Помогите обхитрить чужую либу

char ch;
fread(&ch,1,1,stdin);

$ cat inter.c 

#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
static int pos = 0;
const size_t MAXLEN=5;
static char buf[6] = "abcde";
static FILE* localFile = (FILE*)-2;
const char inter_fname[] = "file1.txt";
static FILE* (*real_fopen)(const char *, const char * );
FILE* fopen(const char * filename, const char * mode) {
    if(strcmp(filename,inter_fname)==0)
      return localFile;
    if(!real_fopen) real_fopen = dlsym(RTLD_NEXT, "fopen");
    return real_fopen(filename, mode);
}
static int (*real_fclose)(FILE *) = 0;
int fclose(FILE * stream) {
    if(stream==localFile) return 0;
    if(!real_fclose) real_fclose = dlsym(RTLD_NEXT, "fclose");
    return real_fclose(stream);
}
static size_t (*real_fread)(void *, size_t, size_t, FILE *) = 0;
size_t fread(void * ptr, size_t size, size_t count, FILE * stream) {
    if(stream==localFile) {
	size_t cur = 0;
	char*curptr=ptr, *curbuf=&buf[pos];
	while(count!=0&&(pos+size<=MAXLEN)) {
	    memcpy(curptr,curbuf,size);
	    curptr+=size; curbuf+=size;
	    pos+=size; count--; cur++;
	}
	return cur;
    }
    if(!real_fread) real_fread = dlsym(RTLD_NEXT, "fread");
    return real_fread(ptr,size,count,stream);
}

$ cat main.c 

#include <stdio.h>
#include <dlfcn.h>
// fun - это функция закрытой библиотеки, куда передается имя файла
void fun(char* fname) {
  char buf[10];
  FILE *in = fopen(fname,"rb");
  printf("fopen(%s), in=%x\n",fname,in);
  fread(buf,1,5,in); buf[5] = 0;
  printf("fread, buf={%s}\n",buf);
  fclose(in);
}
int main(int argc, char* argv) {
  fun("file1.txt");
  fun("file2.txt");
  return 0;
}

$ cat file1.txt 
12345
$ cat file2.txt 
asdfg
$ gcc main.c inter.c -ldl -o main
$ ./main 
fopen(file1.txt), in=fffffffe
fread, buf={abcde}
fopen(file2.txt), in=9576008
fread, buf={asdfg}