title: Can `unsigned int x; scanf("%u",&x);` really cause undefined behavior?
body: <p>For once I thought I found a good use for <em>sscanf()</em> but after reading about how it handles integers, it appears not. Having a string that should look like this: <code>123,456,678</code> I thought I could safely and concisely parse it with this code:</p>
  <pre class="lang-c prettyprint-override"><code>unsigned int x[3];
  if( sscanf( s, &quot;%u,%u,%u&quot;, x+0, x+1, x+2 ) == 3 )
      …
  </code></pre>
  <p>If conversion fails I'm not really interested in knowing <em>why</em>, nor am I worried about getting incorrect data. If there's something other than numbers in there, <code>scanf()</code> should surely create a matching error and abort, and it knows I'm looking for an unsigned integer, so anything negative should also be a matching error? Nope.</p>
  <p>I got suspicious when I read about the conversion specifier <strong>%u</strong>: <em>Matches an optionally signed decimal integer.</em> Why would this not be a matching error? What happens if it is signed?</p>
  <p>Quoting from ISO/IEC 9899:201x 7.21.6.2 ¶ 10, <em>The fscanf function</em> (emphasis mine):</p>
  <blockquote>
  <p>Except in the case of a % specifier, the input item (or, in the case of a %n directive, the
  count of input characters) is converted to <strong>a type appropriate to the conversion specifier</strong>. If
  the input item is not a matching sequence, the execution of the directive fails: this
  condition is a matching failure. Unless assignment suppression was indicated by a *, the
  result of the conversion is placed in the object pointed to by the first argument following
  the format argument that has not already received a conversion result. If this object
  does not have an appropriate type, or <strong>if the result of the conversion cannot be represented
  in the object, the behavior is undefined</strong>.</p>
  </blockquote>
  <p>It appears to read as if <code>scanf()</code> treats every integer-looking conversion specifier the same, reads the input as some kind of signed integer of unspecified size, and then writes to the output <em>bypassing</em> all normal conversions.</p>
  <p>For example converting any integer (negative or positive) into an unsigned integer of smaller size is well behaved according to normal implicit conversions, but not with <code>scanf()</code>:</p>
  <pre class="lang-c prettyprint-override"><code>unsigned int x;
  x = -1;                   /* Well defined: (-1) + (UINT_MAX+1) = UINT_MAX */
  sscanf( &quot;-1&quot;, &quot;%u&quot;, &amp;x ); /* Undefined behavior? */
  </code></pre>
  <p>Please tell me I'm wrong and that I have missed some part of the standard. One thing that I can't really find a reference to is this part of the section quoted above: <strong>&quot;the input item (…) is converted to a type appropriate to the conversion specifier&quot;</strong>. If the conversion specifier is <strong>%u</strong> then anything negative is of course <em>not</em> appropriate, nor is anything that does not fit into an unsigned integer. However, I could not find anything in the standard telling me exactly what an &quot;appropriate type&quot; is.</p>
  <p>I found a handful of questions dealing with this directly or indirectly, but not in much detail. The question most similar to mine is <a href="https://stackoverflow.com/q/21665449/5725780">C: How to prevent input using scanf from overflowing?</a> but it's framed in a way that's not as specific. A few answers (<a href="https://stackoverflow.com/a/2430978/5725780">1</a>, <a href="https://stackoverflow.com/a/52026335/5725780">2</a>) mentions the issue but offer no detail or references.</p>
  <p>The goal of my question is to get an answer detailing exactly why this can not be interpreted in any way other than <em>undefined behavior</em>, and preferably some rationale as to why this makes sense - fully knowing that some things in C are inconsistent and you I have to accept it.</p>