sprintf buffer overflows

[setharnold]

openjpeg/src/bin/jp3d/convert.c

Line 428 in 06f7d41

sprintf(name, "%s%d-%d.pgx", outfile, sliceno + 1, compno);

            if (volume->numcomps > 1) {
                sprintf(name, "%s%d-%d.pgx", outfile, sliceno + 1, compno);
            } else if ((volume->z1 - volume->z0) > 1) {
                sprintf(name, "%s%d.pgx", outfile, sliceno + 1);
            } else {
                sprintf(name, "%s.pgx", outfile);

Hello, the values I found for MAX_PATH (260) and OPJ_PATH_LEN (4096) that I found suggest these sprintf(3) calls could overflow. Perhaps asprintf(3) would be the easiest re-write, but that uses GNU-specific extensions that might not be available on all target platforms. If you swap to snprintf(3) please check for both less than zero and greater than allocated length return values.

Thanks