Eliminate a bunch of sprintf usage (all looked safe, but I'm puzzled why these

were still there - I did a sweep many years ago...)

diff --git a/backend/ipp.c b/backend/ipp.c
index 3f3e1867d3efb0b631b743a28b5a62e701386e31..35c0711c06c42207721d8ab8fcd9f96c972033da 100644 (file)
--- a/backend/ipp.c
+++ b/backend/ipp.c
@@ -3116,11 +3116,10 @@ report_printer_state(ipp_t *ipp)        /* I - IPP response */
       if (*ptr < ' ' && *ptr > 0 && *ptr != '\t')
       {
        /*
-        * Substitute "<XX>" for the control character; sprintf is safe because
-       * we always leave 6 chars free at the end...
+        * Substitute "<XX>" for the control character...
        */
 
-        sprintf(valptr, "<%02X>", *ptr);
+        snprintf(valptr, sizeof(value) - (size_t)(valptr - value), "<%02X>", *ptr);
        valptr += 4;
       }
       else

diff --git a/backend/network.c b/backend/network.c
index 5af0a8eeadd07145f6c5b6eab74ee1d68ad2d890..f7ee2fbbe3c8e080c9e34d6d7f1e7e22e4240a21 100644 (file)
--- a/backend/network.c
+++ b/backend/network.c
@@ -258,7 +258,7 @@ backendNetworkSideCB(
                         i < packet.object_value.string.num_bytes &&
                             dataptr < (data + sizeof(data) - 3);
                         i ++, dataptr += 2)
-                     sprintf(dataptr, "%02X", packet.object_value.string.bytes[i]);
+                     snprintf(dataptr, sizeof(data) - (size_t)(dataptr - data), "%02X", packet.object_value.string.bytes[i]);
                    datalen += (int)strlen(dataptr);
                    break;
 

diff --git a/backend/usb-unix.c b/backend/usb-unix.c
index 81e20c524bc66c108addb0aa14cdc9ff128d116d..d256a813ba80e4b4868e891f70102028b98c3740 100644 (file)
--- a/backend/usb-unix.c
+++ b/backend/usb-unix.c
@@ -214,21 +214,21 @@ list_devices(void)
     * for USB printer devices.  We get the honor of trying them all...
     */
 
-    sprintf(device, "/dev/usblp%d", i);
+    snprintf(device, sizeof(device), "/dev/usblp%d", i);
 
     if ((fd = open(device, O_RDWR | O_EXCL)) < 0)
     {
       if (errno != ENOENT)
        continue;
 
-      sprintf(device, "/dev/usb/lp%d", i);
+      snprintf(device, sizeof(device), "/dev/usb/lp%d", i);
 
       if ((fd = open(device, O_RDWR | O_EXCL)) < 0)
       {
        if (errno != ENOENT)
          continue;
 
-       sprintf(device, "/dev/usb/usblp%d", i);
+       snprintf(device, sizeof(device), "/dev/usb/usblp%d", i);
 
        if ((fd = open(device, O_RDWR | O_EXCL)) < 0)
          continue;
@@ -258,7 +258,7 @@ list_devices(void)
 
   for (i = 0; i < 8; i ++)
   {
-    sprintf(device, "/dev/usb/printer%d", i);
+    snprintf(device, sizeof(device), "/dev/usb/printer%d", i);
 
     if ((fd = open(device, O_WRONLY | O_EXCL)) >= 0)
     {
@@ -278,11 +278,11 @@ list_devices(void)
 
   for (i = 0; i < 8; i ++)
   {
-    sprintf(device, "/dev/ulpt%d", i);
+    snprintf(device, sizeof(device), "/dev/ulpt%d", i);
     if (!access(device, 0))
       printf("direct usb:%s \"Unknown\" \"USB Printer #%d\"\n", device, i + 1);
 
