diff -Nur php5-5.2.4/ext/standard/formatted_print.c php5-5.2.4.new/ext/standard/formatted_print.c
--- php5-5.2.4/ext/standard/formatted_print.c	2007-06-03 05:12:04.000000000 -0400
+++ php5-5.2.4.new/ext/standard/formatted_print.c	2008-07-10 17:05:41.000000000 -0400
@@ -76,6 +76,7 @@
 	register int npad;
 	int req_size;
 	int copy_len;
+	int m_width;
 
 	copy_len = (expprec ? MIN(max_width, len) : len);
 	npad = min_width - copy_len;
@@ -86,11 +87,19 @@
 	
 	PRINTF_DEBUG(("sprintf: appendstring(%x, %d, %d, \"%s\", %d, '%c', %d)\n",
 				  *buffer, *pos, *size, add, min_width, padding, alignment));
+	m_width = MAX(min_width, copy_len);
 
-	req_size = *pos + MAX(min_width, copy_len) + 1;
+	if(m_width > INT_MAX - *pos - 1) {
+		zend_error_noreturn(E_ERROR, "Field width %d is too long", m_width);
+	}
+
+	req_size = *pos + m_width + 1;
 
 	if (req_size > *size) {
 		while (req_size > *size) {
+			if(*size > INT_MAX/2) {
+				zend_error_noreturn(E_ERROR, "Field width %d is too long", req_size); 
+			}
 			*size <<= 1;
 		}
 		PRINTF_DEBUG(("sprintf ereallocing buffer to %d bytes\n", *size));