--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2008-02-07  Bruno Haible  <bruno@clisp.org>
+
+	* lib/vasnprintf.c (VASNPRINTF): Don't use %n on native Woe32 systems.
+	Avoids a crash on Windows Vista.
+	Reported by Simon Josefsson <simon@josefsson.org>.
+
 2008-02-06  Bruno Haible  <bruno@clisp.org>
 
 	Fix *printf behaviour regarding the left-adjust flag on HP-UX 10.20.

--- a/lib/vasnprintf.c
+++ b/lib/vasnprintf.c
@@ -4010,7 +4010,7 @@
 #endif
 		  *fbp = dp->conversion;
 #if USE_SNPRINTF
-# if !(__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3))
+# if !(__GLIBC__ > 2 || (__GLIBC__ == 2 && __GLIBC_MINOR__ >= 3) || ((defined _WIN32 || defined __WIN32__) && ! defined __CYGWIN__))
 		fbp[1] = '%';
 		fbp[2] = 'n';
 		fbp[3] = '\0';
@@ -4023,6 +4023,21 @@
 		   in format strings in writable memory may crash the program
 		   (if compiled with _FORTIFY_SOURCE=2), so we should avoid it
 		   in this situation.  */
+		/* On native Win32 systems (such as mingw), we can avoid using
+		   %n because:
+		     - Although the gl_SNPRINTF_TRUNCATION_C99 test fails,
+		       snprintf does not write more than the specified number
+		       of bytes. (snprintf (buf, 3, "%d %d", 4567, 89) writes
+		       '4', '5', '6' into buf, not '4', '5', '\0'.)
+		     - Although the gl_SNPRINTF_RETVAL_C99 test fails, snprintf
+		       allows us to recognize the case of an insufficient
+		       buffer size: it returns -1 in this case.
+		   On native Win32 systems (such as mingw) where the OS is
+		   Windows Vista, the use of %n in format strings by default
+		   crashes the program. See
+		     <http://gcc.gnu.org/ml/gcc/2007-06/msg00122.html> and
+		     <http://msdn2.microsoft.com/en-us/library/ms175782(VS.80).aspx>
+		   So we should avoid %n in this situation.  */
 		fbp[1] = '\0';
 # endif
 #else