Merge from mainline.

diff --cc src/ChangeLog
index b23904a3575bb16de749e0b13d9a315eadc8efa8,f67e27f4e5e1807d3b7de00c3b9c21dfb97cfd27..939e11ed61c319b5431e01020c7684ace0387e96
--- 1/src/ChangeLog
--- 2/src/ChangeLog
+++ b/src/ChangeLog
@@@ -1,7 -1,16 +1,20 @@@
 +2011-04-27  Paul Eggert  <eggert@cs.ucla.edu>
 +
 +      * doprnt.c (doprnt): Support "ll" length modifier, for long long.
 +
+ 2011-04-27  Eli Zaretskii  <eliz@gnu.org>
+ 
+       Improve `doprnt' and its usage.  (Bug#8545)
+       * doprnt.c (doprnt): Make sure `format' is never accessed beyond
+       `format_end'.  Remove support for %l as a conversion specifier.
+       Don't use xrealloc.  Improve diagnostics when the %l size modifier
+       is used.  Update the commentary.
+ 
+       * eval.c (verror): Simplify calculation of size_t.
+ 
+       * coding.c (Ffind_operation_coding_system): Fix diagnostic error
+       messages.
+ 
  2011-04-27  Yoshiaki Kasahara  <kasahara@nc.kyushu-u.ac.jp>  (tiny change)
  
        * buffer.c (init_buffer) [USE_MMAP_FOR_BUFFERS]: Adjust to aliasing

diff --cc src/doprnt.c
index 229ad06e057913db360ce15a841f410bfab6b7ec,92e2d6274320961a2fc6a718487f3a72ae1d909d..cc4e5daebf32c0e5c5bab505f40466c167bee6a1
--- 1/src/doprnt.c
--- 2/src/doprnt.c
+++ b/src/doprnt.c
@@@ -65,24 -64,26 +64,28 @@@ along with GNU Emacs.  If not, see <htt
     %c means print a `signed int' argument as a single character.
     %% means produce a literal % character.
  
-    A %-sequence may contain optional flag, width, and precision specifiers, as
-    follows:
+    A %-sequence may contain optional flag, width, and precision specifiers, and
+    a length modifier, as follows:
  
-      %<flags><width><precision>character
+      %<flags><width><precision><length>character
  
 -   where flags is [+ -0], width is [0-9]+, precision is .[0-9]+, and length
 -   modifier is l.
 +   where flags is [+ -0l], width is [0-9]+, and precision is .[0-9]+
  
     The + flag character inserts a + before any positive number, while a space
-    inserts a space before any positive number; these flags only affect %d, %l,
-    %o, %x, %e, %f, and %g sequences.  The - and 0 flags affect the width
-    specifier, as described below.
- 
-    The l (lower-case letter ell) flag is a `long' data type modifier: it is
-    supported for %d, %o, and %x conversions of integral arguments, and means
-    that the respective argument is to be treated as `long int' or `unsigned
-    long int'.  ll means to use 'long long'.  EMACS_INT arguments
-    should use the pI macro, which expands to whatever length modifier
-    is needed for the target host, e.g., "", "l", "ll".
+    inserts a space before any positive number; these flags only affect %d, %o,
+    %x, %e, %f, and %g sequences.  The - and 0 flags affect the width specifier,
+    as described below.  For signed numerical arguments only, the ` ' (space)
+    flag causes the result to be prefixed with a space character if it does not
+    start with a sign (+ or -).
+ 
+    The l (lower-case letter ell) length modifier is a `long' data type
+    modifier: it is supported for %d, %o, and %x conversions of integral
 -   arguments, must immediately preced the conversion specifier, and means that
++   arguments, must immediately precede the conversion specifier, and means that
+    the respective argument is to be treated as `long int' or `unsigned long
 -   int'.  The EMACS_INT data type should use this modifier.
++   int'.  Similarly, ll (two letter ells) means to use `long long int' or
++   `unsigned long long int'.  The empty length modifier means to use `int' or
++   `unsigned int'.  EMACS_INT arguments should use the pI macro, which
++   expands to whatever length modifier is needed for the target host.
  
     The width specifier supplies a lower limit for the length of the printed
     representation.  The padding, if any, normally goes on the left, but it goes
@@@ -206,15 -208,9 +210,9 @@@ doprnt (char *buffer, register size_t b
                ;
              else if (*fmt == 'l')
                {
--                long_flag = 1;
-                 if (fmt[1] == 'l')
-                   {
-                     long_flag = 2;
-                     fmt++;
-                   }
-                 if (!strchr ("dox", fmt[1]))
-                   /* %l as conversion specifier, not as modifier.  */
-                   break;
 -                fmt++;
++                long_flag = 1 + (fmt + 1 < fmt_end && fmt[1] == 'l');
++                fmt += long_flag;
+                 break;
                }
              else
                break;