Index: gcc/dwarf2asm.c
===================================================================
--- gcc/dwarf2asm.c	(revision 189995)
+++ gcc/dwarf2asm.c	(working copy)
@@ -163,7 +163,7 @@ dw2_asm_output_vms_delta (int size ATTRIBUTE_UNUSE
 #ifndef ASM_OUTPUT_DWARF_VMS_DELTA
   /* VMS Delta is only special on ia64-vms, but this function also gets
      called on alpha-vms so it has to do something sane.  */
-  dw2_asm_output_delta (size, lab1, lab2, comment);
+  dw2_asm_output_delta (size, lab1, lab2, "%s", comment);
 #else
   ASM_OUTPUT_DWARF_VMS_DELTA (asm_out_file, size, lab1, lab2);
   if (flag_debug_asm && comment)
Index: gcc/tree-ssa-uninit.c
===================================================================
--- gcc/tree-ssa-uninit.c	(revision 189995)
+++ gcc/tree-ssa-uninit.c	(working copy)
@@ -599,7 +599,7 @@ dump_predicates (gimple usestmt, size_t num_preds,
 {
   size_t i, j;
   VEC(use_pred_info_t, heap) *one_pred_chain;
-  fprintf (dump_file, msg);
+  fprintf (dump_file, "%s", msg);
   print_gimple_stmt (dump_file, usestmt, 0, 0);
   fprintf (dump_file, "is guarded by :\n");
   /* do some dumping here:  */
Index: gcc/c-family/c-common.c
===================================================================
--- gcc/c-family/c-common.c	(revision 189995)
+++ gcc/c-family/c-common.c	(working copy)
@@ -8938,11 +8938,11 @@ c_parse_error (const char *gmsgid, enum cpp_ttype
       message = NULL;
     }
   else
-    error (gmsgid);
+    error ("%s", gmsgid);
 
   if (message)
     {
-      error (message);
+      error ("%s", message);
       free (message);
     }
 #undef catenate_messages
Index: gcc/c/c-convert.c
===================================================================
--- gcc/c/c-convert.c	(revision 189995)
+++ gcc/c/c-convert.c	(working copy)
@@ -80,7 +80,7 @@ convert (tree type, tree expr)
   if ((invalid_conv_diag
        = targetm.invalid_conversion (TREE_TYPE (expr), type)))
     {
-      error (invalid_conv_diag);
+      error ("%s", invalid_conv_diag);
       return error_mark_node;
     }
 
Index: gcc/c/c-typeck.c
===================================================================
--- gcc/c/c-typeck.c	(revision 189995)
+++ gcc/c/c-typeck.c	(working copy)
@@ -3167,7 +3167,7 @@ convert_arguments (tree typelist, VEC(tree,gc) *va
       else if ((invalid_func_diag =
 		targetm.calls.invalid_arg_for_unprototyped_fn (typelist, fundecl, val)))
 	{
-	  error (invalid_func_diag);
+	  error ("%s", invalid_func_diag);
 	  return -1;
 	}
       else
@@ -3452,7 +3452,7 @@ build_unary_op (location_t location,
   if ((invalid_op_diag
        = targetm.invalid_unary_op (code, TREE_TYPE (xarg))))
     {
-      error_at (location, invalid_op_diag);
+      error_at (location, "%s", invalid_op_diag);
       return error_mark_node;
     }
 
@@ -5930,7 +5930,7 @@ error_init (const char *gmsgid)
   char *ofwhat;
 
   /* The gmsgid may be a format string with %< and %>. */
-  error (gmsgid);
+  error ("%s", gmsgid);
   ofwhat = print_spelling ((char *) alloca (spelling_length () + 1));
   if (*ofwhat)
     error ("(near initialization for %qs)", ofwhat);
@@ -5947,7 +5947,7 @@ pedwarn_init (location_t location, int opt, const
   char *ofwhat;
 
   /* The gmsgid may be a format string with %< and %>. */
-  pedwarn (location, opt, gmsgid);
+  pedwarn (location, opt, "%s", gmsgid);
   ofwhat = print_spelling ((char *) alloca (spelling_length () + 1));
   if (*ofwhat)
     pedwarn (location, opt, "(near initialization for %qs)", ofwhat);
@@ -5965,7 +5965,7 @@ warning_init (int opt, const char *gmsgid)
   char *ofwhat;
 
   /* The gmsgid may be a format string with %< and %>. */
-  warning (opt, gmsgid);
+  warning (opt, "%s", gmsgid);
   ofwhat = print_spelling ((char *) alloca (spelling_length () + 1));
   if (*ofwhat)
     warning (opt, "(near initialization for %qs)", ofwhat);
@@ -9579,7 +9579,7 @@ build_binary_op (location_t location, enum tree_co
   if ((invalid_op_diag
        = targetm.invalid_binary_op (code, type0, type1)))
     {
-      error_at (location, invalid_op_diag);
+      error_at (location, "%s", invalid_op_diag);
       return error_mark_node;
     }
 
