[PATCH] vfscanf-internal: Get rid of unbounded allocas

[Joe Simmons-Talbott]

Replace two unbounded allocas with scratch_buffers to avoid potential
stack overflow.
---
 stdio-common/vfscanf-internal.c | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
index bfb9baa21a..60376ccff9 100644
--- a/stdio-common/vfscanf-internal.c
+++ b/stdio-common/vfscanf-internal.c
@@ -335,6 +335,12 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
   struct char_buffer charbuf;
   scratch_buffer_init (&charbuf.scratch);
 
+  struct scratch_buffer wc_ext_sbuf;
+  scratch_buffer_init (&wc_ext_sbuf);
+
+  struct scratch_buffer mb_ext_sbuf;
+  scratch_buffer_init (&mb_ext_sbuf);
+
 #ifdef __va_copy
   __va_copy (arg, argptr);
 #else
@@ -1488,8 +1494,14 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
 		      wcdigits[n] = (const wchar_t *)
 			_NL_CURRENT (LC_CTYPE, _NL_CTYPE_INDIGITS0_WC + n);
 
-		      wchar_t *wc_extended = (wchar_t *)
-			alloca ((to_level + 2) * sizeof (wchar_t));
+		      wchar_t *wc_extended;
+		      if (!scratch_buffer_set_array_size
+		          (&wc_ext_sbuf, sizeof (wchar_t), to_level + 2))
+		        {
+		          done = EOF;
+		          goto errout;
+		        }
+		      wc_extended = wc_ext_sbuf.data;
 		      __wmemcpy (wc_extended, wcdigits[n], to_level);
 		      wc_extended[to_level] = __towctrans (L'0' + n, map);
 		      wc_extended[to_level + 1] = '\0';
@@ -1525,7 +1537,13 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
 
 		      /*  Allocate memory for extended multibyte digit.  */
 		      char *mb_extended;
-		      mb_extended = (char *) alloca (mbdigits_len + mblen + 1);
+		      if (!scratch_buffer_set_array_size
+		          (&mb_ext_sbuf, 1, mbdigits_len + mblen + 1))
+		        {
+		          done = EOF;
+		          goto errout;
+		        }
+		      mb_extended = mb_ext_sbuf.data;
 
 		      /*  And get the mbdigits + extra_digit string.  */
 		      *(char *) __mempcpy (__mempcpy (mb_extended, mbdigits[n],
@@ -3063,5 +3081,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
       free (*strptr);
       *strptr = NULL;
     }
+  scratch_buffer_free (&wc_ext_sbuf);
+  scratch_buffer_free (&mb_ext_sbuf);
   return done;
 }
-- 
2.39.2