NetBSD Problem Report #60708

From zakinko@snowrabbit.org  Thu Sep 10 17:42:57 2026
Return-Path: <zakinko@snowrabbit.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.netbsd.org", Issuer "YR1" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 510461A923B
	for <gnats-bugs@gnats.NetBSD.org>; Thu, 10 Sep 2026 17:42:57 +0000 (UTC)
Message-Id: <20260910174254.E23F7C9306@bambi.snowrabbit.org>
Date: Fri, 11 Sep 2026 02:42:54 +0900 (JST)
From: Showta Ishizaki <zakinko@snowrabbit.org>
To: gnats-bugs@NetBSD.org
Cc: zakinko@snowrabbit.org
Subject: lib/: printf(3) leaves a positional %F argument untyped
X-Send-Pr-Version: 3.95
X-From4GNATS: "Showta Ishizaki via gnats" <gnats-admin@NetBSD.org>

>Number:         60708
>Category:       lib
>Synopsis:       printf(3) leaves a positional %F argument untyped, so "%1$F" prints the wrong value
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kre
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Sep 10 17:45:00 +0000 2026
>Closed-Date:    Wed Oct 14 18:43:23 +0000 2026
>Last-Modified:  Wed Oct 14 18:43:23 +0000 2026
>Originator:     Showta Ishizaki
>Release:        NetBSD 11.0 (the code is the same in -current)
>Organization:
>Environment:
System: NetBSD 11.0 amd64
Architecture: x86_64
Machine: amd64

>Description:

When a format uses positional arguments (n$), vfprintf(3) first walks
the format with __find_arguments() to learn the type of every argument,
and then reads them from a table.  That walk, in lib/libc/stdio/
vfwprintf.c, lists the floating-point conversions as

	case 'a':
	case 'A':
	case 'e':
	case 'E':
	case 'f':
	case 'g':
	case 'G':

and leaves out F.  A double that is only referred to through %F never
gets a type, so its slot in the table stays zero and the conversion
prints a zero:

	printf("%1$F", -INFINITY)   ->  0.000000
	printf("%1$F", 1.5)         ->  0.000000
	printf("%F", 1.5)           ->  1.500000

The same format with %1$f, or with %1$F next to any other conversion of
the same argument, works, because those give the argument its type.
The conversion switch itself already knows F (it sits next to 'f' at
line 1115), so only the type scan is missing it.

abseil's str_format test caught this on NetBSD: it prints "%1$*2$F" and
compares against the C library.

>How-To-Repeat:

	#include <stdio.h>
	#include <math.h>
	int main(void) {
		printf("[%1$F]\n", -INFINITY);
		printf("[%1$F]\n", 1.5);
		printf("[%F]\n", 1.5);
		return 0;
	}

prints

	[0.000000]
	[0.000000]
	[1.500000]

and the first two should be [-INF] and [1.500000].

>Fix:

Add 'F' to the list in __find_arguments().  The diff is against trunk
and applies to the netbsd-11 file as well.

--- lib/libc/stdio/vfwprintf.c.orig
+++ lib/libc/stdio/vfwprintf.c
@@ -1727,6 +1727,7 @@
 		case 'e':
 		case 'E':
 		case 'f':
+		case 'F':
 		case 'g':
 		case 'G':
 			if (flags & LONGDBL)

Checked by building lib/libc from the 11.0 source sets with this change
and running the program above against the new libc.so.12 through
LD_LIBRARY_PATH: it prints [-INF], [1.500000], [1.500000], and the
system libc still prints the zeros.  Not built on -current.

FreeBSD and DragonFly have the same omission in their printf-pos.c and
I am reporting it there separately; OpenBSD's vfprintf.c has the F.

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: lib-bug-people->kre
Responsible-Changed-By: kre@NetBSD.org
Responsible-Changed-When: Sat, 12 Sep 2026 17:02:40 +0000
Responsible-Changed-Why:
As I am making changes to printf(3) for PR bin/60496 
(which should be lib/60496 but never mind) I might as
well fix this one at (approximately) the same time.


