The attached patch corrects a couple of typos in argument numbers in the handling of __builtin__vsnprintf_chk calls in the gimple- ssa-sprintf pass, and another couple of typos in the test for this that were masking this failure.
As an aside, the patch also fixes the off-by-one line test failures introduced in r240503. If there is a way to make the line numbers relative (as suggested in https://gcc.gnu.org/ml/gcc-patches/2016-09/msg02070.html) I'm happy to update the -Wformat-length tests to make use of them (and document it on the Wiki) if someone can point me at an example (or documentation). I couldn't find examples of dg-warning directives that use the feature. Thanks Martin
PR c/77762 - Incorrect destination buffer length in -Wformat-length warning gcc/testsuite/ChangeLog: 2016-09-27 Martin Sebor <mse...@redhat.com> PR c/77762 * gcc.dg/tree-ssa/builtin-sprintf-warn-1.c (test_vsnprintf_chk_s): Call __builtin___vsnprintf_chk, not __builtin___snprintf_chk. (test_sprintf_p_const): Adjust line numbers to avoid failures introduced in r240503. gcc/ChangeLog: 2016-09-27 Martin Sebor <mse...@redhat.com> PR c/77762 * gimple-ssa-sprintf.c (pass_sprintf_length::handle_gimple_call): Fix typos. Index: gcc/gimple-ssa-sprintf.c =================================================================== --- gcc/gimple-ssa-sprintf.c (revision 240556) +++ gcc/gimple-ssa-sprintf.c (working copy) @@ -2536,8 +2536,8 @@ pass_sprintf_length::handle_gimple_call (gimple_st // Signature: // __builtin___vsnprintf_chk (dst, size, ost, objsize, format, va) idx_dstsize = 1; - idx_objsize = 2; - idx_format = 3; + idx_objsize = 3; + idx_format = 4; info.argidx = -1; info.bounded = true; break; Index: gcc/testsuite/gcc.dg/tree-ssa/builtin-sprintf-warn-1.c =================================================================== --- gcc/testsuite/gcc.dg/tree-ssa/builtin-sprintf-warn-1.c (revision 240556) +++ gcc/testsuite/gcc.dg/tree-ssa/builtin-sprintf-warn-1.c (working copy) @@ -95,7 +95,7 @@ void test_sprintf_p_const (void) format null pointers as 0 or 0x0 and so the following will only be diagnosed on the former targets. */ T (5, "%p", (void*)0); - /* { dg-warning "nul past the end" "(nil)" { target *-linux-gnu *-*-uclinux } 96 } */ + /* { dg-warning "nul past the end" "(nil)" { target *-linux-gnu *-*-uclinux } 97 } */ /* The exact output for %p is unspecified by C. Two formats are known: same as %tx (for example AIX) and same as %#tx (for example Solaris). */ @@ -107,8 +107,8 @@ void test_sprintf_p_const (void) as with signed integer conversions (i.e., it prepends a space). Other known implementations ignore it. */ T (6, "% p", (void*)0x234); /* { dg-warning ". . flag used with .%p." } */ - /* { dg-warning "nul past the end" "Glibc %p" { target *-linux-gnu } 108 } */ - /* { dg-warning "nul past the end" "Generic %p" { target *-*-uclinux } 108 } */ + /* { dg-warning "nul past the end" "Glibc %p" { target *-linux-gnu } 109 } */ + /* { dg-warning "nul past the end" "Generic %p" { target *-*-uclinux } 109 } */ } /* Verify that no warning is issued for calls that write into a flexible @@ -1404,9 +1404,9 @@ void test_vsnprintf_chk_s (__builtin_va_list va) /* Verify that specifying a size of the destination buffer that's bigger than its actual size (normally determined and passed to the function by __builtin_object_size) is diagnosed. */ - __builtin___snprintf_chk (buffer, 123, 0, 122, " "); /* { dg-warning "always overflow|specified size 123 exceeds the size 122 of the destination object" } */ + __builtin___vsnprintf_chk (buffer, 123, 0, 122, "%-s", va); /* { dg-warning "always overflow|specified size 123 exceeds the size 122 of the destination object" } */ - __builtin___snprintf_chk (buffer, __SIZE_MAX__, 0, 2, " "); /* { dg-warning "always overflow|destination size .\[0-9\]+. too large" } */ + __builtin___vsnprintf_chk (buffer, __SIZE_MAX__, 0, 2, "%-s", va); /* { dg-warning "always overflow|destination size .\[0-9\]+. too large" } */ T (0, "%s"); T (1, "%s");