Even if you're not realloc()ing the string, you still need to plug in the

replacement value.

src/xpdev/xpprintf.c

@@ -1122,19 +1122,21 @@ char *xp_asprintf_next(char *format, int type, ...)
 	}
 
 	this_format_len=strlen(this_format);
-	if(j>=0 && format_len < (format_len-this_format_len+j)) {
+	if(j>=0) {
 		/*
 		 * This isn't necessary if it's already the right size,
 		 * or it's too large... this realloc() should only need to grow
 		 * the string.
 		 */
-		newbuf=(char *)realloc(format, format_len-this_format_len+j);
-		if(newbuf==NULL) {
-			if(entry != entry_buf)
-				free(entry);
-			return(NULL);
+		if(format_len < (format_len-this_format_len+j)) {
+			newbuf=(char *)realloc(format, format_len-this_format_len+j);
+			if(newbuf==NULL) {
+				if(entry != entry_buf)
+					free(entry);
+				return(NULL);
+			}
+			format=newbuf;
 		}
-		format=newbuf;
 		/* Move trailing end to make space */
 		memmove(format+offset+j, format+offset+this_format_len, format_len-offset-this_format_len);
 		memcpy(format+offset, entry, j);