diff --git a/tests/printf.test b/tests/printf.test
index 57f2a283..3d37e1b7 100755
--- a/tests/printf.test
+++ b/tests/printf.test
@@ -87,3 +87,8 @@ testcmd "%b \e" "'%b' '\\e' | xxd -p" "1b\n" "" ""
 testcmd "\e" "'\\e' | xxd -p" "1b\n" "" ""
 
 testcmd '\0 in %b' '%b ab\\x07\\0x07 | xxd -p' '61620700783037\n' '' ''
+
+testcmd 'short err1' '% 2>/dev/null || echo yes' 'yes\n' '' ''
+testcmd 'short err2' '"%*" 2>/dev/null || echo yes' 'yes\n' '' ''
+testcmd 'short err3' '"%*." 2>/dev/null || echo yes' 'yes\n' "" ""
+testcmd 'short err4' '"%*.123" 2>/dev/null || echo yes' 'yes\n' "" ""
diff --git a/toys/posix/printf.c b/toys/posix/printf.c
index c80e6fe4..dbbb36c6 100644
--- a/toys/posix/printf.c
+++ b/toys/posix/printf.c
@@ -97,7 +97,7 @@ void printf_main(void)
 
         // Parse width.precision between % and type indicator.
         *to++ = '%';
-        while (strchr("-+# '0", *f) && (to-toybuf)<10) *to++ = *f++;
+        while (*f && strchr("-+# '0", *f) && (to-toybuf)<10) *to++ = *f++;
         for (;;) {
           if (chrstart(&f, '*')) {
             if (*arg) wp[i] = atolx(*arg++);
@@ -111,6 +111,7 @@ void printf_main(void)
         aa = *arg ? *arg++ : "";
 
         // Output %esc using parsed format string
+        if (!c) error_exit("bad %s", *toys.optargs);
         if (c == 'b') {
           while (*aa)
             putchar(chrstart(&aa, '\\') ? handle_slash(&aa, 1) : *aa++);