https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85840
--- Comment #9 from Joshua Cogliati <jjcogliati-r1 at yahoo dot com> --- Looking at write.c, there are multiple places where things like the pattern: result = select_string (dtp, f, str_buf, &res_len, kind); ... get_float_string (dtp, f, source , kind, 0, buffer, precision, buf_size, result, &res_len); ... if (res_len > BUF_STACK_SZ) free (result); appear (such as write_complex, write_real etc). So either they all need to be fixed, or get_float_string needs to never change the length compared to select_string. I could look into either method of fixing this if you want. (And for what it is worth, I do have copyright assignment paperwork from both myself and my employer for GCC filed)