/* { dg-do compile } */
/* { dg-options "-Wformat -Wformat-overflow=1 -ftrack-macro-expansion=0" } */
/* { dg-require-effective-target int32plus } */

/* When debugging, define LINE to the line number of the test case to exercise
   and avoid exercising any of the others.  The buffer and objsize macros
   below make use of LINE to avoid warnings for other lines.  */
#ifndef LINE
# define LINE 0
#endif

#define INT_MAX __INT_MAX__

typedef __builtin_va_list va_list;


char buffer [256];
extern char *ptr;

/* Evaluate to an array of SIZE characters when non-negative, or to
   a pointer to an unknown object otherwise.  */
#define buffer(size)					\
  ((0 <= size) ? buffer + sizeof buffer - (size) : ptr)

/* Evaluate to SIZE when non-negative, or to SIZE_MAX otherise.  */
#define objsize(size) ((0 <= size) ? (size) : __SIZE_MAX__)

typedef __SIZE_TYPE__ size_t;

#if !__cplusplus
typedef __WCHAR_TYPE__ wchar_t;
#endif

typedef __WINT_TYPE__ wint_t;

typedef unsigned char UChar;

/* Constants used to verify the pass can determine their values even
   without optimization.  */
const int cst0   =  0;
const int cst1   =  1;
const int cst10  = 10;

/* Initialized global variables used to verify that the pass doesn't
   use their initial values (they could be modified by calls to other
   functions).  */
int var0  =  0;
int var10 = 10;

const char s0[] = "";
const char s1[] = "1";
const char s2[] = "12";
const char s3[] = "123";
const char s4[] = "1234";
const char s5[] = "12345";
const char s6[] = "123456";
const char s7[] = "1234567";
const char s8[] = "12345678";

void sink (void*, ...);

int dummy_sprintf (char*, const char*, ...);
int dummy_snprintf (char*, size_t, const char*, ...);
int dummy_vsprintf (char*, const char*, va_list);
int dummy_vsnprintf (char*, size_t, const char*, va_list);
int dummy___sprintf_chk (char*, int, size_t, const char*, ...);
int dummy___snprintf_chk (char*, size_t, int, size_t, const char*, ...);
int dummy___vsprintf_chk (char*, int, size_t, const char*, va_list);
int dummy___vsnprintf_chk (char*, size_t, int, size_t, const char*, va_list);

/* Helper to expand function to either __builtin_f or dummy_f to
   make debugging GCC easy.  */
#define FUNC(f)							\
  ((!LINE || LINE == __LINE__) ? __builtin_ ## f : dummy_ ## f)

/* Macro to verify that calls to __builtin_sprintf (i.e., with no size
   argument) issue diagnostics by correctly determining the size of
   the destination buffer.  */
#define T(size, ...)						\
  (FUNC (sprintf) (buffer (size),  __VA_ARGS__),		\
   sink (buffer, ptr))

/* Exercise the "%%" directive.  */

void test_sprintf_percent (void)
{
  T (-1, "%%");
  T ( 0, "%%");                 /* { dg-warning ".%%. directive writing 1 byte into a region of size 0" } */
  T ( 1, "%%");                 /* { dg-warning "writing a terminating nul past the end" } */
  T ( 2, "%%");
  T ( 2, "%%%%");               /* { dg-warning "writing a terminating nul past the end" } */
  T ( 3, "%%%%");
  T ( 3, "%%X%%");              /* { dg-warning "writing a terminating nul past the end" } */
  T ( 4, "%%X%%");
}

/* Exercise the "%c" and "%lc" directive with constant arguments.  */

void test_sprintf_c_const (void)
{
  T (-1, "%c",    0);           /* No warning for unknown destination size.  */
  T ( 0, "%c",    0);           /* { dg-warning ".%c. directive writing 1 byte into a region of size 0" } */
  T ( 1, "%c",    0);           /* { dg-warning "writing a terminating nul past the end" } */
  T ( 1, "%c",   '1');          /* { dg-warning "nul past the end" } */
  T ( 2, "%c",   '1');
  T ( 2, "%2c",  '1');          /* { dg-warning "nul past the end" } */
  T ( 2, "%3c",  '1');          /* { dg-warning "into a region" } */
  T ( 2, "%c%c", '1', '2');     /* { dg-warning "nul past the end" } */
  T ( 3, "%c%c", '1', '2');

  T ( 2, "%1$c%2$c", '1', '2'); /* { dg-warning "does not support %n.|nul past the end" } */
  T ( 3, "%1$c%2$c", '1', '2');

  /* Verify that a warning is issued for exceeding INT_MAX bytes and
     not otherwise.  In ILP32 the maximum object size is INT_MAX - 1
     bytes so the calls are diagnosed due to the overflow.  */
  T (-1, "%*c",  INT_MAX - 1, '1');
  T (-1, "%*c",  INT_MAX,     '1'); /* { dg-warning "writing a terminating nul past the end " "ilp32" { target ilp32 } } */
  T (-1, "X%*c", INT_MAX - 1, '1'); /* { dg-warning "writing a terminating nul past the end " "ilp32" { target ilp32 } } */
  T (-1, "X%*c", INT_MAX,     '1'); /* { dg-warning "directive output of \[0-9\]+ bytes causes result to exceed .INT_MAX." "lp64" { target lp64 } } */
  /* { dg-warning "directive writing 2147483647 bytes into a region of size 2147483646" "ilp32" { target ilp32 } .-1 } */

  T (-1, "%*c%*c", INT_MAX - 1, '1', INT_MAX - 1, '2'); /* { dg-warning "directive output of \[0-9\]+ bytes causes result to exceed .INT_MAX." "lp64" { target lp64 } } */
  /* { dg-warning "directive writing 2147483646 bytes into a region of size 1" "ilp32" { target ilp32 } .-1 } */

  T (-1, "%*cX", INT_MAX - 2, '1');
  T (-1, "%*cX", INT_MAX - 1, '1'); /* { dg-warning "writing a terminating nul past the end of the destination" "ilp32" { target ilp32 } } */
  T (-1, "%*cX", INT_MAX,     '1'); /* { dg-warning "output of \[0-9\]+ bytes causes result to exceed .INT_MAX." "lp64" { target lp64 } } */
  /* { dg-warning "directive writing 1 byte into a region of size 0" "ilp32" { target ilp32 } .-1 } */
}

/* Verify that no warning is issued for calls that write into a flexible
   array member whose size isn't known.  Also verify that calls that use
   a flexible array member as an argument to the "%s" directive do not
   cause a warning.  */

void test_sprintf_flexarray (void *p, int i)
{
  struct S
  {
    int n;
    char a[];
  } *s = p;

  FUNC (sprintf)(s->a, "%c",       'x');

  FUNC (sprintf)(s->a, "%-s",      "");
  FUNC (sprintf)(s->a, "%-s",      "abc");
  FUNC (sprintf)(s->a, "abc%sghi", "def");

  FUNC (sprintf)(s->a, "%i",       1234);

  FUNC (sprintf)(buffer (1), "%-s", s->a);
  FUNC (sprintf)(buffer (1), "%-s", s [i].a);
  FUNC (sprintf)(buffer (2), "%-s", s->a);
  FUNC (sprintf)(buffer (2), "%-s", s [i].a);
}

/* Same as above but for zero-length arrays.  */

void test_sprintf_zero_length_array (void *p, int i)
{
  struct S
  {
    int n;
    char a [0];
  } *s = p;

  FUNC (sprintf)(s->a, "%c",       'x');

  FUNC (sprintf)(s->a, "%s",       "");
  FUNC (sprintf)(s->a, "%s",       "abc");
  FUNC (sprintf)(s->a, "abc%sghi", "def");

  FUNC (sprintf)(s->a, "%i",       1234);

  FUNC (sprintf)(buffer (1), "%s",  s->a);
  FUNC (sprintf)(buffer (1), "%s",  s [i].a);
}

#undef T
#define T(size, fmt, ...)						\
  (FUNC (__sprintf_chk) (buffer (size), 0, objsize (size), fmt, __VA_ARGS__), \
   sink (buffer, ptr))

/* Exercise the "%c" and "%lc" directive with constant arguments.  */

void test_sprintf_chk_c_const (void)
{
  T (-1, "%c",    0);            /* No warning for unknown destination size.  */
  /* Verify the full text of the diagnostic for just the distinct messages
     and use abbreviations in subsequent test cases.  */
  T (0, "%c",     0);            /* { dg-warning ".%c. directive writing 1 byte into a region of size 0" } */
  T (1, "%c",     0);            /* { dg-warning "writing a terminating nul past the end" } */
  T (1, "%c",   '1');            /* { dg-warning "nul past the end" } */
  T (2, "%c",   '1');
  T (2, "%2c",  '1');            /* { dg-warning "nul past the end" } */
  T (2, "%3c",  '1');            /* { dg-warning "into a region" } */
  T (2, "%c%c", '1', '2');       /* { dg-warning "nul past the end" } */
  T (3, "%c%c", '1', '2');

  /* Wide characters.  */
  T (0, "%lc",     (wint_t)0);   /* { dg-warning ".%lc. directive writing up to 1 bytes into a region of size 0" } */
  T (1, "%lc",     (wint_t)0);   /* { dg-warning "nul past the end" } */
  T (1, "%lc%lc",  (wint_t)0, (wint_t)0);   /* { dg-warning ".%lc. directive writing up to 1 bytes into a region of size between 0 and 1" } */
  T (2, "%lc",     (wint_t)0);
  T (2, "%lc%lc",  (wint_t)0, (wint_t)0);   /* { dg-warning "nul past the end" } */

  /* The following could result in as few as no bytes and in as many as
     MB_CUR_MAX, but since the MB_CUR_MAX value is a runtime property
     the write cannot be reliably diagnosed.  */
  T (2, "%lc",  (wint_t)L'1');
  T (2, "%1lc", (wint_t)L'1');
  /* Writing some unknown number of bytes into a field two characters wide.  */
  T (2, "%2lc", (wint_t)L'1');          /* { dg-warning "nul past the end" } */

  T (3, "%lc%c",   (wint_t)L'1', '2');
  /* Here in the best case each argument will format as single character,
     causing the terminating NUL to be written past the end.  */
  T (3, "%lc%c%c", (wint_t)L'1', '2', '3');   /* { dg-warning "nul past the end" } */
  T (3, "%lc%lc%c", (wint_t)L'1', (wint_t)L'2', '3'); /* { dg-warning "nul past the end" } */
}

/* Exercise the "%s" and "%ls" directive with constant arguments.  */

void test_sprintf_chk_s_const (void)
{
  T (-1, "%*s",  0, "");        /* No warning for unknown destination size.  */
  T ( 0, "%*s",  0, "");        /* { dg-warning "nul past the end" } */
  T ( 0, "%-s",     "");        /* { dg-warning "nul past the end" } */
  T ( 0, "%*s",  0, s0);        /* { dg-warning "nul past the end" } */
  T ( 1, "%*s",  0, "");
  T ( 1, "%*s",  0, s0);
  T ( 1, "%*s",  0, "\0");
  T ( 1, "%*s",  0, "1");       /* { dg-warning "nul past the end" } */
  T ( 1, "%*s",  0, s1);        /* { dg-warning "nul past the end" } */
  T ( 1, "%1s",     "");        /* { dg-warning "nul past the end" } */
  T ( 1, "%1s",     s0);        /* { dg-warning "nul past the end" } */
  T (-1, "%1s",    "1");        /* No warning for unknown destination size.  */
  T ( 1, "%*s",  1, "");        /* { dg-warning "nul past the end" } */
  T ( 1, "%*s",  1, s0);        /* { dg-warning "nul past the end" } */
  T (-1, "%*s",  1, s0);        /* No warning for unknown destination size.  */

