[PATCH v3 1/2] msvcrt: Fix scanf with dashes in scanset.

[Will Mainio]

Signed-off-by: Will Mainio <will.mainio at fastmail.com>
---
 dlls/msvcrt/scanf.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/dlls/msvcrt/scanf.h b/dlls/msvcrt/scanf.h
index 3b4686c1107..44cb0faa87e 100644
--- a/dlls/msvcrt/scanf.h
+++ b/dlls/msvcrt/scanf.h
@@ -615,6 +615,7 @@ _FUNCTION_ {
                     _CHAR_ *sptr = str;
 		    RTL_BITMAP bitMask;
                     ULONG *Mask;
+		    VOID *scansetLastRangeEnd;
 		    int invert = 0; /* Set if we are NOT to find the chars */
 #ifdef SECURE
                     unsigned size = suppress ? UINT_MAX : va_arg(ap, unsigned);
@@ -636,15 +637,17 @@ _FUNCTION_ {
 			RtlSetBits(&bitMask, ']', 1);
 			format++;
 		    }
+		    scansetLastRangeEnd = (VOID *)(format - 1);
                     while(*format && (*format != ']')) {
 			/* According to msdn:
 			 * "Note that %[a-z] and %[z-a] are interpreted as equivalent to %[abcde...z]." */
-			if((*format == '-') && (*(format + 1) != ']')) {
+			if((*format == '-') && ((VOID *)(format - 1) > scansetLastRangeEnd) && (*(format + 1) != ']')) {
 			    if ((*(format - 1)) < *(format + 1))
 				RtlSetBits(&bitMask, *(format - 1) +1 , *(format + 1) - *(format - 1));
 			    else
 				RtlSetBits(&bitMask, *(format + 1)    , *(format - 1) - *(format + 1));			      
 			    format++;
+			    scansetLastRangeEnd = (VOID *)format;
 			} else
 			    RtlSetBits(&bitMask, *format, 1);
 			format++;
-- 
2.28.0