- Fixed bug #48802 (printf() returns incorrect outputted length)

NEWS

@@ -14,17 +14,18 @@ PHP                                                                        NEWS
   (Greg)
 - Fixed bug #49018 (phar tar stores long filenames wit prefix/name reversed).
   (Greg)
+- Fixed bug #49014 (dechunked filter broken when serving more than 8192 bytes in
+  a chunk). (andreas dot streichardt at globalpark dot com, Ilia)
 - Fixed bug #48962 (cURL does not upload files with specified filename).
   (Ilia)
 - Fixed bug #48929 (Double \r\n after HTTP headers when "header" context
   option is an array). (David Zülke)
-- Fixed bug #49014 (dechunked filter broken when serving more than 8192 bytes in
-  a chunk) (andreas dot streichardt at globalpark dot com, Ilia)
 - Fixed bug #48899 (is_callable returns true even if method does not exist in
   parent class). (Felipe)
 - Fixed bug #48893 (Problems compiling with Curl). (Felipe)
 - Fixed bug #48854 (array_merge_recursive modifies arrays after first one).
   (Felipe)
+- Fixed bug #48802 (printf() returns incorrect outputted length). (Jani)
 - Fixed bug #48788 (RecursiveDirectoryIterator doesn't descend into symlinked
   directories). (Ilia)
 - Fixed bug #48771 (rename() between volumes fails and reports no error on 

ext/standard/formatted_print.c

@@ -697,14 +697,14 @@ PHP_FUNCTION(vsprintf)
 PHP_FUNCTION(user_printf)
 {
 	char *result;
-	int len;
+	int len, rlen;
 	
 	if ((result=php_formatted_print(ht, &len, 0, 0 TSRMLS_CC))==NULL) {
 		RETURN_FALSE;
 	}
-	PHPWRITE(result, len);
+	rlen = PHPWRITE(result, len);
 	efree(result);
-	RETURN_LONG(len);
+	RETURN_LONG(rlen);
 }
 /* }}} */
 
@@ -713,14 +713,14 @@ PHP_FUNCTION(user_printf)
 PHP_FUNCTION(vprintf)
 {
 	char *result;
-	int len;
+	int len, rlen;
 	
 	if ((result=php_formatted_print(ht, &len, 1, 0 TSRMLS_CC))==NULL) {
 		RETURN_FALSE;
 	}
-	PHPWRITE(result, len);
+	rlen = PHPWRITE(result, len);
 	efree(result);
-	RETURN_LONG(len);
+	RETURN_LONG(rlen);
 }
 /* }}} */
 

sapi/cli/php_cli.c

@@ -298,7 +298,7 @@ static int sapi_cli_ub_write(const char *str, uint str_length TSRMLS_DC) /* {{{
 		remaining -= ret;
 	}
 
-	return str_length;
+	return (ptr - str);
 }
 /* }}} */