Need help figuring out parameters of __isoc9_scanf()

Question

I have some some C code that I'm trying to understand which uses the function __isoc99_scanf(). I haven't encountered that function ever before. I looked it up and it turns out that it is some kind of variation of scanf(). This is the code:

__isoc99_scanf(&DAT_00400d18,local_78,(undefined4 *)((long)puVar3 + 4));

&DAT_00400d18 is a C string containing the value "%s". local_78 is an array of unknown data type. puVar3 is a pointer that points to the last element of that array.

What really confuses me is why does that function call have three parameters? I know that scanf() takes two parameters: the first one is the format string. The second one is the memory address to save the date into. However __isoc99_scanf() here is invoked with three parameters. I cannot understand why the third parameter is there. The first parameter &DAT_00400d18 is just "%s", which suggests that the second parameter be a memory location where to save that string. But why do you need the third parameter when it's not even specified in the format string?

This is not my code, I didn't write it. Actually it is a disassembled version of the assembly code for a particular application that I'm trying to debug. But I've never seen __isoc99_scanf() before because I only used scanf() in my own code.

Answer 1

When you compile scanf, the compiler automatically translates it to the __isoc99_scanf function in libc. If you compile this code:

#include <stdio.h>

int main() {
    char buf[32];
    scanf("%32s", buf);
    return 0;
}

and decompile in GHIDRA, you get:

__isoc99_scanf(&DAT_001007b4,local_38);

where DAT_001007b4 is "%32s" and local_38 is a buffer. It behaves exactly the same as normal scanf. One important thing to keep in mind when using GHIDRA is it doesn't know exactly how many arguments a function should expect, so if a function is being passed in too many arguments, like in your case, you should just ignore the extra arguments since the code will too.