cmark

diff --git a/src/commonmark.c b/src/commonmark.c
@@ -23,9 +23,10 @@
 static inline void outc(cmark_renderer *renderer, cmark_escaping escape,
                         int32_t c, unsigned char nextc) {
   bool needs_escaping = false;
-  char encoded[20];
   bool follows_digit = renderer->buffer->size > 0 &&
 	  cmark_isdigit(renderer->buffer->ptr[renderer->buffer->size - 1]);
+  const size_t ENCODED_SIZE = 20;
+  char encoded[ENCODED_SIZE];
 
   needs_escaping =
       escape != LITERAL &&
@@ -47,7 +48,7 @@ static inline void outc(cmark_renderer *renderer, cmark_escaping escape,
   if (needs_escaping) {
     if (isspace(c)) {
       // use percent encoding for spaces
-      sprintf(encoded, "%%%2x", c);
+      snprintf(encoded, ENCODED_SIZE, "%%%2x", c);
       cmark_strbuf_puts(renderer->buffer, encoded);
       renderer->column += 3;
     } else {
@@ -166,7 +167,8 @@ static int S_render_node(cmark_renderer *renderer, cmark_node *node,
   bool entering = (ev_type == CMARK_EVENT_ENTER);
   const char *info, *code, *title;
   size_t info_len, code_len;
-  char listmarker[20];
+  const size_t LISTMARKER_SIZE = 20;
+  char listmarker[LISTMARKER_SIZE];
   char *emph_delim;
   bufsize_t marker_width;
 
@@ -223,9 +225,9 @@ static int S_render_node(cmark_renderer *renderer, cmark_node *node,
       // we ensure a width of at least 4 so
       // we get nice transition from single digits
       // to double
-      sprintf(listmarker, "%d%s%s", list_number,
-              list_delim == CMARK_PAREN_DELIM ? ")" : ".",
-              list_number < 10 ? "  " : " ");
+      snprintf(listmarker, LISTMARKER_SIZE, "%d%s%s", list_number,
+               list_delim == CMARK_PAREN_DELIM ? ")" : ".",
+               list_number < 10 ? "  " : " ");
       marker_width = safe_strlen(listmarker);
     }
     if (entering) {

diff --git a/src/html.c b/src/html.c
@@ -29,11 +29,12 @@ struct render_state {
 
 static void S_render_sourcepos(cmark_node *node, cmark_strbuf *html,
                                int options) {
-  char buffer[100];
+  const size_t BUFFER_SIZE = 100;
+  char buffer[BUFFER_SIZE];
   if (CMARK_OPT_SOURCEPOS & options) {
-    sprintf(buffer, " data-sourcepos=\"%d:%d-%d:%d\"",
-            cmark_node_get_start_line(node), cmark_node_get_start_column(node),
-            cmark_node_get_end_line(node), cmark_node_get_end_column(node));
+    snprintf(buffer, BUFFER_SIZE, " data-sourcepos=\"%d:%d-%d:%d\"",
+             cmark_node_get_start_line(node), cmark_node_get_start_column(node),
+             cmark_node_get_end_line(node), cmark_node_get_end_column(node));
     cmark_strbuf_puts(html, buffer);
   }
 }
@@ -46,7 +47,8 @@ static int S_render_node(cmark_node *node, cmark_event_type ev_type,
   char start_heading[] = "<h0";
   char end_heading[] = "</h0";
   bool tight;
-  char buffer[100];
+  const size_t BUFFER_SIZE = 100;
+  char buffer[BUFFER_SIZE];
 
   bool entering = (ev_type == CMARK_EVENT_ENTER);
 
@@ -104,7 +106,7 @@ static int S_render_node(cmark_node *node, cmark_event_type ev_type,
         S_render_sourcepos(node, html, options);
         cmark_strbuf_puts(html, ">\n");
       } else {
-        sprintf(buffer, "<ol start=\"%d\"", start);
+        snprintf(buffer, BUFFER_SIZE, "<ol start=\"%d\"", start);
         cmark_strbuf_puts(html, buffer);
         S_render_sourcepos(node, html, options);
         cmark_strbuf_puts(html, ">\n");