  T (1, "%.s",     "");
  T (1, "%.s",     "123");
  T (1, "%.0s",    "123");
  T (1, "%.0s",    s3);
  T (1, "%.*s", 0, "123");
  T (1, "%.*s", 0, s3);
  T (1, "%.1s",    "123");      /* { dg-warning "nul past the end" } */
  T (1, "%.1s",    s3);         /* { dg-warning "nul past the end" } */
  T (1, "%.*s", 1, "123");      /* { dg-warning "nul past the end" } */
  T (1, "%.*s", 1, s3);         /* { dg-warning "nul past the end" } */

  T (2, "%.*s", 0, "");
  T (2, "%.*s", 0, "1");
  T (2, "%.*s", 0, s1);
  T (2, "%.*s", 0, "1\0");
  T (2, "%.*s", 0, "12");
  T (2, "%.*s", 0, s2);

  T (2, "%.*s", 1, "");
  T (2, "%.*s", 1, "1");
  T (2, "%.*s", 1, s1);
  T (2, "%.*s", 1, "1\0");
  T (2, "%.*s", 1, "12");
  T (2, "%.*s", 1, s2);

  T (2, "%.*s", 2, "");
  T (2, "%.*s", 2, "1");
  T (2, "%.*s", 2, s1);
  T (2, "%.*s", 2, "1\0");
  T (2, "%.*s", 2, "12");       /* { dg-warning "nul past the end" } */
  T (2, "%.*s", 2, s2);         /* { dg-warning "nul past the end" } */

  T (2, "%.*s", 3, "");
  T (2, "%.*s", 3, "1");
  T (2, "%.*s", 3, s1);
  T (2, "%.*s", 3, "1\0");
  T (2, "%.*s", 3, "12");       /* { dg-warning "nul past the end" } */
  T (2, "%.*s", 3, "123");      /* { dg-warning "into a region" } */
  T (2, "%.*s", 3, s2);         /* { dg-warning "nul past the end" } */
  T (2, "%.*s", 3, s3);         /* { dg-warning "into a region" } */

  T (2, "%*s",  0, "");
  T (2, "%*s",  0, "1");
  T (2, "%*s",  0, s1);
  T (2, "%*s",  0, "1\0");
  T (2, "%*s",  0, "12");       /* { dg-warning "nul past the end" } */
  T (2, "%*s",  0, s2);         /* { dg-warning "nul past the end" } */

  /* Verify that output in excess of INT_MAX bytes is diagnosed even
     when the size of the destination object is unknown.  */
  T (-1, "%*s",  INT_MAX - 1, "");
  T (-1, "%*s",  INT_MAX,     ""); /* { dg-warning "writing a terminating nul past the end" "ilp32" { target ilp32 } } */
  T (-1, "X%*s", INT_MAX,     ""); /* { dg-warning "directive output of \[0-9\]+ bytes causes result to exceed .INT_MAX." "lp64" { target lp64 } } */
  /* { dg-warning "directive writing 2147483647 bytes into a region of size 2147483646" "ilp32" { target ilp32 } .-1 } */

  /* Multiple directives.  */

  T (1, "%s%s", "", "");
  T (1, "%s%s", s0, s0);
  T (1, "%s%s", "", "1");       /* { dg-warning "nul past the end" } */
  T (1, "%s%s", s0, s1);        /* { dg-warning "nul past the end" } */
  T (1, "%s%s", "1", "");       /* { dg-warning "nul past the end" } */
  T (1, "%s%s", s1, s0);        /* { dg-warning "nul past the end" } */
  T (1, "%s%s", "1", "2");      /* { dg-warning "into a region" } */
  T (1, "%s%s", s1, s1);        /* { dg-warning "into a region" } */

  T (2, "%s%s", "", "");
  T (2, "%s%s", "", "1");
  T (2, "%s%s", "1", "");
  T (2, "%s%s", "", "12");      /* { dg-warning "nul past the end" } */
  T (2, "%s%s", "1", "2");      /* { dg-warning "nul past the end" } */
  T (2, "%s%s", "12", "2");     /* { dg-warning "into a region" } */
  T (2, "%s%s", "1", "23");     /* { dg-warning "into a region" } */
  T (2, "%s%s", "12", "3");     /* { dg-warning "into a region" } */
  T (2, "%s%s", "12", "34");    /* { dg-warning "into a region" } */

  T (2, "_%s",   "");
  T (2, "%%%s",  "");
  T (2, "%%%%%s",  "");         /* { dg-warning "nul past the end" } */
  T (2, "%s%%",  "");
  T (2, "_%s",   "1");          /* { dg-warning "nul past the end" } */
  T (2, "%%%s",  "1");          /* { dg-warning "nul past the end" } */
  T (2, "%s%%",  "1");          /* { dg-warning "nul past the end" } */
  T (2, "_%s",   "12");         /* { dg-warning "into a region" } */
  T (2, "__%s",  "1");          /* { dg-warning "into a region" } */

  T (2, "%1$s%2$s", "12", "3"); /* { dg-warning ".%2.s. directive writing 1 byte into a region of size 0" } */
  T (2, "%1$s%1$s", "12");      /* { dg-warning "does not support|.%1.s. directive writing 2 bytes into a region of size 0" } */
  T (2, "%2$s%1$s", "1", "23"); /* { dg-warning ".%1.s. directive writing 1 byte into a region of size 0" } */
  T (2, "%2$s%2$s", "1", "23"); /* { dg-warning "unused|%2.s. directive writing 2 bytes into a region of size 0" } */

  T (3, "__%s", "");
  T (3, "__%s", "1");           /* { dg-warning "nul past the end" } */
  T (3, "%s_%s", "", "");
  T (3, "%s_%s", "1", "");
  T (3, "%s_%s", "", "1");
  T (3, "%s_%s", "1", "2");     /* { dg-warning "nul past the end" } */

  /* Wide strings.  */
  T (-1, "%ls",      L"");
  T ( 0, "%ls",      L"");      /* { dg-warning "nul past the end" } */
  T ( 1, "%ls",      L"");
  T ( 1, "%ls",      L"\0");
  T ( 1, "%1ls",     L"");      /* { dg-warning "nul past the end" } */

  T (0, "%*ls",  0, L"");       /* { dg-warning "nul past the end" } */
  T (1, "%*ls",  0, L"");
  T (1, "%*ls",  0, L"\0");
  T (1, "%*ls",  1, L"");       /* { dg-warning "nul past the end" } */

  /* A wide character string need not convert into any bytes (although
     individual ASCII characters are assumed to convert into 1 bt %lc
     so this could be made smarter.  */
  T (1, "%ls",      L"1");      /* { dg-warning "directive writing up to 6 bytes into a region of size 1" } */
  T (1, "%.0ls",    L"1");
  T (2, "%.0ls",    L"1");
  T (2, "%.1ls",    L"1");
  T (2, "%.*ls", 1, L"1");

  /* The "%.2ls" directive below will write at a minimum 1 byte (because
     L"1" is known and can be assumed to convert to at least one multibyte
     character), and at most 2 bytes because of the precision.  Since its
     output is explicitly bounded it is diagnosed.  */
  T (2, "%.2ls",    L"1");      /* { dg-warning "nul past the end" } */
  T (2, "%.*ls", 2, L"1");      /* { dg-warning "nul past the end" } */

  T (3, "%.0ls",    L"1");
  T (3, "%.1ls",    L"1");
  T (3, "%.2ls",    L"1");
  T (3, "%ls",      L"12");     /* { dg-warning "directive writing up to 12 bytes" } */

  T (3, "%ls",      L"123");    /* { dg-warning "directive writing up to 18 bytes" } */
  T (3, "%.0ls",    L"123");
  T (3, "%.1ls",    L"123");
  T (3, "%.2ls",    L"123");
  T (3, "%.3ls",    L"123");    /* { dg-warning "nul past the end" } */
}

/* Exercise the "%hhd", "%hhi", "%hho", "%hhu", and "%hhx" directives
   with constant arguments.  */

void test_sprintf_chk_hh_const (void)
{
  T (-1, "%hhd",        0);

  T (1, "%hhd",         0);     /* { dg-warning "nul past the end" } */
  T (1, "%hhd",      cst0);     /* { dg-warning "nul past the end" } */
  T (1, "%hhd",         1);     /* { dg-warning "nul past the end" } */
  T (1, "%hhd",      cst1);     /* { dg-warning "nul past the end" } */
  T (1, "%hhd",        -1);     /* { dg-warning "into a region" } */
  T (1, "%+hhd",        0);     /* { dg-warning "into a region" } */
  T (1, "%+hhd",        1);     /* { dg-warning "into a region" } */
  T (1, "%-hhd",        0);     /* { dg-warning "nul past the end" } */

  T (1, "%hhi",         0);     /* { dg-warning "nul past the end" } */
  T (1, "%hhi",         1);     /* { dg-warning "nul past the end" } */
  T (1, "%hhi",        -1);     /* { dg-warning "into a region" } */
  T (1, "%+hhi",        0);     /* { dg-warning "into a region" } */
  T (1, "%+hhi",        1);     /* { dg-warning "into a region" } */
  T (1, "%-hhi",        0);     /* { dg-warning "nul past the end" } */

  T (2, "%hhi",         0);
  T (2, "%hhi",         1);
  T (2, "%hhi",         9);
  T (2, "% hhi",        9);     /* { dg-warning "nul past the end" } */
  T (2, "%+hhi",        9);     /* { dg-warning "nul past the end" } */
  T (2, "%-hhi",        9);
  T (2, "%hhi",        10);     /* { dg-warning "nul past the end" } */
  T (2, "%hhi",     cst10);     /* { dg-warning "nul past the end" } */
  T (2, "%hhi",        -1);     /* { dg-warning "nul past the end" } */
  T (2, "% hhi",       -1);     /* { dg-warning "nul past the end" } */
  T (2, "%+hhi",       -1);     /* { dg-warning "nul past the end" } */
  T (2, "%-hhi",       -1);     /* { dg-warning "nul past the end" } */

  T (2, "%hho",         0);
  T (2, "%hho",         1);
  T (2, "%hho",         7);
  T (2, "%hho",       010);     /* { dg-warning "nul past the end" } */
  T (2, "%hho",       077);     /* { dg-warning "nul past the end" } */
  T (2, "%hho",        -1);     /* { dg-warning "into a region" } */

  T (2, "%hhx",         0);
  T (2, "%hhX",         1);
  T (2, "%hhx",         7);
  T (2, "%hhX",         8);
  T (2, "%hhx",        -1);     /* { dg-warning "nul past the end" } */
  T (2, "%hhX",       0xf);
  T (2, "%hhx",      0x10);     /* { dg-warning "nul past the end" } */
  T (2, "%hhX",      0xff);     /* { dg-warning "nul past the end" } */

  T (1, "%#hhx",        0);     /* { dg-warning "nul past the end" } */
  T (2, "%#hhx",        0);
  T (3, "%#hhx",        1);     /* { dg-warning "nul past the end" } */

