Bug 11672

Created attachment 3823 [details]
example C file

If you have a program such as
---
#include <stdio.h>

int main(int argc, char **argv)
{
  int i = 0;
  char buffer[100];

  for(i=0; i <= 999; i++)
    snprintf(buffer, 5, "-%d", i);

  return 0;
}
---

and build it with something like:
x86_64-overc-linux-gcc --sysroot=/home/mark/build/overc/tmp/work/core2-64-overc-linux/lxc/2.0.8-r0/recipe-sysroot -Wall -Werror -m64 -march=core2 -mtune=core2 -msse3 -mfpmath=sse -fPIC -DPIC -O2 -c range.c -o range

where x86_64-overc-linux-gcc --version
x86_64-overc-linux-gcc (GCC) 7.1.0

You will get
---
range.c: In function 'main':
range.c:10:25: error: 'snprintf' output may be truncated before the last format character [-Werror=format-truncation=]
     snprintf(buffer, 5, "-%d", i);
                         ^~~~~
range.c:10:5: note: 'snprintf' output between 3 and 6 bytes into a destination of size 5
     snprintf(buffer, 5, "-%d", i);
     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
---

NOTE that to my surprise the check is not using the type size (which would be 12 -- 10 chars in an int, plus sign, plus null). It is in fact using the loop logic to determine range but incorrectly using 1000 even though the loop stops at 999.

Attached is a more extensive example which can be played with.