diff --git a/ChangeLog b/ChangeLog
index ccb260b451..af8909e240 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+Mon Oct 18 09:57:28 2010  NARUSE, Yui  <naruse@ruby-lang.org>
+
+	* sprintf.c (BSD_vfprintf): wrong padding arround prefix and
+	  floating point with %a. [ruby-dev:42403] Bug #3956
+
 Sun Oct 17 22:36:33 2010  Tadayoshi Funaba  <tadf@dotrb.org>
 
 	* lib/date/delta.rb: added an rdoc tag.
diff --git a/test/ruby/test_sprintf.rb b/test/ruby/test_sprintf.rb
index 96a1b62bb7..9c4566f8d0 100644
--- a/test/ruby/test_sprintf.rb
+++ b/test/ruby/test_sprintf.rb
@@ -204,6 +204,13 @@ class TestSprintf < Test::Unit::TestCase
     assert_equal("Inf", sprintf("%E", Float::INFINITY))
     assert_equal("NaN", sprintf("%e", Float::NAN))
     assert_equal("NaN", sprintf("%E", Float::NAN))
+
+    assert_equal("   -0x1p+0", sprintf("%10a", -1))
+    assert_equal(" -0x1.8p+0", sprintf("%10a", -1.5))
+    assert_equal(" -0x1.4p+0", sprintf("%10a", -1.25))
+    assert_equal(" -0x1.2p+0", sprintf("%10a", -1.125))
+    assert_equal(" -0x1.1p+0", sprintf("%10a", -1.0625))
+    assert_equal("-0x1.05p+0", sprintf("%10a", -1.03125))
   end
 
   BSIZ = 120
diff --git a/vsnprintf.c b/vsnprintf.c
index a1ac4424a2..1f53bc4265 100644
--- a/vsnprintf.c
+++ b/vsnprintf.c
@@ -829,6 +829,9 @@ fp_begin:		_double = va_arg(ap, double);
 				--expt;
 				expsize = exponent(expstr, expt, ch + 'p' - 'a');
 				size = expsize + ndig;
+				size += 2; /* 0x */
+				if (ndig > 1)
+					++size; /* floating point */
 			}
 			else if (ch <= 'e') {	/* 'e' or 'E' fmt */
 				--expt;