Fixed bug #22227

Added test case for bug #22227

1 files changed, 11 insertions, 12 deletions

diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index b53d5e3072..67915bed65 100644
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -158,12 +158,11 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add,
 						   int alignment, int len, int sign, int expprec)
 {
 	register int npad;
+	int req_size;
+	int copy_len;
 
-	if (max_width && min_width) {
-		expprec = max_width = 0;	
-	}
-
-	npad = min_width - MIN(len, (expprec ? max_width : len));
+	copy_len = (expprec ? MIN(max_width, len) : len);
+	npad = min_width - copy_len;
 
 	if (npad < 0) {
 		npad = 0;
@@ -171,11 +170,11 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add,
 	
 	PRINTF_DEBUG(("sprintf: appendstring(%x, %d, %d, \"%s\", %d, '%c', %d)\n",
 				  *buffer, *pos, *size, add, min_width, padding, alignment));
-	if ((max_width == 0) && (! expprec)) {
-		max_width = MAX(min_width, len);
-	}
-	if ((*pos + max_width) >= *size) {
-		while ((*pos + max_width) >= *size) {
+
+	req_size = *pos + MAX(min_width, copy_len) + 1;
+
+	if (req_size > *size) {
+		while (req_size > *size) {
 			*size <<= 1;
 		}
 		PRINTF_DEBUG(("sprintf ereallocing buffer to %d bytes\n", *size));
@@ -192,8 +191,8 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add,
 		}
 	}
 	PRINTF_DEBUG(("sprintf: appending \"%s\"\n", add));
-	memcpy(&(*buffer)[*pos], add, MIN(max_width, len)+1);
-	*pos += MIN(max_width, len);
+	memcpy(&(*buffer)[*pos], add, copy_len + 1);
+	*pos += copy_len;
 	if (alignment == ALIGN_LEFT) {
 		while (npad--) {
 			(*buffer)[(*pos)++] = padding;