The CUR_PARAM can be null at this place, so check for that. I had hoped that extra testing the original patch by running the C testsuite with -Wformat=2 enabled would detect such a case, but apparently not. :(
Bootstrapped/regtested on x86_64-linux, ok for trunk? 2015-02-16 Marek Polacek <pola...@redhat.com> PR c/65066 * c-format.c (check_format_types): Handle null param. * gcc.dg/pr65066.c: New test. diff --git gcc/c-family/c-format.c gcc/c-family/c-format.c index 2f49b2d..9d03ff0 100644 --- gcc/c-family/c-format.c +++ gcc/c-family/c-format.c @@ -2492,6 +2492,7 @@ check_format_types (location_t loc, format_wanted_type *types) && TREE_CODE (cur_type) == INTEGER_TYPE && warn_format_signedness && TYPE_UNSIGNED (wanted_type) + && cur_param != NULL_TREE && TREE_CODE (cur_param) == NOP_EXPR) { tree t = TREE_TYPE (TREE_OPERAND (cur_param, 0)); diff --git gcc/testsuite/gcc.dg/pr65066.c gcc/testsuite/gcc.dg/pr65066.c index e69de29..883a87d 100644 --- gcc/testsuite/gcc.dg/pr65066.c +++ gcc/testsuite/gcc.dg/pr65066.c @@ -0,0 +1,12 @@ +/* PR c/65066 */ +/* { dg-do compile } */ +/* { dg-options "-Wformat=2" } */ + +extern int sscanf (const char *restrict, const char *restrict, ...); +int *a; + +void +foo () +{ + sscanf (0, "0x%x #", a); /* { dg-warning "expects argument of type" } */ +} Marek