* editfns.c (Fformat): Since floats occupy two elements in the

	argument list passed to doprnt, we must use separate indices for
	the array of arguments passed to Fformat, and the array of
	arguments to be passed to doprnt.

src/editfns.c

@@ -1394,29 +1394,34 @@ Use %% to put a single % into the output.")
 
   {
     register int nstrings = n + 1;
+
+    /* Allocate twice as many strings as we have %-escapes; floats occupy
+       two slots, and we're not sure how many of those we have.  */
     register unsigned char **strings
-      = (unsigned char **) alloca (nstrings * sizeof (unsigned char *));
+      = (unsigned char **) alloca (2 * nstrings * sizeof (unsigned char *));
+    int i;
 
+    i = 0;
     for (n = 0; n < nstrings; n++)
       {
 	if (n >= nargs)
-	  strings[n] = (unsigned char *) "";
+	  strings[i++] = (unsigned char *) "";
 	else if (XTYPE (args[n]) == Lisp_Int)
 	  /* We checked above that the corresponding format effector
 	     isn't %s, which would cause MPV.  */
-	  strings[n] = (unsigned char *) XINT (args[n]);
+	  strings[i++] = (unsigned char *) XINT (args[n]);
 #ifdef LISP_FLOAT_TYPE
 	else if (XTYPE (args[n]) == Lisp_Float)
 	  {
 	    union { double d; int half[2]; } u;
 
 	    u.d = XFLOAT (args[n])->data;
-	    strings[n++] = (unsigned char *) u.half[0];
-	    strings[n] = (unsigned char *) u.half[1];
+	    strings[i++] = (unsigned char *) u.half[0];
+	    strings[i++] = (unsigned char *) u.half[1];
 	  }
 #endif
 	else
-	  strings[n] = XSTRING (args[n])->data;
+	  strings[i++] = XSTRING (args[n])->data;
       }
 
     /* Format it in bigger and bigger buf's until it all fits. */
@@ -1425,7 +1430,7 @@ Use %% to put a single % into the output.")
 	buf = (char *) alloca (total + 1);
 	buf[total - 1] = 0;
 
-	length = doprnt (buf, total + 1, strings[0], end, nargs, strings + 1);
+	length = doprnt (buf, total + 1, strings[0], end, i-1, strings + 1);
 	if (buf[total - 1] == 0)
 	  break;