vcscanf: ensure buf is NULL after string decoding

The presence of a pointer in buf could result in double free bugs
when execution reaches the end of the function and it is freed.

libc/stdio/vcscanf.c

@@ -540,6 +540,7 @@ int __vcscanf(int callback(void *),    //
           if (ismalloc) {
             *va_arg(va, char **) = (void *) buf;
           }
+	  buf = NULL;
         } else {
           do {
             if (isspace(c)) break;