vfscanf: Avoid multiple reads of multi-byte character width

This avoids a race condition if the process-global locale is changed
while vfscanf is running.  MB_LEN_MAX is always larger than MB_CUR_MAX,
so we might realloc earlier than necessary (but even MB_CUR_MAX could
be larger than the minimum required space).

The existing length was a bit questionable because str + MB_LEN_MAX
might point past the end of the buffer.

1 files changed, 6 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index ef10db070b..8559e0dfda 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
 2016-09-02  Florian Weimer  <fweimer@redhat.com>
 
+	* stdio-common/vfscanf.c (_IO_vfwscanf): Use MB_LEN_MAX instead of
+	MB_CUR_MAX to avoid race condition.  Avoid pointer arithmetic
+	outside of allocated array.
+
+2016-09-02  Florian Weimer  <fweimer@redhat.com>
+
 	* stdio-common/vfprintf.c (process_string_arg): Use MB_LEN_MAX
 	instead of MB_CUR_MAX to avoid variable-length array.