https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104854
--- Comment #2 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> --- (In reply to David Malcolm from comment #1) > Compiler Explorer link for the above (with -fanalyzer -Wall > -Wstringop-overread -O2; -O2 seems to be needed to trigger it): Ah yes, sorry, I pasted an older reproducer. This: char * foo (void) { return __builtin_strndup ("test", 8); } doesn't need -O2. $ gcc -S -Wall ../test.c ../test.c: In function ‘foo’: ../test.c:5:10: warning: ‘__builtin_strndup’ specified bound 8 exceeds source size 5 [-Wstringop-overread] 5 | return __builtin_strndup ("test", 8); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~