https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83448
--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> --- Untested fix: --- gimple-ssa-sprintf.c.jj8 2017-12-19 22:05:44.000000000 +0100 +++ gimple-ssa-sprintf.c 2017-12-21 18:04:30.960153926 +0100 @@ -2466,7 +2466,8 @@ maybe_warn (substring_loc &dirloc, locat /* For plain character directives (i.e., the format string itself) but not others, point the caret at the first character that's past the end of the destination. */ - dirloc.set_caret_index (dirloc.get_caret_idx () + navail); + if (navail < dir.len) + dirloc.set_caret_index (dirloc.get_caret_idx () + navail); } if (*dir.beg == '\0') @@ -2587,14 +2588,16 @@ maybe_warn (substring_loc &dirloc, locat /* The size of the destination region is a range. */ - if (target_to_host (*dir.beg) != '%') + if (target_to_host (*dir.beg) != '%' + && avail_range.min == avail_range.max) { unsigned HOST_WIDE_INT navail = avail_range.max; /* For plain character directives (i.e., the format string itself) but not others, point the caret at the first character that's past the end of the destination. */ - dirloc.set_caret_index (dirloc.get_caret_idx () + navail); + if (navail < dir.len) + dirloc.set_caret_index (dirloc.get_caret_idx () + navail); } if (*dir.beg == '\0') Will try to write some testcases now.