Description: Use snprintf
 Use snprintf() when converting dates to strings to make completely sure we
 can't overrun the buffer.
Author: Olly Betts <olly@survex.com>
Forwarded: no
Last-Update: 2018-11-29

--- antiword-0.37.orig/summary.c
+++ antiword-0.37/summary.c
@@ -729,7 +729,7 @@ szGetLastSaveDtm(void)
 	if (pTime == NULL) {
 		return NULL;
 	}
-	sprintf(szTime, "%04d-%02d-%02d",
+	snprintf(szTime, sizeof(szTime), "%04d-%02d-%02d",
 		pTime->tm_year + 1900, pTime->tm_mon + 1, pTime->tm_mday);
 	return szTime;
 } /* end of szGetLastSaveDtm */
@@ -750,7 +750,7 @@ szGetModDate(void)
 	if (pTime == NULL) {
 		return NULL;
 	}
-	sprintf(szTime, "D:%04d%02d%02d%02d%02d",
+	snprintf(szTime, sizeof(szTime), "D:%04d%02d%02d%02d%02d",
 		pTime->tm_year + 1900, pTime->tm_mon + 1, pTime->tm_mday,
 		pTime->tm_hour, pTime->tm_min);
 	return szTime;
@@ -772,7 +772,7 @@ szGetCreationDate(void)
 	if (pTime == NULL) {
 		return NULL;
 	}
-	sprintf(szTime, "D:%04d%02d%02d%02d%02d",
+	snprintf(szTime, sizeof(szTime), "D:%04d%02d%02d%02d%02d",
 		pTime->tm_year + 1900, pTime->tm_mon + 1, pTime->tm_mday,
 		pTime->tm_hour, pTime->tm_min);
 	return szTime;