fix invalid %m format crash in wide scanf variants

[musl] / src / stdio / vfwscanf.c

diff --git a/src/stdio/vfwscanf.c b/src/stdio/vfwscanf.c
index b1eb793..75f04d7 100644 (file)
--- a/src/stdio/vfwscanf.c
+++ b/src/stdio/vfwscanf.c
@@ -109,6 +109,8 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
 
        for (p=fmt; *p; p++) {
 
+               alloc = 0;
+
                if (iswspace(*p)) {
                        while (iswspace(p[1])) p++;
                        while (iswspace((c=getwc(f)))) pos++;
@@ -141,6 +143,8 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
                }
 
                if (*p=='m') {
+                       wcs = 0;
+                       s = 0;
                        alloc = !!dest;
                        p++;
                } else {
@@ -281,8 +285,10 @@ int vfwscanf(FILE *restrict f, const wchar_t *restrict fmt, va_list ap)
                                if (size == SIZE_l) *(wchar_t **)dest = wcs;
                                else *(char **)dest = s;
                        }
-                       if (wcs) wcs[i] = 0;
-                       if (s) s[i] = 0;
+                       if (t != 'c') {
+                               if (wcs) wcs[i] = 0;
+                               if (s) s[i] = 0;
+                       }
                        break;
 
                case 'd': case 'i': case 'o': case 'u': case 'x':