Fixed bug #22227

Added test case for bug #22227

Author: Moriyoshi Koizumi

ext/standard/formatted_print.c

@@ -158,24 +158,23 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add,
 						   int alignment, int len, int sign, int expprec)
 {
 	register int npad;
+	int req_size;
+	int copy_len;
 
-	if (max_width && min_width) {
-		expprec = max_width = 0;	
-	}
-
-	npad = min_width - MIN(len, (expprec ? max_width : len));
+	copy_len = (expprec ? MIN(max_width, len) : len);
+	npad = min_width - copy_len;
 
 	if (npad < 0) {
 		npad = 0;
 	}
 
 	PRINTF_DEBUG(("sprintf: appendstring(%x, %d, %d, \"%s\", %d, '%c', %d)\n",
 				  *buffer, *pos, *size, add, min_width, padding, alignment));
-	if ((max_width == 0) && (! expprec)) {
-		max_width = MAX(min_width, len);
-	}
-	if ((*pos + max_width) >= *size) {
-		while ((*pos + max_width) >= *size) {
+
+	req_size = *pos + MAX(min_width, copy_len) + 1;
+
+	if (req_size > *size) {
+		while (req_size > *size) {
 			*size <<= 1;
 		}
 		PRINTF_DEBUG(("sprintf ereallocing buffer to %d bytes\n", *size));
@@ -192,8 +191,8 @@ php_sprintf_appendstring(char **buffer, int *pos, int *size, char *add,
 		}
 	}
 	PRINTF_DEBUG(("sprintf: appending \"%s\"\n", add));
-	memcpy(&(*buffer)[*pos], add, MIN(max_width, len)+1);
-	*pos += MIN(max_width, len);
+	memcpy(&(*buffer)[*pos], add, copy_len + 1);
+	*pos += copy_len;
 	if (alignment == ALIGN_LEFT) {
 		while (npad--) {
 			(*buffer)[(*pos)++] = padding;

ext/standard/tests/strings/bug22227.phpt

@@ -0,0 +1,9 @@
+--TEST--
+Bug #22227 (printf() field limiters broke between 4.2.3 and 4.3.0)
+--FILE--
+<?php
+printf("%-3.3s", "abcdef");
+print "\n";
+?>
+--EXPECT--
+abc