[Bug tree-optimization/104746] New: [12 Regression] False positive for -Wformat-overflow=2 since r12-7033-g3c9f762ad02f398c

[marxin at gcc dot gnu.org via Gcc-bugs]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104746

            Bug ID: 104746
           Summary: [12 Regression] False positive for -Wformat-overflow=2
                    since r12-7033-g3c9f762ad02f398c
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: msebor at gcc dot gnu.org
  Target Milestone: ---

I see the following regression reduced from nfs-utils:

$ cat 1.i

unsigned long systemd_escape___trans_tmp_2;
char *systemd_escape_p;
int systemd_escape_len;
char generate_target_pipefs_path;
char *main_path;

char *systemd_escape2()
{
}

char *systemd_escape(char, char *suffix) {
  char *result;
  systemd_escape_p++;
  systemd_escape_len++;
  systemd_escape___trans_tmp_2 = __builtin_strlen(suffix);
  result =__builtin_malloc(systemd_escape_len + systemd_escape___trans_tmp_2 +
1);
  __builtin_sprintf(systemd_escape_p, suffix);
  return result;
}

void main()
{
  char *pipefs_unit = systemd_escape(generate_target_pipefs_path, ".mount");
  char *dirname = systemd_escape2();

  unsigned long len = __builtin_strlen(pipefs_unit) + __builtin_strlen(dirname)
+ 1;
  main_path = __builtin_malloc(len);

  __builtin_sprintf(main_path, "%s/%s", pipefs_unit, dirname);
}

$ gcc -Werror=format-overflow=2 1.i -flto -O2
XXX
1.i: In function ‘main’:
1.i:29:32: error: ‘%s’ directive output between 0 and 2147483653 bytes may
exceed minimum required size of 4095 [-Werror=format-overflow=]
   29 |   __builtin_sprintf(main_path, "%s/%s", pipefs_unit, dirname);
      |                                ^
1.i:29:32: note: assuming directive output of 1 byte
1.i:29:32: note: assuming directive output of 1 byte
lto1: some warnings being treated as errors
lto-wrapper: fatal error: gcc returned 1 exit status
compilation terminated.
/tmp/binutils/bin/ld: error: lto-wrapper failed
collect2: error: ld returned 1 exit status

Note it's fine w/o LTO:

$ gcc -Werror=format-overflow=2 1.i -O2