On Fri, Oct 26, 2018 at 04:26:32PM +0100, Ben Dooks wrote: > @@ -2259,7 +2402,18 @@ static int evaluate_arguments(struct symbol *fn, struct expression_list *head) > if (!ctype) > return 0; > > - target = argtype; > + if (i == fn->printf_msg) { > + int ret = evaluate_format_printf(fn, *p, &variadic); > + if (ret < 0) > + warning((*p)->pos, "cannot parse format"); > + else if (ret > 0) > + variadic_limit = fn->printf_va_start + ret; > + } > + > + if (i >= fn->printf_va_start && i <= variadic_limit) There is an off-by-one error here. The test should be: + if (i >= fn->printf_va_start && i < variadic_limit) But even better to replace this with a struct symbol_list. -- Luc