diff --git a/src/latex.c b/src/latex.c
@@ -217,7 +217,8 @@ static int S_get_enumlevel(cmark_node *node) {
 static int S_render_node(cmark_renderer *renderer, cmark_node *node,
                          cmark_event_type ev_type, int options) {
   int list_number;
-  char list_number_string[20];
+  const size_t LIST_NUMBER_STRING_SIZE = 20;
+  char list_number_string[LIST_NUMBER_STRING_SIZE];
   bool entering = (ev_type == CMARK_EVENT_ENTER);
   cmark_list_type list_type;
   const char *roman_numerals[] = {"",   "i",   "ii",   "iii", "iv", "v",
@@ -249,7 +250,8 @@ static int S_render_node(cmark_renderer *renderer, cmark_node *node,
       CR();
       list_number = cmark_node_get_list_start(node);
       if (list_number > 1) {
-        sprintf(list_number_string, "%d", list_number);
+        snprintf(list_number_string, LIST_NUMBER_STRING_SIZE, "%d",
+                 list_number);
         LIT("\\setcounter{enum");
         LIT((char *)roman_numerals[S_get_enumlevel(node)]);
         LIT("}{");

diff --git a/src/man.c b/src/man.c
@@ -110,8 +110,9 @@ static int S_render_node(cmark_renderer *renderer, cmark_node *node,
           tmp = tmp->prev;
           list_number += 1;
         }
-        char list_number_s[20];
-        sprintf(list_number_s, "\"%d.\" 4", list_number);
+        const size_t LIST_NUMBER_SIZE = 20;
+        char list_number_s[LIST_NUMBER_SIZE];
+        snprintf(list_number_s, LIST_NUMBER_SIZE, "\"%d.\" 4", list_number);
         LIT(list_number_s);
       }
       CR();

diff --git a/src/xml.c b/src/xml.c
@@ -34,7 +34,8 @@ static int S_render_node(cmark_node *node, cmark_event_type ev_type,
   bool literal = false;
   cmark_delim_type delim;
   bool entering = (ev_type == CMARK_EVENT_ENTER);
-  char buffer[100];
+  const size_t BUFFER_SIZE = 100;
+  char buffer[BUFFER_SIZE];
 
   if (entering) {
     indent(state);
@@ -42,8 +43,9 @@ static int S_render_node(cmark_node *node, cmark_event_type ev_type,
     cmark_strbuf_puts(xml, cmark_node_get_type_string(node));
 
     if (options & CMARK_OPT_SOURCEPOS && node->start_line != 0) {
-      sprintf(buffer, " sourcepos=\"%d:%d-%d:%d\"", node->start_line,
-              node->start_column, node->end_line, node->end_column);
+      snprintf(buffer, BUFFER_SIZE, " sourcepos=\"%d:%d-%d:%d\"",
+               node->start_line, node->start_column, node->end_line,
+               node->end_column);
       cmark_strbuf_puts(xml, buffer);
     }
 
@@ -67,7 +69,8 @@ static int S_render_node(cmark_node *node, cmark_event_type ev_type,
       switch (cmark_node_get_list_type(node)) {
       case CMARK_ORDERED_LIST:
         cmark_strbuf_puts(xml, " type=\"ordered\"");
-        sprintf(buffer, " start=\"%d\"", cmark_node_get_list_start(node));
+        snprintf(buffer, BUFFER_SIZE, " start=\"%d\"",
+                 cmark_node_get_list_start(node));
         cmark_strbuf_puts(xml, buffer);
         delim = cmark_node_get_list_delim(node);
         if (delim == CMARK_PAREN_DELIM) {
@@ -82,12 +85,12 @@ static int S_render_node(cmark_node *node, cmark_event_type ev_type,
       default:
         break;
       }
-      sprintf(buffer, " tight=\"%s\"",
-              (cmark_node_get_list_tight(node) ? "true" : "false"));
+      snprintf(buffer, BUFFER_SIZE, " tight=\"%s\"",
+               (cmark_node_get_list_tight(node) ? "true" : "false"));
       cmark_strbuf_puts(xml, buffer);
       break;
     case CMARK_NODE_HEADING:
-      sprintf(buffer, " level=\"%d\"", node->as.heading.level);
+      snprintf(buffer, BUFFER_SIZE, " level=\"%d\"", node->as.heading.level);
       cmark_strbuf_puts(xml, buffer);
       break;
     case CMARK_NODE_CODE_BLOCK: