2 files changed, 10 insertions, 0 deletions
diff --git a/jim.c b/jim.c
index f4e1d54..f070526 100644
--- a/jim.c
+++ b/jim.c
@@ -9516,6 +9516,11 @@ static int SetScanFmtFromAny(Jim_Interp *interp, Jim_Obj *objPtr)
                         return JIM_ERR;
                     }
                 }
+                if (descr->pos < 0) {
+                    fmtObj->error =
+                        "\"%n$\" conversion specifier is negative";
+                    return JIM_ERR;
+                }
                 /* Try to find a width after the XPG3 specifier */
                 if (sscanf(fmt, "%d%n", &width, &skip) == 1) {
                     descr->width = width;
diff --git a/regtest.tcl b/regtest.tcl
index e3213b5..15dc3ec 100644
--- a/regtest.tcl
+++ b/regtest.tcl
@@ -330,6 +330,11 @@ puts "TEST 46 PASSED"
 catch {set a $(99?9,99?9:*9:999)?9)}
 puts "TEST 47 PASSED"
 
+# REGTEST 48
+# scan: -ve XPG3 specifier
+catch {scan a {%-9999999$c}}
+puts "TEST 48 PASSED"
+
 # TAKE THE FOLLOWING puts AS LAST LINE
 
 puts "--- ALL TESTS PASSED ---"