From ec1a7e02d4fd93cef70e1a0cdf08ec0f418b8e11 Mon Sep 17 00:00:00 2001
From: Marcus Boerger <helly@php.net>
Date: Mon, 26 Dec 2005 13:41:58 +0000
Subject: [PATCH] - SWH (WS + memory corruption fix)

---
 main/snprintf.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/main/snprintf.c b/main/snprintf.c
index 2d702a80a0..5eba393699 100644
--- a/main/snprintf.c
+++ b/main/snprintf.c
@@ -111,8 +111,7 @@
  * which is a pointer to the END of the buffer + 1 (i.e. if the buffer
  * is declared as buf[ 100 ], buf_end should be &buf[ 100 ])
  */
-char *
-ap_php_conv_10(register wide_int num, register bool_int is_unsigned,
+char * ap_php_conv_10(register wide_int num, register bool_int is_unsigned,
 	   register bool_int * is_negative, char *buf_end, register int *len)
 {
 	register char *p = buf_end;
@@ -167,8 +166,7 @@ ap_php_conv_10(register wide_int num, register bool_int is_unsigned,
  * The sign is returned in the is_negative argument (and is not placed
  * in buf).
  */
-char *
- ap_php_conv_fp(register char format, register double num,
+char * ap_php_conv_fp(register char format, register double num,
 		 boolean_e add_dp, int precision, bool_int * is_negative, char *buf, int *len)
 {
 	register char *s = buf;
@@ -201,9 +199,14 @@ char *
 				*s++ = '.';
 			}
 		} else {
+			int addz = decimal_point >= NDIG ? decimal_point - NDIG + 1 : 0;
+			decimal_point -= addz;
 			while (decimal_point-- > 0) {
 				*s++ = *p++;
 			}
+			while (addz-- > 0) {
+				*s++ = '0';
+			}
 			if (precision > 0 || add_dp) {
 				*s++ = '.';
 			}
@@ -260,8 +263,7 @@ char *
  * which is a pointer to the END of the buffer + 1 (i.e. if the buffer
  * is declared as buf[ 100 ], buf_end should be &buf[ 100 ])
  */
-char *
- ap_php_conv_p2(register u_wide_int num, register int nbits,
+char * ap_php_conv_p2(register u_wide_int num, register int nbits,
 		 char format, char *buf_end, register int *len)
 {
 	register int mask = (1 << nbits) - 1;
@@ -293,8 +295,7 @@ char *
  */
 
 
-char *
-ap_php_cvt(double arg, int ndigits, int *decpt, int *sign, int eflag, char *buf)
+char * ap_php_cvt(double arg, int ndigits, int *decpt, int *sign, int eflag, char *buf)
 {
 	register int r2;
 	int mvl;
@@ -316,19 +317,21 @@ ap_php_cvt(double arg, int ndigits, int *decpt, int *sign, int eflag, char *buf)
 	 * Do integer part
 	 */
 	if (fi != 0) {
-		p1 = &buf[NDIG];
 		while (fi != 0) {
 			fj = modf(fi / 10, &fi);
 			if (p1 <= &buf[0]) {
 				mvl = NDIG - ndigits;
-				memmove(&buf[mvl], &buf[0], NDIG-mvl-1);
+				if (ndigits > 0) {
+					memmove(&buf[mvl], &buf[0], NDIG-mvl-1);
+				}
 				p1 += mvl;
 			}
 			*--p1 = (int) ((fj + .03) * 10) + '0';
 			r2++;
 		}
-		while (p1 < &buf[NDIG])
+		while (p1 < &buf[NDIG]) {
 			*p++ = *p1++;
+		}
 	} else if (arg > 0) {
 		while ((fj = arg * 10) < 1) {
 			if (!eflag && (r2 * -1) < ndigits) {
@@ -382,14 +385,12 @@ ap_php_cvt(double arg, int ndigits, int *decpt, int *sign, int eflag, char *buf)
 	return (buf);
 }
 
-char *
-ap_php_ecvt(double arg, int ndigits, int *decpt, int *sign, char *buf)
+char * ap_php_ecvt(double arg, int ndigits, int *decpt, int *sign, char *buf)
 {
 	return (ap_php_cvt(arg, ndigits, decpt, sign, 1, buf));
 }
 
-char *
-ap_php_fcvt(double arg, int ndigits, int *decpt, int *sign, char *buf)
+char * ap_php_fcvt(double arg, int ndigits, int *decpt, int *sign, char *buf)
 {
 	return (ap_php_cvt(arg, ndigits, decpt, sign, 0, buf));
 }
@@ -399,8 +400,7 @@ ap_php_fcvt(double arg, int ndigits, int *decpt, int *sign, char *buf)
  * minimal length string
  */
 
-char *
-ap_php_gcvt(double number, int ndigit, char *buf, boolean_e altform)
+char * ap_php_gcvt(double number, int ndigit, char *buf, boolean_e altform)
 {
 	int sign, decpt;
 	register char *p1, *p2;
-- 
2.50.1