Fix off-by-one error when pushing back a multibyte sequence in

wide character class (%l[) and wide string (%ls) conversions.

1 files changed, 6 insertions, 2 deletions

diff --git a/lib/libc/stdio/vfscanf.c b/lib/libc/stdio/vfscanf.c
index 6aebd60..d9d3e1c 100644
--- a/lib/libc/stdio/vfscanf.c
+++ b/lib/libc/stdio/vfscanf.c
@@ -464,9 +464,11 @@ literal:
 					if (nconv != (size_t)-2) {
 						if (wctob(*wcp) != EOF &&
 						    !ccltab[wctob(*wcp)]) {
-							while (--n > 0)
+							while (n != 0) {
+								n--;
 								__ungetc(buf[n],
 								    fp);
+							}
 							break;
 						}
 						nread += n;
@@ -562,9 +564,11 @@ literal:
 						*wcp = L'\0';
 					if (nconv != (size_t)-2) {
 						if (iswspace(*wcp)) {
-							while (--n > 0)
+							while (n != 0) {
+								n--;
 								__ungetc(buf[n],
 								    fp);
+							}
 							break;
 						}
 						nread += n;