--- gcc/gimple-ssa-sprintf.cc.jj	2024-01-03 11:51:22.225860346 +0100
+++ gcc/gimple-ssa-sprintf.cc	2024-04-29 12:52:59.760668894 +0200
@@ -2177,8 +2177,7 @@ format_character (const directive &dir,
 
   res.knownrange = true;
 
-  if (dir.specifier == 'C'
-      || dir.modifier == FMT_LEN_l)
+  if (dir.specifier == 'C' || dir.modifier == FMT_LEN_l)
     {
       /* A wide character can result in as few as zero bytes.  */
       res.range.min = 0;
@@ -2189,10 +2188,13 @@ format_character (const directive &dir,
 	{
 	  if (min == 0 && max == 0)
 	    {
-	      /* The NUL wide character results in no bytes.  */
-	      res.range.max = 0;
-	      res.range.likely = 0;
-	      res.range.unlikely = 0;
+	      /* In strict reading of older ISO C or POSIX, this required
+		 no characters to be emitted.  ISO C23 changes that, so
+		 does POSIX, to match what has been implemented in most of the
+		 implementations, namely emitting a single NUL character.
+		 Let's use 0 for minimum and 1 for all the other values.  */
+	      res.range.max = 1;
+	      res.range.likely = res.range.unlikely = 1;
 	    }
 	  else if (min >= 0 && min < 128)
 	    {
@@ -2200,11 +2202,12 @@ format_character (const directive &dir,
 		 is not a 1-to-1 mapping to the source character set or
 		 if the source set is not ASCII.  */
 	      bool one_2_one_ascii
-		= (target_to_host_charmap[0] == 1 && target_to_host ('a') == 97);
+		= (target_to_host_charmap[0] == 1
+		   && target_to_host ('a') == 97);
 
 	      /* A wide character in the ASCII range most likely results
 		 in a single byte, and only unlikely in up to MB_LEN_MAX.  */
-	      res.range.max = one_2_one_ascii ? 1 : target_mb_len_max ();;
+	      res.range.max = one_2_one_ascii ? 1 : target_mb_len_max ();
 	      res.range.likely = 1;
 	      res.range.unlikely = target_mb_len_max ();
 	      res.mayfail = !one_2_one_ascii;
@@ -2235,7 +2238,6 @@ format_character (const directive &dir,
       /* A plain '%c' directive.  Its output is exactly 1.  */
       res.range.min = res.range.max = 1;
       res.range.likely = res.range.unlikely = 1;
-      res.knownrange = true;
     }
 
   /* Bump up the byte counters if WIDTH is greater.  */
--- gcc/testsuite/gcc.dg/pr114876.c.jj	2024-04-29 12:26:45.774965158 +0200
+++ gcc/testsuite/gcc.dg/pr114876.c	2024-04-29 12:51:37.863777055 +0200
@@ -0,0 +1,34 @@
+/* PR tree-optimization/114876 */
+/* { dg-do compile } */
+/* { dg-options "-O2 -fdump-tree-optimized" } */
+/* { dg-final { scan-tree-dump-not "return \[01\];" "optimized" } } */
+/* { dg-final { scan-tree-dump "return 3;" "optimized" } } */
+/* { dg-final { scan-tree-dump "return 4;" "optimized" } } */
+
+int
+foo (void)
+{
+  char buf[64];
+  return __builtin_sprintf (buf, "%lc%lc%lc", (__WINT_TYPE__) 0, (__WINT_TYPE__) 0, (__WINT_TYPE__) 0);
+}
+
+int
+bar (void)
+{
+  char buf[64];
+  return __builtin_sprintf (buf, "%c%c%c", 0, 0, 0);
+}
+
+int
+baz (void)
+{
+  char buf[64];
+  return __builtin_sprintf (buf, "%lc%lc%lca", (__WINT_TYPE__) 0, (__WINT_TYPE__) 0, (__WINT_TYPE__) 0);
+}
+
+int
+qux (void)
+{
+  char buf[64];
+  return __builtin_sprintf (buf, "%c%c%ca", 0, 0, 0);
+}
--- gcc/testsuite/gcc.dg/tree-ssa/builtin-sprintf-warn-1.c.jj	2020-12-03 10:04:35.888092988 +0100
+++ gcc/testsuite/gcc.dg/tree-ssa/builtin-sprintf-warn-1.c	2024-04-29 12:49:14.452717581 +0200
@@ -200,11 +200,11 @@ void test_sprintf_chk_c_const (void)
   T (3, "%c%c", '1', '2');
 
   /* Wide characters.  */
-  T (0, "%lc",     (wint_t)0);   /* { dg-warning "nul past the end" } */
-  T (1, "%lc",     (wint_t)0);
-  T (1, "%lc%lc",  (wint_t)0, (wint_t)0);
+  T (0, "%lc",     (wint_t)0);   /* { dg-warning ".%lc. directive writing up to 1 bytes into a region of size 0" } */
+  T (1, "%lc",     (wint_t)0);   /* { dg-warning "nul past the end" } */
+  T (1, "%lc%lc",  (wint_t)0, (wint_t)0);   /* { dg-warning ".%lc. directive writing up to 1 bytes into a region of size between 0 and 1" } */
   T (2, "%lc",     (wint_t)0);
-  T (2, "%lc%lc",  (wint_t)0, (wint_t)0);
+  T (2, "%lc%lc",  (wint_t)0, (wint_t)0);   /* { dg-warning "nul past the end" } */
 
   /* The following could result in as few as no bytes and in as many as
      MB_CUR_MAX, but since the MB_CUR_MAX value is a runtime property
@@ -1550,7 +1550,7 @@ void test_snprintf_c_const (char *d)
 
   /* Wide characters.  */
   T (0, "%lc",  (wint_t)0);
-  T (1, "%lc",  (wint_t)0);
+  T (1, "%lc",  (wint_t)0);      /* { dg-warning "output may be truncated before the last format character" } */
   T (2, "%lc",  (wint_t)0);
 
   /* The following could result in as few as a single byte and in as many
@@ -1603,7 +1603,7 @@ void test_snprintf_chk_c_const (void)
 
   /* Wide characters.  */
   T (0, "%lc",  (wint_t)0);
-  T (1, "%lc",  (wint_t)0);
+  T (1, "%lc",  (wint_t)0);      /* { dg-warning "output may be truncated before the last format character" } */
   T (2, "%lc",  (wint_t)0);
 
   /* The following could result in as few as a single byte and in as many
