Update.

2000-09-21  Bruno Haible  <haible@clisp.cons.org>

	* stdio-common/vfscanf.c (__vfscanf, _IO_vfscanf): Fix bugs in
	reallocation logic for MALLOC (%as, %aS formats).

2 files changed, 57 insertions, 40 deletions

diff --git a/ChangeLog b/ChangeLog
index f49147a..0955752 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2000-09-21  Bruno Haible  <haible@clisp.cons.org>
+
+	* stdio-common/vfscanf.c (__vfscanf, _IO_vfscanf): Fix bugs in
+	reallocation logic for MALLOC (%as, %aS formats).
+
 2000-09-24  Ulrich Drepper  <drepper@redhat.com>
 
 	* stdio-common/vfprintf.c (process_arg): Handle %hhn.
diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
index 7b1b3f6..43d25ee 100644
--- a/stdio-common/vfscanf.c
+++ b/stdio-common/vfscanf.c
@@ -858,32 +858,36 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 		      {
 			/* We have to enlarge the buffer if the `a' flag
 			   was given.  */
-			str = (char *) realloc (*strptr, strsize * 2);
-			if (str == NULL)
+			size_t strleng = str - *strptr;
+			char *newstr;
+
+			newstr = (char *) realloc (*strptr, strsize * 2);
+			if (newstr == NULL)
 			  {
 			    /* Can't allocate that much.  Last-ditch
 			       effort.  */
-			    str = (char *) realloc (*strptr, strsize + 1);
-			    if (str == NULL)
+			    newstr = (char *) realloc (*strptr,
+						       strleng + MB_CUR_MAX);
+			    if (newstr == NULL)
 			      {
 				/* We lose.  Oh well.  Terminate the
 				   string and stop converting,
 				   so at least we don't skip any input.  */
-				((char *) (*strptr))[strsize - 1] = '\0';
+				((char *) (*strptr))[strleng] = '\0';
 				++done;
 				conv_error ();
 			      }
 			    else
 			      {
-				*strptr = (char *) str;
-				str += strsize;
-				++strsize;
+				*strptr = newstr;
+				str = newstr + strleng;
+				strsize = strleng + MB_CUR_MAX;
 			      }
 			  }
 			else
 			  {
-			    *strptr = (char *) str;
-			    str += strsize;
+			    *strptr = newstr;
+			    str = newstr + strleng;
 			    strsize *= 2;
 			  }
 		      }
@@ -950,28 +954,30 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 		      && str + n >= *strptr + strsize)
 		    {
 		      /* Enlarge the buffer.  */
-		      str = (char *) realloc (*strptr,
-					      (str + n + 1) - *strptr);
-		      if (str == NULL)
+		      size_t strleng = str - *strptr;
+		      char *newstr;
+
+		      newstr = (char *) realloc (*strptr, strleng + n + 1);
+		      if (newstr == NULL)
 			{
 			  /* We lose.  Oh well.  Terminate the string
 			     and stop converting, so at least we don't
 			     skip any input.  */
-			  ((char *) (*strptr))[strsize - 1] = '\0';
+			  ((char *) (*strptr))[strleng] = '\0';
 			  ++done;
 			  conv_error ();
 			}
 		      else
 			{
-			  *strptr = (char *) str;
-			  str = ((char *) *strptr) + strsize;
-			  strsize = (str + n + 1) - *strptr;
+			  *strptr = newstr;
+			  str = newstr + strleng;
+			  strsize = strleng + n + 1;
 			}
 		    }
 
 		  str = __mempcpy (str, buf, n);
 #endif
-		  *str = '\0';
+		  *str++ = '\0';
 
 		  if ((flags & MALLOC) && str - *strptr != strsize)
 		    {
@@ -1028,8 +1034,8 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 			    /* Can't allocate that much.  Last-ditch
                                effort.  */
 			    wstr = (wchar_t *) realloc (*strptr,
-							(strsize
-							 + sizeof (wchar_t)));
+							(strsize + 1)
+							* sizeof (wchar_t));
 			    if (wstr == NULL)
 			      {
 				/* We lose.  Oh well.  Terminate the string
@@ -2030,8 +2036,8 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 			      /* Can't allocate that much.  Last-ditch
 				 effort.  */
 			      wstr = (wchar_t *)
-				realloc (*strptr, (strsize
-						   + sizeof (wchar_t)));
+				realloc (*strptr, (strsize + 1)
+						  * sizeof (wchar_t));
 			      if (wstr == NULL)
 				{
 				  /* We lose.  Oh well.  Terminate the string
@@ -2227,32 +2233,36 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 			  && str + MB_CUR_MAX >= *strptr + strsize)
 			{
 			  /* Enlarge the buffer.  */
-			  str = (char *) realloc (*strptr, 2 * strsize);
-			  if (str == NULL)
+			  size_t strleng = str - *strptr;
+			  char *newstr;
+
+			  newstr = (char *) realloc (*strptr, 2 * strsize);
+			  if (newstr == NULL)
 			    {
 			      /* Can't allocate that much.  Last-ditch
 				 effort.  */
-			      str = (char *) realloc (*strptr, strsize + 1);
-			      if (str == NULL)
+			      newstr = (char *) realloc (*strptr,
+							 strleng + MB_CUR_MAX);
+			      if (newstr == NULL)
 				{
 				  /* We lose.  Oh well.  Terminate the string
 				     and stop converting, so at least we don't
 				     skip any input.  */
-				  (*strptr)[strsize - 1] = '\0';
+				  ((char *) (*strptr))[strleng] = '\0';
 				  ++done;
 				  conv_error ();
 				}
 			      else
 				{
-				  *strptr = str;
-				  str += strsize;
-				  ++strsize;
+				  *strptr = newstr;
+				  str = newstr + strleng;
+				  strsize = strleng + MB_CUR_MAX;
 				}
 			    }
 			  else
 			    {
-			      *strptr = str;
-			      str += strsize;
+			      *strptr = newstr;
+			      str = newstr + strleng;
 			      strsize *= 2;
 			    }
 			}
@@ -2336,28 +2346,30 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 		      && str + n >= *strptr + strsize)
 		    {
 		      /* Enlarge the buffer.  */
-		      str = (char *) realloc (*strptr,
-					      (str + n + 1) - *strptr);
-		      if (str == NULL)
+		      size_t strleng = str - *strptr;
+		      char *newstr;
+
+		      newstr = (char *) realloc (*strptr, strleng + n + 1);
+		      if (newstr == NULL)
 			{
 			  /* We lose.  Oh well.  Terminate the string
 			     and stop converting, so at least we don't
 			     skip any input.  */
-			  ((char *) (*strptr))[strsize - 1] = '\0';
+			  ((char *) (*strptr))[strleng] = '\0';
 			  ++done;
 			  conv_error ();
 			}
 		      else
 			{
-			  *strptr = (char *) str;
-			  str = ((char *) *strptr) + strsize;
-			  strsize = (str + n + 1) - *strptr;
+			  *strptr = newstr;
+			  str = newstr + strleng;
+			  strsize = strleng + n + 1;
 			}
 		    }
 
 		  str = __mempcpy (str, buf, n);
 #endif
-		  *str = '\0';
+		  *str++ = '\0';
 
 		  if ((flags & MALLOC) && str - *strptr != strsize)
 		    {