glibc fixes one-byte overflow in scanf %mc allocation

The GNU C Library has fixed a one-byte heap buffer overflow in its scanf family when the %mc or %mC conversion is used. The flaw is tracked as CVE-2026-5450 (Bugzilla 34008).

Those conversions allocate a buffer for the matched string and enlarge it as needed. On each enlargement the allocator reserved one byte too few, so the final write could step one byte past the allocated block under attacker-controlled input. The overflow is small but fully determined by the scanned data, which makes it relevant anywhere untrusted input reaches a scanf call that uses the m modifier.

Rocket Ma supplied the fix, which has been reviewed and is being backported to the 2.39 stable series. A regression test that exercises the reallocation path under malloc checking was added alongside the change.