- Fixed Bug #35978 %n format string specifier wrongly implemented

main/snprintf.c

@@ -1015,7 +1015,7 @@ static int format_converter(register buffy * odp, const char *fmt,
 
 				case 'n':
 					*(va_arg(ap, int *)) = cc;
-					break;
+					goto skip_output;
 
 					/*
 					 * Always extract the argument as a "char *" pointer. We 
@@ -1096,6 +1096,7 @@ fmt_error:
 			if (adjust_width && adjust == LEFT && min_width > s_len)
 				PAD(min_width, s_len, pad_char);
 		}
+skip_output:
 		fmt++;
 	}
 	odp->nextb = sp;

main/spprintf.c

@@ -722,7 +722,7 @@ fmt_string:
 
 				case 'n':
 					*(va_arg(ap, int *)) = xbuf->len;
-					break;
+					goto skip_output;
 
 					/*
 					 * Always extract the argument as a "char *" pointer. We 
@@ -802,6 +802,7 @@ fmt_error:
 				PAD(unicode, xbuf, min_width - s_len, pad_char);
 			}
 		}
+skip_output:
 		fmt++;
 	}
 	return;