prevent CNAME/PTR parsing from reading data past the response end

[musl] / src / stdio / vfscanf.c

diff --git a/src/stdio/vfscanf.c b/src/stdio/vfscanf.c
index 6bea6ad..b78a374 100644 (file)
--- a/src/stdio/vfscanf.c
+++ b/src/stdio/vfscanf.c
@@ -5,10 +5,7 @@
 #include <wctype.h>
 #include <limits.h>
 #include <string.h>
-#include <errno.h>
-#include <math.h>
-#include <float.h>
-#include <inttypes.h>
+#include <stdint.h>
 
 #include "stdio_impl.h"
 #include "shgetc.h"
@@ -60,7 +57,7 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
 {
        int width;
        int size;
-       int alloc;
+       int alloc = 0;
        int base;
        const unsigned char *p;
        int c, t;
@@ -79,8 +76,13 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
 
        FLOCK(f);
 
+       if (!f->rpos) __toread(f);
+       if (!f->rpos) goto input_fail;
+
        for (p=(const unsigned char *)fmt; *p; p++) {
 
+               alloc = 0;
+
                if (isspace(*p)) {
                        while (isspace(p[1])) p++;
                        shlim(f, 0);
@@ -90,15 +92,19 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
                        continue;
                }
                if (*p != '%' || p[1] == '%') {
-                       p += *p=='%';
                        shlim(f, 0);
-                       c = shgetc(f);
+                       if (*p == '%') {
+                               p++;
+                               while (isspace((c=shgetc(f))));
+                       } else {
+                               c = shgetc(f);
+                       }
                        if (c!=*p) {
                                shunget(f);
                                if (c<0) goto input_fail;
                                goto match_fail;
                        }
-                       pos++;
+                       pos += shcnt(f);
                        continue;
                }
 
@@ -116,6 +122,8 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
                }
 
                if (*p=='m') {
+                       wcs = 0;
+                       s = 0;
                        alloc = !!dest;
                        p++;
                } else {
@@ -265,8 +273,10 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
                                if (size == SIZE_l) *(wchar_t **)dest = wcs;
                                else *(char **)dest = s;
                        }
-                       if (wcs) wcs[i] = 0;
-                       if (s) s[i] = 0;
+                       if (t != 'c') {
+                               if (wcs) wcs[i] = 0;
+                               if (s) s[i] = 0;
+                       }
                        break;
                case 'p':
                case 'X':
@@ -325,3 +335,5 @@ match_fail:
        FUNLOCK(f);
        return matches;
 }
+
+weak_alias(vfscanf,__isoc99_vfscanf);