Index: gcc/c/c-decl.c
===================================================================
--- gcc/c/c-decl.c	(revision 189995)
+++ gcc/c/c-decl.c	(working copy)
@@ -5606,7 +5606,7 @@ grokdeclarator (const struct c_declarator *declara
 	    errmsg = targetm.invalid_return_type (type);
 	    if (errmsg)
 	      {
-		error (errmsg);
+		error ("%s", errmsg);
 		type = integer_type_node;
 	      }
 
@@ -6341,7 +6341,7 @@ grokparms (struct c_arg_info *arg_info, bool funcd
 	  errmsg = targetm.invalid_parameter_type (type);
 	  if (errmsg)
 	    {
-	      error (errmsg);
+	      error ("%s", errmsg);
 	      TREE_VALUE (typelt) = error_mark_node;
 	      TREE_TYPE (parm) = error_mark_node;
 	      arg_types = NULL_TREE;
Index: gcc/gcc.c
===================================================================
--- gcc/gcc.c	(revision 189995)
+++ gcc/gcc.c	(working copy)
@@ -2674,7 +2674,7 @@ execute (void)
       if (errmsg != NULL)
 	{
 	  if (err == 0)
-	    fatal_error (errmsg);
+	    fatal_error ("%s", errmsg);
 	  else
 	    {
 	      errno = err;
Index: gcc/fold-const.c
===================================================================
--- gcc/fold-const.c	(revision 189995)
+++ gcc/fold-const.c	(working copy)
@@ -317,7 +317,7 @@ fold_overflow_warning (const char* gmsgid, enum wa
 	}
     }
   else if (issue_strict_overflow_warning (wc))
-    warning (OPT_Wstrict_overflow, gmsgid);
+    warning (OPT_Wstrict_overflow, "%s", gmsgid);
 }
 
 /* Return true if the built-in mathematical function specified by CODE
Index: gcc/cp/typeck.c
===================================================================
--- gcc/cp/typeck.c	(revision 189995)
+++ gcc/cp/typeck.c	(working copy)
@@ -3835,7 +3835,7 @@ cp_build_binary_op (location_t location,
   if ((invalid_op_diag
        = targetm.invalid_binary_op (code, type0, type1)))
     {
-      error (invalid_op_diag);
+      error ("%s", invalid_op_diag);
       return error_mark_node;
     }
 
@@ -5182,7 +5182,7 @@ cp_build_unary_op (enum tree_code code, tree xarg,
 				    : code),
 				   TREE_TYPE (xarg))))
     {
-      error (invalid_op_diag);
+      error ("%s", invalid_op_diag);
       return error_mark_node;
     }
 
Index: gcc/cp/decl.c
===================================================================
--- gcc/cp/decl.c	(revision 189995)
+++ gcc/cp/decl.c	(working copy)
@@ -9169,7 +9169,7 @@ grokdeclarator (const cp_declarator *declarator,
 	    errmsg = targetm.invalid_return_type (type);
 	    if (errmsg)
 	      {
-		error (errmsg);
+		error ("%s", errmsg);
 		type = integer_type_node;
 	      }
 
@@ -10724,7 +10724,7 @@ grokparms (tree parmlist, tree *parms)
       if (type != error_mark_node
 	  && (errmsg = targetm.invalid_parameter_type (type)))
 	{
-	  error (errmsg);
+	  error ("%s", errmsg);
 	  type = error_mark_node;
 	  TREE_TYPE (decl) = error_mark_node;
 	}
Index: gcc/cp/pt.c
===================================================================
--- gcc/cp/pt.c	(revision 189995)
+++ gcc/cp/pt.c	(working copy)
@@ -13123,7 +13123,7 @@ tsubst_copy_and_build (tree t,
 				     &error_msg,
 				     input_location);
 	if (error_msg)
-	  error (error_msg);
+	  error ("%s", error_msg);
 	if (!function_p && TREE_CODE (decl) == IDENTIFIER_NODE)
 	  {
 	    if (complain & tf_error)
Index: gcc/cp/parser.c
===================================================================
--- gcc/cp/parser.c	(revision 189995)
+++ gcc/cp/parser.c	(working copy)
@@ -2508,7 +2508,7 @@ cp_parser_check_type_definition (cp_parser* parser
     {
       /* Don't use `%s' to print the string, because quotations (`%<', `%>')
 	 in the message need to be interpreted.  */
-      error (parser->type_definition_forbidden_message);
+      error ("%s", parser->type_definition_forbidden_message);
       return false;
     }
   return true;
Index: gcc/cp/cvt.c
===================================================================
--- gcc/cp/cvt.c	(revision 189995)
+++ gcc/cp/cvt.c	(working copy)
@@ -660,7 +660,7 @@ ocp_convert (tree type, tree expr, int convtype, i
        = targetm.invalid_conversion (TREE_TYPE (expr), type)))
     {
       if (complain & tf_error)
-	error (invalid_conv_diag);
+	error ("%s", invalid_conv_diag);
       return error_mark_node;
     }
 
