https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86241
--- Comment #2 from Martin Sebor <msebor at gcc dot gnu.org> --- Unlike bug 86203, the test case here uses local variables for the results of the calls to eliminate the possibility of aliasing between them and what the char pointer points to. More important, unlike strlen, the specification for snprintf is clear that the %s argument must point to an object with a character type, so the kind of aliasing that might be possible in the test case in bug 86203(*) would make the call to snprintf undefined. [*] I raised the question of the strlen aliasing in bug 86203 in WG14 and will propose to tighten up the language to make it invalid.