https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61632
--- Comment #16 from Dominique d'Humieres <dominiq at lps dot ens.fr> --- > This: > > + fmt->format_string_len = strrchr (f->source, ')') - f->source + 1; > >Is taking the difference between two string pointers, ie memory addresses > > This: > > printf("pos 0 =%x, pos ) =%x\n",strchr (f->source, '\0'),strrchr (f->source, > ')')); > > Is printing the value of the pointers, the addresses. > > Are you expecting something different? Well, I am fully aware that I am C challenged (the kind who can forget two semicolons while writing a single line!). However the above is more or less part of what I understand. To clarify my question, let me summarize what I understand: (1) This PR occurs iff 'f != NULL', (2) The beginning of f->source is the unprocessed part of the format when the error occurs, the last character of it being the closing ')' of the format, (3) while I was expecting f->source being unprocessed_part\0garbage I have examples for which I see unprocessed_partxxx\0garbage where xxx are some extra characters (from 1 to ~15). My question was about the origin of these characters. Indeed I was not happy with 'strrchr (f->source, ')')' because it could find a ')' in the garbage after '\0'. In addition, valgrind complained about it. I have regtested and ran my own tests with the following change if (f != NULL) - fmt->format_string = f->source; + { + width = strlen (f->source); + for (i = width - 1; i > 0; i--) + { + if (f->source[i] == ')') + break; + width--; + } + fmt->format_string_len = width; + } This makes valgrind happy without regression (I know that this will fail if the extra characters contain a ')', so far I did not crossed this situation).