Index: gcc/lto-wrapper.c
===================================================================
--- gcc/lto-wrapper.c	(revision 189995)
+++ gcc/lto-wrapper.c	(working copy)
@@ -192,10 +192,10 @@ collect_execute (char **argv)
       if (err != 0)
 	{
 	  errno = err;
-	  fatal_perror (errmsg);
+	  fatal_perror ("%s", errmsg);
 	}
       else
-	fatal (errmsg);
+	fatal ("%s", errmsg);
     }
 
   return pex;
Index: gcc/dwarf2out.c
===================================================================
--- gcc/dwarf2out.c	(revision 189995)
+++ gcc/dwarf2out.c	(working copy)
@@ -7832,7 +7832,7 @@ output_die (dw_die_ref die)
 	      }
 
 	    dw2_asm_output_data (HOST_BITS_PER_WIDE_INT / HOST_BITS_PER_CHAR,
-				 first, name);
+				 first, "%s", name);
 	    dw2_asm_output_data (HOST_BITS_PER_WIDE_INT / HOST_BITS_PER_CHAR,
 				 second, NULL);
 	  }
Index: gcc/opts.c
===================================================================
--- gcc/opts.c	(revision 189995)
+++ gcc/opts.c	(working copy)
@@ -1005,7 +1005,7 @@ print_filtered_help (unsigned int include_flags,
 		      if (* (const char **) flag_var != NULL)
 			snprintf (new_help + strlen (new_help),
 				  sizeof (new_help) - strlen (new_help),
-				  * (const char **) flag_var);
+				  "%s", * (const char **) flag_var);
 		    }
 		  else if (option->var_type == CLVC_ENUM)
 		    {
@@ -1019,7 +1019,7 @@ print_filtered_help (unsigned int include_flags,
 			arg = _("[default]");
 		      snprintf (new_help + strlen (new_help),
 				sizeof (new_help) - strlen (new_help),
-				arg);
+				"%s", arg);
 		    }
 		  else
 		    sprintf (new_help + strlen (new_help),
Index: gcc/tree-sra.c
===================================================================
--- gcc/tree-sra.c	(revision 189995)
+++ gcc/tree-sra.c	(working copy)
@@ -3632,7 +3632,7 @@ dump_dereferences_table (FILE *f, const char *str,
 {
   basic_block bb;
 
-  fprintf (dump_file, str);
+  fprintf (dump_file, "%s", str);
   FOR_BB_BETWEEN (bb, ENTRY_BLOCK_PTR, EXIT_BLOCK_PTR, next_bb)
     {
       fprintf (f, "%4i  %i   ", bb->index, bitmap_bit_p (final_bbs, bb->index));
Index: gcc/collect2.c
===================================================================
--- gcc/collect2.c	(revision 189995)
+++ gcc/collect2.c	(working copy)
@@ -2084,7 +2084,7 @@ collect_execute (const char *prog, char **argv, co
 	  fatal_error ("%s: %m", _(errmsg));
 	}
       else
-	fatal_error (errmsg);
+	fatal_error ("%s", errmsg);
     }
 
   free (response_arg);
@@ -2611,7 +2611,7 @@ scan_prog_file (const char *prog_name, scanpass wh
 	  fatal_error ("%s: %m", _(errmsg));
 	}
       else
-	fatal_error (errmsg);
+	fatal_error ("%s", errmsg);
     }
 
   int_handler  = (void (*) (int)) signal (SIGINT,  SIG_IGN);
Index: libcpp/macro.c
===================================================================
--- libcpp/macro.c	(revision 189995)
+++ libcpp/macro.c	(working copy)
@@ -2964,7 +2964,7 @@ create_iso_definition (cpp_reader *pfile, cpp_macr
 	     function-like macros, but not at the end.  */
 	  if (following_paste_op)
 	    {
-	      cpp_error (pfile, CPP_DL_ERROR, paste_op_error_msg);
+	      cpp_error (pfile, CPP_DL_ERROR, "%s", paste_op_error_msg);
 	      return false;
 	    }
 	  break;
@@ -2977,7 +2977,7 @@ create_iso_definition (cpp_reader *pfile, cpp_macr
 	     function-like macros, but not at the beginning.  */
 	  if (macro->count == 1)
 	    {
-	      cpp_error (pfile, CPP_DL_ERROR, paste_op_error_msg);
+	      cpp_error (pfile, CPP_DL_ERROR, "%s", paste_op_error_msg);
 	      return false;
 	    }
 
Index: libcpp/expr.c
===================================================================
--- libcpp/expr.c	(revision 189995)
+++ libcpp/expr.c	(working copy)
@@ -615,10 +615,10 @@ cpp_classify_number (cpp_reader *pfile, const cpp_
 
 	  if (CPP_OPTION (pfile, c99))
             cpp_warning_with_line (pfile, CPP_W_LONG_LONG, virtual_location,
-				   0, message);
+				   0, "%s", message);
           else
             cpp_pedwarning_with_line (pfile, CPP_W_LONG_LONG,
-				      virtual_location, 0, message);
+				      virtual_location, 0, "%s", message);
         }
 
       result |= CPP_N_INTEGER;
