From 4c6b2202cbb6f2e22f4cc48298f64bc5a356f3f9 Mon Sep 17 00:00:00 2001 From: Ulrich Drepper Date: Sun, 28 Oct 2007 08:58:24 +0000 Subject: [BZ #5225] * stdio-common/vfscanf.c (_IO_vfwscanf): Don't misuse wp pointer to keep track of end of %[ format string element. --- stdio-common/vfscanf.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) (limited to 'stdio-common') diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c index e4728d00c9..f550109a90 100644 --- a/stdio-common/vfscanf.c +++ b/stdio-common/vfscanf.c @@ -272,7 +272,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr, { \ CHAR_T *old = wp; \ wpmax = (UCHAR_MAX + 1 > 2 * wpmax ? UCHAR_MAX + 1 : 2 * wpmax); \ - wp = (CHAR_T *) alloca (wpmax * sizeof (wchar_t)); \ + wp = (CHAR_T *) alloca (wpmax * sizeof (CHAR_T)); \ if (old != NULL) \ MEMCPY (wp, old, wpsize); \ } \ @@ -2314,7 +2314,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr, if (__builtin_expect (fc == L'\0', 0)) conv_error (); - wp = (wchar_t *) f - 1; + wchar_t *twend = (wchar_t *) f - 1; #else /* Fill WP with byte flags indexed by character. We will use this flag map for matching input characters. */ @@ -2365,9 +2365,10 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr, /* Test whether it's in the scanlist. */ runp = tw; - while (runp < wp) + while (runp < twend) { - if (runp[0] == L'-' && runp[1] != '\0' && runp + 1 != wp + if (runp[0] == L'-' && runp[1] != '\0' + && runp + 1 != twend && runp != tw && (unsigned int) runp[-1] <= (unsigned int) runp[1]) { @@ -2405,7 +2406,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr, } } - if (runp == wp && !not_in) + if (runp == twend && !not_in) { ungetc (c, s); goto out; @@ -2590,9 +2591,10 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr, /* Test whether it's in the scanlist. */ runp = tw; - while (runp < wp) + while (runp < twend) { - if (runp[0] == L'-' && runp[1] != '\0' && runp + 1 != wp + if (runp[0] == L'-' && runp[1] != '\0' + && runp + 1 != twend && runp != tw && (unsigned int) runp[-1] <= (unsigned int) runp[1]) { @@ -2630,7 +2632,7 @@ _IO_vfscanf_internal (_IO_FILE *s, const char *format, _IO_va_list argptr, } } - if (runp == wp && !not_in) + if (runp == twend && !not_in) { ungetc (c, s); goto out2; -- cgit 1.4.1