From: Rich Felker <dalias@aerifal.cx>
Date: Tue, 17 Apr 2012 18:22:22 +0000 (-0400)
Subject: fix some bugs in scanf %[ handling detected while writing the wide version
X-Git-Url: http://nsz.repo.hu/git/?p=musl;a=commitdiff_plain;h=e0d9f780d171326a12bf9daf2af1e2f0c51c89f6

fix some bugs in scanf %[ handling detected while writing the wide version
---

diff --git a/src/stdio/vfscanf.c b/src/stdio/vfscanf.c
index 926d8a9d..8be0d91c 100644
--- a/src/stdio/vfscanf.c
+++ b/src/stdio/vfscanf.c
@@ -227,14 +227,14 @@ int vfscanf(FILE *f, const char *fmt, va_list ap)
 
 			scanset[0] = 0;
 			if (*p == '-') p++, scanset[1+'-'] = 1-invert;
-			if (*p == ']') p++, scanset[1+']'] = 1-invert;
-			for (; *p && *p != ']'; p++) {
-				if (*p=='-' && p[1] != ']')
+			else if (*p == ']') p++, scanset[1+']'] = 1-invert;
+			for (; *p != ']'; p++) {
+				if (!*p) goto fmt_fail;
+				if (*p=='-' && p[1] && p[1] != ']')
 					for (c=p++[-1]; c<*p; c++)
 						scanset[1+c] = 1-invert;
 				scanset[1+*p] = 1-invert;
 			}
-			if (!*p) goto fmt_fail;
 
 			if (size == SIZE_l) {
 				st = (mbstate_t){0};