On Fri, Jul 13, 2018 at 04:40:52PM +0200, Markus Wichmann wrote:
> Hi all,
> 
> ungetc() seems to depend on f->buf pointing UNGET bytes into a valid
> array. fdopen() will provide such a thing. However, setvbuf() will set
> f->buf to the very start of the user provided buffer. Bizarrely, UNGET
> is deducted from the buffer size, but not added to the pointer.
> Oversight or intentional?

I'm committing the obvious fix. Attached is a regression test suitable
for libc-test.

Rich