mirror of git://git.musl-libc.org/musl
fix uninitialized/stale use of alloc (%m modifier) flag in scanf
for conversion specifiers, alloc is always set when the specifier is parsed. however, if scanf stops due to mismatching literal text, either an uninitialized (if no conversions have been performed yet) or stale (from the previous conversion) of the flag will be used, possibly causing an invalid pointer to be passed to free when the function returns.
This commit is contained in:
parent
8389520ed5
commit
1d92cddb1e
|
@ -81,6 +81,8 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
|
|||
|
||||
for (p=(const unsigned char *)fmt; *p; p++) {
|
||||
|
||||
alloc = 0;
|
||||
|
||||
if (isspace(*p)) {
|
||||
while (isspace(p[1])) p++;
|
||||
shlim(f, 0);
|
||||
|
|
|
@ -109,6 +109,8 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
|
|||
|
||||
for (p=fmt; *p; p++) {
|
||||
|
||||
alloc = 0;
|
||||
|
||||
if (iswspace(*p)) {
|
||||
while (iswspace(p[1])) p++;
|
||||
while (iswspace((c=getwc(f)))) pos++;
|
||||
|
|
Loading…
Reference in New Issue