diff --git a/ChangeLog b/ChangeLog
index d1704532a0..bdc8530bf4 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,11 +1,19 @@
 1998-11-13  Ulrich Drepper  <drepper@cygnus.com>
 
+	* stdio-common/vfscanf.c: Return EOF for invalid format
+	characters.
+
 	* version.h (VERSION): Bump to 2.0.101.
 
 	* Makerules (Versions.all): Generate this file from all Versions.def
 	files.
 	(sysd-versions): Use Versions.all instead of Versions.def.
 
+1998-11-13  Philip Blundell  <philb@gnu.org>
+
+	* sysdeps/arm/fpu/bits/setjmp.h (__JMP_BUF_SP): Correct value.
+	Reported by Scott Bambrough.
+
 1998-11-11  Andreas Schwab  <schwab@issan.cs.uni-dortmund.de>
 
 	* locale/programs/config.h: Define HAVE_STRING_H for xstrdup.c.
diff --git a/stdio-common/vfscanf.c b/stdio-common/vfscanf.c
index ec4a264d65..d2302dd9a2 100644
--- a/stdio-common/vfscanf.c
+++ b/stdio-common/vfscanf.c
@@ -85,6 +85,11 @@
 			  __libc_cleanup_end (0);			      \
 			  return EOF;					      \
 			} while (0)
+# define fmt_error()	do {						      \
+			  _IO_funlockfile (s);				      \
+			  __libc_cleanup_end (0);			      \
+			  return EOF;					      \
+			} while (0)
 # define ARGCHECK(s, format)						      \
   do									      \
     {									      \
@@ -129,6 +134,10 @@
 			  __set_errno (ENOMEM);				      \
 			  return EOF;					      \
 			} while (0)
+# define fmt_error()	do {						      \
+			  funlockfile (s);				      \
+			  return EOF;					      \
+			} while (0)
 # define ARGCHECK(s, format)						      \
   do									      \
     {									      \
@@ -1247,6 +1256,10 @@ __vfscanf (FILE *s, const char *format, va_list argptr)
 	  number_signed = 0;
 	  read_pointer = 1;
 	  goto number;
+
+	default:
+	  /* If this is an unknown format character punt.  */
+	  fmt_error ();
 	}
     }
 
diff --git a/sysdeps/arm/fpu/bits/setjmp.h b/sysdeps/arm/fpu/bits/setjmp.h
index 895356fe0a..a9fb9f32b3 100644
--- a/sysdeps/arm/fpu/bits/setjmp.h
+++ b/sysdeps/arm/fpu/bits/setjmp.h
@@ -28,7 +28,7 @@
 typedef int __jmp_buf[22];
 #endif
 
-#define __JMP_BUF_SP		8
+#define __JMP_BUF_SP		20
 
 /* Test if longjmp to JMPBUF would unwind the frame
    containing a local variable at ADDRESS.  */