Re: [PATCH 2.39] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

Hi,
I've sent backported patch series for 2.40 with the CVE fix as well as prerequisites. I will also send for 2.39 now.

Thanks!
________________________________
From: Adarsh Jagadish Kamini <[email protected]>
Sent: Thursday, July 23, 2026 14:04
To: Florian Weimer <[email protected]>
Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>
Subject: Re: [PATCH 2.39] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

Thanks for your review, Florian. I will send a fix for [BZ #12701] and BZ #34008 in a patch series as version 2. I will also send it for 2.40.
________________________________
From: Florian Weimer <[email protected]>
Sent: Thursday, July 23, 2026 13:43
To: Adarsh Jagadish Kamini <[email protected]>
Cc: [email protected] <[email protected]>; [email protected] <[email protected]>; [email protected] <[email protected]>
Subject: Re: [PATCH 2.39] stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]

* Adarsh Jagadish Kamini:

> From: Rocket Ma <[email protected]>
>
> * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
> format %mc or %mC, glibc allocates one byte less, leading to
> user-controlled one byte overflow. This commit fixes BZ #34008, or
> CVE-2026-5450.

We should fix 2.40 first, I think it's still missing the backport.
You'll also need to include the special fixes from the newer release
branches, around DJ's “stdio-common: Allow partially-filled %mc buffers
[BZ #12701]”.

Thanks,
Florian