Update.

* stdio-common/vfscanf.c: Fix reading of wide chars and strings if
	not COMPILE_WSCANF.

ChangeLog

@@ -1,5 +1,8 @@
 2001-08-09  Ulrich Drepper  <drepper@redhat.com>
 
+	* stdio-common/vfscanf.c: Fix reading of wide chars and strings if
+	not COMPILE_WSCANF.
+
 	* libio/vswprintf.c (_IO_vswprintf): Fix return value handling
 	which is different from snprintf.
 	* libio/tst_swprintf.c: Add tests for too small output buffer.

manual/stdio.texi

@@ -2295,11 +2295,11 @@ argument specifies the maximum number of characters to produce.  The
 trailing null character is counted towards this limit, so you should
 allocate at least @var{size} wide characters for the string @var{ws}.
 
-The return value is the number of characters which would be generated
+The return value is the number of characters generated for the given
-for the given input, excluding the trailing null.  If this value is
+input, excluding the trailing null.  If not all output fits into the
-greater or equal to @var{size}, not all characters from the result have
+provided buffer a negative value is returned.  You should try again with
-been stored in @var{ws}.  You should try again with a bigger output
+a bigger output string.  @emph{Note:} this is different from how
-string.
+@code{snprintf} handles this situation.
 
 Note that the corresponding narrow stream function takes fewer
 parameters.  @code{swprintf} in fact corresponds to the @code{snprintf}

stdio-common/vfscanf.c

@@ -755,40 +755,35 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 	  {
 	    /* We have to convert the multibyte input sequence to wide
 	       characters.  */
-	    char buf[MB_LEN_MAX];
+	    char buf[0];
 	    mbstate_t cstate;
 
 	    memset (&cstate, '\0', sizeof (cstate));
 
 	    do
 	      {
-		size_t cnt;
-
 		/* This is what we present the mbrtowc function first.  */
 		buf[0] = c;
-		cnt = 1;
 
 		while (1)
 		  {
 		    size_t n;
 
 		    n = __mbrtowc (!(flags & SUPPRESS) ? wstr : NULL,
-				   buf, cnt, &cstate);
+				   buf, 1, &cstate);
 
 		    if (n == (size_t) -2)
 		      {
 			/* Possibly correct character, just not enough
 			   input.  */
-			assert (cnt < MB_CUR_MAX);
-
 			if (inchar () == EOF)
 			  encode_error ();
 
-			buf[cnt++] = c;
+			buf[0] = c;
 			continue;
 		      }
 
-		    if (n != cnt)
+		    if (n != 1)
 		      encode_error ();
 
 		    /* We have a match.  */
@@ -1063,36 +1058,33 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 		  }
 #else
 		{
-		  char buf[MB_LEN_MAX];
+		  char buf[0];
-		  size_t cnt;
 
 		  buf[0] = c;
-		  cnt = 1;
 
 		  while (1)
 		    {
 		      size_t n;
 
 		      n = __mbrtowc (!(flags & SUPPRESS) ? wstr : NULL,
-				     buf, cnt, &cstate);
+				     buf, 1, &cstate);
 
 		      if (n == (size_t) -2)
 			{
 			  /* Possibly correct character, just not enough
 			     input.  */
-			  assert (cnt < MB_CUR_MAX);
-
 			  if (inchar () == EOF)
 			    encode_error ();
 
-			  buf[cnt++] = c;
+			  buf[0] = c;
 			  continue;
 			}
 
-		      if (n != cnt)
+		      if (n != 1)
 			encode_error ();
 
 		      /* We have a match.  */
+		      ++wstr;
 		      break;
 		    }