-    sprintf(device, "/dev/unlpt%d", i);
+    snprintf(device, sizeof(device), "/dev/unlpt%d", i);
     if (!access(device, 0))
       printf("direct usb:%s \"Unknown\" \"USB Printer #%d (no reset)\"\n", device, i + 1);
   }
@@ -344,15 +344,15 @@ open_device(const char *uri,              /* I - Device URI */
        * for USB printer devices.  We get the honor of trying them all...
        */
 
-       sprintf(device, "/dev/usblp%d", i);
+       snprintf(device, sizeof(device), "/dev/usblp%d", i);
 
        if ((fd = open(device, O_RDWR | O_EXCL)) < 0 && errno == ENOENT)
        {
-         sprintf(device, "/dev/usb/lp%d", i);
+         snprintf(device, sizeof(device), "/dev/usb/lp%d", i);
 
          if ((fd = open(device, O_RDWR | O_EXCL)) < 0 && errno == ENOENT)
          {
-           sprintf(device, "/dev/usb/usblp%d", i);
+           snprintf(device, sizeof(device), "/dev/usb/usblp%d", i);
 
            if ((fd = open(device, O_RDWR | O_EXCL)) < 0 && errno == ENOENT)
              continue;
@@ -440,7 +440,7 @@ open_device(const char *uri,                /* I - Device URI */
     {
       for (i = 0, busy = 0; i < 8; i ++)
       {
-       sprintf(device, "/dev/usb/printer%d", i);
+       snprintf(device, sizeof(device), "/dev/usb/printer%d", i);
 
        if ((fd = open(device, O_WRONLY | O_EXCL)) >= 0)
          backendGetDeviceID(fd, device_id, sizeof(device_id),

diff --git a/berkeley/lpr.c b/berkeley/lpr.c
index a8f78b8815b22535566397a80b9432210d7c1495..12c40a1db4822c6a21f34477dce134e9be86d874 100644 (file)
--- a/berkeley/lpr.c
+++ b/berkeley/lpr.c
@@ -266,8 +266,7 @@ main(int  argc,                             /* I - Number of command-line arguments */
                return (1);
              }
 
-             sprintf(buffer, "%d", num_copies);
-             num_options = cupsAddOption("copies", buffer, num_options, &options);
+             num_options = cupsAddIntegerOption("copies", num_copies, num_options, &options);
              break;
 
          case 'C' : /* Class */

diff --git a/cgi-bin/admin.c b/cgi-bin/admin.c
index 1683f987b13f838cf49d5f6ba2f11521fc95471c..c6489389f50f4bb33f0a9f4c654b22e3e79bc4c5 100644 (file)
--- a/cgi-bin/admin.c
+++ b/cgi-bin/admin.c
@@ -208,7 +208,7 @@ main(void)
          * bytes left in the array...
          */
 
-         sprintf(ptr, "%%%02X", *url & 255);
+         snprintf(ptr, sizeof(encoded) - (size_t)(ptr - encoded), "%%%02X", *url & 255);
          ptr += 3;
        }
        else
@@ -871,7 +871,7 @@ do_am_printer(http_t *http,         /* I - HTTP connection */
         break;
       else
       {
-        sprintf(baudrate, "%d", baudrates[i]);
+        snprintf(baudrate, sizeof(baudrate), "%d", baudrates[i]);
        cgiSetArray("BAUDRATES", i, baudrate);
       }
 

diff --git a/cgi-bin/classes.c b/cgi-bin/classes.c
index 78ef08e22f1ab2ecbb08c5f81cd1c4da0d5ce415..718604ab2bf9cd2f821a9f8268dd82f49ccccf81 100644 (file)
--- a/cgi-bin/classes.c
+++ b/cgi-bin/classes.c
@@ -362,7 +362,7 @@ show_all_classes(http_t     *http,  /* I - Connection to server */
     if (first < 0)
       first = 0;
 
