[PATCH v2 11/17] stdio-common: Add tests for formatted sscanf input specifiers

[Maciej W. Rozycki]

On Tue, 4 Mar 2025, Joseph Myers wrote:

> > +  do									\
> > +    {									\
> > +      ch = read_input ();						\
> > +      if (ch < 0)							\
> > +	{								\
> > +	  result = ch;							\
> > +	  goto out;							\
> > +	}								\
> > +      if (i == sscanf_buf_size)						\
> > +	{								\
> > +	  sscanf_buf_size += SIZE_CHUNK;				\
> > +	  sscanf_buf = xrealloc (sscanf_buf, sscanf_buf_size);		\
> > +	}								\
> > +      sscanf_buf[i++] = ch;						\
> > +    }									\
> > +  while (ch != ':');							\
> > +  sscanf_buf[i++] = '\0';						\
> 
> I think there's potential for a one-byte overrun when writing the null 
> terminator here, if i == sscanf_buf_size on exiting this loop.
> 
> The same applies to patch 14.

 Right, fixed in v3.  Thank you.

  Maciej