--- nspr-4.9.2.orig/mozilla/nsprpub/pr/src/io/prprf.c
+++ nspr-4.9.2/mozilla/nsprpub/pr/src/io/prprf.c
@@ -304,7 +304,7 @@ static int cvt_ll(SprintfState *ss, PRIn
 ** Convert a double precision floating point number into its printable
 ** form.
 **
-** XXX stop using sprintf to convert floating point
+** XXX stop using snprintf to convert floating point
 */
 static int cvt_f(SprintfState *ss, double d, const char *fmt0, const char *fmt1)
 {
@@ -312,15 +312,14 @@ static int cvt_f(SprintfState *ss, doubl
     char fout[300];
     int amount = fmt1 - fmt0;
 
-    PR_ASSERT((amount > 0) && (amount < sizeof(fin)));
-    if (amount >= sizeof(fin)) {
-	/* Totally bogus % command to sprintf. Just ignore it */
+    if (amount <= 0 || amount >= sizeof(fin)) {
+	/* Totally bogus % command to snprintf. Just ignore it */
 	return 0;
     }
     memcpy(fin, fmt0, amount);
     fin[amount] = 0;
 
-    /* Convert floating point using the native sprintf code */
+    /* Convert floating point using the native snprintf code */
 #ifdef DEBUG
     {
         const char *p = fin;
@@ -330,14 +329,11 @@ static int cvt_f(SprintfState *ss, doubl
         }
     }
 #endif
-    sprintf(fout, fin, d);
-
-    /*
-    ** This assert will catch overflow's of fout, when building with
-    ** debugging on. At least this way we can track down the evil piece
-    ** of calling code and fix it!
-    */
-    PR_ASSERT(strlen(fout) < sizeof(fout));
+    memset(fout, 0, sizeof(fout));
+    snprintf(fout, sizeof(fout), fin, d);
+    /* Explicitly null-terminate fout because on Windows snprintf doesn't
+     * append a null-terminator if the buffer is too small. */
+    fout[sizeof(fout) - 1] = '\0';
 
     return (*ss->stuff)(ss, fout, strlen(fout));
 }
--- nspr-4.9.2.orig/mozilla/nsprpub/pr/tests/Makefile.in
+++ nspr-4.9.2/mozilla/nsprpub/pr/tests/Makefile.in
@@ -106,6 +106,7 @@ CSRCS =             \
 	poll_nm.c		\
 	poll_to.c		\
 	pollable.c		\
+	prfdbl.c		\
 	prftest.c		\
 	prftest1.c		\
 	prftest2.c		\
--- /dev/null
+++ nspr-4.9.2/mozilla/nsprpub/pr/tests/prfdbl.c
@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * This is a simple test of the PR_fprintf() function for doubles.
+ */
+
+#include "prprf.h"
+
+int main()
+{
+    double pi = 3.1415926;
+    double e = 2.71828;
+    double root2 = 1.414;
+    double nan = 0.0 / 0.0;
+
+    PR_fprintf(PR_STDOUT, "pi is %f.\n", pi);
+    PR_fprintf(PR_STDOUT, "e is %f.\n", e);
+    PR_fprintf(PR_STDOUT, "The square root of 2 is %f.\n", root2);
+    PR_fprintf(PR_STDOUT, "NaN is %f.\n", nan);
+
+    PR_fprintf(PR_STDOUT, "pi is %301f.\n", pi);
+    PR_fprintf(PR_STDOUT, "e is %65416.123f.\n", e);
+    PR_fprintf(PR_STDOUT, "e is %0000000000000000000065416.123f.\n", e);
+    PR_fprintf(PR_STDOUT, "NaN is %1024.1f.\n", nan);
+    return 0;
+}
