diff --git a/autogen-avoid-GCC-code-analysis-bug.patch b/autogen-avoid-GCC-code-analysis-bug.patch
new file mode 100644
index 0000000..6e0adf9
--- /dev/null
+++ b/autogen-avoid-GCC-code-analysis-bug.patch
@@ -0,0 +1,101 @@
+From 65163ab8c318a501f019c64490aea188e258b954 Mon Sep 17 00:00:00 2001
+From: Bruce Korb <bruce.korb+GIT@gmail.com>
+Date: Tue, 19 Apr 2022 09:10:37 -0700
+Subject: [PATCH] avoid GCC code analysis bug
+
+---
+ agen5/defLoad.c | 47 ++++++++++++++++++++++++++---------------------
+ 1 file changed, 26 insertions(+), 21 deletions(-)
+
+diff --git a/agen5/defLoad.c b/agen5/defLoad.c
+index e40f2e80..99258cd6 100644
+--- a/agen5/defLoad.c
++++ b/agen5/defLoad.c
+@@ -453,17 +453,28 @@ read_defs(void)
+     FILE *        fp;
+     def_input_mode_t in_mode = ready_def_input(&def_fname, &data_sz);
+ 
++    /*
++     * "ready_def_input" has a lot of side effects. It's possible that
++     * there are no definitions, so "in_mode" is set to DONE and there's
++     * nothing to do.
++     */
+     if (in_mode == INPUT_DONE)
+         return;
+ 
+     /*
+      *  Allocate the space we need for our definitions.
++     * "data_sz" was set by read_def_input to the size of the
++     * definitions file (or 4096 if we're reading from a fifo file).
++     * In that alternate case, we'll start the input size at 4096 bytes.
++     * The allocation includes space for context and a NUL byte or two
+      */
+-    rem_sz = data_sz+4+sizeof(*base_ctx);
+-    base_ctx = (scan_ctx_t *)AGALOC(rem_sz, "file buf");
+-    memset(VOIDP(base_ctx), 0, rem_sz);
++    {
++        size_t sz = data_sz + sizeof(long) + sizeof(*base_ctx);
++        base_ctx = (scan_ctx_t *)AGALOC(sz, "file buf");
++        memset(VOIDP(base_ctx), 0, sz);
++    }
+     base_ctx->scx_line = 1;
+-    rem_sz = data_sz;
++    rem_sz = data_sz; // size available for storing def text
+ 
+     /*
+      *  Our base context will have its currency pointer set to this
+@@ -487,6 +498,9 @@ read_defs(void)
+         if (fp == NULL)
+             AG_CANT(READ_DEF_OPEN, def_fname);
+ 
++        /*
++         * If we're emitting dependency information, then do so.
++         */
+         if (dep_fp != NULL)
+             add_source_file(def_fname);
+     }
+@@ -521,8 +535,7 @@ read_defs(void)
+          *  See if there is any space left
+          */
+         if (rem_sz == 0) {
+-            scan_ctx_t * p;
+-            off_t dataOff;
++            off_t scan_off;
+ 
+             /*
+              *  IF it is a regular file, then we are done
+@@ -532,24 +545,16 @@ read_defs(void)
+ 
+             /*
+              *  We have more data and we are out of space.
+-             *  Try to reallocate our input buffer.
++             *  AGREALOC will succeed or not return.
+              */
+             data_sz += (rem_sz = 0x1000);
+-            dataOff = data - base_ctx->scx_data;
+-            p = AGREALOC(VOIDP(base_ctx), data_sz + 4 + sizeof(*base_ctx),
+-                         "expand f buf");
++            scan_off = data - base_ctx->scx_data;
++            base_ctx = AGREALOC(VOIDP(base_ctx), data_sz + 4 + sizeof(*base_ctx),
++                                "expand f buf");
+ 
+-            /*
+-             *  The buffer may have moved.  Set the data pointer at an
+-             *  offset within the new buffer and make sure our base pointer
+-             *  has been corrected as well.
+-             */
+-            if (p != base_ctx) {
+-                p->scx_scan = \
+-                    p->scx_data = (char *)(p + 1);
+-                data = p->scx_data + dataOff;
+-                base_ctx = p;
+-            }
++            base_ctx->scx_scan = \
++                base_ctx->scx_data = (char *)(base_ctx + 1);
++            data = base_ctx->scx_data + scan_off;
+         }
+     }
+ 
+-- 
+2.35.3
+
diff --git a/autogen.changes b/autogen.changes
index bd1fe19..41dc72a 100644
--- a/autogen.changes
+++ b/autogen.changes
@@ -1,3 +1,10 @@
+-------------------------------------------------------------------
+Tue Apr 19 19:22:33 UTC 2022 - Martin Liška <mliska@suse.cz>
+
+- Add upstream patch autogen-avoid-GCC-code-analysis-bug.patch
+  in order to support -D_FORTIFY_SOURCE=3 with GCC 12.
+- Use autosetup.
+
 -------------------------------------------------------------------
 Wed Jun 10 11:53:58 UTC 2020 - Bernhard Wiedemann <bwiedemann@suse.com>
 
diff --git a/autogen.spec b/autogen.spec
index 1ed6a8c..2d1abe5 100644
--- a/autogen.spec
+++ b/autogen.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package autogen
 #
-# Copyright (c) 2020 SUSE LLC
+# Copyright (c) 2022 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -36,13 +36,14 @@ Patch4:         sprintf-overflow.patch
 Patch5:         gcc9-fix-wrestrict.patch
 # PATCH-FIX-UPSTREAM Allow building with guile 3.0
 Patch6:         guile-version.patch
+Patch7:         autogen-avoid-GCC-code-analysis-bug.patch
 BuildRequires:  fdupes
 BuildRequires:  guile-devel
 BuildRequires:  makeinfo
 BuildRequires:  pkgconfig >= 0.9.0
 BuildRequires:  pkgconfig(libxml-2.0)
 Requires(post): %{install_info_prereq}
-Requires(preun): %{install_info_prereq}
+Requires(preun):%{install_info_prereq}
 
 %description
 AutoGen is a tool designed for generating program files that contain
@@ -85,13 +86,7 @@ file options, and the documentation that should go with your program as
 well.
 
 %prep
-%setup -q
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
-%patch5 -p1
-%patch6 -p1
+%autosetup -p1
 touch aclocal.m4 configure Makefile.in config-h.in
 
 %build