[uClibc] Weird fprintf problem with 0.9.27

[Andrew de Quincey]

Hi, I'm having a very odd problem with uclibc 0.9.27 on the ppc405 
with GCC 3.4. I'm getting a segfault in the printf() code. Here are the last few frames of 
the backtrace:

#0  0x301e4df8 in _store_inttype (dest=0x0, desttype=0, val=39) at _store_inttype.c:56
#1  0x301e8f98 in _do_one_spec (stream=0x30276574, ppfs=0x7f3ff520, count=0x7f3ff5c0) at vfprintf.c:1509
#2  0x301e9944 in vfprintf (stream=0x30276574, format=0x100d0bc0 "b_set_discontinuity.\n", arg=0x7f3ff670) at vfprintf.c:1878
#3  0x301e2be8 in fprintf (stream=0x30276574, format=0x100d0b98 "00:09:30.059 bbrtspd_prepare_packet: bbrb_set_discontinuity.\n")
    at fprintf.c:17

The segfault always happens at the same place with the same string. It doesn't 
happen immediately. I have a stress testing program for our app, and this error only
happens after 10 minutes or so.

The thing that is confusing me is why it is calling _do_one_spec... from the code in vfprintf, 
that is used when rendering a %... format specification. Yet the string being printed contains
no % characters.

I had a dig about in vfprintf.c/vfprintf(), and the piece of code is:
                        while (*format && (*format != '%')) {
                                ++format;
                        }

                        if (format-s) {         /* output any literal text in format string */
                                if ( (r = OUTNSTR(stream, s, format-s)) < 0) {
                                        count = -1;
                                        break;
                                }
                                count += r;
                        }

                        if (!*format) {                 /* we're done */
                                break;
                        }


The values of format and s are (from the coredump):
format: $1 = 0x100d0bc0 "b_set_discontinuity.\n"
s: $2 = 0x100d0b98 "00:09:30.059 bbrtspd_prepare_packet: bbrb_set_discontinuity.\n"