printf with '*' as field size core dumps when field size missing

[Alexis Huxley]

Configuration Information [Automatically generated, do not change]:
Machine: hppa2.0
OS: hpux11.00
Compiler: gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='hppa2.0' 
-DCONF_OSTYPE='hpux11.00' -DCONF_MACHTYPE='hppa2.0-hp-hpux11.00' 
-DCONF_VENDOR='hp' -DSHELL -DHAVE_CONFIG_H -DHPUX  -I.  -I. -I./lib 
-I/opt/bash/include -g -O2
uname output: HP-UX te35 B.11.00 A 9000/785 2008900992 two-user license
Machine Type: hppa2.0-hp-hpux11.00

Bash Version: 2.03
Patch Level: 0
Release Status: release

Description:
        the builtin command 'printf' causes a core dump when a field width 
specifier
        is missing.

Repeat-By:
        First start a 'script' session or a sub-shell (otherwise your 
        window/login-session will close before you see the error
        message :-)))

                te35$ script
                Script started, file is typescript

        First here it is working fine:

                te35$ printf '%.*s\n' 5 'a string which will be chopped'
                a str
        
        And now here it is just with the field width specifier missing

                te35$ printf '%.*s\n' 'a string which will be chopped'
                bash: printf: a string which will be chopped: illegal number

        Bash then core dumps and exits, returning (via 'script's own
        exit when it sees bash exiting):

                Script done, file is typescript
                te35$ file core
                core:           core file from 'bash' - received SIGSEGV
                te35$ 

        I downloaded the latest bash on ftp.gnu.org and tried the
        same thing with the same results:

                <compile output>
                ashhist.o bashline.o siglist.o list.o stringlib.o locale.o 
findcmd.o redir.o pcomplete.o pcomplib.o syntax.o xmalloc.o -lbuiltins -lsh 
-lreadline -lhistory -ltermcap -lglob -ltilde -lmalloc  
                ls -l bash
                -rwxr-xr-x   1 ahuxley    vlt        4259244 Nov  2 11:30 bash
                size bash
                text    data     bss     dec     hex filename
                624465   28172   12780  665417   a2749 bash
                te35$ ./bash --version
                GNU bash, version 2.05.0(1)-release (hppa2.0w-hp-hpux11.00)
                Copyright 2000 Free Software Foundation, Inc.
                te35$ ./bash
                te35$ printf '%.*s\n' 5 'a string which will be chopped'
                a str
                te35$ printf '%.*s\n' 'a string which will be chopped'
                bash: printf: a string which will be chopped: invalid number
                Segmentation fault (core dumped)
                te35$ ./bash --version
                GNU bash, version 2.05.0(1)-release (hppa2.0w-hp-hpux11.00)
                Copyright 2000 Free Software Foundation, Inc.
                te35$ 

        Hope that helps! BTW, thanks very much for an excellent piece of
        software!

        Alexis