[Bug c/72783] Fortify scanf %s, %[ conversion specifiers

["fw at gcc dot gnu.org" <gcc-bugzilla at gcc dot gnu dot org>]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72783

--- Comment #1 from Florian Weimer <fw at gcc dot gnu.org> ---
Martin and I discussed this for a bit.

The %ms hack does not work due to embedded NULs, which are copied to the
destination buffer by scanf, do not terminate the string, and are (in most
cases) detectable by the application.

The new M flag raises POSIX compatibility concerns.

The easiest way seems to warn if the output length cannot be bounded (say, with
sscanf and an input string of limited length) and there are no length
specifiers, and not attempt any format string rewriting or process termination
operation.  If there is a separate warning flag which controls this, maybe we
can compile Fedora with -Werror=scanf-length.