An unneeded zero "\0" is inserted after a right aligned zero padded negative number,
as can be seen with following examples:

  printf("number='%5d'\n",-321);
  // works as expected: number=' -321'
  printf("number='%5f'\n",-321.0123456789);
  // works as expected: number=' -321.012346'
  printf("number='%05d'\n",-321);
  // a \0 is inserted between 1 and closing quote :-(
  printf("number='%05f'\n",-321.0123456789);
  // a \0 is inserted between 6 and closing quote :-(

The bug is IMO in the function php_sprintf_appendstring() in the source
.../ext/standard/formatted_print.c

In the following code fragment of the PHP sources, only the "len" variable is decremented
when a negative number is encountered.

  if (alignment == ALIGN_RIGHT) {
    if (sign && padding=='0') { (*buffer)[(*pos)++] = '-'; add++; len--; }

If "max_width" is also decremented next to "len", then this bug is squashed :-)

  if (alignment == ALIGN_RIGHT) {
    if (sign && padding=='0') { (*buffer)[(*pos)++] = '-'; add++; len--; max_width--; }

Kind regards,
DQ