replaced sprintf() with snprintf() to prevent possible buffer overflow
* DOCBparser.c HTMLparser.c debugXML.c encoding.c
nanoftp.c nanohttp.c parser.c tree.c uri.c xmlIO.c
xmllint.c xpath.c: replaced sprintf() with snprintf()
to prevent possible buffer overflow (the bug was pointed
out by Anju Premachandran)
diff --git a/encoding.c b/encoding.c
index 08dda58..d2d5ca2 100644
--- a/encoding.c
+++ b/encoding.c
@@ -2270,7 +2270,7 @@
* and continue the transcoding phase, hoping the error
* did not mangle the encoder state.
*/
- sprintf((char *) charref, "&#%d;", cur);
+ snprintf((char *) charref, sizeof(charref), "&#%d;", cur);
xmlBufferShrink(in, len);
xmlBufferAddHead(in, charref, -1);