avoid null pointer dereference on %*p fields in scanf

diff --git a/src/stdio/vfscanf.c b/src/stdio/vfscanf.c
index 5c1e49b1536df9e366dbf6352be6ffff04ab5e67..926d8a9d13d4c3aa455aa8bb6c4610ac742dde7e 100644 (file)
--- a/src/stdio/vfscanf.c
+++ b/src/stdio/vfscanf.c
@@ -284,7 +284,7 @@ int vfscanf(FILE *f, const char *fmt, va_list ap)
                int_common:
                        x = __intscan(f, base, 0, ULLONG_MAX);
                        if (!shcnt(f)) goto match_fail;
-                       if (t=='p') *(void **)dest = (void *)(uintptr_t)x;
+                       if (t=='p' && dest) *(void **)dest = (void *)(uintptr_t)x;
                        else store_int(dest, size, x);
                        break;
                case 'a': case 'A':