From: Rich Felker <dalias@aerifal.cx>
Date: Wed, 11 Apr 2012 04:18:57 +0000 (-0400)
Subject: fix bug parsing lone zero followed by junk, and hex float over-reading
X-Git-Url: http://nsz.repo.hu/git/?p=musl;a=commitdiff_plain;h=48bb81adf80a439133c376d50ea814687fb5169f;hp=38b3f1fea8fe4f2c590c1a9438d219291a7bfcd2

fix bug parsing lone zero followed by junk, and hex float over-reading
---

diff --git a/src/internal/floatscan.c b/src/internal/floatscan.c
index 000706d7..3aa54082 100644
--- a/src/internal/floatscan.c
+++ b/src/internal/floatscan.c
@@ -52,7 +52,7 @@ static long long scanexp(FILE *f, int pok)
 }
 
 
-static long double decfloat(FILE *f, int bits, int emin, int sign, int pok)
+static long double decfloat(FILE *f, int c, int bits, int emin, int sign, int pok)
 {
 	uint32_t x[KMAX];
 	static const uint32_t th[] = { LD_B1B_MAX };
@@ -65,13 +65,10 @@ static long double decfloat(FILE *f, int bits, int emin, int sign, int pok)
 	long double y;
 	long double frac=0;
 	long double bias=0;
-	int c;
 
 	j=0;
 	k=0;
 
-	c = shgetc(f);
-
 	/* Don't let leading zeros consume buffer space */
 	for (; c=='0'; c = shgetc(f)) gotdig=1;
 
@@ -338,6 +335,8 @@ static long double hexfloat(FILE *f, int bits, int emin, int sign, int pok)
 			}
 			e2 = 0;
 		}
+	} else {
+		shunget(f);
 	}
 	e2 += 4*rp - 32;
 
@@ -436,9 +435,9 @@ long double __floatscan(FILE *f, int c, int prec, int pok)
 		c = shgetc(f);
 		if ((c|32) == 'x')
 			return hexfloat(f, bits, emin, sign, pok);
+		shunget(f);
 		c = '0';
 	}
 
-	shunget(f);
-	return decfloat(f, bits, emin, sign, pok);
+	return decfloat(f, c, bits, emin, sign, pok);
 }