1 files changed, 6 insertions, 12 deletions

diff --git a/Zend/zend_operators.c b/Zend/zend_operators.c
index 0a9281c8a4..505b12c8aa 100644
--- a/Zend/zend_operators.c
+++ b/Zend/zend_operators.c
@@ -29,6 +29,7 @@
 #include "zend_API.h"
 #include "zend_multiply.h"
 #include "zend_strtod.h"
+#include "zend_exceptions.h"
 
 #define LONG_SIGN_MASK (1L << (8*sizeof(long)-1))
 
@@ -550,21 +551,18 @@ ZEND_API void _convert_to_string(zval *op ZEND_FILE_LINE_DC)
 			TSRMLS_FETCH();
 
 			zend_list_delete(op->value.lval);
-			op->value.str.val = (char *) emalloc(sizeof("Resource id #") + MAX_LENGTH_OF_LONG);
-			op->value.str.len = sprintf(op->value.str.val, "Resource id #%ld", tmp);
+			op->value.str.len = zend_spprintf(&op->value.str.val, 0, "Resource id #%ld", tmp);
 			break;
 		}
 		case IS_LONG:
 			lval = op->value.lval;
 
-			op->value.str.val = (char *) emalloc_rel(MAX_LENGTH_OF_LONG + 1);
-			op->value.str.len = zend_sprintf(op->value.str.val, "%ld", lval);  /* SAFE */
+			op->value.str.len = zend_spprintf(&op->value.str.val, 0, "%ld", lval);  /* SAFE */
 			break;
 		case IS_DOUBLE: {
 			TSRMLS_FETCH();
 			dval = op->value.dval;
-			op->value.str.val = (char *) emalloc_rel(MAX_LENGTH_OF_DOUBLE + EG(precision) + 1);
-			op->value.str.len = zend_sprintf(op->value.str.val, "%.*G", (int) EG(precision), dval);  /* SAFE */
+			op->value.str.len = zend_spprintf(&op->value.str.val, 0, "%.*G", (int) EG(precision), dval);  /* SAFE */
 			/* %G already handles removing trailing zeros from the fractional part, yay */
 			break;
 		}
@@ -2031,13 +2029,9 @@ ZEND_API void zend_compare_objects(zval *result, zval *o1, zval *o2 TSRMLS_DC)
 
 ZEND_API void zend_locale_sprintf_double(zval *op ZEND_FILE_LINE_DC)
 {
-	double dval = op->value.dval;
-	
 	TSRMLS_FETCH();
-	
-	op->value.str.val = (char *) emalloc_rel(MAX_LENGTH_OF_DOUBLE + EG(precision) + 1);
-	sprintf(op->value.str.val, "%.*G", (int) EG(precision), dval);
-	op->value.str.len = strlen(op->value.str.val);
+
+	op->value.str.len = zend_spprintf(&op->value.str.val, 0, "%.*G", (int) EG(precision), (double)op->value.dval);
 }
 
 /*