  T (4, "%hhd",       255);
  T (4, "%hhd",       256);
  T (4, "%hhd",     0xfff);
  T (4, "%hhd",    0xffff);

  T (4, "%hhi",       255);
  T (4, "%hhi",       256);
  T (4, "%hhi",     0xfff);
  T (4, "%hhi",    0xffff);

  T (4, "%hhu",        -1);
  T (4, "%hhu",       255);
  T (4, "%hhu",       256);
  T (4, "%hhu",     0xfff);
  T (4, "%hhu",    0xffff);

  T (4, "%#hhx",        0);
  T (4, "%#hhx",        1);
  T (4, "%#hhx",       -1);     /* { dg-warning "nul past the end" } */
  T (4, "%#hhx",      0xf);
  T (4, "%#hhx",     0x10);     /* { dg-warning "nul past the end" } */
  T (4, "%#hhx",     0xff);     /* { dg-warning "nul past the end" } */
  T (4, "%#hhx",    0xfff);     /* { dg-warning "nul past the end" } */

  T (4, "%hhi %hhi",  0,  0);
  T (4, "%hhi %hhi",  9,  9);
  T (4, "%hhi %hhi",  1, 10);   /* { dg-warning "nul past the end" } */
  T (4, "%hhi %hhi", 10,  1);   /* { dg-warning "nul past the end" } */
  T (4, "%hhi %hhi", 11, 12);   /* { dg-warning "into a region" } */

  /*  As a special case, a precision of zero with an argument of zero
      results in zero bytes (unless modified by flags and/or width).  */
  T (1, "%.0hhd",   0);
  T (1, "%+.0hhd",  0);         /* { dg-warning "nul past the end" } */
  T (1, "%-.0hhd",  0);
  T (1, "% .0hhd",  0);         /* { dg-warning "nul past the end" } */
  T (1, "%0.0hhd",  0);         /* { dg-warning ".0. flag ignored with precision" } */
  T (1, "%00.0hhd", 0);         /* { dg-warning "repeated .0. flag in format" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%-0.0hhd", 0);         /* { dg-warning ".0. flag ignored with .-. flag" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%.0hhi",   0);
  T (1, "%.0hho",   0);
  /* As a special case, '#' in base 8 results in 1 byte (the zero).  */
  T (1, "%#.0hho",  0);         /* { dg-warning "nul past the end" } */
  T (1, "%.0hhx",   0);
  T (1, "%.0hhX",   0);
  T (1, "%#.0hhX",  0);

  T (5, "%0*hhd %0*hhi", 0,  7, 0,   9);
  T (5, "%0*hhd %0*hhi", 1,  7, 1,   9);
  T (5, "%0*hhd %0*hhi", 1,  7, 2,   9);
  T (5, "%0*hhd %0*hhi", 2,  7, 1,   9);
  T (5, "%0*hhd %0*hhi", 2,  7, 2,   9); /* { dg-warning "nul past the end" } */
  T (5, "%0*hhd %0*hhi", 0, 12, 0, 123); /* { dg-warning ".%0\\*hhi. directive writing 3 bytes into a region of size 2" } */
  T (5, "%0*hhd %0*hhi", 1, 12, 1, 123); /* { dg-warning ".%0\\*hhi. directive writing 3 bytes into a region of size 2" } */
  T (5, "%0*hhd %0*hhi", 2, 12, 3, 123); /* { dg-warning ".%0\\*hhi. directive writing 3 bytes into a region of size 2" } */

  /* FIXME: Move the boundary test cases into a file of their own that's
     exercised only on targets with the matching type limits (otherwise
     they'll fail).  */
#undef MAX
#define MAX   127

#undef MIN
#define MIN   (-MAX -1)

  T (1, "%hhi",        MAX);    /* { dg-warning "into a region" } */
  T (1, "%hhi",        MIN);    /* { dg-warning "into a region" } */
  T (1, "%hhi",  MAX +   1);    /* { dg-warning "into a region" } */

  T (2, "%hhi",  MAX +   1);    /* { dg-warning "into a region" } */
  T (2, "%hhi",  MAX +  10);    /* { dg-warning "into a region" } */
  T (2, "%hhi",  MAX + 100);    /* { dg-warning "into a region" } */
}

/* Exercise the "%hhd", "%hi", "%ho", "%hu", and "%hx" directives
   with constant arguments.  */

void test_sprintf_chk_h_const (void)
{
  T (1, "%hu",          0);     /* { dg-warning "nul past the end" } */
  T (1, "%hu",          1);     /* { dg-warning "nul past the end" } */
  T (1, "%hu",         -1);     /* { dg-warning "into a region" } */

  T (2, "%hi",          0);
  T (2, "%hi",          1);
  T (2, "%hi",          9);
  T (2, "% hi",         9);     /* { dg-warning "nul past the end" } */
  T (2, "%+hi",         9);     /* { dg-warning "nul past the end" } */
  T (2, "%-hi",         9);
  T (2, "%hi",         10);     /* { dg-warning "nul past the end" } */
  T (2, "%hi",         -1);     /* { dg-warning "nul past the end" } */
  T (2, "% hi",        -2);     /* { dg-warning "nul past the end" } */
  T (2, "%+hi",        -3);     /* { dg-warning "nul past the end" } */
  T (2, "%-hi",        -4);     /* { dg-warning "nul past the end" } */

  T (2, "%hu",          0);
  T (2, "%hu",          1);
  T (2, "%hu",          9);
  T (2, "%hu",         10);     /* { dg-warning "nul past the end" } */
  T (2, "%hu",         -1);     /* { dg-warning "into a region" } */

  T (2, "%ho",          0);
  T (2, "%ho",          1);
  T (2, "%ho",          7);
  T (2, "%ho",        010);     /* { dg-warning "nul past the end" } */
  T (2, "%ho",        077);     /* { dg-warning "nul past the end" } */
  T (2, "%ho",       0100);     /* { dg-warning "into a region" } */
  T (2, "%ho",         -1);     /* { dg-warning "into a region" } */

  T (2, "%hx",          0);
  T (2, "%hx",          1);
  T (2, "%hx",          7);
  T (2, "%hx",        0xf);
  T (2, "%hx",       0x10);     /* { dg-warning "nul past the end" } */
  T (2, "%hx",       0xff);     /* { dg-warning "nul past the end" } */
  T (2, "%hx",      0x100);     /* { dg-warning "into a region" } */
  T (2, "%hx",         -1);     /* { dg-warning "into a region" } */

  T (3, "% hi",         7);
  T (3, "%+hi",         8);
  T (3, "%-hi",         9);
  T (3, "%hi",         10);
  T (3, "%hi",         -1);
  T (3, "% hi",        -2);
  T (3, "%+hi",        -3);
  T (3, "%-hi",        -4);

  T (5, "%hu",       9999);
  T (5, "%hu",      10000);     /* { dg-warning "nul past the end" } */
  T (5, "%hu",      65535);     /* { dg-warning "nul past the end" } */

  T (1, "%#hx",         0);     /* { dg-warning "nul past the end" } */
  T (2, "%#hx",         0);
  T (3, "%#hx",         1);     /* { dg-warning "nul past the end" } */

  T (4, "%#hx",         0);
  T (4, "%#hx",         1);
  T (4, "%#hx",       0xf);
  T (4, "%#hx",      0x10);     /* { dg-warning "nul past the end" } */
  T (4, "%#hx",      0xff);     /* { dg-warning "nul past the end" } */
  T (4, "%#hx",     0x100);     /* { dg-warning "into a region" } */
  T (4, "%#hx",        -1);     /* { dg-warning "into a region" } */

  /*  As a special case, a precision of zero with an argument of zero
      results in zero bytes (unless modified by width).  */
  T (1, "%.0hd",        0);
  T (1, "%+.0hd",       0);         /* { dg-warning "nul past the end" } */
  T (1, "%-.0hd",       0);
  T (1, "% .0hd",       0);         /* { dg-warning "nul past the end" } */
  T (1, "%0.0hd",       0);         /* { dg-warning ".0. flag ignored with precision" } */
  T (1, "%00.0hd",      0);         /* { dg-warning "repeated .0. flag in format" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%-0.0hd",      0);         /* { dg-warning ".0. flag ignored with .-. flag" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%.0hi",        0);
  T (1, "%.0ho",        0);
  T (1, "%#.0ho",       0);         /* { dg-warning "nul past the end" } */
  T (1, "%.0hx",        0);
  T (1, "%.0hX",        0);
  T (1, "%#.0hX",       0);

#undef MAX
#define MAX   65535

  T (1, "%hu",          0);     /* { dg-warning "nul past the end" } */
  T (1, "%hu",          1);     /* { dg-warning "nul past the end" } */
  T (1, "%hu",         -1);     /* { dg-warning "into a region" } */
  T (1, "%hu",        MAX);     /* { dg-warning "into a region" } */
  T (1, "%hu",   MAX +  1);     /* { dg-warning "nul past the end" } */
}

/* Exercise the "%d", "%i", "%o", "%u", and "%x" directives with
   constant arguments.  */

void test_sprintf_chk_integer_const (void)
{
  T ( 1, "%i",          0);         /* { dg-warning "nul past the end" } */
  T ( 1, "%i",          1);         /* { dg-warning "nul past the end" } */
  T ( 1, "%i",         -1);         /* { dg-warning "into a region" } */
  T ( 1, "%i_",         1);         /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 1, "_%i",         1);         /* { dg-warning "into a region" } */
  T ( 1, "_%i_",        1);         /* { dg-warning "into a region" } */
  T ( 1, "%o",          0);         /* { dg-warning "nul past the end" } */
  T ( 1, "%u",          0);         /* { dg-warning "nul past the end" } */
  T ( 1, "%x",          0);         /* { dg-warning "nul past the end" } */
  T ( 1, "%#x",         0);         /* { dg-warning "nul past the end" } */
  T ( 1, "%x",          1);         /* { dg-warning "nul past the end" } */
  T ( 1, "%#x",         1);         /* { dg-warning "into a region" } */

  T ( 2, "%i",          0);
  T ( 2, "%i",          1);
  T ( 2, "%i",          9);
  T ( 2, "%i",         -1);         /* { dg-warning "nul past the end" } */
  T ( 2, "%i",         10);         /* { dg-warning "nul past the end" } */
  T ( 2, "%i_",         0);         /* { dg-warning "nul past the end" } */
  T ( 2, "_%i",         0);         /* { dg-warning "nul past the end" } */
  T ( 2, "_%i_",        0);         /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 2, "%o",          1);
  T ( 2, "%o",          7);
  T ( 2, "%o",        010);         /* { dg-warning "nul past the end" } */
  T ( 2, "%o",       0100);         /* { dg-warning "into a region" } */
  T ( 2, "%x",          1);
  T ( 2, "%#x",         1);         /* { dg-warning "into a region" } */
  T ( 2, "%x",        0xa);
  T ( 2, "%x",        0xf);
  T ( 2, "%x",       0x10);         /* { dg-warning "nul past the end" } */
  T ( 2, "%x",       0xff);         /* { dg-warning "nul past the end" } */
  T ( 2, "%x",      0x1ff);         /* { dg-warning "into a region" } */

  T ( 3, "%i",          0);
  T ( 3, "%i",          1);
  T ( 3, "%i",          9);
  T ( 3, "%i",         -9);
  T ( 3, "%i",         10);
  T ( 3, "%i",         99);
  T ( 3, "%i",        -99);         /* { dg-warning "nul past the end" } */

