Description of problem:

fscanf interprets 'a' GNU extension format specifier wrongly


Version-Release number of selected component (if applicable):
[Matti@home exe]$ /lib/libc-2.10.1.so 
GNU C Library stable release version 2.10.1, by Roland McGrath et al.
Copyright (C) 2009 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
Compiled by GNU CC version 4.4.0 20090506 (Red Hat 4.4.0-4).
Compiled on a Linux >>2.6.18-128.2.1.el5<< system on 2009-08-04.
Available extensions:
	The C stubs add-on version 2.1.2.
	crypt add-on version 2.1 by Michael Glad and others
	GNU Libidn by Simon Josefsson
	Native POSIX Threads Library by Ulrich Drepper et al
	BIND-8.2.3-T5B
	RT using linux kernel aio


How reproducible:
try using fscanf with format specifier %a[\n] for parsing a file.

Steps to Reproduce:
1. compile test code shown below gcc -Wall -o scanftest scanftest.c
2. create scanftest.txt file as shown below
3. run ./scanftest

scanftest.c:

#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <string.h>

int main(void)
{
	FILE *testfile;
	int commentfound,datafound;
	int scanned;
	char *readdata;
	int readint;
	int ok=1;
	testfile=fopen("scanftest.txt","r");
	if(NULL==testfile)
	{
		perror("Could not open file\n");
		return -1;
	}
	while(ok)
	{
		commentfound=datafound=0;
		scanned=fscanf(testfile,"#%a[^\n]\n",&readdata);
		if(scanned<0 || feof(testfile))
			ok=0;
		if(scanned!=1)
		{
			printf("Could not find commentline (scanned=%d)\n",scanned);
		}
		else
		{
			printf("commentline found: \"%s\"\n",readdata);
			free(readdata);
			commentfound=1;
			continue;
		}
		scanned=fscanf(testfile,"%d:%a[^\n]\n",&readint,&readdata);
		if(scanned<0 || feof(testfile))
			ok=0;
		if(scanned!=2)
		{
			printf("could not find realdata (scanned=%d)\n",scanned);
		}
		else
		{
			printf("data found: \"%d:%s\"\n",readint,readdata);
			datafound=1;
			free(readdata);
		}
		if(!commentfound && !datafound)
		{
			readdata=NULL;
			readint=NULL;
			if(0!=(readint=getline(&readdata,&readint,testfile)) && -1!= readint)
			{
				printf("This line was neither comment, nor data: \"%s\"\n",readdata);
				free(readdata);
			}
			if(-1==readint)
			{
				printf("getline noticed problems... %s",strerror(errno));
				ok=0;
			}
			if(feof(testfile))
			{
				printf("EOF");
				ok= 0;
			}
		}
	}
	return 0;
}

scanftest.txt:

#OWN_ID:
0:MazBot_V4.0.1
#E_callback_event_file
1:events.conf
#E_event_def_reply_file
2:def_replies.conf
#4E_text_event_prefix_in_use
3:0
#5E_text_event_prefix
#4:!
#E_own_nick
5:MazBotV4
#E_user_ident_mode
#0 = registered users based on nick, nonregged cannot be identified
#1 = password based - user needs to send password to bot.
#2 = hostmask
6:0
#E_user_level_file_name_reg
7:userlevel_modeRegNick.conf
#E_user_level_file_name_pass
8:userlevel_modePasswd.conf
#E_user_level_file_name_host
9:userlevel_modeHostmask.conf

  
Actual results:
fscanf seems to be interpreting 'a' format specifier as floating point specifier

Expected results:
fscanf should interpret 'a' as a request to allocate space for returned pointer when string specifier [ is given.

Additional info:
used system:
[Matti@home exe]$ uname -a
Linux home.maz 2.6.29.6-217.2.8.fc11.i586 #1 SMP Sat Aug 15 00:44:39 EDT 2009 i686 athlon i386 GNU/Linux