Tidy 5.7.20 GetSurrogatePair can use uninitialised value processing malformed entity refs

[dd8]

GetSurrogatePair ignores scanf return value, which means ch may be uninitialised if buf doesn't contain hex or digits (or uses # incorrectly) leading to UTF encoding errors and undefined behaviour.

Here's a patch for the issue
patch-scanf.diff.txt

Compiles in XCode 10 clang on Mac, Visual Studio 2015 on Windows
Tested in production on macOS 10.13, macOS 10.14, Windows 7, Windows 10, Windows Server 2016

Not tested on Linux/gcc

[geoffmcl]

@dd8 thank for the issue and the patch... will try to include it soon... maybe remind me if too long...

It is interesting, one of the issues mentioned in #788, 12074 I think, mentioned IsHighSurrogate, but was unable to repeat the bug... as usual, without being able to replicate, is very difficult to investigate... but maybe this is it? ...

But regardless of that, agree with your assessment, we ignore the scanf return, to our peril, thus the patch looks, logic-wise, good...

As stated, baring any negative comments, will try to include it soonest... thanks...