/* Determine the number of arguments the format string consumes.  */
nargs = MAX (nargs, max_ref_arg);

/* Allocate memory for the argument descriptions.  */
args_type = alloca (nargs * sizeof (int));
memset (args_type, s->_flags2 & _IO_FLAGS2_FORTIFY ? '\xff' : '\0', nargs * sizeof (int));
args_value = alloca (nargs * sizeof (union printf_arg));
args_size = alloca (nargs * sizeof (int));
...
for (cnt = 0; cnt < nargs; ++cnt)
..
switch (args_type[cnt])
...
case -1:
 /* Error case.  Not all parameters appear in N$ format strings.  We have no way to determine their type.  */
 assert (s->_flags2 & _IO_FLAGS2_FORTIFY);
  __libc_fatal ("*** invalid %N$ use detected ***\n");
}