I was trying to compile binutils 2.19.1 with the following configure options:

'--prefix=/usr/local/avr' '--target=avr' '--disable-nls'

On my MacBook (OS X 10.6.1) with gcc (i686-apple-darwin10-gcc-4.2.1 (GCC) 4.2.1 (Apple Inc. build 
5646)) and compilation of opcodes/avr-dis.c failed due to warnings re sprintf without string literals and 
warnings as errors enabled.  Converting the offending lines to strcpy()s fixes it.

Below is the patch to fix it.

diff -aur binutils-2.19.1.orig/opcodes/avr-dis.c binutils-2.19.1/opcodes/avr-dis.c
--- binutils-2.19.1.orig/opcodes/avr-dis.c	2007-07-05 10:49:00.000000000 +0100
+++ binutils-2.19.1/opcodes/avr-dis.c	2009-10-05 21:41:21.000000000 +0100
@@ -109,7 +109,7 @@
 	    case 0x100e: xyz = "-X"; break;
 	    default: xyz = "??"; ok = 0;
 	  }
-	sprintf (buf, xyz);
+	strcpy (buf, xyz);
 
 	if (AVR_UNDEF_P (insn))
 	  sprintf (comment, _("undefined"));
@@ -149,7 +149,7 @@
 	 value of the address only once, but this would mean recoding
 	 objdump_print_address() which would affect many targets.  */
       sprintf (buf, "%#lx", (unsigned long) *sym_addr);      
-      sprintf (comment, comment_start);
+      strcpy (comment, comment_start);
       break;
       
     case 'L':
@@ -158,7 +158,7 @@
 	sprintf (buf, ".%+-8d", rel_addr);
         *sym = 1;
         *sym_addr = pc + 2 + rel_addr;
-	sprintf (comment, comment_start);
+	strcpy (comment, comment_start);
       }
       break;
 
@@ -169,7 +169,7 @@
 	sprintf (buf, ".%+-8d", rel_addr);
         *sym = 1;
         *sym_addr = pc + 2 + rel_addr;
-	sprintf (comment, comment_start);
+	strcpy (comment, comment_start);
       }
       break;