https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=246630
--- Comment #16 from Dimitry Andric <d...@freebsd.org> --- Okay, I can reproduce, and it appears to be something in usr.bin/printf/printf.c, which gets built as part of sh. In particular, in the printf_doformat function. One version gives: 0000000000000440 <printf_doformat>: 440: 55 push %rbp 441: 48 89 e5 mov %rsp,%rbp 444: 41 57 push %r15 446: 41 56 push %r14 448: 41 55 push %r13 44a: 41 54 push %r12 44c: 53 push %rbx 44d: 48 81 ec e8 00 00 00 sub $0xe8,%rsp 454: 49 89 f4 mov %rsi,%r12 457: 48 89 fb mov %rdi,%rbx 45a: 48 8b 05 00 00 00 00 mov 0x0(%rip),%rax # 461 <printf_doformat+0x21> 461: 48 89 45 d0 mov %rax,-0x30(%rbp) 465: e8 00 00 00 00 callq 46a <printf_doformat+0x2a> another: 0000000000000440 <printf_doformat>: 440: 55 push %rbp 441: 48 89 e5 mov %rsp,%rbp 444: 41 57 push %r15 446: 41 56 push %r14 448: 41 55 push %r13 44a: 41 54 push %r12 44c: 53 push %rbx 44d: 48 81 ec e8 00 00 00 sub $0xe8,%rsp 454: 49 89 f5 mov %rsi,%r13 457: 48 89 fb mov %rdi,%rbx 45a: 48 8b 05 00 00 00 00 mov 0x0(%rip),%rax # 461 <printf_doformat+0x21> 461: 48 89 45 d0 mov %rax,-0x30(%rbp) 465: e8 00 00 00 00 callq 46a <printf_doformat+0x2a> The C function starts with: static char * printf_doformat(char *fmt, int *rval) { static const char skip1[] = "#'-+ 0"; int fieldwidth, haveprec, havewidth, mod_ldbl, precision; char convch, nextch; char start[strlen(fmt) + 1]; char **fargv; char *dptr; int l; and the starting piece of code corresponds to the dynamic array declaration, char start[strlen(fmt) + 1]. As to why this is happening, no clue yet... I'm trying to build clang with UBSan, to see if it hits something in particular. -- You are receiving this mail because: You are the assignee for the bug. _______________________________________________ freebsd-bugs@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/freebsd-bugs To unsubscribe, send any mail to "freebsd-bugs-unsubscr...@freebsd.org"