fix unsynchronized access to FILE structure in fflush(0)

[musl] / src / stdio / vfwscanf.c

diff --git a/src/stdio/vfwscanf.c b/src/stdio/vfwscanf.c
index 45de337..1ebc5ce 100644 (file)
--- a/src/stdio/vfwscanf.c
+++ b/src/stdio/vfwscanf.c
@@ -6,9 +6,6 @@
 #include <wctype.h>
 #include <limits.h>
 #include <string.h>
-#include <errno.h>
-#include <math.h>
-#include <float.h>
 
 #include "stdio_impl.h"
 #include "shgetc.h"
@@ -103,11 +100,16 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
        static const char size_pfx[][3] = { "hh", "h", "", "l", "L", "ll" };
        char tmp[3*sizeof(int)+10];
        const wchar_t *set;
+       size_t i, k;
 
        FLOCK(f);
 
+       fwide(f, 1);
+
        for (p=fmt; *p; p++) {
 
+               alloc = 0;
+
                if (iswspace(*p)) {
                        while (iswspace(p[1])) p++;
                        while (iswspace((c=getwc(f)))) pos++;
@@ -140,7 +142,9 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
                }
 
                if (*p=='m') {
-                       alloc = 1;
+                       wcs = 0;
+                       s = 0;
+                       alloc = !!dest;
                        p++;
                } else {
                        alloc = 0;
@@ -210,11 +214,12 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
                                set = L"";
                        } else if (t == 's') {
                                invert = 1;
-                               set = (const wchar_t[]){
+                               static const wchar_t spaces[] = {
                                        ' ', '\t', '\n', '\r', 11, 12,  0x0085,
                                        0x2000, 0x2001, 0x2002, 0x2003, 0x2004, 0x2005,
                                        0x2006, 0x2008, 0x2009, 0x200a,
                                        0x2028, 0x2029, 0x205f, 0x3000, 0 };
+                               set = spaces;
                        } else {
                                if (*++p == '^') p++, invert = 1;
                                else invert = 0;
@@ -233,16 +238,39 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
 
                        if (width < 1) width = -1;
 
+                       i = 0;
+                       if (alloc) {
+                               k = t=='c' ? width+1U : 31;
+                               if (size == SIZE_l) {
+                                       wcs = malloc(k*sizeof(wchar_t));
+                                       if (!wcs) goto alloc_fail;
+                               } else {
+                                       s = malloc(k);
+                                       if (!s) goto alloc_fail;
+                               }
+                       }
                        while (width) {
                                if ((c=getwc(f))<0) break;
                                if (in_set(set, c) == invert)
                                        break;
                                if (wcs) {
-                                       *wcs++ = c;
+                                       wcs[i++] = c;
+                                       if (alloc && i==k) {
+                                               k += k+1;
+                                               wchar_t *tmp = realloc(wcs, k*sizeof(wchar_t));
+                                               if (!tmp) goto alloc_fail;
+                                               wcs = tmp;
+                                       }
                                } else if (size != SIZE_l) {
-                                       int l = wctomb(s?s:tmp, c);
+                                       int l = wctomb(s?s+i:tmp, c);
                                        if (l<0) goto input_fail;
-                                       if (s) s+=l;
+                                       i += l;
+                                       if (alloc && i > k-4) {
+                                               k += k+1;
+                                               char *tmp = realloc(s, k);
+                                               if (!tmp) goto alloc_fail;
+                                               s = tmp;
+                                       }
                                }
                                pos++;
                                width-=(width>0);
@@ -253,8 +281,14 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
                                if (t == 'c' || !gotmatch) goto match_fail;
                        }
 
-                       if (wcs) *wcs++ = 0;
-                       if (s) *s++ = 0;
+                       if (alloc) {
+                               if (size == SIZE_l) *(wchar_t **)dest = wcs;
+                               else *(char **)dest = s;
+                       }
+                       if (t != 'c') {
+                               if (wcs) wcs[i] = 0;
+                               if (s) s[i] = 0;
+                       }
                        break;
 
                case 'd': case 'i': case 'o': case 'u': case 'x':
@@ -279,10 +313,15 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
        }
        if (0) {
 fmt_fail:
+alloc_fail:
 input_fail:
                if (!matches) matches--;
-       }
 match_fail:
+               if (alloc) {
+                       free(s);
+                       free(wcs);
+               }
+       }
        FUNLOCK(f);
        return matches;
 }