I'm porting an application from VC++ 6.0 to VC++ 2003 and I'm seeing crashes
sometimes when _vsnprintf is called sometimes with format strings that have
a"%s" in them.  When I debug the code within _vsnprintf_ it calls output and
internally after finding the %s it tries to get the next int parameter from
va_args through a macro (I presume the int is the address of the string it is
going to replace the %s with).  What it returns though is 0xcdcdcdcd bad
pointer and causes the code to fail later when it tries to access the
pointer.)

Compiling using multithreaded DLL libraries.
Anyone have any ideas?

The areas I have already looked at:
Checked calling conventions setup on all builds
Rebuild all/clean several times
Checked execution libraries to verify the correct ones are in place.
Cleared up any suspicious warnings in seemingly related libraries.
Debugged in assembly to see what is going on.  It looks like we are calling
TRACE2 or our internal log method that uses _vsnprintf and it copies the
format string into a stack variable and I see it seems to leave a space on
the stack that is cdcdcdcd that I think may account for the return value but
I'm not sure why yet.