fix overflow in printf %N$ argument handling

diff --git a/src/stdio/vfprintf.c b/src/stdio/vfprintf.c
index 2245d1d..a8cf41b 100644 (file)
--- a/src/stdio/vfprintf.c
+++ b/src/stdio/vfprintf.c
@@ -633,8 +633,8 @@ static int printf_core(FILE *f, const char *fmt, va_list *ap, union arg *nl_arg,
 int vfprintf(FILE *f, const char *fmt, va_list ap)
 {
        va_list ap2;
-       int nl_type[NL_ARGMAX] = {0};
-       union arg nl_arg[NL_ARGMAX];
+       int nl_type[NL_ARGMAX+1] = {0};
+       union arg nl_arg[NL_ARGMAX+1];
        unsigned char internal_buf[80], *saved_buf = 0;
        int ret;