This section describes the miscellaneous input conversions.
The ‘%p’ conversion is used to read a pointer value. It recognizes
the same syntax used by the ‘%p’ output conversion for
printf (see Other Output Conversions); that is, a hexadecimal
number just as the ‘%x’ conversion accepts. The corresponding
argument should be of type void **; that is, the address of a
place to store a pointer.
The resulting pointer value is not guaranteed to be valid if it was not originally written during the same program execution that reads it in.
The ‘%n’ conversion produces the number of characters read so far
by this call. The corresponding argument should be of type int *,
unless a type modifier is in effect (see Numeric Input Conversions).
This conversion works in the same way as the ‘%n’ conversion for
printf; see Other Output Conversions, for an example.
The ‘%n’ conversion is the only mechanism for determining the
success of literal matches or conversions with suppressed assignments.
If the ‘%n’ follows the locus of a matching failure, then no value
is stored for it since scanf returns before processing the
‘%n’. If you store -1 in that argument slot before calling
scanf, the presence of -1 after scanf indicates an
error occurred before the ‘%n’ was reached.
Finally, the ‘%%’ conversion matches a literal ‘%’ character in the input stream, without using an argument. This conversion does not permit any flags, field width, or type modifier to be specified.