the subsequent rounding code assumes the end pointer (z) accurately reflects the end of significance in the decimal expansion, but for certain large integers, spurious trailing zero slots were left behind when applying the binary exponent. issue reported by Morten Welinder; the analysis of the cause was performed by nsz, who also proposed this change. (cherry picked from commit e94d0692864ecf9522fd6a97610a47a2f718d3de)
the code to strip trailing zeros was only looking in the last slot for up to 9 zeros, assuming that the rounding code had already removed fully-zero slots from the end. however, this ignored cases where the rounding code did not run at all, which occur when the value being printed is exactly representable in the requested precision. the simplest solution is to move the code that strips trailing zero slots to run unconditionally, immediately after rounding, rather than as the last step of rounding. (cherry picked from commit 89740868c9f1c84b8ee528468d12df1fa72cd392)
in cases where rounding caused a carry, the slot into which the carry was taking place was unconditionally treated as valid, despite the possibility that it could be a new slot prior to the beginning of the existing non-rounded number. in theory this could lead to unbounded runaway carry, but in order for that to happen, the whole uninitialized buffer would need to have been pre-filled with 32-bit integer values greater than or equal to 999999999. patch based on proposed fix by Morten Welinder, who also discovered and reported the bug. (cherry picked from commit 109048e031f39fbb370211fde44ababf6c04c8fb)
the printf floating point formatting code contains an optimization to avoid computing digits that will be thrown away by rounding at the specified (or default) precision. while it was correctly retaining all places up to the last decimal place to be printed, it was not retaining enough precision to see the next nonzero decimal place in all cases. this could cause incorrect rounding down in round-to-even (default) rounding mode, for example, when printing 0.5+DBL_EPSILON with "%.0f". in the fix, LDBL_MANT_DIG/3 is a lazy (non-sharp) upper bound on the number of zeros between any two nonzero decimal digits.
empirically the overflow was an off-by-one, and it did not seem to be overwriting meaningful data. rather than simply increasing the buffer size by one, however, I have attempted to make the size obviously correct in terms of bounds on the number of iterations for the loops that fill the buffer. this still results in no more than a negligible size increase of the buffer on the stack (6-7 32-bit slots) and is a "safer" fix unless/until somebody wants to do the proof that a smaller buffer would suffice.
this saves a syscall in the case where the underlying open already took place with O_APPEND, which is common because fopen with append modes sets O_APPEND at the time of open before passing the file descriptor to __fdopen.
when there is unflushed output, ftello (and ftell) compute the logical stream position as the underlying file descriptor's offset plus an adjustment for the amount of buffered data. however, this can give the wrong result for append-mode streams where the unflushed writes should adjust the logical position to be at the end of the file, as if a seek to end-of-file takes place before the write. the solution turns out to be a simple trick: when ftello (indirectly) calls lseek to determine the current file offset, use SEEK_END instead of SEEK_CUR if the stream is append-mode and there's unwritten buffered data. the ISO C rules regarding switching between reading and writing for a stream opened in an update mode, along with the POSIX rules regarding switching "active handles", conveniently leave undefined the hypothetical usage cases where this fix might lead to observably incorrect offsets. the bug being fixed was discovered via the test case for glibc issue
this glibc abi compatibility function was missed when the scanf aliases were added.
add missing va_end and remove some unnecessary code.