From 2d47816e558388191f4294dee469a0a224e8bb40 Mon Sep 17 00:00:00 2001
From: Lorenz Meier <lm@inf.ethz.ch>
Date: Sat, 16 Mar 2013 20:05:22 +0100
Subject: [PATCH] Attempt to fix sscanf() %n handling

---
 nuttx/libc/stdio/lib_sscanf.c | 52 +++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 23 deletions(-)

diff --git a/nuttx/libc/stdio/lib_sscanf.c b/nuttx/libc/stdio/lib_sscanf.c
index 77a6cf212f..0092fbec2e 100644
--- a/nuttx/libc/stdio/lib_sscanf.c
+++ b/nuttx/libc/stdio/lib_sscanf.c
@@ -197,7 +197,7 @@ int vsscanf(FAR char *buf, FAR const char *fmt, va_list ap)
   noassign = false;
   lflag    = false;
 
-  while (*fmt && *buf)
+  while (*fmt)
     {
       /* Skip over white space */
 
@@ -242,6 +242,33 @@ int vsscanf(FAR char *buf, FAR const char *fmt, va_list ap)
                   fmt--;
                 }
             }
+            
+            /* Process %n:  Character count */
+            
+            if (*fmt == 'n')
+            {
+                lvdbg("vsscanf: Performing character count\n");
+                
+                if (!noassign)
+                {
+                    size_t nchars = (size_t)(buf - bufstart);
+                    
+                    if (lflag)
+                    {
+                        long *plong = va_arg(ap, long*);
+                        *plong = (long)nchars;
+                    }
+                    else
+                    {
+                        int *pint = va_arg(ap, int*);
+                        *pint = (int)nchars;
+                    }
+                }
+            } else {
+                
+            /* Check for valid data in input string */
+            if (!(*buf))
+                break;
 
           /* Process %s:  String conversion */
 
@@ -445,28 +472,7 @@ int vsscanf(FAR char *buf, FAR const char *fmt, va_list ap)
 #endif
             }
 
-          /* Process %n:  Character count */
-
-          else if (*fmt == 'n')
-            {
-              lvdbg("vsscanf: Performing character count\n");
-
-              if (!noassign)
-                {
-                  size_t nchars = (size_t)(buf - bufstart);
-
-                  if (lflag)
-                    {
-                      long *plong = va_arg(ap, long*);
-                      *plong = (long)nchars;
-                    }
-                  else
-                    {
-                      int *pint = va_arg(ap, int*);
-                      *pint = (int)nchars;
-                    }
-                }
-            }
+        }
 
           /* Note %n does not count as a conversion */