diff --git a/NEWS b/NEWS
index 32e44d80b31..de54978e00f 100644
--- a/NEWS
+++ b/NEWS
@@ -14,17 +14,18 @@ PHP                                                                        NEWS
   (Greg)
 - Fixed bug #49018 (phar tar stores long filenames wit prefix/name reversed).
   (Greg)
+- Fixed bug #49014 (dechunked filter broken when serving more than 8192 bytes in
+  a chunk). (andreas dot streichardt at globalpark dot com, Ilia)
 - Fixed bug #48962 (cURL does not upload files with specified filename).
   (Ilia)
 - Fixed bug #48929 (Double \r\n after HTTP headers when "header" context
   option is an array). (David Zülke)
-- Fixed bug #49014 (dechunked filter broken when serving more than 8192 bytes in
-  a chunk) (andreas dot streichardt at globalpark dot com, Ilia)
 - Fixed bug #48899 (is_callable returns true even if method does not exist in
   parent class). (Felipe)
 - Fixed bug #48893 (Problems compiling with Curl). (Felipe)
 - Fixed bug #48854 (array_merge_recursive modifies arrays after first one).
   (Felipe)
+- Fixed bug #48802 (printf() returns incorrect outputted length). (Jani)
 - Fixed bug #48788 (RecursiveDirectoryIterator doesn't descend into symlinked
   directories). (Ilia)
 - Fixed bug #48771 (rename() between volumes fails and reports no error on 
diff --git a/ext/standard/formatted_print.c b/ext/standard/formatted_print.c
index a6b8af783dc..6d3e5ad8e1c 100644
--- a/ext/standard/formatted_print.c
+++ b/ext/standard/formatted_print.c
@@ -697,14 +697,14 @@ PHP_FUNCTION(vsprintf)
 PHP_FUNCTION(user_printf)
 {
 	char *result;
-	int len;
+	int len, rlen;
 	
 	if ((result=php_formatted_print(ht, &len, 0, 0 TSRMLS_CC))==NULL) {
 		RETURN_FALSE;
 	}
-	PHPWRITE(result, len);
+	rlen = PHPWRITE(result, len);
 	efree(result);
-	RETURN_LONG(len);
+	RETURN_LONG(rlen);
 }
 /* }}} */
 
@@ -713,14 +713,14 @@ PHP_FUNCTION(user_printf)
 PHP_FUNCTION(vprintf)
 {
 	char *result;
-	int len;
+	int len, rlen;
 	
 	if ((result=php_formatted_print(ht, &len, 1, 0 TSRMLS_CC))==NULL) {
 		RETURN_FALSE;
 	}
-	PHPWRITE(result, len);
+	rlen = PHPWRITE(result, len);
 	efree(result);
-	RETURN_LONG(len);
+	RETURN_LONG(rlen);
 }
 /* }}} */
 
diff --git a/sapi/cli/php_cli.c b/sapi/cli/php_cli.c
index a8ab0edf718..71e0fd98ac0 100644
--- a/sapi/cli/php_cli.c
+++ b/sapi/cli/php_cli.c
@@ -298,7 +298,7 @@ static int sapi_cli_ub_write(const char *str, uint str_length TSRMLS_DC) /* {{{
 		remaining -= ret;
 	}
 
-	return str_length;
+	return (ptr - str);
 }
 /* }}} */