stdio-common: Fix a crash in scanf input specifier tests [BZ #32857]

Fix a null pointer dereference causing a crash in 'read_real' when the
terminating null character is written for use with the subsequent call
to 'nan' for NaN reference input using null 'n-char-sequence', such as:

%a:nan():1:5:nan():

by moving the memory allocation call ahead of the check for the closing
parenthesis.

No test case added as it's a test case issue in the first place.

Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>

diff --git a/stdio-common/tst-scanf-format-real.h b/stdio-common/tst-scanf-format-real.h
index fc7f39e7602d2a93fb085b6882faf8aa837556a1..9ed8dc00a19a7ed9f244b5171272fe44dad5b687 100644 (file)
--- a/stdio-common/tst-scanf-format-real.h
+++ b/stdio-common/tst-scanf-format-real.h
@@ -207,6 +207,11 @@ out:                                                                       \
        if (ch == '(')                                                  \
          while (1)                                                     \
            {                                                           \
+             if (i == seq_size)                                        \
+               {                                                       \
+                 seq_size += SIZE_CHUNK;                               \
+                 seq = xrealloc (seq, seq_size);                       \
+               }                                                       \
              ch = read_input ();                                       \
              if (ch == ')')                                            \
                break;                                                  \
@@ -219,11 +224,6 @@ out:                                                                       \
                  v = NAN;                                              \
                  goto out;                                             \
                }                                                       \
-             if (i == seq_size)                                        \
-               {                                                       \
-                 seq_size += SIZE_CHUNK;                               \
-                 seq = xrealloc (seq, seq_size);                       \
-               }                                                       \
              seq[i++] = ch;                                            \
            }                                                           \
        seq[i] = '\0';                                                  \