Replace sprintf with snprintf

Fixes #292

Author: evanmiller

src/spss/readstat_por.c

@@ -129,7 +129,7 @@ ssize_t por_utf8_encode(const unsigned char *input, size_t input_len,
             }
             /* TODO - For some reason that replacement character isn't recognized
              * by some systems, so be prepared to insert an ASCII space instead */
-            int printed = sprintf(output + offset, "%lc", codepoint);
+            int printed = snprintf(output + offset, output_len - offset, "%lc", codepoint);
             if (printed > 0) {
                 offset += printed;
             } else {

src/stata/readstat_dta_write.c

@@ -420,10 +420,10 @@ static readstat_error_t dta_emit_fmtlist(readstat_writer_t *writer, dta_ctx_t *c
             }
             char format[64];
             if (format_letter == 'g') {
-                sprintf(format, "%%%s%d.0g", r_variable->alignment == READSTAT_ALIGNMENT_LEFT ? "-" : "",
+                snprintf(format, sizeof(format), "%%%s%d.0g", r_variable->alignment == READSTAT_ALIGNMENT_LEFT ? "-" : "",
                         display_width);
             } else {
-                sprintf(format, "%%%s%ds",
+                snprintf(format, sizeof(format), "%%%s%ds",
                         r_variable->alignment == READSTAT_ALIGNMENT_LEFT ? "-" : "",
                         display_width);
             }