https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115965
--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> --- Note valgrind in this case cannot always capture buffer overruns due to it cann't easily add a redzone (buffer to detect overruns) for stack arrays. This is why -fsanitize=address is more powerful than both of the other two here.
