More printf format paranoia; noticed by David Krause

1 files changed, 5 insertions, 3 deletions

diff --git a/gnu/usr.bin/groff/pic/pic.y b/gnu/usr.bin/groff/pic/pic.y
index 4d5a35440d3..d0420acd793 100644
--- a/gnu/usr.bin/groff/pic/pic.y
+++ b/gnu/usr.bin/groff/pic/pic.y
@@ -1758,18 +1758,20 @@ char *do_sprintf(const char *form, const double *v, int nv)
       if (*form == '%') {
 	one_format += *form++;
 	one_format += '\0';
-	snprintf(sprintf_buf, sizeof(sprintf_buf), one_format.contents());
+	snprintf(sprintf_buf, sizeof(sprintf_buf),
+		 "%s", one_format.contents());
       }
       else {
 	if (i >= nv) {
-	  lex_error("too few arguments to sprintf");
+	  lex_error("too few arguments to snprintf");
 	  result += one_format;
 	  result += form;
 	  break;
 	}
 	one_format += *form++;
 	one_format += '\0';
-	snprintf(sprintf_buf, sizeof(sprintf_buf), one_format.contents(), v[i++]);
+	snprintf(sprintf_buf, sizeof(sprintf_buf),
+		 one_format.contents(), v[i++]);
       }
       one_format.clear();
       result += sprintf_buf;