[PATCH v2 01/17] stdio-common: Add tests for formatted scanf input specifiers

[Andreas Schwab]

On Mär 01 2025, Maciej W. Rozycki wrote:

> +    case 'N':								\
> +    case 'n':								\
> +      {									\
> +	static const char uan[] = { 'A', 'N' };				\
> +	static const char lan[] = { 'a', 'n' };				\
> +	size_t i;							\
> +									\
> +	for (i = 0; i < sizeof (uan); i++)				\
> +	  {								\
> +	    ch = read_input ();						\
> +	    if (ch != uan[i] && ch != lan[i])				\
> +	      {								\
> +		err = ch < 0 ? ch : INPUT_FORMAT;			\
> +		v = NAN;						\
> +		goto out;						\
> +	      }								\
> +	  }								\
> +									\
> +	ch = read_input ();						\
> +	if (ch == ':')							\
> +	  {								\
> +	    v = m ? -nan (v, ".") : nan (v, ".");			\
> +	    goto out;							\
> +	  }								\
> +									\
> +	size_t seq_size = 0;						\
> +	char *seq = NULL;						\
> +	i = 0;								\
> +	if (ch == '(')							\
> +	  while (1)							\
> +	    {								\
> +	      ch = read_input ();					\
> +	      if (ch == ')')						\
> +		break;							\
> +	      if (ch != '_' && !isdigit (ch)				\
> +		  && !(ch >= 'A' && ch <= 'Z')				\
> +		  && !(ch >= 'a' && ch <= 'z'))				\
> +		{							\
> +		  free (seq);						\
> +		  err = ch < 0 ? ch : INPUT_FORMAT;			\
> +		  v = NAN;						\
> +		  goto out;						\
> +		}							\
> +	      if (i == seq_size)					\
> +		{							\
> +		  seq_size += SIZE_CHUNK;				\
> +		  seq = xrealloc (seq, seq_size);			\
> +		}							\
> +	      seq[i++] = ch;						\
> +	    }								\
> +	seq[i] = '\0';							\

So if the input line is '%lf:nan():1:5:nan():' this crashes with a null
pointer dereference.

-- 
Andreas Schwab, SUSE Labs, schwab@suse.de
GPG Key fingerprint = 0196 BAD8 1CE9 1970 F4BE  1748 E4D4 88E3 0EEA B9D7
"And now for something completely different."