  /* ~0U is formatted into exactly three bytes as "-1" followed by
     the terminating NUL character.  */
  T ( 3, "%+i",       ~0U);
  T ( 3, "%-i",       ~0U);
  T ( 3, "% i",       ~0U);

  T ( 8, "%8u",         1);        /* { dg-warning "nul past the end" } */
  T ( 9, "%8u",         1);

  /*  As a special case, a precision of zero with an argument of zero
      results in zero bytes (unless modified by width).  */
  T (1, "%.0d",         0);
  T (1, "%+.0d",        0);         /* { dg-warning "nul past the end" } */
  T (1, "%-.0d",        0);
  T (1, "% .0d",        0);         /* { dg-warning "nul past the end" } */
  T (1, "%0.0d",        0);         /* { dg-warning ".0. flag ignored with precision" } */
  T (1, "%00.0d",       0);         /* { dg-warning "repeated .0. flag in format" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%-0.0d",       0);         /* { dg-warning ".0. flag ignored with .-. flag" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%.0i",         0);
  T (1, "%.0o",         0);
  T (1, "%#.0o",        0);         /* { dg-warning "nul past the end" } */
  T (1, "%.0x",         0);
  T (1, "%.0X",         0);
  T (1, "%#.0X",        0);

  T ( 7, "%1$i%2$i%3$i",     1, 23, 456);
  T ( 8, "%1$i%2$i%3$i%1$i", 1, 23, 456);
  T ( 8, "%1$i%2$i%3$i%2$i", 1, 23, 456);   /* { dg-warning "nul past the end" } */
  T ( 8, "%1$i%2$i%3$i%3$i", 1, 23, 456);   /* { dg-warning "into a region" } */

#undef MAX
#define MAX   2147483647   /* 10 digits.  */
#undef MIN
#define MIN   (-MAX -1)    /* Sign plus 10 digits.  */

  T ( 1, "%i",        MAX);         /* { dg-warning "into a region" } */
  T ( 1, "%i",        MIN);         /* { dg-warning "into a region" } */
  T ( 2, "%i",        MAX);         /* { dg-warning "into a region" } */
  T ( 2, "%i",        MIN);         /* { dg-warning "into a region" } */
  T (10, "%i",  123456789);
  T (10, "%i", -123456789);         /* { dg-warning "nul past the end" } */
  T (10, "%i",        MAX);         /* { dg-warning "nul past the end" } */
  T (10, "%i",        MIN);         /* { dg-warning "into a region" } */

  T (11, "%i",        MAX);
  T (11, "%i",        MIN);         /* { dg-warning "nul past the end" } */
}

/* Exercise the "%jd", "%ji", "%jo", "%ju", and "%jx" directives
   for the formatting of intmax_t and uintmax_t values with constant
   arguments.  */

void test_sprintf_chk_j_const (void)
{
#define I(x) ((__INTMAX_TYPE__)x)

  T ( 1, "%ji",  I (    0));      /* { dg-warning "nul past the end" } */
  T ( 1, "%ji",  I (    1));      /* { dg-warning "nul past the end" } */
  T ( 1, "%ji",  I (   -1));      /* { dg-warning "into a region" } */
  T ( 1, "%ji_", I (    1));      /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 1, "_%ji", I (    1));      /* { dg-warning "into a region" } */
  T ( 1, "_%ji_",I (    1));      /* { dg-warning "into a region" } */
  T ( 1, "%jo",  I (    0));      /* { dg-warning "nul past the end" } */
  T ( 1, "%ju",  I (    0));      /* { dg-warning "nul past the end" } */
  T ( 1, "%jx",  I (    0));      /* { dg-warning "nul past the end" } */
  T ( 1, "%#jx", I (    0));      /* { dg-warning "nul past the end" } */
  T ( 1, "%jx",  I (    1));      /* { dg-warning "nul past the end" } */
  T ( 1, "%#jx", I (    1));      /* { dg-warning "into a region" } */

  T ( 2, "%ji",  I (    0));
  T ( 2, "%ji",  I (    1));
  T ( 2, "%ji",  I (    9));
  T ( 2, "%ji",  I (   -1));      /* { dg-warning "nul past the end" } */
  T ( 2, "%ji",  I (   10));      /* { dg-warning "nul past the end" } */
  T ( 2, "%ji_", I (    0));      /* { dg-warning "nul past the end" } */
  T ( 2, "_%ji", I (    0));      /* { dg-warning "nul past the end" } */
  T ( 2, "_%ji_",I (    0));      /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 2, "%jo",  I (    1));
  T ( 2, "%jo",  I (    7));
  T ( 2, "%jo",  I (  010));      /* { dg-warning "nul past the end" } */
  T ( 2, "%jo",  I ( 0100));      /* { dg-warning "into a region" } */
  T ( 2, "%jx",  I (    1));
  T ( 2, "%#jx", I (    1));      /* { dg-warning "into a region" } */
  T ( 2, "%jx",  I (  0xa));
  T ( 2, "%jx",  I (  0xf));
  T ( 2, "%jx",  I ( 0x10));      /* { dg-warning "nul past the end" } */
  T ( 2, "%jx",  I ( 0xff));      /* { dg-warning "nul past the end" } */
  T ( 2, "%jx",  I (0x1ff));      /* { dg-warning "into a region" } */

  T ( 3, "%ji",  I (    0));
  T ( 3, "%ji",  I (    1));
  T ( 3, "%ji",  I (    9));
  T ( 3, "%ji",  I (   -9));
  T ( 3, "%ji",  I (   10));
  T ( 3, "%ji",  I (   99));
  T ( 3, "%ji",  I (  -99));      /* { dg-warning "nul past the end" } */

  /* ~0 is formatted into exactly three bytes as "-1" followed by
     the terminating NUL character.  */
  T ( 3, "%+ji",    ~I (0));
  T ( 3, "%-ji",    ~I (0));
  T ( 3, "% ji",    ~I (0));

  T ( 8, "%8ju",     I (1));      /* { dg-warning "nul past the end" } */
  T ( 9, "%8ju",     I (1));

  /*  As a special case, a precision of zero with an argument of zero
      results in zero bytes (unless modified by width).  */
  T (1, "%.0jd",     I (0));
  T (1, "%+.0jd",    I (0));         /* { dg-warning "nul past the end" } */
  T (1, "%+.0ju",    I (0));         /* { dg-warning ".\\+. flag used" } */
  T (1, "%-.0jd",    I (0));
  T (1, "% .0jd",    I (0));         /* { dg-warning "nul past the end" } */
  T (1, "% .0ju",    I (0));         /* { dg-warning ". . flag used" } */
  T (1, "%0.0jd",    I (0));         /* { dg-warning ".0. flag ignored with precision" } */
  T (1, "%00.0jd",   I (0));         /* { dg-warning "repeated .0. flag in format" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%-0.0jd",   I (0));         /* { dg-warning ".0. flag ignored with .-. flag" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%.0ji",     I (0));
  T (1, "%.0jo",     I (0));
  T (1, "%#.0jo",    I (0));         /* { dg-warning "nul past the end" } */
  T (1, "%.0jx",     I (0));
  T (1, "%.0jX",     I (0));
  T (1, "%#.0jX",    I (0));
}

/* Exercise the "%ld", "%li", "%lo", "%lu", and "%lx" directives
   with constant arguments.  */

void test_sprintf_chk_l_const (void)
{
  T ( 1, "%li",      0L);         /* { dg-warning "nul past the end" } */
  T ( 1, "%li",      1L);         /* { dg-warning "nul past the end" } */
  T ( 1, "%li",     -1L);         /* { dg-warning "into a region" } */
  T ( 1, "%li_",     1L);         /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 1, "_%li",     1L);         /* { dg-warning "into a region" } */
  T ( 1, "_%li_",    1L);         /* { dg-warning "into a region" } */
  T ( 1, "%lo",      0L);         /* { dg-warning "nul past the end" } */
  T ( 1, "%lu",      0L);         /* { dg-warning "nul past the end" } */
  T ( 1, "%lx",      0L);         /* { dg-warning "nul past the end" } */
  T ( 1, "%#lx",     0L);         /* { dg-warning "nul past the end" } */
  T ( 1, "%lx",      1L);         /* { dg-warning "nul past the end" } */
  T ( 1, "%#lx",     1L);         /* { dg-warning "into a region" } */

  T ( 2, "%li",      0L);
  T ( 2, "%li",      1L);
  T ( 2, "%li",      9L);
  T ( 2, "%li",     -1L);         /* { dg-warning "nul past the end" } */
  T ( 2, "%li",     10L);         /* { dg-warning "nul past the end" } */
  T ( 2, "%li_",     0L);         /* { dg-warning "nul past the end" } */
  T ( 2, "_%li",     0L);         /* { dg-warning "nul past the end" } */
  T ( 2, "_%li_",    0L);         /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 2, "%lo",      1L);
  T ( 2, "%lo",      7L);
  T ( 2, "%lo",    010L);         /* { dg-warning "nul past the end" } */
  T ( 2, "%lo",   0100L);         /* { dg-warning "into a region" } */
  T ( 2, "%lx",      1L);
  T ( 2, "%#lx",     1L);         /* { dg-warning "into a region" } */
  T ( 2, "%lx",    0xaL);
  T ( 2, "%lx",    0xfL);
  T ( 2, "%lx",   0x10L);         /* { dg-warning "nul past the end" } */
  T ( 2, "%lx",   0xffL);         /* { dg-warning "nul past the end" } */
  T ( 2, "%lx",  0x1ffL);         /* { dg-warning "into a region" } */

  T ( 3, "%li",      0L);
  T ( 3, "%li",      1L);
  T ( 3, "%li",      9L);
  T ( 3, "%li",     -9L);
  T ( 3, "%li",     10L);
  T ( 3, "%li",     99L);
  T ( 3, "%li",    -99L);         /* { dg-warning "nul past the end" } */

  /* ~0U is formatted into exactly three bytes as "-1" followed by
     the terminating NUL character.  */
  T ( 3, "%+li",   ~0LU);
  T ( 3, "%-li",   ~0LU);
  T ( 3, "% li",   ~0LU);

  T ( 8, "%8lu",     1L);         /* { dg-warning "nul past the end" } */
  T ( 9, "%8lu",     1L);

  /*  As a special case, a precision of zero with an argument of zero
      results in zero bytes (unless modified by width).  */
  T (1, "%.0ld",     0L);
  T (1, "%+.0ld",    0L);         /* { dg-warning "nul past the end" } */
  T (1, "%+.0lu",    0L);         /* { dg-warning ".\\+. flag used" } */
  T (1, "%-.0ld",    0L);
  T (1, "% .0ld",    0L);         /* { dg-warning "nul past the end" } */
  T (1, "% .0lu",    0L);         /* { dg-warning ". . flag used" } */
  T (1, "%0.0ld",    0L);         /* { dg-warning ".0. flag ignored with precision" } */
  T (1, "%00.0ld",   0L);         /* { dg-warning "repeated .0. flag in format" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%-0.0ld",   0L);         /* { dg-warning ".0. flag ignored with .-. flag" } */
  /* { dg-warning ".0. flag ignored with precision" "" { target *-*-* } .-1 } */
  T (1, "%.0li",     0L);
  T (1, "%.0lo",     0L);
  T (1, "%#.0lo",    0L);         /* { dg-warning "nul past the end" } */
  T (1, "%.0lx",     0L);
  T (1, "%.0lX",     0L);
  T (1, "%#.0lX",    0L);
}

