https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91397
--- Comment #4 from Marc Glisse <glisse at gcc dot gnu.org> --- I guess it happens in some dead path that gcc doesn't know is dead. At some point, you look at last_slash-path+1. Here there is a branch on whether this number is 0, and if it is 0, nonsense happens (writing 0 at address -1, this huge memcpy, etc). Maybe you know that last_slash is always >= path (so this weird code path is dead) and gcc doesn't?