diff --git a/funcs/func_strings.c b/funcs/func_strings.c
index ffe7e4e026b20b730bf1800f4962acc173f93bc7..b8aac135189d4ac91729ff18da3e9d594ee0976d 100644
--- a/funcs/func_strings.c
+++ b/funcs/func_strings.c
@@ -496,8 +496,13 @@ static int acf_sprintf(struct ast_channel *chan, const char *cmd, char *data, ch
 				formatbuf[&arg.format[i] - formatstart + 1] = '\0';
 
 				/* Convert the argument into the required type */
-				if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
-					ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+				if (arg.var[argcount]) {
+					if (sscanf(arg.var[argcount++], "%d", &tmpi) != 1) {
+						ast_log(LOG_ERROR, "Argument '%s' is not an integer number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+						goto sprintf_fail;
+					}
+				} else {
+					ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
 					goto sprintf_fail;
 				}
 
@@ -514,8 +519,13 @@ static int acf_sprintf(struct ast_channel *chan, const char *cmd, char *data, ch
 				formatbuf[&arg.format[i] - formatstart + 1] = '\0';
 
 				/* Convert the argument into the required type */
-				if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
-					ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+				if (arg.var[argcount]) {
+					if (sscanf(arg.var[argcount++], "%lf", &tmpd) != 1) {
+						ast_log(LOG_ERROR, "Argument '%s' is not a floating point number for format '%s'\n", arg.var[argcount - 1], formatbuf);
+						goto sprintf_fail;
+					}
+				} else {
+					ast_log(LOG_ERROR, "SPRINTF() has more format specifiers than arguments!\n");
 					goto sprintf_fail;
 				}
 
@@ -562,6 +572,7 @@ static int acf_sprintf(struct ast_channel *chan, const char *cmd, char *data, ch
 			}
 		}
 	}
+	*bufptr = '\0';
 	return 0;
 sprintf_fail:
 	return -1;