- Fixed bug #42107 (sscanf broken when using %2$s type format parameters)

2 files changed, 79 insertions, 0 deletions

diff --git a/ext/standard/scanf.c b/ext/standard/scanf.c
index dbad05a6fc..c4e132640c 100644
--- a/ext/standard/scanf.c
+++ b/ext/standard/scanf.c
@@ -1105,6 +1105,7 @@ PHPAPI int php_sscanf_internal( char *string, char *format,
 				return FAILURE;
 			}
 		}
+		varStart = 0; /* Array index starts from 0 */
 	}
 
 	baseString = string;
@@ -1750,6 +1751,7 @@ PHPAPI int php_u_sscanf_internal(	UChar *string, UChar *format,
 				return FAILURE;
 			}
 		}
+		varStart = 0; /* Array index starts from 0 */
 	}
 
 	baseString = string;
diff --git a/ext/standard/tests/strings/bug42107.phpt b/ext/standard/tests/strings/bug42107.phpt
new file mode 100644
index 0000000000..fc9e449a8f
--- /dev/null
+++ b/ext/standard/tests/strings/bug42107.phpt
@@ -0,0 +1,77 @@
+--TEST--
+Bug #42107 (sscanf() broken when using %2$s type format parameters)
+--FILE--
+<?php
+
+var_dump(sscanf('one two', '%1$s %2$s'));
+var_dump(sscanf('one two', '%2$s %1$s'));
+echo "--\n";
+sscanf('one two', '%1$s %2$s', $foo, $bar);
+var_dump($foo, $bar);
+sscanf('one two', '%2$s %1$s', $foo, $bar);
+var_dump($foo, $bar);
+echo "--\n";
+var_dump(sscanf('one two', '%1$d %2$d'));
+var_dump(sscanf('one two', '%1$d'));
+echo "Done\n";
+?>
+--EXPECTF--
+array(2) {
+  [0]=>
+  string(3) "one"
+  [1]=>
+  string(3) "two"
+}
+array(2) {
+  [0]=>
+  string(3) "two"
+  [1]=>
+  string(3) "one"
+}
+--
+string(3) "one"
+string(3) "two"
+string(3) "two"
+string(3) "one"
+--
+array(2) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+}
+array(1) {
+  [0]=>
+  NULL
+}
+Done
+--UEXPECTF--
+array(2) {
+  [0]=>
+  unicode(3) "one"
+  [1]=>
+  unicode(3) "two"
+}
+array(2) {
+  [0]=>
+  unicode(3) "two"
+  [1]=>
+  unicode(3) "one"
+}
+--
+unicode(3) "one"
+unicode(3) "two"
+unicode(3) "two"
+unicode(3) "one"
+--
+array(2) {
+  [0]=>
+  NULL
+  [1]=>
+  NULL
+}
+array(1) {
+  [0]=>
+  NULL
+}
+Done