[PATCH v4 2/2] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

[Carlos O'Donell]

On 4/8/26 12:13 PM, Rocket Ma wrote:
>> If the function need to be separated, then the old behavior, "size_t
>> newsize = strsize + (strsize >= width ? width : strsize)", is not
>> worth a new function. And the function only expands to several
>> instructions, less than 10, observed via Compiler Explorer. I think
>> it's OK to inline the function.
>>
>> Since the behavior mentioned has become some sort of convention, the
>> function should be OK? Readers has the constant to distinguish between
>> %ms and %mc, and they can understand the code via enough comments.
>> Personally I think it's worth to put these two actions together to do
>> one thing: calculate the size of expanded array.
> 
> Any idea?
> 

The best way forward is to simplify and just fix the %mc case for bug
34008 and the CVE.

Then we can have a follow-on changes that refactors?

-- 
Cheers,
Carlos.