/* Exercise the "%lld", "%lli", "%llo", "%llu", and "%llx" directives
   with constant arguments.  */

void test_sprintf_chk_ll_const (void)
{
  T ( 1, "%lli",      0LL);     /* { dg-warning "nul past the end" } */
  T ( 1, "%lli",      1LL);     /* { dg-warning "nul past the end" } */
  T ( 1, "%lli",     -1LL);     /* { dg-warning "into a region" } */
  T ( 1, "%lli_",     1LL);     /* { dg-warning " 1 byte into a region of size 0 " } */
  T ( 1, "_%lli",     1LL);     /* { dg-warning "into a region" } */
  T ( 1, "_%lli_",    1LL);     /* { dg-warning "into a region" } */
  T ( 1, "%llo",      0LL);     /* { dg-warning "nul past the end" } */
  T ( 1, "%llu",      0LL);     /* { dg-warning "nul past the end" } */
  T ( 1, "%llx",      0LL);     /* { dg-warning "nul past the end" } */
  T ( 1, "%#llx",     0LL);     /* { dg-warning "nul past the end" } */
  T ( 1, "%llx",      1LL);     /* { dg-warning "nul past the end" } */
  T ( 1, "%#llx",     1LL);     /* { dg-warning "into a region" } */

  T ( 2, "%lli",      0LL);
  T ( 2, "%lli",      1LL);
  T ( 2, "%lli",      9LL);
  T ( 2, "%lli",     -1LL);     /* { dg-warning "nul past the end" } */
  T ( 2, "%lli",     10LL);     /* { dg-warning "nul past the end" } */
  T ( 2, "%lli_",     0LL);     /* { dg-warning "nul past the end" } */
  T ( 2, "_%lli",     0LL);     /* { dg-warning "nul past the end" } */
  T ( 2, "_%lli_",    0LL);     /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 2, "%llo",      1LL);
  T ( 2, "%llo",      7LL);
  T ( 2, "%llo",    010LL);     /* { dg-warning "nul past the end" } */
  T ( 2, "%llo",   0100LL);     /* { dg-warning "into a region" } */
  T ( 2, "%llx",      1LL);
  T ( 2, "%#llx",     1LL);     /* { dg-warning "into a region" } */
  T ( 2, "%llx",    0xaLL);
  T ( 2, "%llx",    0xfLL);
  T ( 2, "%llx",   0x10LL);     /* { dg-warning "nul past the end" } */
  T ( 2, "%llx",   0xffLL);     /* { dg-warning "nul past the end" } */
  T ( 2, "%llx",  0x1ffLL);     /* { dg-warning "into a region" } */

  T ( 3, "%lli",      0LL);
  T ( 3, "%lli",      1LL);
  T ( 3, "%lli",      9LL);
  T ( 3, "%lli",     -9LL);
  T ( 3, "%lli",     10LL);
  T ( 3, "%lli",     99LL);
  T ( 3, "%lli",    -99LL);     /* { dg-warning "nul past the end" } */

  /* ~0U is formatted into exactly three bytes as "-1" followed by
     the terminating NUL character.  */
  T ( 3, "%+lli",   ~0LLU);
  T ( 3, "%-lli",   ~0LLU);
  T ( 3, "% lli",   ~0LLU);

  T ( 8, "%8llu",     1LL);     /* { dg-warning "nul past the end" } */
  T ( 9, "%8llu",     1LL);

  /* assume 64-bit long long.  */
#define LLONG_MAX   9223372036854775807LL   /* 19 bytes */
#define LLONG_MIN   (-LLONG_MAX - 1)        /* 20 bytes */

  T (18, "%lli", LLONG_MIN);    /* { dg-warning "into a region" } */
  T (19, "%lli", LLONG_MIN);    /* { dg-warning "into a region" } */
  T (20, "%lli", LLONG_MIN);    /* { dg-warning "nul past the end" } */
  T (21, "%lli", LLONG_MIN);

  T (18, "%lli", LLONG_MAX);    /* { dg-warning "into a region" } */
  T (19, "%lli", LLONG_MAX);    /* { dg-warning "nul past the end" } */
  T (20, "%lli", LLONG_MAX);

  T (21, "%llo",      -1LL);    /* { dg-warning "into a region" } */
  T (22, "%llo",      -1LL);    /* { dg-warning "nul past the end" } */
  T (23, "%llo",      -1LL);

  T (19, "%llu",      -1LL);    /* { dg-warning "into a region" } */
  T (20, "%llu",      -1LL);    /* { dg-warning "nul past the end" } */
  T (21, "%llu",      -1LL);

  T (15, "%llx",      -1LL);    /* { dg-warning "into a region" } */
  T (16, "%llx",      -1LL);    /* { dg-warning "nul past the end" } */
  T (17, "%llx",      -1LL);
}

void test_sprintf_chk_L_const (void)
{
  T (-1, "%Li",        0LL);
  T ( 1, "%Li",        0LL);         /* { dg-warning "nul past the end" } */
  T ( 1, "%Li",        1LL);         /* { dg-warning "nul past the end" } */
  T ( 1, "%Li",       -1LL);         /* { dg-warning "into a region" } */
  T ( 1, "%Li_",       1LL);         /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 1, "_%Li",       1LL);         /* { dg-warning "into a region" } */
  T ( 1, "_%Li_",      1LL);         /* { dg-warning "into a region" } */
}

void test_sprintf_chk_z_const (void)
{
  T (-1, "%zi",        (size_t)0);
  T ( 1, "%zi",        (size_t)0);  /* { dg-warning "nul past the end" } */
  T ( 1, "%zi",        (size_t)1);  /* { dg-warning "nul past the end" } */
  T ( 1, "%zi",        (size_t)-1L);/* { dg-warning "into a region" } */
  T ( 1, "%zi_",       (size_t)1);  /* { dg-warning " 1 byte into a region of size 0" } */
  T ( 1, "_%zi",       (size_t)1);  /* { dg-warning "into a region" } */
  T ( 1, "_%zi_",      (size_t)1);  /* { dg-warning "into a region" } */

  T ( 2, "%zu",        (size_t)1);
  T ( 2, "%zu",        (size_t)9);
  T ( 2, "%zu",        (size_t)10); /* { dg-warning "nul past the end" } */
}

void test_sprintf_chk_a_const (void)
{
  T (-1, "%a",         0.0);
  T (-1, "%la",        0.0);
  T (-1, "%.a",        0.0);
  T (-1, "%.la",       0.0);
  T (-1, "%123.a",     0.0);
  T (-1, "%234.la",    0.0);
  T (-1, "%.345a",     0.0);
  T (-1, "%456.567la", 0.0);

  /* The least number of bytes on output is 6 for "0x0p+0".  When precision
     is missing the number of digits after the decimal point isn't fully
     specified by C (a defect).  Two sets of implementations are known to
     exist: those that trim trailing zeros (e.g., Glibc) and those that
     pad output with trailing zeros so that all floating point numbers
     result in the same number of bytes on output (e.g., Solaris).  */
  T ( 0, "%a",   0.0);         /* { dg-warning "writing between 6 and 20 bytes" } */
  T ( 0, "%la",  0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T ( 1, "%a",   0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T ( 2, "%a",   0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T ( 3, "%a",   0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T ( 4, "%a",   0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T ( 5, "%a",   0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T ( 6, "%a",   0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T (19, "%a",   0.0);         /* { dg-warning "between 6 and 20 bytes" } */
  T (20, "%a",   0.0);         /* { dg-warning "may write a terminating nul" } */

  T (0, "%.a",    0.0);       /* { dg-warning "into a region" } */
  T (0, "%.0a",   0.0);       /* { dg-warning "into a region" } */
  T (0, "%.0la",  0.0);       /* { dg-warning "into a region" } */
  T (1, "%.0a",   0.0);       /* { dg-warning "into a region" } */
  T (2, "%.0a",   0.0);       /* { dg-warning "into a region" } */
  T (3, "%.0a",   0.0);       /* { dg-warning "into a region" } */
  T (4, "%.0a",   0.0);       /* { dg-warning "into a region" } */
  T (5, "%.0a",   0.0);       /* { dg-warning "into a region" } */
  T (6, "%.0a",   0.0);       /* { dg-warning "writing a terminating nul" } */

  T (7, "%6.a",   0.0);
  T (7, "%7.a",   0.0);       /* { dg-warning "writing a terminating nul" } */
  T (7, "%7.1a",  0.0);       /* { dg-warning "writing 8 bytes into a region of size 7" } */

  T (7, "%.a",    0.0);
  T (7, "%.0a",   0.0);
}

void test_sprintf_chk_e_const (void)
{
  T (-1, "%E",      0.0);
  T (-1, "%lE",     0.0);
  T (-1, "%.E",     0.0);
  T (-1, "%.lE",    0.0);
  T (-1, "%123.E",  0.0);
  T (-1, "%234.lE", 0.0);
  T (-1, "%.345E",  0.0);
  T (-1, "%.456lE", 0.0);

  T ( 0, "%E",   0.0);          /* { dg-warning "into a region" } */
  T ( 0, "%e",   0.0);          /* { dg-warning "into a region" } */
  T ( 1, "%E",   1.0);          /* { dg-warning "into a region" } */
  T ( 1, "%e",   1.0);          /* { dg-warning "into a region" } */
  T ( 2, "%e",   2.0);          /* { dg-warning "into a region" } */
  T ( 3, "%e",   3.0);          /* { dg-warning "into a region" } */
  T (12, "%e",   1.2);          /* { dg-warning "nul past the end" } */
  T (12, "%e",  12.0);          /* { dg-warning "nul past the end" } */
  T (13, "%e",   1.3);          /* 1.300000e+00 */
  T (13, "%E",  13.0);          /* 1.300000e+01 */
  T (13, "%e",  13.0);
  T (13, "%E",  1.4e+99);       /* 1.400000e+99 */
  T (13, "%e",  1.5e+100);      /* { dg-warning "nul past the end" } */
  T (14, "%E",  1.6e+101);      /* 1.600000E+101 */
  T (14, "%e", -1.7e+102);      /* { dg-warning "nul past the end" } */
  T (15, "%E", -1.8e+103);      /* -1.800000E+103 */

  T (16, "%.8e", -1.9e+104);    /* { dg-warning "nul past the end" } */
  T (17, "%.8e", -2.0e+105);    /* -2.00000000e+105 */

  T ( 5, "%.e",  0.0);          /* { dg-warning "nul past the end" } */
  T ( 5, "%.0e", 0.0);          /* { dg-warning "nul past the end" } */
  T ( 5, "%.0e", 1.0);          /* { dg-warning "nul past the end" } */
  T ( 6, "%.e",  1.0);
  T ( 6, "%.0e", 1.0);

  /* The output of the following directives depends on the rounding
     mode.  */
  T (12, "%e",  9.999999e+99);  /* { dg-warning "between 12 and 13" } */
  T (12, "%e",  9.9999994e+99); /* { dg-warning "between 12 and 13" } */
  T (12, "%e",  9.9999995e+99); /* { dg-warning "between 12 and 13" } */
  T (12, "%e",  9.9999996e+99); /* { dg-warning "between 12 and 13" } */
  T (12, "%e",  9.9999997e+99); /* { dg-warning "between 12 and 13" } */
  T (12, "%e",  9.9999998e+99); /* { dg-warning "between 12 and 13" } */

