Use snprintf to print to zip->format_name

zip->format_name is a fixed size character array so ensure that the number of
characters written to the array is appropriately limited.

Signed-off-by: Paul Barker <paul@paulbarker.me.uk>

diff --git a/libarchive/archive_read_support_format_zip.c b/libarchive/archive_read_support_format_zip.c
index ab3c71e2e817a1b864678d8636d8278071080b47..dbe245e150c83159688b6fea065aaebcc1aee0bb 100644 (file)
--- a/libarchive/archive_read_support_format_zip.c
+++ b/libarchive/archive_read_support_format_zip.c
@@ -744,7 +744,7 @@ zip_read_local_file_header(struct archive_read *a, struct archive_entry *entry,
                zip->end_of_entry = 1;
 
        /* Set up a more descriptive format name. */
-       sprintf(zip->format_name, "ZIP %d.%d (%s)",
+       snprintf(zip->format_name, sizeof(zip->format_name), "ZIP %d.%d (%s)",
            version / 10, version % 10,
            compression_name(zip->entry->compression));
        a->archive.archive_format_name = zip->format_name;