fix possible access to uninitialized memory in shgetc (via scanf)

shgetc sets up to be able to perform an "unget" operation without the
caller having to remember and pass back the character value, and for
this purpose used a conditional store idiom:

    if (f->rpos[-1] != c) f->rpos[-1] = c

to make it safe to use with non-writable buffers (setup by the
sh_fromstring macro or __string_read with sscanf).

however, validity of this depends on the buffer space at rpos[-1]
being initialized, which is not the case under some conditions
(including at least unbuffered files and fmemopen ones).

whenever data was read "through the buffer", the desired character
value is already in place and does not need to be written. thus,
rather than testing for the absence of the value, we can test for
rpos<=buf, indicating that the last character read could not have come
from the buffer, and thereby that we have a "real" buffer (possibly of
zero length) with writable pushback (UNGET bytes) below it.

diff --git a/src/internal/shgetc.c b/src/internal/shgetc.c
index a4a9c633dc976033622003c3cc7e5068466076bd..7455d2f00a04e477db9f4129fb4d5ba0809af1cb 100644 (file)
--- a/src/internal/shgetc.c
+++ b/src/internal/shgetc.c
@@ -32,6 +32,6 @@ int __shgetc(FILE *f)
        else
                f->shend = f->rend;
        f->shcnt = f->buf - f->rpos + cnt;
-       if (f->rpos[-1] != c) f->rpos[-1] = c;
+       if (f->rpos <= f->buf) f->rpos[-1] = c;
        return c;
 }