  T (12, "%Le", 9.9999994e+99L);/* { dg-warning "between 12 and 13" } */
  T (12, "%Le", 9.9999995e+99L);/* { dg-warning "between 12 and 13" } */
  T (12, "%Le", 9.9999996e+99L);/* { dg-warning "between 12 and 13" } */
  T (12, "%Le", 9.9999997e+99L);/* { dg-warning "between 12 and 13" } */
  T (12, "%Le", 9.9999998e+99L);/* { dg-warning "between 12 and 13" } */
  T (12, "%Le", 9.9999999e+99L);/* { dg-warning "between 12 and 13" } */
}

/* At -Wformat-overflow level 1 unknown numbers are assumed to have
   the value one, and unknown strings are assumed to have a zero
   length.  */

void test_sprintf_chk_s_nonconst (int w, int p, const char *s)
{
  T (-1, "%s",   s);
  T ( 0, "%-s",  s);            /* { dg-warning "writing a terminating nul" } */
  T ( 1, "%s",   s);
  T (-1, "%.0s", s);
  T ( 1, "%.0s", s);
  T (-1, "%.1s", s);
  T ( 1, "%.1s", s);            /* { dg-warning "may write a terminating nul past the end" } */
  T (-1, "%.2s", s);
  T ( 1, "%.2s", s);            /* { dg-warning "directive writing up to 2 bytes" } */
  T ( 2, "%.2s", s);            /* { dg-warning "may write a terminating nul" } */
  T ( 3, "%.2s", s);

  /* The string argument is constant but the width and/or precision
     is not.  */
  T (-1, "%*s",  w, "");
  T ( 1, "%*s",  w, "");        /* { dg-warning "may write a terminating nul past the end" } */
  T (-1, "%*s",  w, "1");
  T ( 1, "%*s",  w, "1");       /* { dg-warning "writing a terminating nul past the end" } */
  T (-1, "%.*s", p, "");
  T ( 1, "%.*s", p, "");
  T (-1, "%.*s", p, "1");
  T ( 1, "%.*s", p, "1");       /* { dg-warning "may write a terminating nul" } */
  T ( 1, "%.*s", w, "123");     /* { dg-warning "writing up to 3 bytes into a region of size 1" } */

  /* Either of the messages below is acceptable.  */
  T ( 1, "%*s", w, "123");      /* { dg-warning "writing 3 or more bytes into a region of size 1|writing between 3 and 2147483648 bytes" } */
  T ( 2, "%*s", w, "123");      /* { dg-warning "writing 3 or more bytes into a region of size 2|writing between 3 and 2147483648 bytes" } */
  T ( 3, "%*s", w, "123");      /* { dg-warning "writing a terminating nul past the end" } */
  T ( 4, "%*s", w, "123");

  /* The following will definitely write past the end of the buffer,
     but since at level 1 the length of an unknown string argument
     is assumed to be zero, it will write the terminating nul past
     the end (we don't print "past the end" when we're not
     sure which we can't be with an unknown string.  */
  T (1, "%1s",  s);             /* { dg-warning "writing a terminating nul past the end" } */

  /* Multiple directives.  */
  T (1, "%s%s",    s, s);
  T (1, "%s%s%s", s, s, s);
}

/* Exercise the hh length modifier with all integer specifiers and
   a non-constant argument.  */

void test_sprintf_chk_hh_nonconst (int w, int p, int a)
{
  T (-1, "%hhd",        a);

  T (0, "%hhd",         a);     /* { dg-warning ".%hhd. directive writing between 1 and . bytes into a region of size 0" } */
  T (0, "%hhi",      var0);     /* { dg-warning "into a region" } */
  T (0, "%hhi",         a);     /* { dg-warning "into a region" } */
  T (0, "%hhu",         a);     /* { dg-warning "into a region" } */
  T (0, "%hhx",         a);     /* { dg-warning "into a region" } */

  T (1, "%hhd",         a);     /* { dg-warning "nul past the end" } */
  T (1, "%hhd",      var0);     /* { dg-warning "nul past the end" } */
  T (1, "%hhi",         a);     /* { dg-warning "nul past the end" } */
  T (1, "%hhu",         a);     /* { dg-warning "nul past the end" } */
  T (1, "%hhx",         a);     /* { dg-warning "nul past the end" } */

  T (1, "% hhd",        a);     /* { dg-warning "into a region" } */
  T (1, "% hhi",        a);     /* { dg-warning "into a region" } */
  T (1, "%+hhd",        a);     /* { dg-warning "into a region" } */
  T (1, "%+hhi",        a);     /* { dg-warning "into a region" } */
  T (1, "%-hhd",        a);     /* { dg-warning "nul past the end" } */
  T (1, "%-hhi",        a);     /* { dg-warning "nul past the end" } */

  T (2, "%hhd",         a);
  T (2, "%hhd",      var0);
  T (2, "%hhd",     var10);
  T (2, "%hhi",         a);
  T (2, "%hho",         a);
  T (2, "%hhu",         a);
  T (2, "%hhx",         a);

  T (2, "% hhd",        a);     /* { dg-warning "nul past the end" } */
  T (2, "% hhd",     var0);     /* { dg-warning "nul past the end" } */
  T (2, "% hhd",    var10);     /* { dg-warning "nul past the end" } */
  T (2, "% hhi",        a);     /* { dg-warning "nul past the end" } */
  T (2, "% hho",        a);     /* { dg-warning ". . flag used with .%o." } */
  T (2, "% hhu",        a);     /* { dg-warning ". . flag used with .%u." } */
  T (2, "% hhx",        a);     /* { dg-warning ". . flag used with .%x." } */

  /* The following results in between "0" and "0377" for -1.  Although
     the minimum output would fit, given the '#' flag the likely output
     (i.e., for any non-zero argument) includes a leading zero followed
     by one or more octal digits, which results in the terminating nul
     being written past the end.  Thus the "may write" warning.  */
  T (2, "%#hho",        a);     /* { dg-warning "may write a terminating nul" } */
  /* Similar to the above, but the likely output of the directive for
     a non-zero argument overflows.  Thus the "writing X bytes" (as
     opposed to "may write") warning.  */
  T (2, "%#hhx",        a);     /* { dg-warning "writing between 1 and 4 bytes" } */

  T (3, "%0hhd",        a);
  T (3, "%1hhd",        a);
  T (3, "%2hhd",        a);
  T (3, "%2hhi",        a);
  T (3, "%2hho",        a);
  T (3, "%2hhu",        a);
  T (3, "%2hhx",        a);
  T (3, "%2.hhx",       a);

  T (3, "%3hhd",        a);     /* { dg-warning "nul past the end" } */
  T (3, "%3hhi",        a);     /* { dg-warning "nul past the end" } */
  T (3, "%3hho",        a);     /* { dg-warning "nul past the end" } */
  T (3, "%3hhu",        a);     /* { dg-warning "nul past the end" } */
  T (3, "%3hhx",        a);     /* { dg-warning "nul past the end" } */
  T (3, "%3.hhx",       a);     /* { dg-warning "nul past the end" } */

  T (4, "%5hhd",        a);     /* { dg-warning "into a region" } */
  T (4, "%6hhi",        a);     /* { dg-warning "into a region" } */
  T (4, "%7hho",        a);     /* { dg-warning "into a region" } */
  T (4, "%8hhu",        a);     /* { dg-warning "into a region" } */
  T (4, "%9hhx",        a);     /* { dg-warning "into a region" } */

  T (3, "%.hhd",        a);
  T (3, "%.0hhd",       a);
  T (3, "%.1hhd",       a);
  T (3, "%.2hhd",       a);
  T (3, "%.2hhi",       a);
  T (3, "%.2hho",       a);
  T (3, "%.2hhu",       a);
  T (3, "%.2hhx",       a);

  T (3, "%.3hhd",       a);     /* { dg-warning "nul past the end" } */
  T (3, "%.3hhi",       a);     /* { dg-warning "nul past the end" } */
  T (3, "%.3hho",       a);     /* { dg-warning "nul past the end" } */
  T (3, "%.3hhu",       a);     /* { dg-warning "nul past the end" } */
  T (3, "%.3hhx",       a);     /* { dg-warning "nul past the end" } */

  T (4, "%.5hhd",       a);     /* { dg-warning "into a region" } */
  T (4, "%.6hhi",       a);     /* { dg-warning "into a region" } */
  T (4, "%.7hho",       a);     /* { dg-warning "into a region" } */
  T (4, "%.8hhu",       a);     /* { dg-warning "into a region" } */
  T (4, "%.9hhx",       a);     /* { dg-warning "into a region" } */

  /* Exercise cases where the type of the actual argument (whose value
     and range are unknown) constrain the size of the output and so
     can be used to avoid what would otherwise be false positives.  */

  T (2, "%hhd", (UChar)a);
  T (2, "%hhi", (UChar)a);
  T (2, "%-hhi", (UChar)a);

  /* Exercise cases where the argument is known but width isn't.  */
  T (0, "%*hhi", w,   0);       /* { dg-warning "into a region" } */
  T (1, "%*hhi", w,   0);       /* { dg-warning "nul past the end" } */
  T (2, "%*hhi", w,   0);
  T (2, "%*hhi", w,  12);       /* { dg-warning "nul past the end" } */
  T (2, "%*hhi", w, 123);       /* { dg-warning "into a region" } */

  /* The argument is known but precision isn't.  When the argument
     is zero only the first call can be diagnosed since a zero
     precision would result in no bytes on output.  */
  T (0, "%.*hhi", p,   0);      /* { dg-warning " writing up to \[0-9\]+ bytes" } */
  T (1, "%.*hhi", p,   0);      /* { dg-warning "may write a terminating nul" }*/
  T (2, "%.*hhi", p,   0);
  T (2, "%.*hhi", p,  12);      /* { dg-warning "nul past the end" } */
  T (2, "%.*hhi", p, 123);      /* { dg-warning "into a region" } */

  /* The argument is known but neither width nor precision is.  */
  T (0, "%*.*hhi", w, p,   0);  /* { dg-warning "writing up to \[0-9\]+ bytes" } */
  T (1, "%*.*hhi", w, p,   0);  /* { dg-warning "may write a terminating nul" } */
  T (2, "%*.*hhi", w, p,   0);
  T (2, "%*.*hhi", w, p,  12);  /* { dg-warning "nul past the end" } */
  T (2, "%*.*hhi", w, p, 123);  /* { dg-warning "into a region" } */

  /* The argument and width are known but precision isn't.  */
  T (0, "%1.*hhi",  p,   0);    /* { dg-warning "into a region" } */
  T (0, "%-1.*hhi", p,   0);    /* { dg-warning "into a region" } */
  T (1, "%1.*hhi",  p,   0);    /* { dg-warning "nul past the end" } */
  T (2, "%1.*hhi",  p,   0);
  T (2, "%2.*hhi",  p,   0);    /* { dg-warning "nul past the end" } */
  T (2, "%1.*hhi",  p,  12);    /* { dg-warning "nul past the end" } */
  T (2, "%2.*hhi",  p,  12);    /* { dg-warning "nul past the end" } */

  T (2, "%1.*hhi",  p, 123);    /* { dg-warning "into a region" } */
  T (2, "%2.*hhi",  p, 123);    /* { dg-warning "into a region" } */
  T (2, "%3.*hhi",  p, 123);    /* { dg-warning "into a region" } */

