Index: clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
===================================================================
--- clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
+++ clang/lib/StaticAnalyzer/Checkers/GenericTaintChecker.cpp
@@ -514,7 +514,7 @@
     if (OneOf("snprintf"))
       return {{1}, {0, ReturnValueIndex}, VariadicType::Src, 3};
     if (OneOf("sprintf"))
-      return {{}, {0, ReturnValueIndex}, VariadicType::Src, 2};
+      return {{1}, {0, ReturnValueIndex}, VariadicType::Src, 2};
     if (OneOf("strcpy", "stpcpy", "strcat"))
       return {{1}, {0, ReturnValueIndex}};
     if (OneOf("bcopy"))
Index: clang/test/Analysis/taint-generic.c
===================================================================
--- clang/test/Analysis/taint-generic.c
+++ clang/test/Analysis/taint-generic.c
@@ -341,6 +341,16 @@
     *(volatile int *) 0; // no-warning
 }
 
+int sprintf_is_not_a_source(char *buf, char *msg) {
+  int x = sprintf(buf, "%s", msg); // no-warning
+  return 1 / x; // no-warning: 'sprintf' is not a taint source
+}
+
+int sprintf_propagates_taint(char *buf, char *msg) {
+  scanf("%s", msg);
+  int x = sprintf(buf, "%s", msg); // propagate taint!
+  return 1 / x; // expected-warning {{Division by a tainted value, possibly zero}}
+}
 
 // Test configuration
 int mySource1();
Index: fof.c
===================================================================
--- /dev/null
+++ fof.c
@@ -0,0 +1,38 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+
+typedef struct ss {
+  int a;
+  char b;
+  char c;
+  short d;
+  unsigned long e;
+} ss;
+
+void clang_analyzer_dump(void *);
+void clang_analyzer_printState();
+
+int main(void) {
+  time_t t;
+  ss sss;
+  unsigned char *pu8 = (unsigned char *)&sss;
+  unsigned short *pu16 = (unsigned short *)&sss;
+  // clang_analyzer_dump(pu16);
+  // srand((unsigned) time(&t));
+  // for (int i=0; i<sizeof(ss); i++)
+  //  pu8[i] = rand(); sss.a = 0;
+  sss.a = 42;
+  sss.b = 1;
+  sss.c = 2;
+  sss.d = 3;
+  sss.e = 4;
+  // clang_analyzer_printState();
+  int h = 0;
+  // for (int i=0; i<9; i++) {
+  //  h += pu16[i];
+  // }
+  for (int i = 0; i < sizeof(sss) / 2; i++) {
+    h += pu16[i];
+  }
+}