DragonFlyBSD Kernel Audit
DF-2882 / fix.diff
← back to finding ↓ download raw
--- a/sys/kern/subr_scanf.c
+++ b/sys/kern/subr_scanf.c
@@ -250,6 +250,8 @@
 			else
 				*__va_arg(ap, int *) = nread;
 			continue;
+		default:
+			goto match_failure;
 		}
 
 		/*
@@ -293,6 +295,7 @@
 						sum += n;
 						width -= n;
 						inp += n;
+						inr = 0;	/* all input consumed */
 						if (sum == 0)
 							goto input_failure;
 						break;
@@ -484,9 +487,8 @@
 				 * c is legal: store it and look at the next.
 				 */
 				*p++ = c;
-				if (--inr > 0)
-					inp++;
-				else 
+				inp++;
+				if (--inr <= 0)
 					break;		/* end of input */
 			}
 			/*