Created attachment 5215 [details]
proposed patch

A seldom-used code branch in vfprintf causes stack corruption in this (minimal) testcase:

#include <stdio.h>

int main()
{
  printf ("\n%1$s\n" "%1$s" "%2$s" "%2$s" "%3$s" "%4$s" "%5$d" "%5$d" "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%",
          "a", "b", "c", "d", 5);
  return 0;
}