[Bug c/83011] New: -Wformat-truncation wrongly computes length (depends on the position of numbers in the addition)

[julien at trigofacile dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83011

            Bug ID: 83011
           Summary: -Wformat-truncation wrongly computes length (depends
                    on the position of numbers in the addition)
           Product: gcc
           Version: 7.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: julien at trigofacile dot com
  Target Milestone: ---

Hi,

Trying to build INN, I encounter the following warning:

timer.c: Dans la fonction « TMRsummary »:
timer.c:395:37: error: la sortie de la directive «   » peut être tronquée en
écrivant 1 octet dans une région dont la taille est comprise entre 0 et 1
[-Werror=format-truncation=]
         rc = snprintf(buf, len, "%s ", prefix);
                                    ~ 
timer.c:395:12: note: « snprintf » écrit 2 octets ou plus (3 supposé) dans une
destination dont la taille est 1
         rc = snprintf(buf, len, "%s ", prefix);
         ~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


It happens in:
  https://inn.eyrie.org/trac/browser/trunk/lib/timer.c

    len = 52 * timer_count + 27 + (prefix == NULL ? 0 : strlen(prefix)) + 1;
    buf = xmalloc(len);
    off = 0;
    if (prefix == NULL)
        rc = 0;
    else
        rc = snprintf(buf, len, "%s ", prefix);


If I rewrite len this way, gcc no longer gives the above warning:

    len = 1 + 52 * timer_count + 27 + (prefix == NULL ? 0 : strlen(prefix));


Isn't there a computation issue? (depending on the location of components in
the addition)

Julien