[PATCH] Improper handling of %c in vsscanf

From: <gb@phonema.ea.univpm.it>

The "%c" in sscanf actually reads and writes one extra character (i.e.  2
characters insted of just one), and may thus easily overflow caller's
buffer.

Also affects 2.4 tree, even if there "%c" seems not to be used at all.

lib/vsprintf.c

@@ -618,7 +618,7 @@ int vsscanf(const char * buf, const char * fmt, va_list args)
 				field_width = 1;
 			do {
 				*s++ = *str++;
-			} while(field_width-- > 0 && *str);
+			} while (--field_width > 0 && *str);
 			num++;
 		}
 		continue;