crt: Fix v*scanf functions

Currently v*scanf functions are broken and crash when are called with more
than 30 arguments in va_list. This is because va_list v*scanf functions are
redirected to variadic *scanf functions and this redirect implemented in
scanf.S file has fixed limit for 30 arguments.

Number of arguments for msvcrt *scanf function can be determined from
format string by counting number of '%' characters which is the upper
limit. *scanf functions would not access more arguments than this number.
Every scanf parameter is pointer, it has fixed size and so upper stack size
limit can be exactly calculated.

Fix this scanf.S redirect implementation by dynamically allocating stack
for upper limit of pointer parameters.

Signed-off-by: Martin Storsjö <martin@martin.st>
diff --git a/mingw-w64-crt/stdio/vsscanf.c b/mingw-w64-crt/stdio/vsscanf.c
index 6c8fe5a..9b3b650 100644
--- a/mingw-w64-crt/stdio/vsscanf.c
+++ b/mingw-w64-crt/stdio/vsscanf.c
@@ -11,19 +11,23 @@
   const char * s,
   const char * format,
   va_list arg,
+  size_t count,
   int (*func)(const char * __restrict__,  const char * __restrict__, ...))
   asm("__argtos");
 
+extern size_t __ms_scanf_max_arg_count_internal (const char * format);
+
 int __ms_vsscanf (const char * __restrict__ s,
   const char * __restrict__ format, va_list arg)
 {
+  size_t count = __ms_scanf_max_arg_count_internal (format);
   int ret;
 
 #if defined(_AMD64_) || defined(__x86_64__) || \
   defined(_X86_) || defined(__i386__) || \
   defined(_ARM_) || defined(__arm__) || \
   defined(_ARM64_) || defined(__aarch64__)
-  ret = __ms_vsscanf_internal (s, format, arg, sscanf);
+  ret = __ms_vsscanf_internal (s, format, arg, count, sscanf);
 #else
 #error "unknown platform"
 #endif