From: "Robert Elz" <kre@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60708 CVS commit: src/lib/libc/stdio
Date: Mon, 21 Sep 2026 19:12:51 +0000

 Module Name:	src
 Committed By:	kre
 Date:		Mon Sep 21 19:12:51 UTC 2026

 Modified Files:
 	src/lib/libc/stdio: vfwprintf.c

 Log Message:
 PR lib/60708 - include 'F' format when fetching %n$ args.

 XXX pullup -10 -11 (to be done along with PR bin/60496 pullups).


 To generate a diff of this commit:
 cvs rdiff -u -r1.41 -r1.42 src/lib/libc/stdio/vfwprintf.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: kre@NetBSD.org
State-Changed-When: Thu, 24 Sep 2026 08:20:00 +0000
State-Changed-Why:
Needs pullups to -10 and -11 branches


State-Changed-From-To: needs-pullups->pending-pullups
State-Changed-By: kre@NetBSD.org
State-Changed-When: Wed, 14 Oct 2026 18:20:59 +0000
State-Changed-Why:
[pullup-10 #1363] [pullup-11 #531]


From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60708 CVS commit: [netbsd-11] src/lib/libc/stdio
Date: Wed, 14 Oct 2026 18:30:55 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Wed Oct 14 18:30:55 UTC 2026

 Modified Files:
 	src/lib/libc/stdio [netbsd-11]: vfwprintf.c

 Log Message:
 Pull up following revision(s) (requested by kre in ticket #531):

 	lib/libc/stdio/vfwprintf.c: revision 1.42,1.43

 PR lib/60708 - include 'F' format when fetching %n$ args.

 PR bin/60496 - fix printf(3) with non-single-byte decimal point & thousands sep

 These fixes are relatively simple, and should be safe -- I have had them
 in my source tree for ages now.

 The fix for the decimal point case is taken more or less directly from
 an old FreeBSD fix for the same issue.

 The thousands separator case is different - our code and FreeBSD's have
 diverged so much in this area that simply using their method would have
 been more trouble than it was worth, so I reimplemented it differently
 to better fit our code model.

 There are ATF tests that go with this, which will be committed one day,
 but have been waiting on strfmon(3) fixes, which are related.   I decided
 these code changes should wait no longer.  The tests will come later.


 To generate a diff of this commit:
 cvs rdiff -u -r1.41 -r1.41.4.1 src/lib/libc/stdio/vfwprintf.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60708 CVS commit: [netbsd-10] src/lib/libc/stdio
Date: Wed, 14 Oct 2026 18:33:23 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Wed Oct 14 18:33:22 UTC 2026

 Modified Files:
 	src/lib/libc/stdio [netbsd-10]: vfwprintf.c

 Log Message:
 Pull up following revision(s) (requested by kre in ticket #1363):

 	lib/libc/stdio/vfwprintf.c: revision 1.42,1.43

 PR lib/60708 - include 'F' format when fetching %n$ args.

 PR bin/60496 - fix printf(3) with non-single-byte decimal point & thousands sep

 These fixes are relatively simple, and should be safe -- I have had them
 in my source tree for ages now.

 The fix for the decimal point case is taken more or less directly from
 an old FreeBSD fix for the same issue.

 The thousands separator case is different - our code and FreeBSD's have
 diverged so much in this area that simply using their method would have
 been more trouble than it was worth, so I reimplemented it differently
 to better fit our code model.

 There are ATF tests that go with this, which will be committed one day,
 but have been waiting on strfmon(3) fixes, which are related.   I decided
 these code changes should wait no longer.  The tests will come later.


 To generate a diff of this commit:
 cvs rdiff -u -r1.39.2.1 -r1.39.2.2 src/lib/libc/stdio/vfwprintf.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: pending-pullups->closed
State-Changed-By: kre@NetBSD.org
State-Changed-When: Wed, 14 Oct 2026 18:43:23 +0000
State-Changed-Why:
Pullups completed.

The problem was fixed exactly as suggested.

Thanks for the PR.


>Unformatted:

Home	PR Database Search