diff -up flightgear-2.6.0/src/Cockpit/panel.cxx.checkforn flightgear-2.6.0/src/Cockpit/panel.cxx
--- flightgear-2.6.0/src/Cockpit/panel.cxx.checkforn	2012-02-17 17:41:14.704313333 -0500
+++ flightgear-2.6.0/src/Cockpit/panel.cxx	2012-05-29 21:01:31.264831372 -0400
@@ -1209,8 +1209,18 @@ FGTextLayer::Chunk::Chunk (const string
   : _type(FGTextLayer::TEXT), _fmt(fmt)
 {
   _text = text;
-  if (_fmt.empty()) 
-    _fmt = "%s";
+  if (_fmt.empty()) {
+    _fmt = "%s"; 
+  } else {
+    // It is never safe for _fmt.c_str to be %n.    
+    string unsafe ("%n");
+    size_t found;
+    found=_fmt.find(unsafe);
+    if (found!=string::npos) {
+      SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %s");
+      _fmt = "%s";
+    }
+  }   
 }
 
 FGTextLayer::Chunk::Chunk (ChunkType type, const SGPropertyNode * node,
@@ -1223,6 +1233,20 @@ FGTextLayer::Chunk::Chunk (ChunkType typ
       _fmt = "%s";
     else
       _fmt = "%.2f";
+  } else {
+    // It is never safe for _fmt.c_str to be %n.
+    string unsafe ("%n");
+    size_t found;
+    found=_fmt.find(unsafe);
+    if (found!=string::npos) {
+      if (type == TEXT_VALUE) {
+        SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %s");
+        _fmt = "%s";
+      } else {
+        SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %.2f");
+        _fmt = "%.2f";
+      }
+    }
   }
   _node = node;
 }
diff -up flightgear-2.6.0/src/Network/generic.cxx.checkforn flightgear-2.6.0/src/Network/generic.cxx
--- flightgear-2.6.0/src/Network/generic.cxx.checkforn	2012-02-17 17:41:16.428329558 -0500
+++ flightgear-2.6.0/src/Network/generic.cxx	2012-05-29 20:50:37.212255822 -0400
@@ -205,6 +205,8 @@ bool FGGeneric::gen_message_binary() {
 
 bool FGGeneric::gen_message_ascii() {
     string generic_sentence;
+    string unsafe ("%n");
+    size_t found;
     char tmp[255];
     length = 0;
 
@@ -215,6 +217,13 @@ bool FGGeneric::gen_message_ascii() {
             generic_sentence += var_separator;
         }
 
+        // It is never safe for _out_message[i].format.c_str to be %n.
+        found=_out_message[i].format.find(unsafe);
+        if (found!=string::npos) {
+          SG_LOG(SG_COCKPIT, SG_WARN, "format type contained %n, but this is unsafe, reverting to %s");
+          _out_message[i].format = "%s";
+        }
+
         switch (_out_message[i].type) {
         case FG_INT:
             val = _out_message[i].offset +