- Fix handling of zero'th argument for sprintf()'s argument swapping code

  (Patch by Morten Poulsen <morten@afdelingp.dk>)

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 57a32bef1a883128d3d5fb705454f80b70d16cf0..7a11b3a5f02c04cdfd55b8120a341d07ee9e3042 100644 (file)
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -480,6 +480,14 @@ php_formatted_print(int ht, int *len, int use_array TSRMLS_DC)
                                while (isdigit((int)format[temppos])) temppos++;
                                if (format[temppos] == '$') {
                                        argnum = php_sprintf_getnumber(format, &inpos);
+
+                                       if (argnum == 0) {
+                                               efree(result);
+                                               efree(args);
+                                               php_error(E_WARNING, "%s(): zero is not a valid argument number", get_active_function_name(TSRMLS_C));
+                                               return NULL;
+                                       }
+       
                                        inpos++;  /* skip the '$' */
                                } else {
                                        argnum = currarg++;