avoid crash in scanf when invalid %m format is encountered

invalid format strings invoke undefined behavior, so this is not a
conformance issue, but it's nicer for scanf to report the error safely
instead of calling free on a potentially-uninitialized pointer or a
pointer to memory belonging to the caller.

src/stdio/vfscanf.c

@@ -118,6 +118,8 @@ int vfscanf(FILE *restrict f, const char *restrict fmt, va_list ap)
 		}
 
 		if (*p=='m') {
+			wcs = 0;
+			s = 0;
 			alloc = !!dest;
 			p++;
 		} else {