Fixed bug #29733 (printf() handles repeated placeholders wrong).

(bugs dot php dot net at bluetwanger dot de, Ilia)

diff --git a/NEWS b/NEWS
index 878ababfafa8bff96ebff53e5cccd28c823946ba..4f0993792f4d30e3ea74e074eec114b6d74664fe 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -59,6 +59,8 @@ PHP                                                                        NEWS
   in segfault). (pdan-php at esync dot org, Tony)
 - Fixed bug #30120 (imagettftext() and imagettfbbox() accept too many
   parameters). (Jani)
+- Fixed bug #29733 (printf() handles repeated placeholders wrong).
+  (bugs dot php dot net at bluetwanger dot de, Ilia)
 - Fixed bug #29136 (make test - libtool failure on MacOSX). (Jani)
 - Fixed bug #28976 (mail(): use "From:" from headers if sendmail_from is empty).
   (Jani)

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 75cf0205d86a9df22be8bf0dd99ac1de496ac1de..8119ce2f906a8c0a57479b881793e19b84bc69a0 100644 (file)
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -545,12 +545,6 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                        php_sprintf_appendchar(&result, &outpos, &size, '%' TSRMLS_CC);
                        inpos += 2;
                } else {
-                       if (currarg >= argc && format[inpos + 1] != '%') {
-                               efree(result);
-                               efree(args);
-                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
-                               return NULL;
-                       }
                        /* starting a new format specifier, reset variables */
                        alignment = ALIGN_RIGHT;
                        adjusting = 0;
@@ -581,13 +575,6 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                                }
 
                                argnum += format_offset;
-                               
-                               if (argnum >= argc) {
-                                       efree(result);
-                                       efree(args);
-                                       php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
-                                       return NULL;
-                               }
 
                                /* after argnum comes modifiers */
                                PRINTF_DEBUG(("sprintf: looking for modifiers\n"
@@ -643,6 +630,13 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
                                argnum = currarg++ + format_offset;
                        }
 
+                       if (argnum >= argc) {
+                               efree(result);
+                               efree(args);
+                               php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
+                               return NULL;
+                       }
+
                        if (format[inpos] == 'l') {
                                inpos++;
                        }