[PATCH] Fix aliasing violation in __vfscanf_internal [BZ #26690]

[Szabolcs Nagy <szabolcs.nagy@arm.com>]

Internal stdio code uses both CHAR_T and UCHAR_T strings.
But the internal helper read_int was only written for UCHAR_T.

A CHAR_T object can alias UCHAR_T, but CHAR_T * cannot alias
UCHAR_T *.  This means a cast like (UCHAR_T **)&pc is likely
a bug in the code (currently GCC does not warn about this
see PR97321). The fix introduces a read_int_char variant and
removes the problematic casts.

(The mixed use of CHAR_T and UCHAR_T may be a design mistake
in stdio: if everything used char and wchar_t consistently
then aliasing violation would be much less likely, but fixing
that requires more refactoring.)

Fixes bug 26690.
---
 stdio-common/vfscanf-internal.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
index 95b46dcbeb..d832493623 100644
--- a/stdio-common/vfscanf-internal.c
+++ b/stdio-common/vfscanf-internal.c
@@ -135,6 +135,16 @@
 
 #include "printf-parse.h" /* Use read_int.  */
 
+/* Same as read_int, but for CHAR_T * instead of UCHAR_T * string.  */
+static int
+read_int_char (const CHAR_T * *pstr)
+{
+  const UCHAR_T *ustr = (const UCHAR_T *) *pstr;
+  int retval = read_int (&ustr);
+  *pstr = (const CHAR_T *) ustr;
+  return retval;
+}
+
 #define encode_error() do {						      \
 			  __set_errno (EILSEQ);				      \
 			  goto errout;					      \
@@ -486,7 +496,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
       /* Check for a positional parameter specification.  */
       if (ISDIGIT ((UCHAR_T) *f))
 	{
-	  argpos = read_int ((const UCHAR_T **) &f);
+	  argpos = read_int_char (&f);
 	  if (*f == L_('$'))
 	    ++f;
 	  else
@@ -522,7 +532,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
       /* Find the maximum field width.  */
       width = 0;
       if (ISDIGIT ((UCHAR_T) *f))
-	width = read_int ((const UCHAR_T **) &f);
+	width = read_int_char (&f);
     got_width:
       if (width == 0)
 	width = -1;
-- 
2.17.1