diff -Naurd mpfr-3.1.1-a/PATCHES mpfr-3.1.1-b/PATCHES
--- mpfr-3.1.1-a/PATCHES	2012-08-30 09:35:12.000000000 +0000
+++ mpfr-3.1.1-b/PATCHES	2012-08-30 09:35:12.000000000 +0000
@@ -0,0 +1 @@
+strtofr-ternary-value
diff -Naurd mpfr-3.1.1-a/VERSION mpfr-3.1.1-b/VERSION
--- mpfr-3.1.1-a/VERSION	2012-08-30 09:28:51.000000000 +0000
+++ mpfr-3.1.1-b/VERSION	2012-08-30 09:35:12.000000000 +0000
@@ -1 +1 @@
-3.1.1-p1
+3.1.1-p2
diff -Naurd mpfr-3.1.1-a/src/mpfr.h mpfr-3.1.1-b/src/mpfr.h
--- mpfr-3.1.1-a/src/mpfr.h	2012-08-30 09:28:51.000000000 +0000
+++ mpfr-3.1.1-b/src/mpfr.h	2012-08-30 09:35:12.000000000 +0000
@@ -27,7 +27,7 @@
 #define MPFR_VERSION_MAJOR 3
 #define MPFR_VERSION_MINOR 1
 #define MPFR_VERSION_PATCHLEVEL 1
-#define MPFR_VERSION_STRING "3.1.1-p1"
+#define MPFR_VERSION_STRING "3.1.1-p2"
 
 /* Macros dealing with MPFR VERSION */
 #define MPFR_VERSION_NUM(a,b,c) (((a) << 16L) | ((b) << 8) | (c))
diff -Naurd mpfr-3.1.1-a/src/strtofr.c mpfr-3.1.1-b/src/strtofr.c
--- mpfr-3.1.1-a/src/strtofr.c	2012-07-03 15:01:16.000000000 +0000
+++ mpfr-3.1.1-b/src/strtofr.c	2012-08-30 09:35:12.000000000 +0000
@@ -667,6 +667,20 @@
           /* (z, exp_z) = base^(exp_base-pstr_size) */
           z = result + 2*ysize + 1;
           err = mpfr_mpn_exp (z, &exp_z, pstr->base, exp_z, ysize);
+          /* Since we want y/z rounded toward zero, we must get an upper
+             bound of z. If err >= 0, the error on z is bounded by 2^err. */
+          if (err >= 0)
+            {
+              mp_limb_t cy;
+              unsigned long h = err / GMP_NUMB_BITS;
+              unsigned long l = err - h * GMP_NUMB_BITS;
+
+              if (h >= ysize) /* not enough precision in z */
+                goto next_loop;
+              cy = mpn_add_1 (z, z, ysize - h, MPFR_LIMB_ONE << l);
+              if (cy != 0) /* the code below requires z on ysize limbs */
+                goto next_loop;
+            }
           exact = exact && (err == -1);
           if (err == -2)
             goto underflow; /* FIXME: Sure? */
@@ -730,6 +744,7 @@
                                        MPFR_RNDN, rnd, MPFR_PREC(x)))
         break;
 
+    next_loop:
       /* update the prec for next loop */
       MPFR_ZIV_NEXT (loop, prec);
     } /* loop */
diff -Naurd mpfr-3.1.1-a/src/version.c mpfr-3.1.1-b/src/version.c
--- mpfr-3.1.1-a/src/version.c	2012-08-30 09:28:51.000000000 +0000
+++ mpfr-3.1.1-b/src/version.c	2012-08-30 09:35:12.000000000 +0000
@@ -25,5 +25,5 @@
 const char *
 mpfr_get_version (void)
 {
-  return "3.1.1-p1";
+  return "3.1.1-p2";
 }
diff -Naurd mpfr-3.1.1-a/tests/tstrtofr.c mpfr-3.1.1-b/tests/tstrtofr.c
--- mpfr-3.1.1-a/tests/tstrtofr.c	2012-07-03 15:01:24.000000000 +0000
+++ mpfr-3.1.1-b/tests/tstrtofr.c	2012-08-30 09:35:12.000000000 +0000
@@ -1105,6 +1105,92 @@
   mpfr_clear (y);
 }
 
