[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20260805140954.840221-1-matthias.goergens@gmail.com>
Date: Wed, 5 Aug 2026 22:09:54 +0800
From: Matthias Goergens <matthias.goergens@...il.com>
To: musl@...ts.openwall.com
Cc: Matthias Goergens <matthias.goergens@...il.com>
Subject: [PATCH] stdio: reserve multibyte space in allocated vfwscanf %c conversions
Allocated narrow %c conversions initially reserve only width+1 bytes.
For the default width this is two bytes, but in a UTF-8 locale wctomb
can write up to MB_LEN_MAX bytes into the buffer before the
post-conversion growth check, overflowing the two-byte allocation for
a three- or four-byte input character.
Ensure every allocated narrow buffer starts at no less than
MB_LEN_MAX bytes. The existing geometric growth then keeps at least
MB_LEN_MAX spare bytes available after each conversion.
---
src/stdio/vfwscanf.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/stdio/vfwscanf.c b/src/stdio/vfwscanf.c
index 82f48604..7c7c82f1 100644
--- a/src/stdio/vfwscanf.c
+++ b/src/stdio/vfwscanf.c
@@ -248,6 +248,7 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
wcs = malloc(k*sizeof(wchar_t));
if (!wcs) goto alloc_fail;
} else {
+ if (k < MB_LEN_MAX) k = MB_LEN_MAX;
s = malloc(k);
if (!s) goto alloc_fail;
}
--
2.55.0
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
