 .Sh SECURITY CONSIDERATIONS
767 functions are easily misused in a manner which enables malicious users
768 to arbitrarily change a running program's functionality through
769 a buffer overflow attack.
774 assume an infinitely long string,
775 callers must be careful not to overflow the actual space;
776 this is often hard to assure.
777 For safety, programmers should use the
783 foo(const char *arbitrary_string, const char *and_another)
789 * This first sprintf is bad behavior. Do not use sprintf!
791 sprintf(onstack, "%s, %s", arbitrary_string, and_another);
794 * The following two lines demonstrate better use of
797 snprintf(onstack, sizeof(onstack), "%s, %s", arbitrary_string,
807 family of functions are also easily misused in a manner
808 allowing malicious users to arbitrarily change a running program's
809 functionality by either causing the program
810 to print potentially sensitive data
811 .Dq "left on the stack" ,
812 or causing it to generate a memory fault or bus error
813 by dereferencing an invalid pointer.
816 can be used to write arbitrary data to potentially carefully-selected
818 Programmers are therefore strongly advised to never pass untrusted strings
821 argument, as an attacker can put format specifiers in the string
822 to mangle your stack,
823 leading to a possible security hole.
824 This holds true even if the string was built using a function like
826 as the resulting string may still contain user-supplied conversion specifiers
827 for later interpolation by
830 Always use the proper secure idiom:
832 .Dl "snprintf(buffer, sizeof(buffer), \*q%s\*q, string);"
834 The conversion formats
839 are provided only for backward compatibility.
840 The effect of padding the
842 format with zeros (either by the
844 flag or by specifying a precision), and the benign effect (i.e., none)
851 conversions, as well as other
852 nonsensical combinations such as
854 are not standard; such combinations
857 In addition to the errors documented for the
861 family of functions may fail if:
864 An invalid wide character code was encountered.
866 Insufficient storage space is available.
877 Subject to the caveats noted in the
892 With the same reservation, the
909 first appeared in the
912 These were implemented by
913 .An Peter Wemm Aq peter@FreeBSD.org
916 but were later replaced with a different implementation
918 .An Todd C. Miller Aq Todd.Miller@courtesan.com
925 functions were added in
930 family of functions do not correctly handle multibyte characters in the