[PATCH] Improper handling of %c in vsscanf

From: <gb@phonema.ea.univpm.it>

The "%c" in sscanf actually reads and writes one extra character (i.e.  2
characters insted of just one), and may thus easily overflow caller's
buffer.

Also affects 2.4 tree, even if there "%c" seems not to be used at all.

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index fdc2f19e241c..b30a4a2541c0 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -618,7 +618,7 @@ int vsscanf(const char * buf, const char * fmt, va_list args)
 				field_width = 1;
 			do {
 				*s++ = *str++;
-			} while(field_width-- > 0 && *str);
+			} while (--field_width > 0 && *str);
 			num++;
 		}
 		continue;