Fix number of required parameters in printf

If n$ references are involved, the maximum argnum referenced may
not the one at the end. Store it explicitly.

Author: nikic

ext/standard/formatted_print.c

@@ -399,7 +399,7 @@ php_formatted_print(char *format, size_t format_len, zval *args, int argc, int n
 	char *temppos, padding;
 	zend_string *result;
 	int always_sign;
-	int bad_arg_number = 0;
+	int max_missing_argnum = -1;
 
 	result = zend_string_alloc(size, 0);
 
@@ -527,7 +527,7 @@ php_formatted_print(char *format, size_t format_len, zval *args, int argc, int n
 			PRINTF_DEBUG(("sprintf: format character='%c'\n", *format));
 
 			if (argnum >= argc) {
-				bad_arg_number = 1;
+				max_missing_argnum = MAX(max_missing_argnum, argnum);
 				continue;
 			}
 
@@ -626,12 +626,12 @@ php_formatted_print(char *format, size_t format_len, zval *args, int argc, int n
 		}
 	}
 
-	if (bad_arg_number == 1) {
+	if (max_missing_argnum >= 0) {
 		efree(result);
 		if (nb_additional_parameters == -1) {
-			zend_value_error("The arguments array must contain %d items, %d given", argnum + 1, argc);
+			zend_value_error("The arguments array must contain %d items, %d given", max_missing_argnum + 1, argc);
 		} else {
-			zend_argument_count_error("%d parameters are required, %d given", argnum + nb_additional_parameters + 1, argc + nb_additional_parameters);
+			zend_argument_count_error("%d parameters are required, %d given", max_missing_argnum + nb_additional_parameters + 1, argc + nb_additional_parameters);
 		}
 		return NULL;
 	}

ext/standard/tests/strings/sprintf_error.phpt

@@ -60,6 +60,12 @@ try {
     echo $e->getMessage(), "\n";
 }
 
+try {
+    var_dump(sprintf('%100$d %d'));
+} catch (\ArgumentCountError $e) {
+    echo $e->getMessage(), "\n";
+}
+
 echo "Done";
 ?>
 --EXPECTF--
@@ -75,4 +81,5 @@ sprintf() expects at least %d parameter, %d given
 3 parameters are required, 1 given
 4 parameters are required, 2 given
 4 parameters are required, 1 given
+101 parameters are required, 1 given
 Done