about summary refs log tree commit diff
path: root/stdio-common
diff options
context:
space:
mode:
authorUlrich Drepper <drepper@redhat.com>2007-10-28 08:58:24 +0000
committerUlrich Drepper <drepper@redhat.com>2007-10-28 08:58:24 +0000
commit4c6b2202cbb6f2e22f4cc48298f64bc5a356f3f9 (patch)
tree677bcdbffc37f0f5c65e33526b76eca619dd072c /stdio-common
parent88197030d5805d95d3e71d0aab71f44c6895b3b2 (diff)
downloadglibc-4c6b2202cbb6f2e22f4cc48298f64bc5a356f3f9.tar.gz
glibc-4c6b2202cbb6f2e22f4cc48298f64bc5a356f3f9.tar.xz
glibc-4c6b2202cbb6f2e22f4cc48298f64bc5a356f3f9.zip
[BZ #5225]
	* stdio-common/vfscanf.c (_IO_vfwscanf): Don't misuse wp pointer
	to keep track of end of %[ format string element.
Diffstat (limited to 'stdio-common')
-rw-r--r--stdio-common/vfscanf.c18
1 files changed, 10 insertions, 8 deletions
diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
index e4728d00c9..f550109a90 100644
--- a/stdio-common/vfscanf.c
+++ b/stdio-common/vfscanf.c
@@ -272,7 +272,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 	{								    \
 	  CHAR_T *old = wp;						    \
 	  wpmax = (UCHAR_MAX + 1 > 2 * wpmax ? UCHAR_MAX + 1 : 2 * wpmax);  \
-	  wp = (CHAR_T *) alloca (wpmax * sizeof (wchar_t));		    \
+	  wp = (CHAR_T *) alloca (wpmax * sizeof (CHAR_T));		    \
 	  if (old != NULL)						    \
 	    MEMCPY (wp, old, wpsize);					    \
 	}								    \
@@ -2314,7 +2314,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 
 	  if (__builtin_expect (fc == L'\0', 0))
 	    conv_error ();
-	  wp = (wchar_t *) f - 1;
+	  wchar_t *twend = (wchar_t *) f - 1;
 #else
 	  /* Fill WP with byte flags indexed by character.
 	     We will use this flag map for matching input characters.  */
@@ -2365,9 +2365,10 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 
 		  /* Test whether it's in the scanlist.  */
 		  runp = tw;
-		  while (runp < wp)
+		  while (runp < twend)
 		    {
-		      if (runp[0] == L'-' && runp[1] != '\0' && runp + 1 != wp
+		      if (runp[0] == L'-' && runp[1] != '\0'
+			  && runp + 1 != twend
 			  && runp != tw
 			  && (unsigned int) runp[-1] <= (unsigned int) runp[1])
 			{
@@ -2405,7 +2406,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 			}
 		    }
 
-		  if (runp == wp && !not_in)
+		  if (runp == twend && !not_in)
 		    {
 		      ungetc (c, s);
 		      goto out;
@@ -2590,9 +2591,10 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 
 		  /* Test whether it's in the scanlist.  */
 		  runp = tw;
-		  while (runp < wp)
+		  while (runp < twend)
 		    {
-		      if (runp[0] == L'-' && runp[1] != '\0' && runp + 1 != wp
+		      if (runp[0] == L'-' && runp[1] != '\0'
+			  && runp + 1 != twend
 			  && runp != tw
 			  && (unsigned int) runp[-1] <= (unsigned int) runp[1])
 			{
@@ -2630,7 +2632,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr,
 			}
 		    }
 
-		  if (runp == wp && !not_in)
+		  if (runp == twend && !not_in)
 		    {
 		      ungetc (c, s);
 		      goto out2;