  /* The argument and precision are known but width isn't.  */
  T (0, "%*.1hhi",  w,   0);    /* { dg-warning "into a region" } */
  T (1, "%*.1hhi",  w,   0);    /* { dg-warning "nul past the end" } */
  T (2, "%*.1hhi",  w,   0);
  T (2, "%*.2hhi",  w,   0);    /* { dg-warning "nul past the end" } */
  T (2, "%*.1hhi",  w,  12);    /* { dg-warning "nul past the end" } */
  T (2, "%*.2hhi",  w,  12);    /* { dg-warning "nul past the end" } */
  T (2, "%*.3hhi",  w,  12);    /* { dg-warning "into a region" } */

  T (2, "%*.1hhi",  w, 123);    /* { dg-warning "into a region" } */
  T (2, "%*.2hhi",  w, 123);    /* { dg-warning "into a region" } */
  T (2, "%*.3hhi",  w, 123);    /* { dg-warning "into a region" } */
}

/* Exercise the h length modifier with all integer specifiers and
   a non-constant argument.  */

void test_sprintf_chk_h_nonconst (int a)
{
  T (-1, "%hd",         a);

  T (0, "%hd",          a);     /* { dg-warning "into a region" } */
  T (0, "%hi",          a);     /* { dg-warning "into a region" } */
  T (0, "%hu",          a);     /* { dg-warning "into a region" } */
  T (0, "%hx",          a);     /* { dg-warning "into a region" } */

  T (1, "%hd",          a);     /* { dg-warning "nul past the end" } */
  T (1, "%hi",          a);     /* { dg-warning "nul past the end" } */
  T (1, "%hu",          a);     /* { dg-warning "nul past the end" } */
  T (1, "%hx",          a);     /* { dg-warning "nul past the end" } */

  T (1, "% hd",         a);     /* { dg-warning "into a region" } */
  T (1, "% hi",         a);     /* { dg-warning "into a region" } */
  T (1, "%+hd",         a);     /* { dg-warning "into a region" } */
  T (1, "%+hi",         a);     /* { dg-warning "into a region" } */
  T (1, "%-hd",         a);     /* { dg-warning "nul past the end" } */
  T (1, "%-hi",         a);     /* { dg-warning "nul past the end" } */

  T (2, "%hd",          a);
  T (2, "%hi",          a);
  T (2, "%ho",          a);
  T (2, "%hu",          a);
  T (2, "%hx",          a);

  T (2, "% hd",         a);     /* { dg-warning "nul past the end" } */
  T (2, "% hi",         a);     /* { dg-warning "nul past the end" } */
  T (2, "% ho",         a);     /* { dg-warning ". . flag used with .%o." } */
  T (2, "% hu",         a);     /* { dg-warning ". . flag used with .%u." } */
  T (2, "% hx",         a);     /* { dg-warning ". . flag used with .%x." } */

  T (2, "#%ho",         a);     /* { dg-warning "nul past the end" } */
  T (2, "#%hx",         a);     /* { dg-warning "nul past the end" } */

  T (3, "%2hd",         a);
  T (3, "%2hi",         a);
  T (3, "%2ho",         a);
  T (3, "%2hu",         a);
  T (3, "%2hx",         a);
}

/* Exercise all integer specifiers with no modifier and a non-constant
   argument.  */

void test_sprintf_chk_int_nonconst (int w, int p, int a)
{
  T (-1, "%d",          a);

  T (0, "%d",           a);     /* { dg-warning "into a region" } */
  T (0, "%i",           a);     /* { dg-warning "into a region" } */
  T (0, "%u",           a);     /* { dg-warning "into a region" } */
  T (0, "%x",           a);     /* { dg-warning "into a region" } */

  T (1, "%d",           a);     /* { dg-warning "nul past the end" } */
  T (1, "%i",           a);     /* { dg-warning "nul past the end" } */
  T (1, "%u",           a);     /* { dg-warning "nul past the end" } */
  T (1, "%x",           a);     /* { dg-warning "nul past the end" } */

  T (1, "% d",          a);     /* { dg-warning "into a region" } */
  T (1, "% i",          a);     /* { dg-warning "into a region" } */
  T (1, "%+d",          a);     /* { dg-warning "into a region" } */
  T (1, "%+i",          a);     /* { dg-warning "into a region" } */
  T (1, "%-d",          a);     /* { dg-warning "nul past the end" } */
  T (1, "%-i",          a);     /* { dg-warning "nul past the end" } */

  T (2, "%d",           a);
  T (2, "%i",           a);
  T (2, "%o",           a);
  T (2, "%u",           a);
  T (2, "%x",           a);

  T (2, "% d",          a);     /* { dg-warning "nul past the end" } */
  T (2, "% i",          a);     /* { dg-warning "nul past the end" } */
  T (2, "% o",          a);     /* { dg-warning ". . flag used with .%o." } */
  T (2, "% u",          a);     /* { dg-warning ". . flag used with .%u." } */
  T (2, "% x",          a);     /* { dg-warning ". . flag used with .%x." } */

  T (2, "#%o",          a);     /* { dg-warning "nul past the end" } */
  T (2, "#%x",          a);     /* { dg-warning "nul past the end" } */

  T (3, "%2d",          a);
  T (3, "%2i",          a);
  T (3, "%2o",          a);
  T (3, "%2u",          a);
  T (3, "%2x",          a);

  T (1, "%.*d",      p, a);     /* { dg-warning "nul past the end" } */
  T (2, "%.*d",      p, a);

  T (4, "%i %i",        a, a);
  /* The following will definitely be "writing a terminating nul past the end"
     (i.e., not "may write".)  */
  T (4, "%i %i ",       a, a);      /* { dg-warning "nul past the end" } */
  T (4, "%i %i %i",     a, a, a);   /* { dg-warning "into a region" }*/
}

void test_sprintf_chk_e_nonconst (int w, int p, double d)
{
  T (-1, "%E",           d);
  T (-1, "%lE",          d);
  T (-1, "%.E",          d);
  T (-1, "%.lE",         d);
  T (-1, "%*E",    w,    d);
  T (-1, "%*lE",   w,    d);
  T (-1, "%.*E",      p, d);
  T (-1, "%.*lE",     p, d);
  T (-1, "%*.*E",  w, p, d);
  T (-1, "%*.*lE", w, p, d);

  /* The least number of bytes %E can produce is 3 for "inf" and "nan".  */
  T ( 0, "%E",          d);           /* { dg-warning "writing between 3 and 14 bytes into a region of size 0" } */
  T ( 0, "%e",          d);           /* { dg-warning "into a region" } */
  T ( 1, "%E",          d);           /* { dg-warning "into a region" } */
  T ( 1, "%e",          d);           /* { dg-warning "into a region" } */
  T ( 2, "%e",          d);           /* { dg-warning "into a region" } */
  T ( 3, "%e",          d);           /* { dg-warning "into a region" } */
  T (12, "%e",          d);           /* { dg-warning "nul past the end" } */
  T (13, "%E",          d);           /* 1.000000E+00 */
  T (13, "%e",          d);
  T (14, "%E",          d);
  T (14, "%e",          d);

  T ( 0, "%+E",         d);           /* { dg-warning "writing between 4 and 14 bytes into a region of size 0" } */
  T ( 0, "%-e",         d);           /* { dg-warning "writing between 3 and 14 bytes into a region of size 0" } */
  T ( 0, "% E",         d);           /* { dg-warning "writing between 4 and 14 bytes into a region of size 0" } */

  /* The range of output of "%.0e" is between 3 and 7 bytes (not counting
     the terminating NUL.  */
  T ( 5, "%.0e",        d);           /* { dg-warning "may write a terminating nul past the end" } */
  T ( 6, "%.0e",        d);           /* 1e+00 */

  /* The range of output of "%.1e" is between 3 and 9 bytes (not counting
     the terminating NUL.  */
  T ( 7, "%.1e",        d);           /* { dg-warning "may write a terminating nul past the end" } */
  T ( 8, "%.1e",        d);

  T ( 0, "%*e",      0, d);           /* { dg-warning "writing between 3 and 14 bytes into a region of size 0" } */
  T ( 0, "%*e",      w, d);           /* { dg-warning "writing 3 or more bytes into a region of size 0|writing between 3 and \[0-9\]+ bytes into a region of size 0" } */
}

void test_sprintf_chk_f_nonconst (double d)
{
  T (-1, "%F",          d);
  T (-1, "%lF",         d);

  T ( 0, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 0, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 1, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 1, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 2, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 2, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 3, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 3, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 4, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 4, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 5, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 5, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 6, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 6, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 7, "%F",          d);           /* { dg-warning "into a region" } */
  T ( 7, "%f",          d);           /* { dg-warning "into a region" } */
  T ( 8, "%F",          d);           /* { dg-warning "nul past the end" } */
  T ( 8, "%f",          d);           /* { dg-warning "nul past the end" } */
  T ( 9, "%F",          d);
  T ( 9, "%f",          d);
}

/* Tests for __builtin_vsprintf_chk are the same as those for
   __builtin_sprintf_chk with non-constant arguments.  */
#undef T
#define T(size, fmt)							\
  (FUNC (__vsprintf_chk) (buffer (size), 0, objsize (size), fmt, va),	\
   sink (buffer))

void test_vsprintf_chk_c (va_list va)
{
  T (-1, "%c");

  /* Verify the full text of the diagnostic for just the distinct messages
     and use abbreviations in subsequent test cases.  */
  T (0, "%c");              /* { dg-warning ".%c. directive writing 1 byte into a region of size 0" } */
  T (1, "%c");              /* { dg-warning "writing a terminating nul past the end" } */
  T (1, "%c");              /* { dg-warning "nul past the end" } */
  T (2, "%c");
  T (2, "%2c");             /* { dg-warning "nul past the end" } */
  T (2, "%3c");             /* { dg-warning "into a region" } */
  T (2, "%c%c");            /* { dg-warning "nul past the end" } */
  T (3, "%c%c");

  /* Wide characters.  */
  T (0, "%lc");             /* { dg-warning "up to 6 bytes " } */
  T (1, "%lc");             /* { dg-warning "up to 6 bytes " } */
  T (2, "%lc");             /* { dg-warning "may write a terminating nul" } */

  /* The following could result in as few as a single byte and in as many
     as MB_CUR_MAX, but since the MB_CUR_MAX value is a runtime property
     the write cannot be reliably diagnosed.  */
  T (2, "%1lc");            /* { dg-warning "may write a terminating nul" } */
  /* Writing some unknown number of bytes into a field two characters wide.  */
  T (2, "%2lc");            /* { dg-warning "nul past the end" } */
  T (2, "%lc%lc");          /* { dg-warning "writing up to 6 bytes into a region of size between 0 and 2" } */

  T (3, "%lc%c");           /* { dg-warning "may write a terminating nul" } */
  /* Here in the best case each argument will format as single character,
     causing the terminating NUL to be written past the end.  */
  T (3, "%lc%c%c");         /* { dg-warning "writing 1 byte into a region of size between 0 and 2" } */
}

void test_vsprintf_chk_int (va_list va)
{
  T (-1, "%d");

  T (0, "%d");                /* { dg-warning "into a region" } */
  T (0, "%i");                /* { dg-warning "into a region" } */
  T (0, "%u");                /* { dg-warning "into a region" } */
  T (0, "%x");                /* { dg-warning "into a region" } */

