- Fix handling of zero'th argument for sprintf()'s argument swapping code

(Patch by Morten Poulsen <morten@afdelingp.dk>)

ext/standard/formatted_print.c

@@ -480,6 +480,14 @@ php_formatted_print(int ht, int *len, int use_array TSRMLS_DC)
 				while (isdigit((int)format[temppos])) temppos++;
 				if (format[temppos] == '$') {
 					argnum = php_sprintf_getnumber(format, &inpos);
+
+					if (argnum == 0) {
+						efree(result);
+						efree(args);
+						php_error(E_WARNING, "%s(): zero is not a valid argument number", get_active_function_name(TSRMLS_C));
+						return NULL;
+					}
+	
 					inpos++;  /* skip the '$' */
 				} else {
 					argnum = currarg++;