[PATCH] stdio-common: Fix heap overflow in scanf %mc pattern

[Adhemerval Zanella Netto]

On 19/03/26 14:43, Rocket Ma wrote:
> * stdio-common/vfscanf-internal.c: when `WIDTH` in `%WIDTHmc` or
> `%WIDTHmC` greater than 1024, user could read one more byte into heap,
> leading into off-by-one overflow.
> 
> This patch fixes Bug 34008[1].
> 
> [1]: https://sourceware.org/bugzilla/show_bug.cgi?id=34008
> 
> Signed-off-by: Rocket Ma <marocketbd@gmail.com>

Hi, thanks for working on this. Could you add a regression tests similar
to the one on the bug report?

> ---
>  stdio-common/vfscanf-internal.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
> index 59fc8208aa..b33ee0652c 100644
> --- a/stdio-common/vfscanf-internal.c
> +++ b/stdio-common/vfscanf-internal.c
> @@ -856,7 +856,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>  			  /* Enlarge the buffer.  */
>  			  size_t newsize
>  			    = strsize
> -			      + (strsize >= width ? width - 1 : strsize);
> +			      + (strsize >= width ? width : strsize);
>  
>  			  str = (char *) realloc (*strptr, newsize);
>  			  if (str == NULL)
> @@ -929,7 +929,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>  		      && wstr == (wchar_t *) *strptr + strsize)
>  		    {
>  		      size_t newsize
> -			= strsize + (strsize > width ? width - 1 : strsize);
> +			= strsize + (strsize > width ? width : strsize);
>  		      /* Enlarge the buffer.  */
>  		      wstr = (wchar_t *) realloc (*strptr,
>  						  newsize * sizeof (wchar_t));
> @@ -984,7 +984,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
>  		    && wstr == (wchar_t *) *strptr + strsize)
>  		  {
>  		    size_t newsize
> -		      = strsize + (strsize > width ? width - 1 : strsize);
> +		      = strsize + (strsize > width ? width : strsize);
>  		    /* Enlarge the buffer.  */
>  		    wstr = (wchar_t *) realloc (*strptr,
>  						newsize * sizeof (wchar_t));