musl strtod: out-of-bounds store in decfloat
============================================

src/internal/floatscan.c:259, in the assemble loop:

	if ((a+i & MASK)==z) x[(z=(z+1 & MASK))-1] = 0;

The assignment lands before the subtraction, so the index is the new z
minus one. That is the old z everywhere except at the wrap, where z goes
MASK -> 0 and the index is -1: a four-byte store below x.

The intended index is the old z -- the slot being appended -- which is
(z_new - 1) & MASK for every z including the wrap. The downscale loop
eleven lines up does the same append in the clear order:

	if ((z+1 & MASK) != a) { x[z] = carry; z = (z+1 & MASK); }

Reaching the wrap needs the 2048-slot ring to come all the way round, so
the input has to be long:

	strtod("710542735760100185871124267578125e-33", 0)

AddressSanitizer reports it on an ordinary gcc build. The result is
nonetheless correct there, plausibly because i is register-allocated and
nothing live sits in the slot below x -- but that is a property of the
frame layout, not of the code.

	make MUSL=/path/to/musl         # the report below
	make MUSL=/path/to/musl fixed   # the same, patch applied

MUSL is a musl checkout or release tree. Without one to hand, `make
fetch` clones v1.2.6 into ./musl and then plain `make` finds it. musl
itself is never built: configure runs far enough to write the two
generated headers, then three of musl's sources and five math files are
compiled with musl's own flags against the system libc.

	==...==ERROR: AddressSanitizer: stack-buffer-underflow
	WRITE of size 4
	    #0 decfloat  src/internal/floatscan.c:259
	    #1 strtox    src/stdlib/strtod.c:11
	    #2 strtod    src/stdlib/strtod.c:24
	    #3 main      repro.c

	This frame has 1 object(s):
	  [32, 8224) 'x' <== Memory access at offset 28 underflows this variable

With the patch, no report and:

	strtod("710542735760100185871124267578125e-33") = 0.71054273576010019, 37 consumed


	repro.c              calls strtod once
	stub.c               ___errno_location and __uflow, the only two names
	                     the three musl units reach for outside themselves
	floatscan-oob.patch  the fix
	Makefile             the build above
