I discovered that -Wformat-security was never enabled in QEMU builds, despite being listed in configure. This is because the code for checking support of compile flags was wrong. While fixing this, I decided to see how many more GCC compiler warning flags could usefully be enabled. The result is this patch series which fixes several code bugs.
The last patch is a few I could not enable due to the huge number of current violations. It would be desirable to enable at least some of these, -Wjump-misses-init in paticular.