https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83733
Martin Sebor <msebor at gcc dot gnu.org> changed: What |Removed |Added ---------------------------------------------------------------------------- See Also| |https://gcc.gnu.org/bugzill | |a/show_bug.cgi?id=94021 Known to fail| |10.0, 7.3.0, 8.2.0, 9.1.0 --- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> --- GCC 10 issues the same warning. The partial dump below shows that the range info the directive uses doesn't correspond to the range set in the code. This is similar to pr94021. $ gcc -O2 -S -Wall -fdump-tree-strlen=/dev/stdout pr83733.c ;; Function g (g, funcdef_no=1, decl_uid=1939, cgraph_uid=2, symbol_order=1) ;; 1 loops found ;; ;; Loop 0 ;; header 0, latch 1 ;; depth 0, outer -1 ;; nodes: 0 1 2 3 4 5 6 7 ;; 2 succs { 7 3 } ;; 3 succs { 4 6 } ;; 4 succs { 7 5 } ;; 5 succs { 6 } ;; 6 succs { 7 } ;; 7 succs { 1 } Computing maximum subobject size for _10: Computing maximum object size for p_8(D): _10: maximum subobject size 9 pr83733.c:8: __builtin_sprintf: objsize = 9, fmtstr = "CMPRT%02d" Directive 1 at offset 0: "CMPRT", length = 5 Result: 5, 5, 5, 5 (5, 5, 5, 5) Directive 2 at offset 5: "%02d" pr83733.c: In function ‘g’: pr83733.c:8:34: warning: ‘%02d’ directive writing between 2 and 6 bytes into a region of size 4 [-Wformat-overflow=] 8 | __builtin_sprintf (p->a, "CMPRT%02d", i); | ^~~~ pr83733.c:8:28: note: directive argument in the range [-32768, 31] 8 | __builtin_sprintf (p->a, "CMPRT%02d", i); | ^~~~~~~~~~~ Result: 2, 6, 6, 6 (7, 11, 11, 11) Directive 3 at offset 9: "", length = 1 pr83733.c:8:3: note: ‘__builtin_sprintf’ output between 8 and 12 bytes into a destination of size 9 8 | __builtin_sprintf (p->a, "CMPRT%02d", i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~