[PATCH v2 01/17] stdio-common: Add tests for formatted scanf input specifiers

[Maciej W. Rozycki]

On Thu, 3 Apr 2025, Andreas Schwab wrote:

> > +    case 'N':								\
> > +    case 'n':								\
> > +      {									\
> > +	static const char uan[] = { 'A', 'N' };				\
> > +	static const char lan[] = { 'a', 'n' };				\
> > +	size_t i;							\
> > +									\
> > +	for (i = 0; i < sizeof (uan); i++)				\
> > +	  {								\
> > +	    ch = read_input ();						\
> > +	    if (ch != uan[i] && ch != lan[i])				\
> > +	      {								\
> > +		err = ch < 0 ? ch : INPUT_FORMAT;			\
> > +		v = NAN;						\
> > +		goto out;						\
> > +	      }								\
> > +	  }								\
> > +									\
> > +	ch = read_input ();						\
> > +	if (ch == ':')							\
> > +	  {								\
> > +	    v = m ? -nan (v, ".") : nan (v, ".");			\
> > +	    goto out;							\
> > +	  }								\
> > +									\
> > +	size_t seq_size = 0;						\
> > +	char *seq = NULL;						\
> > +	i = 0;								\
> > +	if (ch == '(')							\
> > +	  while (1)							\
> > +	    {								\
> > +	      ch = read_input ();					\
> > +	      if (ch == ')')						\
> > +		break;							\
> > +	      if (ch != '_' && !isdigit (ch)				\
> > +		  && !(ch >= 'A' && ch <= 'Z')				\
> > +		  && !(ch >= 'a' && ch <= 'z'))				\
> > +		{							\
> > +		  free (seq);						\
> > +		  err = ch < 0 ? ch : INPUT_FORMAT;			\
> > +		  v = NAN;						\
> > +		  goto out;						\
> > +		}							\
> > +	      if (i == seq_size)					\
> > +		{							\
> > +		  seq_size += SIZE_CHUNK;				\
> > +		  seq = xrealloc (seq, seq_size);			\
> > +		}							\
> > +	      seq[i++] = ch;						\
> > +	    }								\
> > +	seq[i] = '\0';							\
> 
> So if the input line is '%lf:nan():1:5:nan():' this crashes with a null
> pointer dereference.

 Fix now posted at: 
<https://inbox.sourceware.org/libc-alpha/alpine.DEB.2.21.2504190522470.18253@angie.orcam.me.uk/>.

  Maciej