[Bug middle-end/54582] gap in FORTIFY checking of buffer lengths

[rguenth at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54582



Richard Biener <rguenth at gcc dot gnu.org> changed:



           What    |Removed                     |Added

----------------------------------------------------------------------------

          Component|c                           |middle-end

           Severity|minor                       |enhancement



--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> 2013-02-06 
12:18:21 UTC ---

Code is (maybe_emit_sprintf_chk_warning):



  /* If the format doesn't contain % args or %%, we know its size.  */

  if (strchr (fmt_str, target_percent) == 0)

    len = build_int_cstu (size_type_node, strlen (fmt_str));

  /* If the format is "%s" and first ... argument is a string literal,

     we know it too.  */

  else if (fcode == BUILT_IN_SPRINTF_CHK

           && strcmp (fmt_str, target_percent_s) == 0)

    ...

  else

    return;



so it lacks a way to compute an upper bound for the format which I guess

we can always compute (just not account all %'s at all?).