[PATCH v2 11/17] stdio-common: Add tests for formatted sscanf input specifiers

[Joseph Myers]

On Sat, 1 Mar 2025, Maciej W. Rozycki wrote:

> +  do									\
> +    {									\
> +      ch = read_input ();						\
> +      if (ch < 0)							\
> +	{								\
> +	  result = ch;							\
> +	  goto out;							\
> +	}								\
> +      if (i == sscanf_buf_size)						\
> +	{								\
> +	  sscanf_buf_size += SIZE_CHUNK;				\
> +	  sscanf_buf = xrealloc (sscanf_buf, sscanf_buf_size);		\
> +	}								\
> +      sscanf_buf[i++] = ch;						\
> +    }									\
> +  while (ch != ':');							\
> +  sscanf_buf[i++] = '\0';						\

I think there's potential for a one-byte overrun when writing the null 
terminator here, if i == sscanf_buf_size on exiting this loop.

The same applies to patch 14.

-- 
Joseph S. Myers
josmyers@redhat.com