Index: ext/standard/math.c
===================================================================
RCS file: /repository/php-src/ext/standard/math.c,v
retrieving revision 1.97.2.13.2.3
diff -u -r1.97.2.13.2.3 math.c
--- ext/standard/math.c	1 Jan 2006 13:46:57 -0000	1.97.2.13.2.3
+++ ext/standard/math.c	16 Jul 2006 09:15:04 -0000
@@ -1015,13 +1015,8 @@
 		is_negative = 1;
 		d = -d;
 	}
-	if (!dec_point && dec > 0) {
-		d *= pow(10, dec);
-		dec = 0;
-	} else {
-		dec = MAX(0, dec);
-	}
 
+	dec = MAX(0, dec);
 	PHP_ROUND_WITH_FUZZ(d, dec);
 
 	tmplen = spprintf(&tmpbuf, 0, "%.*f", dec, d);
@@ -1030,8 +1025,10 @@
 		return tmpbuf;
 	}
 
+	/* find decimal point, if expected */
+	dp = dec ? strchr(tmpbuf, '.') : NULL;
+
 	/* calculate the length of the return buffer */
-	dp = strchr(tmpbuf, '.');
 	if (dp) {
 		integral = dp - tmpbuf;
 	} else {
@@ -1047,7 +1044,11 @@
 	reslen = integral;
 
 	if (dec) {
-		reslen += 1 + dec;
+		reslen += dec;
+
+		if (dec_point) {
+			reslen++;
+		}
 	}
 
 	/* add a byte for minus sign */
@@ -1064,29 +1065,29 @@
 	 * Take care, as the sprintf implementation may return less places than
 	 * we requested due to internal buffer limitations */
 	if (dec) {
-		int declen = dp ? strlen(dp+1) : 0;
-		int topad = declen > 0 ? dec - declen : 0;
+		int declen = dp ? s - dp : 0;
+		int topad = dec > declen ? dec - declen : 0;
 
 		/* pad with '0's */
-
 		while (topad--) {
 			*t-- = '0';
 		}
 
 		if (dp) {
-			/* now copy the chars after the point */
-			memcpy(t - declen + 1, dp + 1, declen);
-
+			s -= declen + 1; /* +1 to skip the point */
 			t -= declen;
-			s -= declen;
+
+			/* now copy the chars after the point */
+			memcpy(t + 1, dp + 1, declen);
 		}
 
 		/* add decimal point */
-		*t-- = dec_point;
-		s--;
+		if (dec_point) {
+			*t-- = dec_point;
+		}
 	}
 
-	/* copy the numbers before the decimal place, adding thousand
+	/* copy the numbers before the decimal point, adding thousand
 	 * separator every three digits */
 	while(s >= tmpbuf) {
 		*t-- = *s--;
@@ -1106,13 +1107,13 @@
 }
 
 /* }}} */
-/* {{{ proto string number_format(float number [, int num_decimal_places [, string dec_seperator, string thousands_seperator]])
+/* {{{ proto string number_format(float number [, int decimals [, string dec_point, string thousands_sep]])
    Formats a number with grouped thousands */
 
 PHP_FUNCTION(number_format)
 {
-	zval **num, **dec, **t_s, **d_p;
-	char thousand_sep=',', dec_point='.';
+	zval **num, **dec, **d_p, **t_s;
+	char dec_point='.', thousand_sep=',';
 
 	switch(ZEND_NUM_ARGS()) {
 	case 1: