fix crash/out-of-bound read in sscanf

[musl] / src / internal / shgetc.h

diff --git a/src/internal/shgetc.h b/src/internal/shgetc.h
index 1c30f75..9435381 100644 (file)
--- a/src/internal/shgetc.h
+++ b/src/internal/shgetc.h
@@ -26,7 +26,7 @@ hidden int __shgetc(FILE *);
 #define shcnt(f) ((f)->shcnt + ((f)->rpos - (f)->buf))
 #define shlim(f, lim) __shlim((f), (lim))
 #define shgetc(f) (((f)->rpos != (f)->shend) ? *(f)->rpos++ : __shgetc(f))
-#define shunget(f) ((f)->shend ? (void)(f)->rpos-- : (void)0)
+#define shunget(f) ((f)->shlim>=0 ? (void)(f)->rpos-- : (void)0)
 
 #define sh_fromstring(f, s) \
        ((f)->buf = (f)->rpos = (void *)(s), (f)->rend = (void*)-1)