From: Ilia Alshanetsky <iliaa@php.net>
Date: Wed, 26 Jan 2005 00:02:46 +0000 (+0000)
Subject: Fixed bug #29733 (printf() handles repeated placeholders wrong).
X-Git-Tag: php-5.0.4RC1~243
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=d7852a49300e8f3d229b89093249aa2d4053d8cf;p=php

Fixed bug #29733 (printf() handles repeated placeholders wrong).
(bugs dot php dot net at bluetwanger dot de, Ilia)
---

diff --git a/NEWS b/NEWS
index 878ababfaf..4f0993792f 100644
--- a/NEWS
+++ b/NEWS
@@ -59,6 +59,8 @@ PHP                                                                        NEWS
   in segfault). (pdan-php at esync dot org, Tony)
 - Fixed bug #30120 (imagettftext() and imagettfbbox() accept too many
   parameters). (Jani)
+- Fixed bug #29733 (printf() handles repeated placeholders wrong).
+  (bugs dot php dot net at bluetwanger dot de, Ilia)
 - Fixed bug #29136 (make test - libtool failure on MacOSX). (Jani)
 - Fixed bug #28976 (mail(): use "From:" from headers if sendmail_from is empty).
   (Jani)
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index 75cf0205d8..8119ce2f90 100644
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -545,12 +545,6 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 			php_sprintf_appendchar(&result, &outpos, &size, '%' TSRMLS_CC);
 			inpos += 2;
 		} else {
-			if (currarg >= argc && format[inpos + 1] != '%') {
-				efree(result);
-				efree(args);
-				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
-				return NULL;
-			}
 			/* starting a new format specifier, reset variables */
 			alignment = ALIGN_RIGHT;
 			adjusting = 0;
@@ -581,13 +575,6 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 				}
 
 				argnum += format_offset;
-				
-				if (argnum >= argc) {
-					efree(result);
-					efree(args);
-					php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
-					return NULL;
-				}
 
 				/* after argnum comes modifiers */
 				PRINTF_DEBUG(("sprintf: looking for modifiers\n"
@@ -643,6 +630,13 @@ php_formatted_print(int ht, int *len, int use_array, int format_offset TSRMLS_DC
 				argnum = currarg++ + format_offset;
 			}
 
+			if (argnum >= argc) {
+				efree(result);
+				efree(args);
+				php_error_docref(NULL TSRMLS_CC, E_WARNING, "Too few arguments");
+				return NULL;
+			}
+
 			if (format[inpos] == 'l') {
 				inpos++;
 			}