2011-01-27  Petr Baudis  <pasky@suse.cz>

	* stdio-common/vfprintf.c (vfprintf): Pass correct newlen
	to extend_alloca().

diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index fc370e8..ecf5dfa 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -1682,7 +1682,9 @@ do_positional:
 	  {
 	    /* Extend the array of format specifiers.  */
 	    struct printf_spec *old = specs;
-	    specs = extend_alloca (specs, nspecs_max, 2 * nspecs_max);
+	    specs = extend_alloca (specs, nspecs_max,
+				   2 * nspecs_max
+				   * sizeof (struct printf_spec));
 
 	    /* Copy the old array's elements to the new space.  */
 	    memmove (specs, old, nspecs * sizeof (struct printf_spec));