-    sprintf(val, "%d", count);
+    snprintf(val, sizeof(val), "%d", count);
     cgiSetVariable("TOTAL", val);
 
     for (i = 0, pclass = (ipp_attribute_t *)cupsArrayIndex(classes, first);
@@ -378,13 +378,13 @@ show_all_classes(http_t     *http,        /* I - Connection to server */
 
     if (first > 0)
     {
-      sprintf(val, "%d", first - CUPS_PAGE_MAX);
+      snprintf(val, sizeof(val), "%d", first - CUPS_PAGE_MAX);
       cgiSetVariable("PREV", val);
     }
 
     if ((first + CUPS_PAGE_MAX) < count)
     {
-      sprintf(val, "%d", first + CUPS_PAGE_MAX);
+      snprintf(val, sizeof(val), "%d", first + CUPS_PAGE_MAX);
       cgiSetVariable("NEXT", val);
     }
 

diff --git a/cgi-bin/ipp-var.c b/cgi-bin/ipp-var.c
index 8c5a5616dd5232ab5c3f52b5239d96381f5034c0..443f920a5a2826b5c5147d8744a31fa3b2b0f850 100644 (file)
--- a/cgi-bin/ipp-var.c
+++ b/cgi-bin/ipp-var.c
@@ -224,7 +224,7 @@ cgiGetIPPObjects(ipp_t *response,   /* I - IPP response */
                char    buf[255];       /* Number buffer */
 
 
-                sprintf(buf, "%d", attr->values[i].integer);
+                snprintf(buf, sizeof(buf), "%d", attr->values[i].integer);
 
                if (cgiDoSearch(search, buf))
                  add = 1;
@@ -291,7 +291,7 @@ cgiMoveJobs(http_t     *http,               /* I - Connection to server */
       char     temp[255];              /* Temporary string */
 
 
-      sprintf(temp, "%d", job_id);
+      snprintf(temp, sizeof(temp), "%d", job_id);
       cgiSetVariable("JOB_ID", temp);
     }
 
@@ -1441,7 +1441,7 @@ cgiShowJobs(http_t     *http,             /* I - Connection to server */
 
     cgiSetVariable("SECTION", section);
 
-    sprintf(val, "%d", count);
+    snprintf(val, sizeof(val), "%d", count);
     cgiSetVariable("TOTAL", val);
 
     if (which_jobs)
@@ -1469,13 +1469,13 @@ cgiShowJobs(http_t     *http,           /* I - Connection to server */
 
     if (first > 0)
     {
-      sprintf(val, "%d", first - CUPS_PAGE_MAX);
+      snprintf(val, sizeof(val), "%d", first - CUPS_PAGE_MAX);
       cgiSetVariable("PREV", val);
     }
 
     if ((first + CUPS_PAGE_MAX) < count)
     {
-      sprintf(val, "%d", first + CUPS_PAGE_MAX);
+      snprintf(val, sizeof(val), "%d", first + CUPS_PAGE_MAX);
       cgiSetVariable("NEXT", val);
     }
 

diff --git a/cgi-bin/printers.c b/cgi-bin/printers.c
index bbc153e3b74a35ecc414e5f399db5ddf634af200..2a33b6832d6d2f124b07e91c57f134a19530e500 100644 (file)
--- a/cgi-bin/printers.c
+++ b/cgi-bin/printers.c
@@ -379,7 +379,7 @@ show_all_printers(http_t     *http, /* I - Connection to server */
     if (first < 0)
       first = 0;
 
