Fix another crash with long formats (#6145)

# From strncpy manual:
# In the case where the length of src is less than  that  of
# n, the remainder of dest will be padded with nulls.

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 1db945192851d1fff09cb70c89ac37d0fa84eb75..2846eaaa9840a12b076da5457cc2d0d0365a0850 100644 (file)
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -184,7 +184,7 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add,
                }
        }
        PRINTF_DEBUG(("sprintf: appending \"%s\"\n", add));
-       strncpy(&(*buffer)[*pos], add, max_width);
+       strncpy(&(*buffer)[*pos], add, max_width-*pos+1);
        *pos += MIN(max_width, len);
        if (alignment == ALIGN_LEFT) {
                while (npad--) {