diff --git a/tests/fortify2_test.cpp b/tests/fortify2_test.cpp
index 9a13612..1fa34ca 100644
--- a/tests/fortify2_test.cpp
+++ b/tests/fortify2_test.cpp
@@ -19,6 +19,7 @@
 
 #include <gtest/gtest.h>
 #include <string.h>
+#include <stdarg.h>
 
 struct foo {
   char empty[0];
@@ -53,6 +54,49 @@
               testing::KilledBySignal(SIGABRT), "");
 }
 
+static int vsprintf_helper2(const char *fmt, ...) {
+  foo myfoo;
+  va_list va;
+  int result;
+
+  va_start(va, fmt);
+  result = vsprintf(myfoo.a, fmt, va); // should crash here
+  va_end(va);
+  return result;
+}
+
+TEST(Fortify2_DeathTest, vsprintf_fortified2) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsprintf_helper2("%s", "0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
+TEST(Fortify2_DeathTest, vsprintf2_fortified2) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsprintf_helper2("0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
+static int vsnprintf_helper2(const char *fmt, ...) {
+  foo myfoo;
+  va_list va;
+  int result;
+  size_t size = atoi("11");
+
+  va_start(va, fmt);
+  result = vsnprintf(myfoo.a, size, fmt, va); // should crash here
+  va_end(va);
+  return result;
+}
+
+TEST(Fortify2_DeathTest, vsnprintf_fortified2) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsnprintf_helper2("%s", "0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
+TEST(Fortify2_DeathTest, vsnprintf2_fortified2) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsnprintf_helper2("0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
 #if __BIONIC__
 // zero sized target with "\0" source (should fail)
 TEST(Fortify2_DeathTest, strcpy_fortified2) {
@@ -250,6 +294,49 @@
   ASSERT_EXIT(sprintf(buf, "aaaaa"), testing::KilledBySignal(SIGABRT), "");
 }
 
+static int vsprintf_helper(const char *fmt, ...) {
+  char buf[10];
+  va_list va;
+  int result;
+
+  va_start(va, fmt);
+  result = vsprintf(buf, fmt, va); // should crash here
+  va_end(va);
+  return result;
+}
+
+TEST(Fortify2_DeathTest, vsprintf_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsprintf_helper("%s", "0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
+TEST(Fortify2_DeathTest, vsprintf2_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsprintf_helper("0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
+static int vsnprintf_helper(const char *fmt, ...) {
+  char buf[10];
+  va_list va;
+  int result;
+  size_t size = atoi("11");
+
+  va_start(va, fmt);
+  result = vsnprintf(buf, size, fmt, va); // should crash here
+  va_end(va);
+  return result;
+}
+
+TEST(Fortify2_DeathTest, vsnprintf_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsnprintf_helper("%s", "0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
+TEST(Fortify2_DeathTest, vsnprintf2_fortified) {
+  ::testing::FLAGS_gtest_death_test_style = "threadsafe";
+  ASSERT_EXIT(vsnprintf_helper("0123456789"), testing::KilledBySignal(SIGABRT), "");
+}
+
 TEST(Fortify2_DeathTest, strncat_fortified) {
   ::testing::FLAGS_gtest_death_test_style = "threadsafe";
   char buf[10];