-    sprintf(val, "%d", count);
+    snprintf(val, sizeof(val), "%d", count);
     cgiSetVariable("TOTAL", val);
 
     for (i = 0, printer = (ipp_attribute_t *)cupsArrayIndex(printers, first);
@@ -395,13 +395,13 @@ show_all_printers(http_t     *http,       /* I - Connection to server */
 
     if (first > 0)
     {
-      sprintf(val, "%d", first - CUPS_PAGE_MAX);
+      snprintf(val, sizeof(val), "%d", first - CUPS_PAGE_MAX);
       cgiSetVariable("PREV", val);
     }
 
     if ((first + CUPS_PAGE_MAX) < count)
     {
-      sprintf(val, "%d", first + CUPS_PAGE_MAX);
+      snprintf(val, sizeof(val), "%d", first + CUPS_PAGE_MAX);
       cgiSetVariable("NEXT", val);
     }
 

diff --git a/cgi-bin/template.c b/cgi-bin/template.c
index 1972b4ae2ca2252b03135ae5a6a523fdfe02bfb7..0b785b2f677f9b93ce8e8d300c815d8fdd369b32 100644 (file)
--- a/cgi-bin/template.c
+++ b/cgi-bin/template.c
@@ -307,9 +307,9 @@ cgi_copy(FILE *out,                 /* I - Output file */
        */
 
         if (name[1])
-          sprintf(outval, "%d", cgiGetSize(name + 1));
+          snprintf(outval, sizeof(outval), "%d", cgiGetSize(name + 1));
        else
-         sprintf(outval, "%d", element + 1);
+         snprintf(outval, sizeof(outval), "%d", element + 1);
 
         outptr = outval;
       }
@@ -457,7 +457,7 @@ cgi_copy(FILE *out,                 /* I - Output file */
            continue;
          else if (ch == '#')
          {
-           sprintf(s, "%d", element + 1);
+           snprintf(s, sizeof(compare) - (size_t)(s - compare), "%d", element + 1);
            s += strlen(s);
          }
          else if (ch == '{')
@@ -473,7 +473,7 @@ cgi_copy(FILE *out,                 /* I - Output file */
            *innerptr = '\0';
 
             if (innername[0] == '#')
-             sprintf(s, "%d", cgiGetSize(innername + 1));
+             snprintf(s, sizeof(compare) - (size_t)(s - compare), "%d", cgiGetSize(innername + 1));
            else if ((innerptr = strrchr(innername, '-')) != NULL &&
                     isdigit(innerptr[1] & 255))
             {

diff --git a/cups/ipp-support.c b/cups/ipp-support.c
index bfb9dff09909a9a227e93f9593ad66da186afbc1..d9e900649aa86ea2dfb05e16924c3422a938d868 100644 (file)
--- a/cups/ipp-support.c
+++ b/cups/ipp-support.c
@@ -2262,7 +2262,7 @@ ippErrorString(ipp_status_t error)        /* I - Error status */
   * No, build an "0xxxxx" error string...
   */
 
-  sprintf(cg->ipp_unknown, "0x%04x", error);
+  snprintf(cg->ipp_unknown, sizeof(cg->ipp_unknown), "0x%04x", error);
 
   return (cg->ipp_unknown);
 }
@@ -2339,7 +2339,7 @@ ippOpString(ipp_op_t op)          /* I - Operation ID */
   * No, build an "0xxxxx" operation string...
   */
 
-  sprintf(cg->ipp_unknown, "0x%04x", op);
+  snprintf(cg->ipp_unknown, sizeof(cg->ipp_unknown), "0x%04x", op);
 
   return (cg->ipp_unknown);
 }

diff --git a/cups/ppd-mark.c b/cups/ppd-mark.c
index 7ec0df473951a40cfc5beb0e12fbf656e8cd149e..25797b3761ea4c1296c37a2459ee642f1a1bab29 100644 (file)
--- a/cups/ppd-mark.c
+++ b/cups/ppd-mark.c
@@ -307,7 +307,7 @@ cupsMarkOptions(
         * Look it up in the PPD file...
        */
 
