Fix potential buffer overflow when writing a double (Issue #233)

CHANGES.md

@@ -1,5 +1,7 @@
 # Changes in Mini-XML CURRENT
 
+- Fixed a potential buffer overflow when writing floating point data
+  (Issue #233)
 - Fixed a potential crash bug in mxmldoc found by fuzzing (Issue #235,
   Issue #236)
 - The `mxmldoc` program now sets the EPUB subject ("Programming").

mxml-file.c

@@ -2881,7 +2881,7 @@ mxml_write_node(mxml_node_t     *node,	/* I - Node to write */
 	      col ++;
 	  }
 
-	  sprintf(s, "%d", current->value.integer);
+	  snprintf(s, sizeof(s), "%d", current->value.integer);
 	  if (mxml_write_string(s, p, putc_cb) < 0)
 	    return (-1);
 
@@ -2911,7 +2911,7 @@ mxml_write_node(mxml_node_t     *node,	/* I - Node to write */
 	      col ++;
 	  }
 
-	  sprintf(s, "%f", current->value.real);
+	  snprintf(s, sizeof(s), "%f", current->value.real);
 	  if (mxml_write_string(s, p, putc_cb) < 0)
 	    return (-1);