Index: unrtf-0.21.9/src/attr.c
===================================================================
--- unrtf-0.21.9/src/attr.c
+++ unrtf-0.21.9/src/attr.c	2017-01-02 13:39:05.852529437 -0500
@@ -746,7 +746,7 @@
 assemble_string(char *string, int nr)
 {
 
-	char *s, tmp[12];/* Number of characters that can be in int type (including '\0') - AF */
+	char *s, tmp[20];
 	int i = 0, j = 0;
 
 	if (string == NULL)
@@ -762,7 +762,7 @@
 		}
 
 		if (string[i] != '\0') {
-			sprintf(tmp, "%d", nr);
+			snprintf(tmp, 20, "%d", nr);
 			strcpy(&s[j], tmp);
 			j = j + strlen(tmp);
 		}
Index: unrtf-0.21.9/src/convert.c
===================================================================
--- unrtf-0.21.9/src/convert.c
+++ unrtf-0.21.9/src/convert.c	2017-01-02 13:48:44.994163188 -0500
@@ -472,7 +472,7 @@
 }
 
 // Translate code page to encoding name hopefully suitable as iconv input
-static char *cptoencoding(parm)
+static char *cptoencoding(int parm)
 {
     // Note that CP0 is supposed to mean current system default, which does
     // not make any sense as a stored value, we don't handle it.
@@ -964,7 +964,7 @@
 	}
 	else
 	{
-		sprintf(str,"#%02x%02x%02x",
+		snprintf(str, 40, "#%02x%02x%02x",
 			color_table[num].r,
 			color_table[num].g,
 			color_table[num].b);
@@ -993,7 +993,7 @@
 	}
 	else
 	{
-		sprintf(str,"#%02x%02x%02x",
+		snprintf(str, 40, "#%02x%02x%02x",
 			color_table[num].r,
 			color_table[num].g,
 			color_table[num].b);
@@ -1018,7 +1018,7 @@
 	/* Note, fs20 means 10pt */
 	points /= 2;
 
-	sprintf(str,"%d",points);
+	snprintf(str, 20, "%d", points);
 	attr_push(ATTR_FONTSIZE,str);
 
 	return FALSE;
@@ -1166,7 +1166,7 @@
         {
             // TOBEDONE: WHAT'S THIS ???
             name = my_malloc(12);
-            sprintf(name, "%d", num);
+            snprintf(name, 12, "%d", num);
         }
 
         /* we are going to output entities, so should not output font */
@@ -1218,7 +1218,7 @@
 	}
 	else
 	{
-		sprintf(str,"#%02x%02x%02x",
+		snprintf(str, 40, "#%02x%02x%02x",
 			color_table[num].r,
 			color_table[num].g,
 			color_table[num].b);
@@ -1373,9 +1373,9 @@
 
 static int 
 cmd_expand (Word *w, int align, char has_param, int param) {
-	char str[10];
+	char str[20];
 	if (has_param) {
-		sprintf(str, "%d", param/4);
+		snprintf(str, 20, "%d", param/4);
 		if (!param) 
 			attr_pop(ATTR_EXPAND);
 		else 
@@ -1394,7 +1394,7 @@
 
 static int 
 cmd_emboss (Word *w, int align, char has_param, int param) {
-	char str[10];
+	char str[20];
 	if (has_param && !param)
 #ifdef SUPPORT_UNNESTED
 		attr_find_pop(ATTR_EMBOSS);
@@ -1403,7 +1403,7 @@
 #endif
 	else
 	{
-		sprintf(str, "%d", param);
+		snprintf(str, 20, "%d", param);
 		attr_push(ATTR_EMBOSS, str);
 	}
 	return FALSE;
@@ -1419,12 +1419,12 @@
 
 static int 
 cmd_engrave (Word *w, int align, char has_param, int param) {
-	char str[10];
+	char str[20];
 	if (has_param && !param) 
 		attr_pop(ATTR_ENGRAVE);
 	else
 	{
-		sprintf(str, "%d", param);
+		snprintf(str, 20, "%d", param);
 		attr_push(ATTR_ENGRAVE, str);
 	}
 	return FALSE;
@@ -1976,7 +1976,7 @@
 
 	short	done=0;
 	long unicode_number = (long) param; /* On 16bit architectures int is too small to store unicode characters. - AF */
-	char tmp[12]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */
+	char tmp[20]; /* Number of characters that can be in int type (including '\0'). If int size is greater than 4 bytes change this value. - AF */
 	const char *alias;
 #define DEBUG 0
 #if DEBUG
@@ -2006,7 +2006,7 @@
                             /* RTF spec: Unicode values beyond 32767 are represented by negative numbers */
 				unicode_number += 65536;
 			}
-			sprintf(tmp, "%ld", unicode_number);
+			snprintf(tmp, 20, "%ld", unicode_number);
 
 			if (safe_printf(1, op->unisymbol_print, tmp)) fprintf(stderr, TOO_MANY_ARGS, "unisymbol_print");
 			done++;
@@ -3369,7 +3369,7 @@
 						case PICT_PM: ext="pmm"; break; /* OS/2 metafile=??? */
 						case PICT_EMF: ext="emf"; break;  /* Enhanced MetaFile */
 						}
-						sprintf(picture_path, "pict%03d.%s", 
+						snprintf(picture_path, 255, "pict%03d.%s", 
 							picture_file_number++,ext);
 						pictfile=fopen(picture_path,"wb");
 					}
Index: unrtf-0.21.9/src/output.c
===================================================================
--- unrtf-0.21.9/src/output.c
+++ unrtf-0.21.9/src/output.c	2017-01-02 13:50:16.818421337 -0500
@@ -320,7 +320,7 @@
 	if (!found_std_expr) {
 		if (op->fontsize_begin) {
 			char expr[16];
-			sprintf (expr, "%d", size);
+			snprintf (expr, 16, "%d", size);
 			if (safe_printf (1, op->fontsize_begin, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_begin");
 		} else {
 			/* If we cannot write out a change for the exact
@@ -440,7 +440,7 @@
 	if (!found_std_expr) {
 		if (op->fontsize_end) {
 			char expr[16];
-			sprintf (expr, "%d", size);
+			snprintf (expr, 16, "%d", size);
 			if (safe_printf(1, op->fontsize_end, expr)) fprintf(stderr, TOO_MANY_ARGS, "fontsize_end");
 		} else {
 			/* If we cannot write out a change for the exact