-       sprintf(s, "%d", j);
+       snprintf(s, sizeof(s), "%d", j);
 
         if ((attr = ppdFindAttr(ppd, "cupsIPPFinishings", s)) == NULL)
          continue;

diff --git a/cups/snprintf.c b/cups/snprintf.c
index 49652e2c43b55abc415fa6538fd01f1dd3b89e4a..a4d17b5be3df69ef09e26c8f8a5f43727de41e3f 100644 (file)
--- a/cups/snprintf.c
+++ b/cups/snprintf.c
@@ -171,7 +171,7 @@ _cups_vsnprintf(char       *buffer, /* O - Output buffer */
            if ((width + 2) > sizeof(temp))
              break;
 
-           sprintf(temp, tformat, va_arg(ap, double));
+           snprintf(temp, sizeof(temp), tformat, va_arg(ap, double));
            templen = strlen(temp);
 
             bytes += (int)templen;
@@ -202,7 +202,7 @@ _cups_vsnprintf(char       *buffer, /* O - Output buffer */
            if ((width + 2) > sizeof(temp))
              break;
 
-           sprintf(temp, tformat, va_arg(ap, int));
+           snprintf(temp, sizeof(temp), tformat, va_arg(ap, int));
            templen = strlen(temp);
 
             bytes += (int)templen;
@@ -226,7 +226,7 @@ _cups_vsnprintf(char       *buffer, /* O - Output buffer */
            if ((width + 2) > sizeof(temp))
              break;
 
-           sprintf(temp, tformat, va_arg(ap, void *));
+           snprintf(temp, sizeof(temp), tformat, va_arg(ap, void *));
            templen = strlen(temp);
 
             bytes += (int)templen;

diff --git a/locale/checkpo.c b/locale/checkpo.c
index 7a644f548c93f2538f04d3f0a391814001b14413..2e926d3d44c568d0d0163cb4977973f9b0289fc6 100644 (file)
--- a/locale/checkpo.c
+++ b/locale/checkpo.c
@@ -321,7 +321,7 @@ abbreviate(const char *s,           /* I - String to abbreviate */
       if (bufsize < 4)
         break;
 
-      sprintf(bufptr, "\\%03o", *s);
+      snprintf(bufptr, bufsize, "\\%03o", *s);
       bufptr += 4;
       bufsize -= 4;
     }

diff --git a/scheduler/client.c b/scheduler/client.c
index c2ee8f12a6e3a460790a1e664efcd1180f4587a0..621394436036bcb171ee621dfd94f55bee5de096 100644 (file)
--- a/scheduler/client.c
+++ b/scheduler/client.c
@@ -3471,8 +3471,7 @@ pipe_command(cupsd_client_t *con, /* I - Client connection */
   }
   else
   {
-    sprintf(content_length, "CONTENT_LENGTH=" CUPS_LLFMT,
-            CUPS_LLCAST con->bytes);
+    snprintf(content_length, sizeof(content_length), "CONTENT_LENGTH=" CUPS_LLFMT, CUPS_LLCAST con->bytes);
     snprintf(content_type, sizeof(content_type), "CONTENT_TYPE=%s",
              httpGetField(con->http, HTTP_FIELD_CONTENT_TYPE));
 

diff --git a/scheduler/conf.c b/scheduler/conf.c
index bb6049b2c6ce28483ceaf21bf707d53fe6d8dca2..a1ef7230d6ba430bd334c9ac0dcc0a825c4294ce 100644 (file)
--- a/scheduler/conf.c
+++ b/scheduler/conf.c
@@ -1742,7 +1742,7 @@ get_address(const char  *value,           /* I - Value string */
       * Use the default port...
       */
 
-      sprintf(defpname, "%d", defport);
+      snprintf(defpname, sizeof(defpname), "%d", defport);
       portname = defpname;
       hostname = buffer;
     }

diff --git a/scheduler/cups-lpd.c b/scheduler/cups-lpd.c
index 0da3d0c06e4e10ddcd446b87f261e8b6c15aa9a2..7b1dc4834631605bc78adbd89c9133e074e961fe 100644 (file)
--- a/scheduler/cups-lpd.c
+++ b/scheduler/cups-lpd.c
@@ -1268,7 +1268,7 @@ remove_jobs(const char *dest,             /* I - Destination */
 
     request = ippNewRequest(IPP_OP_CANCEL_JOB);
 
-    sprintf(uri, "ipp://localhost/jobs/%d", id);
+    snprintf(uri, sizeof(uri), "ipp://localhost/jobs/%d", id);
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "job-uri", NULL, uri);
 
     ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_NAME,

diff --git a/scheduler/ipp.c b/scheduler/ipp.c
index 2fe3bf25cc3ac6d384663a95788ae9bf6f18deb2..0c44d7d4ad8bc6e5bd7c6cf3188c2afb1aa10c79 100644 (file)
--- a/scheduler/ipp.c
+++ b/scheduler/ipp.c
@@ -10866,17 +10866,13 @@ set_printer_defaults(
 
       case IPP_TAG_INTEGER :
       case IPP_TAG_ENUM :
-          sprintf(value, "%d", attr->values[0].integer);
-          printer->num_options = cupsAddOption(name, value,
-                                              printer->num_options,
-                                              &(printer->options));
+          printer->num_options = cupsAddIntegerOption(name, attr->values[0].integer, printer->num_options, &(printer->options));
           cupsdLogMessage(CUPSD_LOG_DEBUG,
                          "Setting %s to %s...", attr->name, value);
           break;
 
       case IPP_TAG_RANGE :
-          sprintf(value, "%d-%d", attr->values[0].range.lower,
-                 attr->values[0].range.upper);
+          snprintf(value, sizeof(value), "%d-%d", attr->values[0].range.lower, attr->values[0].range.upper);
           printer->num_options = cupsAddOption(name, value,
                                               printer->num_options,
                                               &(printer->options));
@@ -10885,10 +10881,7 @@ set_printer_defaults(
           break;
 
       case IPP_TAG_RESOLUTION :
-          sprintf(value, "%dx%d%s", attr->values[0].resolution.xres,
-                 attr->values[0].resolution.yres,
-                 attr->values[0].resolution.units == IPP_RES_PER_INCH ?
-                     "dpi" : "dpcm");
+          snprintf(value, sizeof(value), "%dx%d%s", attr->values[0].resolution.xres, attr->values[0].resolution.yres, attr->values[0].resolution.units == IPP_RES_PER_INCH ? "dpi" : "dpcm");
           printer->num_options = cupsAddOption(name, value,
                                               printer->num_options,
                                               &(printer->options));

diff --git a/scheduler/job.c b/scheduler/job.c
index e20e7c563edc65340155d2ad8b8882fe24e0e10e..17b341834cbe5e52ba7608ea783d75b151b79e05 100644 (file)
--- a/scheduler/job.c
+++ b/scheduler/job.c
@@ -893,7 +893,7 @@ cupsdContinueJob(cupsd_job_t *job)  /* I - Job */
     goto abort_job;
   }
 
-  sprintf(jobid, "%d", job->id);
+  snprintf(jobid, sizeof(jobid), "%d", job->id);
 
   argv[0] = job->printer->name;
   argv[1] = jobid;

diff --git a/systemv/cancel.c b/systemv/cancel.c
index c85a86e0cac3402b934413f305efe5d0032f95a4..bcd638cc44e423c71282c11687a9a3d1a5e74b4c 100644 (file)
--- a/systemv/cancel.c
+++ b/systemv/cancel.c
@@ -274,7 +274,7 @@ main(int  argc,                             /* I - Number of command-line arguments */
       }
       else
       {
-        sprintf(uri, "ipp://localhost/jobs/%d", job_id);
+        snprintf(uri, sizeof(uri), "ipp://localhost/jobs/%d", job_id);
        ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI, "job-uri", NULL,
                     uri);
       }

diff --git a/systemv/lp.c b/systemv/lp.c
index d918b4b14e20ade67cf6866feda28bb9d7bef3ea..fd818a56d5a715bc2c48a6a403ede5309bcff5e2 100644 (file)
--- a/systemv/lp.c
+++ b/systemv/lp.c
@@ -286,9 +286,7 @@ main(int  argc,                             /* I - Number of command-line arguments */
                return (1);
              }
 
