c/8194: sprintf causes segfaults

[finch at clara dot co dot uk]

>Number:         8194
>Category:       c
>Synopsis:       sprintf causes segfaults
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    unassigned
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Oct 10 17:16:01 PDT 2002
>Closed-Date:
>Last-Modified:
>Originator:     Gabriel Finch
>Release:        unknown-1.0
>Organization:
>Environment:
gcc -v

Reading specs from /usr/lib/gcc-lib/i586-mandrake-linux-gnu/3.2/specs
Configured with: ../configure --prefix=/usr --libdir=/usr/lib --with-slibdir=/lib --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --enable-long-long --enable-__cxa_atexit --enable-languages=c,c++,ada,f77,objc,java --host=i586-mandrake-linux-gnu --with-system-zlib
Thread model: posix
gcc version 3.2 (Mandrake Linux 9.0 3.2-1mdk)
>Description:
The following code causes a segfault on exit when compiled with gcc and run:

#include <stdio.h>

int main() {
  char *i,*s;
  sprintf(s,"%s","a");   // any format string works here
  sprintf(i,"xx%s",s);  // must be 2 or more chars before %s
  return 0;
 }
>How-To-Repeat:
Compile above code with gcc and execute it.
>Fix:

>Release-Note:
>Audit-Trail:
>Unformatted: