From c34ddd4d367da7b96b8c40a58d7ba2c19fe2cdf3 Mon Sep 17 00:00:00 2001
From: Chris Dinneen <chris.dinneen@tapeark.com>
Date: Fri, 16 Oct 2026 10:30:05 +0800
Subject: [PATCH] Fix: Buffer Overflow vuln

---
 mt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mt.c b/mt.c
index 5cf9db5..57d235f 100644
--- a/mt.c
+++ b/mt.c
@@ -731,7 +731,7 @@ static int do_show_options(int mtfd,
     tapeno = TAPE_NR(tapeminor);
     tapemode = TAPE_MODE(tapeminor);
     tapemode <<= 4 - ST_NBR_MODE_BITS; /* from st.c */
-    sprintf(fname, "/sys/class/scsi_tape/st%d%s/options", tapeno, st_formats[tapemode]);
+    snprintf(fname, sizeof(fname), "/sys/class/scsi_tape/st%d%s/options", tapeno, st_formats[tapemode]);
     /* printf("Trying file '%s' (st_rdev 0x%lx).\n", fname, stat.st_rdev); */
 
     if ((fd = open(fname, O_RDONLY)) < 0 || read(fd, buf, 20) < 0) {