-             sprintf(buffer, "%d", num_copies);
-             num_options = cupsAddOption("copies", buffer, num_options,
-                                         &options);
+             num_options = cupsAddIntegerOption("copies", num_copies, num_options, &options);
              break;
 
          case 'o' : /* Option */
@@ -348,9 +346,7 @@ main(int  argc,                             /* I - Number of command-line arguments */
                return (1);
              }
 
-             sprintf(buffer, "%d", priority);
-             num_options = cupsAddOption("job-priority", buffer, num_options,
-                                         &options);
+             num_options = cupsAddIntegerOption("job-priority", priority, num_options, &options);
              break;
 
          case 's' : /* Silent */
@@ -666,7 +662,7 @@ restart_job(const char *command,    /* I - Command name */
 
   request = ippNewRequest(IPP_RESTART_JOB);
 
-  sprintf(uri, "ipp://localhost/jobs/%d", job_id);
+  snprintf(uri, sizeof(uri), "ipp://localhost/jobs/%d", job_id);
 
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI,
                "job-uri", NULL, uri);
@@ -714,7 +710,7 @@ set_job_attrs(
 
   request = ippNewRequest(IPP_SET_JOB_ATTRIBUTES);
 
-  sprintf(uri, "ipp://localhost/jobs/%d", job_id);
+  snprintf(uri, sizeof(uri), "ipp://localhost/jobs/%d", job_id);
 
   ippAddString(request, IPP_TAG_OPERATION, IPP_TAG_URI,
                "job-uri", NULL, uri);

diff --git a/tools/ippeveprinter.c b/tools/ippeveprinter.c
index 5467c13b54b6eae1b854940440ea0d6a41a1b6f7..7a71f0c6223bf75df02374fadbe265fbe2fe9cb3 100644 (file)
--- a/tools/ippeveprinter.c
+++ b/tools/ippeveprinter.c
@@ -3069,7 +3069,7 @@ html_printf(ippeve_client_t *client,      /* I - Client */
            if ((size_t)(width + 2) > sizeof(temp))
              break;
 
-           sprintf(temp, tformat, va_arg(ap, double));
+           snprintf(temp, sizeof(temp), tformat, va_arg(ap, double));
 
             httpWrite2(client->http, temp, strlen(temp));
            break;
@@ -3087,13 +3087,13 @@ html_printf(ippeve_client_t *client,    /* I - Client */
 
 #  ifdef HAVE_LONG_LONG
             if (size == 'L')
-             sprintf(temp, tformat, va_arg(ap, long long));
+             snprintf(temp, sizeof(temp), tformat, va_arg(ap, long long));
            else
 #  endif /* HAVE_LONG_LONG */
             if (size == 'l')
-             sprintf(temp, tformat, va_arg(ap, long));
+             snprintf(temp, sizeof(temp), tformat, va_arg(ap, long));
            else
-             sprintf(temp, tformat, va_arg(ap, int));
+             snprintf(temp, sizeof(temp), tformat, va_arg(ap, int));
 
             httpWrite2(client->http, temp, strlen(temp));
            break;
@@ -3102,7 +3102,7 @@ html_printf(ippeve_client_t *client,      /* I - Client */
            if ((size_t)(width + 2) > sizeof(temp))
              break;
 
-           sprintf(temp, tformat, va_arg(ap, void *));
+           snprintf(temp, sizeof(temp), tformat, va_arg(ap, void *));
 
             httpWrite2(client->http, temp, strlen(temp));
            break;