libio: Add test for fopen with an empty ", ccs=" value [BZ #34574]

This goes on top of the fix for CVE-2026-18374.  The test runs the
reproducer from the bug report, plus "w,ccs=" and "w,ccs=,", and
expects NULL with errno set to EINVAL.

Signed-off-by: Shamil Abdulaev <ashamil435@gmail.com>
Reviewed-by: Florian Weimer <fweimer@redhat.com>

libio/Makefile

@@ -110,6 +110,7 @@ tests = \
   tst-fgetwc \
   tst-fgetws \
   tst-file-init-race \
+  tst-fopen-ccs-empty \
   tst-fopenloc2 \
   tst-fputws \
   tst-freopen \

libio/tst-fopen-ccs-empty.c

@@ -0,0 +1,62 @@
+/* Test fopen with an empty ",ccs=" value in the mode string (bug 34574).
+   Copyright (C) 2026 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <support/check.h>
+#include <support/support.h>
+#include <support/temp_file.h>
+#include <support/xunistd.h>
+
+static void
+check_fopen_fails (const char *path, const char *mode)
+{
+  errno = 0;
+  FILE *fp = fopen (path, mode);
+  TEST_VERIFY (fp == NULL);
+  TEST_COMPARE (errno, EINVAL);
+  if (fp != NULL)
+    fclose (fp);
+}
+
+static int
+do_test (void)
+{
+  char *path;
+  xclose (create_temp_file ("tst-fopen-ccs-empty", &path));
+
+  /* The value is blank and the mode string continues well past it.  */
+  enum { size = 1024 * 1024 };
+  char *mode = xmalloc (size);
+  memset (mode, 'X', size);
+  mode[size - 1] = '\0';
+  static const char prefix[] = "w,ccs=                     ,";
+  memcpy (mode, prefix, sizeof (prefix) - 1);
+  check_fopen_fails (path, mode);
+  free (mode);
+
+  check_fopen_fails (path, "w,ccs=");
+  check_fopen_fails (path, "w,ccs=,");
+
+  free (path);
+  return 0;
+}
+
+#include <support/test-driver.c>