1 files changed, 83 insertions, 0 deletions
diff --git a/www/php4/patches/patch-aw b/www/php4/patches/patch-aw
new file mode 100644
index 00000000000..10ea46cce89
--- /dev/null
+++ b/www/php4/patches/patch-aw
@@ -0,0 +1,83 @@
+--- ext/standard/scanf.c.orig	2006-01-01 13:46:58.000000000 +0000
++++ ext/standard/scanf.c	2006-08-10 23:00:19.000000000 +0100
+@@ -732,7 +732,7 @@
+                 if (*end == '$') {
+                     format = end+1;
+                     ch = format++;
+-                    objIndex = varStart + value;
++                    objIndex = varStart + value - 1;
+                 }
+          }
+ 
+@@ -762,8 +762,10 @@
+         switch (*ch) {
+             case 'n':
+                 if (!(flags & SCAN_SUPPRESS)) {
+-                    if (numVars) {
+-						current = args[objIndex++];
++                    if (numVars && objIndex >= argCount) {
++                        break;
++                    } else if (numVars) {
++                        current = args[objIndex++];
+                         zval_dtor( *current );
+                         ZVAL_LONG( *current, (long)(string - baseString) );
+                     } else {
+@@ -883,8 +885,10 @@
+                 }
+             }
+             if (!(flags & SCAN_SUPPRESS)) {
+-                if (numVars) {
+-                    current = args[objIndex++];
++                if (numVars && objIndex >= argCount) {
++                    break;
++                } else if (numVars) {
++					current = args[objIndex++];
+ 					zval_dtor( *current );
+ 					ZVAL_STRINGL( *current, string, end-string, 1);
+                 } else {
+@@ -922,7 +926,9 @@
+                 goto done;
+             }
+             if (!(flags & SCAN_SUPPRESS)) {
+-                if (numVars) {
++                if (numVars && objIndex >= argCount) {
++                    break;
++                } else if (numVars) {
+                     current = args[objIndex++];
+                     zval_dtor( *current );
+                     ZVAL_STRINGL( *current, string, end-string, 1);
+@@ -1079,8 +1085,10 @@
+ 		    value = (int) (*fn)(buf, NULL, base);
+ 		    if ((flags & SCAN_UNSIGNED) && (value < 0)) {
+                 sprintf(buf, "%u", value); /* INTL: ISO digit */
+-                if (numVars) {
+-                  /* change passed value type to string */
++                if (numVars && objIndex >= argCount) {
++                   break;
++                } else if (numVars) {
++                   /* change passed value type to string */
+                    current = args[objIndex++];
+                    convert_to_string( *current );
+                    ZVAL_STRING( *current, buf, 1 );
+@@ -1088,7 +1096,9 @@
+                     add_index_string(*return_value, objIndex++, buf, 1);
+                 }
+             } else {
+-                if (numVars) {
++                if (numVars && objIndex >= argCount) {
++                    break;
++                } else if (numVars) {
+                     current = args[objIndex++];
+                     convert_to_long( *current );
+                     Z_LVAL(**current) = value;
+@@ -1196,7 +1206,9 @@
+ 		    double dvalue;
+ 		    *end = '\0';
+ 		    dvalue = zend_strtod(buf, NULL);
+-            if (numVars) {
++            if (numVars && objIndex >= argCount) {
++                break;
++            } else if (numVars) {
+                 current = args[objIndex++];
+                 convert_to_double( *current );
+                 Z_DVAL_PP( current ) = dvalue;