Index: uspace/lib/posix/source/stdio/scanf.c
===================================================================
--- uspace/lib/posix/source/stdio/scanf.c	(revision d39c46e03cdf4c2a6b309cc0244b5bf42b3b6000)
+++ uspace/lib/posix/source/stdio/scanf.c	(revision 17c1427397e6ec84fdd0ce49eddfd8c5ffb03b62)
@@ -625,6 +625,7 @@
 
 				const char *cur_borrowed = NULL;
+				char *cur_duplicated = NULL;
 				const char *cur_limited = NULL;
-				char *cur_updated = NULL;
+				const char *cur_updated = NULL;
 
 				/* Borrow the cursor. Until it is returned to the provider
@@ -637,9 +638,10 @@
 				 * than allowed by width. */
 				if (width != -1) {
-					cur_limited = posix_strndup(cur_borrowed, width);
+					cur_duplicated = posix_strndup(cur_borrowed, width);
+					cur_limited = cur_duplicated;
 				} else {
 					cur_limited = cur_borrowed;
 				}
-				cur_updated = (char *) cur_limited;
+				cur_updated = cur_limited;
 
 				long long sres = 0;
@@ -648,17 +650,18 @@
 				/* Try to convert the integer. */
 				if (int_conv_unsigned) {
-					ures = strtoull(cur_limited, &cur_updated, int_conv_base);
+					ures = strtoull(cur_limited, (char **) &cur_updated, int_conv_base);
 				} else {
-					sres = strtoll(cur_limited, &cur_updated, int_conv_base);
+					sres = strtoll(cur_limited, (char **) &cur_updated, int_conv_base);
 				}
 
 				/* Update the cursor so it can be returned to the provider. */
 				cur_borrowed += cur_updated - cur_limited;
-				if (width != -1 && cur_limited != NULL) {
+				if (cur_duplicated != NULL) {
 					/* Deallocate duplicated part of the cursor view. */
-					free(cur_limited);
+					free(cur_duplicated);
 				}
 				cur_limited = NULL;
 				cur_updated = NULL;
+				cur_duplicated = NULL;
 				/* Return the cursor to the provider. Input consistency is again
 				 * the job of the provider, so we can report errors from
@@ -797,5 +800,6 @@
 				const char *cur_borrowed = NULL;
 				const char *cur_limited = NULL;
-				char *cur_updated = NULL;
+				char *cur_duplicated = NULL;
+				const char *cur_updated = NULL;
 
 				/* Borrow the cursor. Until it is returned to the provider
@@ -808,9 +812,10 @@
 				 * than allowed by width. */
 				if (width != -1) {
-					cur_limited = posix_strndup(cur_borrowed, width);
+					cur_duplicated = posix_strndup(cur_borrowed, width);
+					cur_limited = cur_duplicated;
 				} else {
 					cur_limited = cur_borrowed;
 				}
-				cur_updated = (char *) cur_limited;
+				cur_updated = cur_limited;
 
 				float fres = 0.0;
@@ -821,11 +826,11 @@
 				switch (length_mod) {
 				case LMOD_NONE:
-					fres = posix_strtof(cur_limited, &cur_updated);
+					fres = posix_strtof(cur_limited, (char **) &cur_updated);
 					break;
 				case LMOD_l:
-					dres = posix_strtod(cur_limited, &cur_updated);
+					dres = posix_strtod(cur_limited, (char **) &cur_updated);
 					break;
 				case LMOD_L:
-					ldres = posix_strtold(cur_limited, &cur_updated);
+					ldres = posix_strtold(cur_limited, (char **) &cur_updated);
 					break;
 				default:
@@ -835,7 +840,7 @@
 				/* Update the cursor so it can be returned to the provider. */
 				cur_borrowed += cur_updated - cur_limited;
-				if (width != -1 && cur_limited != NULL) {
+				if (cur_duplicated != NULL) {
 					/* Deallocate duplicated part of the cursor view. */
-					free(cur_limited);
+					free(cur_duplicated);
 				}
 				cur_limited = NULL;