scan: validate -ve XPG3 specifier

Reported-by: Ryan Whitworth <me@ryanwhitworth.com>
Signed-off-by: Steve Bennett <steveb@workware.net.au>

1 files changed, 5 insertions, 0 deletions

diff --git a/jim.c b/jim.c
index f4e1d54..f070526 100644
--- a/jim.c
+++ b/jim.c
@@ -9516,6 +9516,11 @@ static int SetScanFmtFromAny(Jim_Interp *interp, Jim_Obj *objPtr)
                         return JIM_ERR;
                     }
                 }
+                if (descr->pos < 0) {
+                    fmtObj->error =
+                        "\"%n$\" conversion specifier is negative";
+                    return JIM_ERR;
+                }
                 /* Try to find a width after the XPG3 specifier */
                 if (sscanf(fmt, "%d%n", &width, &skip) == 1) {
                     descr->width = width;