sscanf problem

Imported from http://bugzilla.roxen.com/bugzilla/show_bug.cgi?id=678

Reported by Thomas Bopp, Uni-GH Paderborn astra@upb.de

I cannot reproduce this bug in a simple case. sscanf is not The code is:

private static array(object)
get_sanction_new(string str, mapping vars)
{
    array(object) sanctions = ({ });
    string ustr;
    object  obj;
    int     oid;

    if ( stringp(ustr=copy_value(vars["sanction_new_"+str])) ) {
        int res;

        LOG("Initial String is: " + ustr);
        while ( (res = sscanf(ustr, "user_%d%s", oid, ustr)) > 0 ) {
            LOG("Found " + oid + " new: " + ustr + " Result:"+res);
            obj = find_object(oid);
            if ( objectp(obj) )
                sanctions += ({ obj });
        }
        LOG("Last Result was: " + res +  " on " + ustr + " str="+str);
    }
    return sanctions;
}

and the output:
Initial String is: user_235user_239user_240
Found 235 new: user_239user_240 Result:2
Last Result was: 0 on user_239user_240 str=user

When I write a simple pike program with only a main function this works fine. I also played around with a mapping, etc. The copy_value was also just to check what happens. Also tried to have another string in the sscanf, like sscanf(ustr...,s) and ustr = s; in the body of the loop.

---Thomas PS: Roxen seems to concat values of a variable if the same variable is placed more often in the call (like test?type=1&type=2 id->vars["type"] =="12"). Wouldnt it be better to have type = { "1","2" } ? This happens when I have a