[PATCH 2.39] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

[Florian Weimer]

* Adarsh Jagadish Kamini:

> From: Rocket Ma <marocketbd@gmail.com>
>
> * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
> format %mc or %mC, glibc allocates one byte less, leading to
> user-controlled one byte overflow. This commit fixes BZ #34008, or
> CVE-2026-5450.

We should fix 2.40 first, I think it's still missing the backport.
You'll also need to include the special fixes from the newer release
branches, around DJ's “stdio-common: Allow partially-filled %mc buffers
[BZ #12701]”.

Thanks,
Florian