[PATCH] stdio-common: Fix heap overflow in scanf %mc pattern

[Rocket Ma]

* stdio-common/vfscanf-internal.c: when `WIDTH` in `%WIDTHmc` or
`%WIDTHmC` greater than 1024, user could read one more byte into heap,
leading into off-by-one overflow.

This patch fixes Bug 34008[1].

[1]: https://sourceware.org/bugzilla/show_bug.cgi?id=34008

Signed-off-by: Rocket Ma <marocketbd@gmail.com>
---
 stdio-common/vfscanf-internal.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
index 59fc8208aa..b33ee0652c 100644
--- a/stdio-common/vfscanf-internal.c
+++ b/stdio-common/vfscanf-internal.c
@@ -856,7 +856,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
 			  /* Enlarge the buffer.  */
 			  size_t newsize
 			    = strsize
-			      + (strsize >= width ? width - 1 : strsize);
+			      + (strsize >= width ? width : strsize);
 
 			  str = (char *) realloc (*strptr, newsize);
 			  if (str == NULL)
@@ -929,7 +929,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
 		      && wstr == (wchar_t *) *strptr + strsize)
 		    {
 		      size_t newsize
-			= strsize + (strsize > width ? width - 1 : strsize);
+			= strsize + (strsize > width ? width : strsize);
 		      /* Enlarge the buffer.  */
 		      wstr = (wchar_t *) realloc (*strptr,
 						  newsize * sizeof (wchar_t));
@@ -984,7 +984,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
 		    && wstr == (wchar_t *) *strptr + strsize)
 		  {
 		    size_t newsize
-		      = strsize + (strsize > width ? width - 1 : strsize);
+		      = strsize + (strsize > width ? width : strsize);
 		    /* Enlarge the buffer.  */
 		    wstr = (wchar_t *) realloc (*strptr,
 						newsize * sizeof (wchar_t));
-- 
2.53.0