+/* From a bug reported by Joseph S. Myers
+   https://sympa.inria.fr/sympa/arc/mpfr/2012-08/msg00005.html */
+static void
+bug20120814 (void)
+{
+  mpfr_exp_t emin = -30, e;
+  mpfr_t x, y;
+  int r;
+  char s[64], *p;
+
+  mpfr_init2 (x, 2);
+  mpfr_set_ui_2exp (x, 3, emin - 2, MPFR_RNDN);
+  mpfr_get_str (s + 1, &e, 10, 19, x, MPFR_RNDD);
+  s[0] = s[1];
+  s[1] = '.';
+  for (p = s; *p != 0; p++) ;
+  *p = 'e';
+  sprintf (p + 1, "%d", (int) e - 1);
+
+  mpfr_init2 (y, 4);
+  r = mpfr_strtofr (y, s, NULL, 0, MPFR_RNDN);
+  if (r <= 0 || ! mpfr_equal_p (x, y))
+    {
+      printf ("Error in bug20120814\n");
+      printf ("mpfr_strtofr failed on string \"%s\"\n", s);
+      printf ("Expected inex > 0 and y = 0.1100E%d\n", (int) emin);
+      printf ("Got inex = %-6d and y = ", r);
+      mpfr_dump (y);
+      exit (1);
+    }
+
+  mpfr_clear (x);
+  mpfr_clear (y);
+}
+
+static void
+bug20120829 (void)
+{
+  mpfr_t x1, x2, e;
+  int inex1, inex2, i, r;
+  char s[48] = "1e-1";
+
+  mpfr_init2 (e, 128);
+  mpfr_inits2 (4, x1, x2, (mpfr_ptr) 0);
+
+  inex1 = mpfr_set_si (e, -1, MPFR_RNDN);
+  MPFR_ASSERTN (inex1 == 0);
+
+  for (i = 1; i <= sizeof(s) - 5; i++)
+    {
+      s[3+i] = '0';
+      s[4+i] = 0;
+      inex1 = mpfr_mul_ui (e, e, 10, MPFR_RNDN);
+      MPFR_ASSERTN (inex1 == 0);
+      RND_LOOP(r)
+        {
+          mpfr_rnd_t rnd = (mpfr_rnd_t) r;
+
+          inex1 = mpfr_exp10 (x1, e, rnd);
+          inex1 = SIGN (inex1);
+          inex2 = mpfr_strtofr (x2, s, NULL, 0, rnd);
+          inex2 = SIGN (inex2);
+          /* On 32-bit machines, for i = 7, r8389, r8391 and r8394 do:
+             strtofr.c:...: MPFR assertion failed: cy == 0
+             r8396 is OK.
+             On 64-bit machines, for i = 15,
+             r8389 does: strtofr.c:678: MPFR assertion failed: err < (64 - 0)
+             r8391 does: strtofr.c:680: MPFR assertion failed: h < ysize
+             r8394 and r8396 are OK.
+          */
+          if (! mpfr_equal_p (x1, x2) || inex1 != inex2)
+            {
+              printf ("Error in bug20120829 for i = %d, rnd = %s\n",
+                      i, mpfr_print_rnd_mode (rnd));
+              printf ("Expected inex = %d, x = ", inex1);
+              mpfr_dump (x1);
+              printf ("Got      inex = %d, x = ", inex2);
+              mpfr_dump (x2);
+              exit (1);
+            }
+        }
+    }
+
+  mpfr_clears (e, x1, x2, (mpfr_ptr) 0);
+}
+
 int
 main (int argc, char *argv[])
 {
@@ -1117,6 +1203,8 @@
   check_retval ();
   bug20081028 ();
   test20100310 ();
+  bug20120814 ();
+  bug20120829 ();
 
   tests_end_mpfr ();
   return 0;