* editfns.c (Fformat): Since floats occupy two elements in the

	argument list passed to doprnt, we must use separate indices for
	the array of arguments passed to Fformat, and the array of
	arguments to be passed to doprnt.

diff --git a/src/editfns.c b/src/editfns.c
index 93b7c405cd170b5d6596663e63f98a665a506c3f..78f1b1a710ab1f8416d9ef00f417df12d6d184aa 100644 (file)
--- a/src/editfns.c
+++ b/src/editfns.c
@@ -1394,29 +1394,34 @@ Use %% to put a single % into the output.")
 
   {
     register int nstrings = n + 1;
+
+    /* Allocate twice as many strings as we have %-escapes; floats occupy
+       two slots, and we're not sure how many of those we have.  */
     register unsigned char **strings
-      = (unsigned char **) alloca (nstrings * sizeof (unsigned char *));
+      = (unsigned char **) alloca (2 * nstrings * sizeof (unsigned char *));
+    int i;
 
+    i = 0;
     for (n = 0; n < nstrings; n++)
       {
        if (n >= nargs)
-         strings[n] = (unsigned char *) "";
+         strings[i++] = (unsigned char *) "";
        else if (XTYPE (args[n]) == Lisp_Int)
          /* We checked above that the corresponding format effector
             isn't %s, which would cause MPV.  */
-         strings[n] = (unsigned char *) XINT (args[n]);
+         strings[i++] = (unsigned char *) XINT (args[n]);
 #ifdef LISP_FLOAT_TYPE
        else if (XTYPE (args[n]) == Lisp_Float)
          {
            union { double d; int half[2]; } u;
 
            u.d = XFLOAT (args[n])->data;
-           strings[n++] = (unsigned char *) u.half[0];
-           strings[n] = (unsigned char *) u.half[1];
+           strings[i++] = (unsigned char *) u.half[0];
+           strings[i++] = (unsigned char *) u.half[1];
          }
 #endif
        else
-         strings[n] = XSTRING (args[n])->data;
+         strings[i++] = XSTRING (args[n])->data;
       }
 
     /* Format it in bigger and bigger buf's until it all fits. */
@@ -1425,7 +1430,7 @@ Use %% to put a single % into the output.")
        buf = (char *) alloca (total + 1);
        buf[total - 1] = 0;
 
-       length = doprnt (buf, total + 1, strings[0], end, nargs, strings + 1);
+       length = doprnt (buf, total + 1, strings[0], end, i-1, strings + 1);
        if (buf[total - 1] == 0)
          break;