diff --git a/lib/Analysis/FormatString.cpp b/lib/Analysis/FormatString.cpp
index f03a84f..8f1ea4d 100644
--- a/lib/Analysis/FormatString.cpp
+++ b/lib/Analysis/FormatString.cpp
@@ -538,7 +538,6 @@ bool FormatSpecifier::hasValidLengthModifier() const {
         case ConversionSpecifier::uArg:
         case ConversionSpecifier::xArg:
         case ConversionSpecifier::XArg:
-        case ConversionSpecifier::nArg:
           return true;
         default:
           return false;
@@ -561,7 +560,6 @@ bool FormatSpecifier::hasValidLengthModifier() const {
         case ConversionSpecifier::EArg:
         case ConversionSpecifier::gArg:
         case ConversionSpecifier::GArg:
-        case ConversionSpecifier::nArg:
         case ConversionSpecifier::cArg:
         case ConversionSpecifier::sArg:
         case ConversionSpecifier::ScanListArg:
diff --git a/test/Sema/format-strings-scanf.c b/test/Sema/format-strings-scanf.c
index 6f6cb10..e29ef8f 100644
--- a/test/Sema/format-strings-scanf.c
+++ b/test/Sema/format-strings-scanf.c
@@ -40,6 +40,8 @@ void bad_length_modifiers(char *s, void *p, wchar_t *ws, long double *ld) {
   scanf("%1$zp", &p); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}}
   scanf("%ls", ws); // no-warning
   scanf("%#.2Lf", ld); // expected-warning{{invalid conversion specifier '#'}}
+  scanf("%ln", (int*)0); // expected-warning{{length modifier 'l' results in undefined behavior or no effect with 'n' conversion specifier}}
+  scanf("%hn", (int*)0); // expected-warning{{length modifier 'h' results in undefined behavior or no effect with 'n' conversion specifier}}
 }
 
 // Test that the scanf call site is where the warning is attached.  If the
diff --git a/test/Sema/format-strings.c b/test/Sema/format-strings.c
index aff996f..8fe6004 100644
--- a/test/Sema/format-strings.c
+++ b/test/Sema/format-strings.c
@@ -90,6 +90,8 @@ void check_writeback_specifier()
   char *b;
   printf("%n", b); // expected-warning{{format specifies type 'int *' but the argument has type 'char *'}}
   printf("%n", &x); // no-warning
+
+  printf("%n", &x); // no-warning
 }
 
 void check_invalid_specifier(FILE* fp, char *buf)
@@ -309,6 +311,8 @@ void bug7377_bad_length_mod_usage() {
   printf("%1$zp", (void *)0); // expected-warning{{length modifier 'z' results in undefined behavior or no effect with 'p' conversion specifier}}
   printf("%ls", L"foo"); // no-warning
   printf("%#.2Lf", (long double)1.234); // no-warning
+  printf("%ln", (int*)0); // expected-warning{{length modifier 'l' results in undefined behavior or no effect with 'n' conversion specifier}}
+  printf("%hn", (int*)0); // expected-warning{{length modifier 'h' results in undefined behavior or no effect with 'n' conversion specifier}}
 
   // Bad flag usage
   printf("%#p", (void *) 0); // expected-warning{{flag '#' results in undefined behavior with 'p' conversion specifier}}