Use read_int in vfscanf

The function read_int, from printf-parse.h, parses an integer from a string
while avoiding overflows.  It is used by other functions, such as vfprintf,
to avoid undefined behavior.

The function vfscanf (_IO_vfwscanf) parses an integer from the format
string, and can use read_int.

diff --git a/ChangeLog b/ChangeLog
index de9056e92a9e7d28d4c422cb9e7e3e93a5eb8ea8..4b91b6ab7045aef5b7ea8dd8346773f3f8cea99a 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2016-10-26  Gabriel F. T. Gomes  <gftg@linux.vnet.ibm.com>
+
+       * stdio-common/vfscanf.c (_IO_vfwscanf): Use read_int to parse
+       integer from the format string.
+
 2016-10-26  Florian Weimer  <fweimer@redhat.com>
 
        [BZ #19473]

diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
index fe3677ba102e1f9057e1608b17dcc7a648e5c1df..7caa96fbe2c947dded18b0508fe3ddb3f5d58c82 100644 (file)
--- a/stdio-common/vfscanf.c
+++ b/stdio-common/vfscanf.c
@@ -133,6 +133,8 @@
 # define WINT_T                int
 #endif
 
+#include "printf-parse.h" /* Use read_int.  */
+
 #define encode_error() do {                                                  \
                          errval = 4;                                         \
                          __set_errno (EILSEQ);                               \
@@ -488,9 +490,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
       /* Check for a positional parameter specification.  */
       if (ISDIGIT ((UCHAR_T) *f))
        {
-         argpos = (UCHAR_T) *f++ - L_('0');
-         while (ISDIGIT ((UCHAR_T) *f))
-           argpos = argpos * 10 + ((UCHAR_T) *f++ - L_('0'));
+         argpos = read_int ((const UCHAR_T **) &f);
          if (*f == L_('$'))
            ++f;
          else
@@ -525,11 +525,8 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 
       /* Find the maximum field width.  */
       width = 0;
-      while (ISDIGIT ((UCHAR_T) *f))
-       {
-         width *= 10;
-         width += (UCHAR_T) *f++ - L_('0');
-       }
+      if (ISDIGIT ((UCHAR_T) *f))
+       width = read_int ((const UCHAR_T **) &f);
     got_width:
       if (width == 0)
        width = -1;