--- a/fileio.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/fileio.c	Tue Nov 28 20:55:16 2006 +0000
@@ -117,7 +117,7 @@
 	FILE *f;
 	char buf[MAX_PATH];
 
-	sprintf(buf, "%s%s", _path.data_dir, filename);
+	snprintf(buf, lengthof(buf), "%s%s", _path.data_dir, filename);
 
 	f = fopen(buf, "rb");
 #if !defined(WIN32)
@@ -128,7 +128,7 @@
 #if defined SECOND_DATA_DIR
 		// tries in the 2nd data directory
 		if (f == NULL) {
-			sprintf(buf, "%s%s", _path.second_data_dir, filename);
+			snprintf(buf, lengthof(buf), "%s%s", _path.second_data_dir, filename);
 			strtolower(buf + strlen(_path.second_data_dir) - 1);
 			f = fopen(buf, "rb");
 		}