  T (1, "%d");                /* { dg-warning "nul past the end" } */
  T (1, "%i");                /* { dg-warning "nul past the end" } */
  T (1, "%u");                /* { dg-warning "nul past the end" } */
  T (1, "%x");                /* { dg-warning "nul past the end" } */

  T (1, "% d");               /* { dg-warning "into a region" } */
  T (1, "% i");               /* { dg-warning "into a region" } */
  T (1, "%+d");               /* { dg-warning "into a region" } */
  T (1, "%+i");               /* { dg-warning "into a region" } */
  T (1, "%-d");               /* { dg-warning "nul past the end" } */
  T (1, "%-i");               /* { dg-warning "nul past the end" } */

  T (2, "%d");
  T (2, "%i");
  T (2, "%o");
  T (2, "%u");
  T (2, "%x");

  T (2, "% d");               /* { dg-warning "nul past the end" } */
  T (2, "% i");               /* { dg-warning "nul past the end" } */
  T (2, "% o");               /* { dg-warning ". . flag used with .%o." } */
  T (2, "% u");               /* { dg-warning ". . flag used with .%u." } */
  T (2, "% x");               /* { dg-warning ". . flag used with .%x." } */

  T (2, "#%o");               /* { dg-warning "nul past the end" } */
  T (2, "#%x");               /* { dg-warning "nul past the end" } */

  T (3, "%2d");
  T (3, "%2i");
  T (3, "%2o");
  T (3, "%2u");
  T (3, "%2x");
}

#undef T
#define T(size, fmt, ...)					      \
  (FUNC (snprintf) (buffer (size), objsize (size), fmt, __VA_ARGS__), \
   sink (buffer))

void test_snprintf_c_const (char *d)
{
  T (-1, "%c",    0);            /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size \[0-9\]+" } */

  /* Verify the full text of the diagnostic for just the distinct messages
     and use abbreviations in subsequent test cases.  */

  /* A call to snprintf with a buffer of zero size is a request to determine
     the size of output without writing anything into the destination. No
     warning must be issued.  */
  T (0, "%c",     0);
  T (1, "%c",     0);            /* { dg-warning "output truncated before the last format character" } */
  T (1, "%c",   '1');            /* { dg-warning "output truncated" } */
  T (2, "%c",   '1');
  T (2, "%2c",  '1');            /* { dg-warning "output truncated" } */
  T (2, "%3c",  '1');            /* { dg-warning "directive output truncated" } */
  T (2, "%c%c", '1', '2');       /* { dg-warning "output truncated" } */
  T (3, "%c%c", '1', '2');

  /* Wide characters.  */
  T (0, "%lc",  (wint_t)0);
  T (1, "%lc",  (wint_t)0);      /* { dg-warning "output may be truncated before the last format character" } */
  T (2, "%lc",  (wint_t)0);

  /* The following could result in as few as a single byte and in as many
     as MB_CUR_MAX, but since the MB_CUR_MAX value is a runtime property
     the write cannot be reliably diagnosed.  */
  T (2, "%lc",  (wint_t)L'1');
  T (2, "%1lc", (wint_t)L'1');
  /* Writing at least 1 characted into a field two characters wide.  */
  T (2, "%2lc", (wint_t)L'1');          /* { dg-warning "output truncated before the last format character" } */

  T (3, "%lc%c",   (wint_t)'1', '2');
  /* Here %lc may result in anywhere between 0 and MB_CUR_MAX characters
     so the output range is [0, 2, 6, 6] with the middle being used for
     the diagnostic (and the extremes for optimization).  The cast is
     to prevent sign extension.  */
  T (3, "%lc%c%c", (wint_t)(unsigned char)'\x80', '2', '3');  /* { dg-warning ".%c. directive output may be truncated writing 1 byte into a region of size between 0 and 2" } */
  /* It's reasonably safe that L'1' converts into the single byte '1'.  */
  T (3, "%lc%c%c", (wint_t)'1', '2', '3');   /* { dg-warning "output may be truncated" } */
  T (3, "%lc%lc%c", (wint_t)'1', (wint_t)'2', '3'); /* { dg-warning "output may be truncated" } */
}

#undef T
#define T(size, fmt, ...)						\
  (FUNC (__snprintf_chk) (buffer (size), objsize (size),		\
			  0, objsize (size), fmt, __VA_ARGS__),		\
   sink (buffer))

void test_snprintf_chk_c_const (void)
{
  /* Verify that specifying a size of the destination buffer that's
     bigger than its actual size (normally determined and passed to
     the function by __builtin_object_size) is diagnosed.  */
  FUNC (__snprintf_chk)(buffer, 3, 0, 2, " ");   /* { dg-warning "specified bound 3 exceeds destination size 2" } */

  T (-1, "%c",    0);           /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size \[0-9\]+" } */

  T (0, "%c",     0);
  T (0, "%c%c",   0, 0);
  T (0, "%c_%c",  0, 0);
  T (0, "_%c_%c", 0, 0);

  T (1, "%c",     0);            /* { dg-warning "output truncated before the last format character" } */
  T (1, "%c",   '1');            /* { dg-warning "output truncated" } */
  T (2, "%c",   '1');
  T (2, "%2c",  '1');            /* { dg-warning "output truncated" } */
  T (2, "%3c",  '1');            /* { dg-warning "directive output truncated" } */
  T (2, "%c%c", '1', '2');       /* { dg-warning "output truncated before the last format character" } */
  T (3, "%c%c", '1', '2');
  T (3, "%c_%c", '1', '2');      /* { dg-warning "output truncated" } */

  /* Wide characters.  */
  T (0, "%lc",  (wint_t)0);
  T (1, "%lc",  (wint_t)0);      /* { dg-warning "output may be truncated before the last format character" } */
  T (2, "%lc",  (wint_t)0);

  /* The following could result in as few as a single byte and in as many
     as MB_CUR_MAX, but since the MB_CUR_MAX value is a runtime property
     the write cannot be reliably diagnosed.  */
  T (2, "%lc",  (wint_t)L'1');
  T (2, "%1lc", (wint_t)L'1');
  /* Writing at least 1 characted into a field two characters wide.  */
  T (2, "%2lc", (wint_t)'1');          /* { dg-warning "output truncated before the last format character" } */

  T (3, "%lc%c",   (wint_t)'1', '2');
  /* Here %lc may result in anywhere between 0 and MB_CUR_MAX characters
     so the minimum number of bytes on output is 2 (plus the terminating
     nul), but the likely number is 3 (plus the nul).  */
  T (3, "%lc%c%c", (wint_t)'1', '2', '3');   /* { dg-warning "output may be truncated" } */
  T (3, "%lc%lc%c", (wint_t)'1', (wint_t)'2', '3'); /* { dg-warning "output may be truncated" } */
}

/* Macro to verify that calls to __builtin_vsprintf (i.e., with no size
   argument) issue diagnostics by correctly determining the size of
   the destination buffer.  */
#undef T
#define T(size, fmt)				\
  (FUNC (vsprintf) (buffer (size), fmt, va),	\
   sink (buffer))

void test_vsprintf_s (va_list va)
{
  T (-1, "%s");

  T (0, "%s");              /* { dg-warning "writing a terminating nul" } */
  T (1, "%s");
  T (1, "%1s");             /* { dg-warning "writing a terminating nul past the end" } */

  T (2, "%s%s");
  T (2, "%s%s1");
  T (2, "%s%s12");          /* { dg-warning "writing a terminating nul" } */
  T (2, "%s%s123");         /* { dg-warning "writing 3 bytes into a region of size 2" } */
  T (2, "%s_%s");
  T (2, "_%s%s");
  T (2, "_%s_%s");          /* { dg-warning "writing a terminating nul" } */
}

/* Exercise all integer specifiers with no modifier and a non-constant
   argument.  */

void test_vsprintf_int (va_list va)
{
  T (-1, "%d");

  T (0, "%d");     /* { dg-warning "into a region" } */
  T (0, "%i");     /* { dg-warning "into a region" } */
  T (0, "%u");     /* { dg-warning "into a region" } */
  T (0, "%x");     /* { dg-warning "into a region" } */

  T (1, "%d");     /* { dg-warning "nul past the end" } */
  T (1, "%i");     /* { dg-warning "nul past the end" } */
  T (1, "%u");     /* { dg-warning "nul past the end" } */
  T (1, "%x");     /* { dg-warning "nul past the end" } */

  T (1, "% d");     /* { dg-warning "into a region" } */
  T (1, "% i");     /* { dg-warning "into a region" } */
  T (1, "%+d");     /* { dg-warning "into a region" } */
  T (1, "%+i");     /* { dg-warning "into a region" } */
  T (1, "%-d");     /* { dg-warning "nul past the end" } */
  T (1, "%-i");     /* { dg-warning "nul past the end" } */

  T (2, "%d");
  T (2, "%i");
  T (2, "%o");
  T (2, "%u");
  T (2, "%x");

  T (2, "% d");     /* { dg-warning "nul past the end" } */
  T (2, "% i");     /* { dg-warning "nul past the end" } */
  T (2, "% o");     /* { dg-warning ". . flag used with .%o." } */
  T (2, "% u");     /* { dg-warning ". . flag used with .%u." } */
  T (2, "% x");     /* { dg-warning ". . flag used with .%x." } */

  T (2, "#%o");     /* { dg-warning "nul past the end" } */
  T (2, "#%x");     /* { dg-warning "nul past the end" } */

  T (3, "%2d");
  T (3, "%2i");
  T (3, "%2o");
  T (3, "%2u");
  T (3, "%2x");
}

#undef T
#define T(size, fmt)						\
  (FUNC (vsnprintf) (buffer (size), objsize (size), fmt, va),	\
   sink (buffer))

void test_vsnprintf_s (va_list va)
{
  T (-1, "%s");             /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size \[0-9\]+" } */

  T (0, "%s");
  T (1, "%s");
  T (1, "%1s");             /* { dg-warning "output truncated before the last format character" } */

  T (2, "%s%s");
  T (2, "%s%s_");
  T (2, "%s_%s");
  T (2, "_%s%s");
  T (2, "_%s_%s");          /* { dg-warning "output truncated" } */
}

#undef T
#define T(size, fmt)					\
  (FUNC (__vsnprintf_chk) (buffer (size), objsize (size),	\
			   0, objsize (size), fmt, va),		\
   sink (buffer))

void test_vsnprintf_chk_s (va_list va)
{
  /* Verify that specifying a size of the destination buffer that's
     bigger than its actual size (normally determined and passed to
     the function by __builtin_object_size) is diagnosed.  */
  FUNC (__vsnprintf_chk)(buffer, 123, 0, 122, "%-s", va);   /* { dg-warning "specified bound 123 exceeds destination size 122" } */

  FUNC (__vsnprintf_chk)(buffer, __SIZE_MAX__, 0, 2, "%-s", va);   /* { dg-warning "specified bound \[0-9\]+ exceeds maximum object size \[0-9\]+" } */

  T (0, "%s");
  T (1, "%s");
  T (1, "%1s");             /* { dg-warning "output truncated before the last format character" } */

  T (2, "%s%s");
  T (2, "%s%s_");
  T (2, "%s_%s");
  T (2, "_%s%s");
  T (2, "_%s_%s");          /* { dg-warning "output truncated" } */
}