JL after scanf jumps even though the conversion succeeded? Do functions set FLAGS according to their return value?

I wanted to get input using scanf, my idea was to loop scanf until it returns negative number (error). For some reason scanf stores first input in designated variable and returns negative number, it shouldn't do it right? Here is part of my code

.global main
main:
    movl $var, %edx
in:
    push %edx
    push $inp
    call scanf
    jl done
    add $8, %esp
    add $4, %edx
    jmp in
done:
    ...
.data
inp: .asciz "%d"
var: .space 4*100

I'm using assembly AT&T

Solution

Functions return in EAX (for integers/pointers), not also FLAGS.
You need test %eax,%eax to set FLAGS according to the return val before you can branch on it.
Functions don't do that for you.

In the i386 System V calling convention (like all standard ones), FLAGS is call-clobbered, so there's zero requirement on what functions leave in the condition codes. (The convention does require DF=0 on call and ret). You can check the calling convention doc yourself; it's not that long and fairly easy to read.

Or you can look at what compilers do, because it's a good assumption that global (non-static) functions created by compilers will obey the ABI. int foo(){return 1;} compiles to mov $1, %eax ; ret, which leaves FLAGS unaffected. (https://godbolt.org/z/3a1jjaeM1)

In hand-written asm, it's totally fine to use a custom calling convention where FLAGS holds the return value, or is one of the return values. (Asm doesn't have the annoying limitation of C only having one by-value ret-value object.) See Is it considered bad practice to use the flags register as a boolean return value? (no, and MacOS / FreeBSD do it for system-calls.)

Also note that EDX is call-clobbered; pick a different register, like EDI, ESI, or EBX for your pointer, so scanf won't destroy it.