The problem seems to originate in the way the mysql_config script is created during mariadb configuration and how it actually produces the --cflags output.
When building the mariadb on Fedora, the CFLAGS used in building include '-Wall' and '-Werror=format-security' flags, and the script picks them up and records them correctly. However, when eventually asked for them (by executing it with --cflags option or similar), it does some preprocessing on the recorded values - including removing warning-related flags. The regexp ('-W[-A-Za-z]*') catches (and thus removes) the -Wall options (which "include" -Wformat), but not the -Werror=format-security (which needs -Wformat specified in one way or another).
Should the mysql_config script also remove the '-Werror=...' and similar options, or should a way be found to leave this flag in place in order to report the build flags as accurately as posible?
If I am manually remove -Werror=format-security parameter compile would be successful
$ gcc -I/usr/include/mysql -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -m64 -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -fPIC -fno-delete-null-pointer-checks -g -static-libgcc -fno-omit-frame-pointer -fno-strict-aliasing -shared -fPIC -o udf_example.so udf_example.c