[PATCH v5 2/3] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

[Carlos O'Donell]

On 4/13/26 10:17 PM, Rocket Ma wrote:
> * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
> format %mc or %mC, glibc allocates one byte less, leading to
> user-controlled one byte overflow. This commit fixes BZ #34008, or
> CVE-2026-5450.
> 
> Signed-off-by: Rocket Ma <marocketbd@gmail.com>

This looks correct to me.

You can keep my Reviewed-by in your v6 post if you don't change the fix.

Reviewed-by: Carlos O'Donell <carlos@redhat.com>

> ---
>   stdio-common/vfscanf-internal.c | 7 +++----
>   1 file changed, 3 insertions(+), 4 deletions(-)
> 
> diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
> index 59fc8208aa..3d11ac261e 100644
> --- a/stdio-common/vfscanf-internal.c
> +++ b/stdio-common/vfscanf-internal.c
> @@ -855,8 +855,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>   			{
>   			  /* Enlarge the buffer.  */
>   			  size_t newsize
> -			    = strsize
> -			      + (strsize >= width ? width - 1 : strsize);
> +			    = strsize + (strsize >= width ? width : strsize);
>   
>   			  str = (char *) realloc (*strptr, newsize);
>   			  if (str == NULL)
> @@ -929,7 +928,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>   		      && wstr == (wchar_t *) *strptr + strsize)
>   		    {
>   		      size_t newsize
> -			= strsize + (strsize > width ? width - 1 : strsize);
> +			= strsize + (strsize >= width ? width : strsize);
>   		      /* Enlarge the buffer.  */
>   		      wstr = (wchar_t *) realloc (*strptr,
>   						  newsize * sizeof (wchar_t));
> @@ -984,7 +983,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>   		    && wstr == (wchar_t *) *strptr + strsize)
>   		  {
>   		    size_t newsize
> -		      = strsize + (strsize > width ? width - 1 : strsize);
> +		      = strsize + (strsize >= width ? width : strsize);
>   		    /* Enlarge the buffer.  */
>   		    wstr = (wchar_t *) realloc (*strptr,
>   						newsize * sizeof (wchar_t));


-- 
Cheers,
Carlos.