diff --git a/ChangeLog b/ChangeLog
index cea169142b..c370154d9f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,11 @@
 2006-05-02  Ulrich Drepper  <drepper@redhat.com>
 
+	[BZ #2509]
+	* stdio-common/vfprintf.c (process_arg): Fix reading of signed
+	short and byte values from parameter list.
+	* stdio-common/tst-printf.c (main): Add more tests.
+	* stdio-common/tst-printf.sh: Adjust for tst-printf.c change.
+
 	* iconvdata/testdate/MIK: Fix format to match expected output.
 
 	[BZ #2632]
diff --git a/stdio-common/tst-printf.c b/stdio-common/tst-printf.c
index a9db7ad2de..06fa38ab55 100644
--- a/stdio-common/tst-printf.c
+++ b/stdio-common/tst-printf.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 1991,92,93,95,96,97,98,99, 2000, 2002
+/* Copyright (C) 1991,92,93,95,96,97,98,99, 2000, 2002, 2006
      Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
@@ -273,6 +273,15 @@ I am ready for my first lesson today.";
 
   printf ("printf (\"%%hhu\", %u) = %hhu\n", UCHAR_MAX + 2, UCHAR_MAX + 2);
   printf ("printf (\"%%hu\", %u) = %hu\n", USHRT_MAX + 2, USHRT_MAX + 2);
+  printf ("printf (\"%%hhi\", %i) = %hhi\n", UCHAR_MAX + 2, UCHAR_MAX + 2);
+  printf ("printf (\"%%hi\", %i) = %hi\n", USHRT_MAX + 2, USHRT_MAX + 2);
+
+  printf ("printf (\"%%1$hhu\", %2$u) = %1$hhu\n",
+	  UCHAR_MAX + 2, UCHAR_MAX + 2);
+  printf ("printf (\"%%1$hu\", %2$u) = %1$hu\n", USHRT_MAX + 2, USHRT_MAX + 2);
+  printf ("printf (\"%%1$hhi\", %2$i) = %1$hhi\n",
+	  UCHAR_MAX + 2, UCHAR_MAX + 2);
+  printf ("printf (\"%%1$hi\", %2$i) = %1$hi\n", USHRT_MAX + 2, USHRT_MAX + 2);
 
   puts ("--- Should be no further output. ---");
   rfg1 ();
diff --git a/stdio-common/tst-printf.sh b/stdio-common/tst-printf.sh
index 3655558d16..04d04b20b8 100644
--- a/stdio-common/tst-printf.sh
+++ b/stdio-common/tst-printf.sh
@@ -246,6 +246,12 @@ Test ok.
 sprintf (buf, "%07Lo", 040000000000ll) = 40000000000
 printf ("%hhu", 257) = 1
 printf ("%hu", 65537) = 1
+printf ("%hhi", 257) = 1
+printf ("%hi", 65537) = 1
+printf ("%1$hhu", 257) = 1
+printf ("%1$hu", 65537) = 1
+printf ("%1$hhi", 257) = 1
+printf ("%1$hi", 65537) = 1
 --- Should be no further output. ---
 EOF
 cmp - ${common_objpfx}stdio-common/tst-printf.out > /dev/null 2>&1 ||
diff --git a/stdio-common/vfprintf.c b/stdio-common/vfprintf.c
index eb11ac2806..53339f3078 100644
--- a/stdio-common/vfprintf.c
+++ b/stdio-common/vfprintf.c
@@ -530,14 +530,24 @@ vfprintf (FILE *s, const CHAR_T *format, va_list ap)
 	    {								      \
 	      if (is_long_num)						      \
 		signed_number = va_arg (ap, long int);			      \
-	      else  /* `char' and `short int' will be promoted to `int'.  */  \
+	      else if (is_char)						      \
+	        signed_number = (signed char) va_arg (ap, unsigned int);      \
+	      else if (!is_short)					      \
 		signed_number = va_arg (ap, int);			      \
+	      else							      \
+		signed_number = (short int) va_arg (ap, unsigned int);	      \
 	    }								      \
 	  else								      \
 	    if (is_long_num)						      \
 	      signed_number = args_value[fspec->data_arg].pa_long_int;	      \
-	    else  /* `char' and `short int' will be promoted to `int'.  */    \
+	    else if (is_char)						      \
+	      signed_number = (signed char)				      \
+		args_value[fspec->data_arg].pa_u_int;			      \
+	    else if (!is_short)						      \
 	      signed_number = args_value[fspec->data_arg].pa_int;	      \
+	    else							      \
+	      signed_number = (short int)				      \
+		args_value[fspec->data_arg].pa_u_int;			      \
 									      \
 	  is_negative = signed_number < 0;				      \
 	  number.word = is_negative ? (- signed_number) : signed_number;      \