title: Why can a null character be embedded in a conversion specifier for scanf?
body: <p>Perhaps I'm misinterpreting my results, but:</p>
  <pre><code>#include &lt;stdio.h&gt;
  
  int
  main(void)
  {
      char buf[32] = &quot;&quot;;
      int x;
      x = scanf(&quot;%31[^\0]&quot;, buf);
      printf(&quot;x = %d, buf=%s&quot;, x, buf);
  }
  $ printf 'foo\n\0bar' | ./a.out
  x = 1, buf=foo
  </code></pre>
  <p>Since the string literal <code>&quot;%31[^\0]&quot;</code> contains an embedded null, it seems that it should be treated the same as <code>&quot;%31[^&quot;</code>, and the compiler should complain that the <code>[</code> is unmatched.  Indeed, if you replace the string literal, clang gives:</p>
  <p><code>warning: no closing ']' for '%[' in scanf format string [-Wformat]</code></p>
  <p>Why does it work to embed a null character in the string literal passed to scanf?</p>
  <p>-- EDIT --</p>
  <p>The above is undefined behavior and merely happens to &quot;work&quot;.</p>