Bugfix: tzset_r reads beyond string

[Jeff Johnston]

Thanks Till.  Patch checked in.

-- Jeff J.

Till Straumann wrote:
> Hi.
> 
> I found that under some circumstances,
> tzset reads beyond the value of getenv("TZ").
> 
> The attached patch fixes this.
> 
> Regards
> -- Till
> 
> 
> ------------------------------------------------------------------------
> 
> *** newlib-1.14.0/newlib/libc/time/tzset_r.c.orig	2006-11-14 12:09:28.000000000 -0800
> --- newlib-1.14.0/newlib/libc/time/tzset_r.c	2006-11-14 12:10:24.000000000 -0800
> ***************
> *** 104,109 ****
> --- 104,110 ----
>     mm = 0;
>     ss = 0;
>     
> +   n  = 0;
>     if (sscanf (tzenv, "%hu%n:%hu%n:%hu%n", &hh, &n, &mm, &n, &ss, &n) <= 0)
>       tz->__tzrule[1].offset = tz->__tzrule[0].offset - 3600;
>     else