Rémi Zara <remi_zara@mac.com> writes:
> The crash occurs in pg_sprintf, work on which has been done beginning
> march 11th....
Offhand I'd bet it's overrunning its malloc'd arrays because the loop at
the top doesn't count "*" as needing a fmtpos position.
regards, tom lane