* editfns.c (Fformat): Since floats occupy two elements in the

	argument list passed to doprnt, we must use separate indices for
	the array of arguments passed to Fformat, and the array of
	arguments to be passed to doprnt.

1 files changed, 12 insertions, 7 deletions

diff --git a/src/editfns.c b/src/editfns.c
index 93b7c405cd1..78f1b1a710a 100644
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -1394,29 +1394,34 @@ Use %% to put a single % into the output.")
 
   {
     register int nstrings = n + 1;
+
+    /* Allocate twice as many strings as we have %-escapes; floats occupy
+       two slots, and we're not sure how many of those we have.  */
     register unsigned char **strings
-      = (unsigned char **) alloca (nstrings * sizeof (unsigned char *));
+      = (unsigned char **) alloca (2 * nstrings * sizeof (unsigned char *));
+    int i;
 
+    i = 0;
     for (n = 0; n < nstrings; n++)
       {
         if (n >= nargs)
-          strings[n] = (unsigned char *) "";
+          strings[i++] = (unsigned char *) "";
         else if (XTYPE (args[n]) == Lisp_Int)
           /* We checked above that the corresponding format effector
              isn't %s, which would cause MPV.  */
-          strings[n] = (unsigned char *) XINT (args[n]);
+          strings[i++] = (unsigned char *) XINT (args[n]);
 #ifdef LISP_FLOAT_TYPE
         else if (XTYPE (args[n]) == Lisp_Float)
           {
             union { double d; int half[2]; } u;
 
             u.d = XFLOAT (args[n])->data;
-            strings[n++] = (unsigned char *) u.half[0];
-            strings[n] = (unsigned char *) u.half[1];
+            strings[i++] = (unsigned char *) u.half[0];
+            strings[i++] = (unsigned char *) u.half[1];
           }
 #endif
         else
-          strings[n] = XSTRING (args[n])->data;
+          strings[i++] = XSTRING (args[n])->data;
       }
 
     /* Format it in bigger and bigger buf's until it all fits. */
@@ -1425,7 +1430,7 @@ Use %% to put a single % into the output.")
         buf = (char *) alloca (total + 1);
         buf[total - 1] = 0;
 
-        length = doprnt (buf, total + 1, strings[0], end, nargs, strings + 1);
+        length = doprnt (buf, total + 1, strings[0], end, i-1, strings + 1);
         if (buf[total - 1] == 0)
           break;