diff --git a/[refs] b/[refs]
index 9e62d139dee7..860b0e4132b4 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 757dea93e136b219af09d3cd56a81063fdbdef1a
+refs/heads/master: c6b40d16d1cfa1a01158049bb887a9bbe48ef7ba
diff --git a/trunk/lib/vsprintf.c b/trunk/lib/vsprintf.c
index cbab1df150cf..017290241261 100644
--- a/trunk/lib/vsprintf.c
+++ b/trunk/lib/vsprintf.c
@@ -825,6 +825,17 @@ int vsscanf(const char * buf, const char * fmt, va_list args)
 			break;
 		str = next;
 	}
+
+	/*
+	 * Now we've come all the way through so either the input string or the
+	 * format ended. In the former case, there can be a %n at the current
+	 * position in the format that needs to be filled.
+	 */
+	if (*fmt == '%' && *(fmt + 1) == 'n') {
+		int *p = (int *)va_arg(args, int *);
+		*p = str - buf;
+	}
+
 	return num;
 }