Backport from xs.

xs_encdec.h

@@ -24,7 +24,7 @@ xs_str *xs_hex_enc(const xs_val *data, int size)
     p = s = xs_realloc(NULL, _xs_blk_size(size * 2 + 1));
 
     for (n = 0; n < size; n++) {
-        sprintf(p, "%02x", (unsigned char)data[n]);
+        snprintf(p, 3, "%02x", (unsigned char)data[n]);
         p += 2;
     }
 

xs_json.h

@@ -40,7 +40,7 @@ static xs_str *_xs_json_dumps_str(xs_str *s, const char *data)
         if (c < 32) {
             char tmp[10];
 
-            sprintf(tmp, "\\u%04x", (unsigned int) c);
+            snprintf(tmp, sizeof(tmp), "\\u%04x", (unsigned int) c);
             s = xs_str_cat(s, tmp);
         }
         else

xs_version.h

@@ -1 +1 @@
-/* 69d6e64d31491688ba4411e71c55e6c25482b17e */
+/* ff134685f4cb4096c6fce0a2a946be2663ff196e */