#buffer-overflow

glibc fixes one-byte overflow in scanf %mc allocation

Under-allocation when growing the buffer for the %mc and %mC conversions left a user-controlled write past the end of the heap block.