http://gcc.gnu.org/bugzilla/show_bug.cgi?id=50460
--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> 2011-09-23 07:26:10 UTC --- Looking at: const char *str1 = "JIHGFEDCBA"; #define strcpy(x,y) __builtin___strcpy_chk (x, y, __builtin_object_size (x, 1)) int f1 (void) { struct A { char buf1[9]; char buf2[1]; } a; strcpy (a.buf1 + (0 + 4), str1 + 5); return 0; } int f2 (void) { struct A { char buf1[9]; char buf2[1]; } a; strcpy ((char *) &a + (0 + 4), str1 + 5); return 0; } int f3 (void) { struct A { char buf1[9]; char buf2[1]; } a; char *p = (char *) &a; strcpy (p + (0 + 4), str1 + 5); return 0; } int f4 (void) { struct A { char buf0; char buf1[9]; char buf2[1]; } a; char *p = (char *) &a; strcpy (p + (0 + 5), str1 + 5); return 0; } int f5 (void) { struct A { char buf0; char buf1[9]; char buf2[1]; } a; strcpy ((char *) &a + (0 + 5), str1 + 5); return 0; } with GCC 4.4, seems we have always reconstructed it into &a.buf1[4]. So likely we want to reconstruct it from the MEM_REF in the *.objsz pass then. If there is union involved, we probably want to reconstruct it to the alternative with the largest possible __builtin_object_size (X, 1) resp. smallest possible __builtin_object_size (X, 3).