diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index 23648c9271e..5f8cd96b9bc 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,8 @@
+2011-02-24  Jakub Jelinek  <jakub@redhat.com>
+
+	PR fortran/47878
+	* gfortran.dg/pr47878.f90: New test.
+
 2011-02-24  Richard Guenther  <rguenther@suse.de>
 
 	PR testsuite/47801
diff --git a/gcc/testsuite/gfortran.dg/pr47878.f90 b/gcc/testsuite/gfortran.dg/pr47878.f90
new file mode 100644
index 00000000000..9cc4a086031
--- /dev/null
+++ b/gcc/testsuite/gfortran.dg/pr47878.f90
@@ -0,0 +1,10 @@
+! PR fortran/47878
+! { dg-do run }
+  integer :: a(5)
+  open (99, recl = 40)
+  write (99, '(5i3)') 1, 2, 3
+  rewind (99)
+  read (99, '(5i3)') a
+  if (any (a.ne.(/1, 2, 3, 0, 0/))) call abort 
+  close (99, status = 'delete')
+end
diff --git a/libgfortran/ChangeLog b/libgfortran/ChangeLog
index 0b0a27e9c8e..c7e1950b1c4 100644
--- a/libgfortran/ChangeLog
+++ b/libgfortran/ChangeLog
@@ -1,3 +1,9 @@
+2011-02-24  Jakub Jelinek  <jakub@redhat.com>
+
+	PR fortran/47878
+	* io/transfer.c (read_sf): Call fbuf_getptr only at the end,
+	and subtract n, dtp->u.p.sf_seen_eor and seen_comma from it.
+
 2011-02-24  Janne Blomqvist  <jb@gcc.gnu.org>
 
 	PR libfortran/47802
diff --git a/libgfortran/io/transfer.c b/libgfortran/io/transfer.c
index ad5d19d2bf5..15f90e767aa 100644
--- a/libgfortran/io/transfer.c
+++ b/libgfortran/io/transfer.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
+/* Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011
    Free Software Foundation, Inc.
    Contributed by Andy Vaught
    Namelist transfer functions contributed by Paul Thomas
@@ -284,7 +284,6 @@ static char *
 read_sf (st_parameter_dt *dtp, int * length)
 {
   static char *empty_string[0];
-  char *base;
   int q, q2;
   int n, lorig, seen_comma;
 
@@ -302,9 +301,6 @@ read_sf (st_parameter_dt *dtp, int * length)
 
   /* Read data into format buffer and scan through it.  */
   lorig = *length;
-  base = fbuf_getptr (dtp->u.p.current_unit);
-  if (base == NULL)
-    return NULL;
 
   while (n < *length)
     {
@@ -396,7 +392,12 @@ read_sf (st_parameter_dt *dtp, int * length)
   if ((dtp->common.flags & IOPARM_DT_HAS_SIZE) != 0)
     dtp->u.p.size_used += (GFC_IO_INT) n;
 
-  return base;
+  /* We can't call fbuf_getptr before the loop doing fbuf_getc, because
+     fbuf_getc might reallocate the buffer.  So return current pointer
+     minus all the advances, which is n plus up to two characters
+     of newline or comma.  */
+  return fbuf_getptr (dtp->u.p.current_unit)
+	 - n - dtp->u.p.sf_seen_eor - seen_comma;
 }