CAN-2005-3178, CAN-2005-0639 ?
Index: xli-1.17.0+20061110/zoom.c
===================================================================
--- xli-1.17.0+20061110.orig/zoom.c
+++ xli-1.17.0+20061110/zoom.c
@@ -52,28 +52,29 @@ Image *zoom(Image *oimage, unsigned int
     if (verbose)
       printf("  Zooming image Y axis by %d%%...", yzoom);
     if (changetitle)
-      sprintf(buf, "%s (Y zoom %d%%)", oimage->title, yzoom);
+      snprintf(buf, BUFSIZ, "%s (Y zoom %d%%)", oimage->title, yzoom);
   }
   else if (!yzoom) {
     if (verbose)
       printf("  Zooming image X axis by %d%%...", xzoom);
     if (changetitle)
-      sprintf(buf, "%s (X zoom %d%%)", oimage->title, xzoom);
+      snprintf(buf, BUFSIZ, "%s (X zoom %d%%)", oimage->title, xzoom);
   }
   else if (xzoom == yzoom) {
     if (verbose)
       printf("  Zooming image by %d%%...", xzoom);
     if (changetitle)
-      sprintf(buf, "%s (%d%% zoom)", oimage->title, xzoom);
+      snprintf(buf, BUFSIZ, "%s (%d%% zoom)", oimage->title, xzoom);
   }
   else {
     if (verbose)
       printf("  Zooming image X axis by %d%% and Y axis by %d%%...",
 	     xzoom, yzoom);
     if (changetitle)
-      sprintf(buf, "%s (X zoom %d%% Y zoom %d%%)", oimage->title,
+      snprintf(buf, BUFSIZ, "%s (X zoom %d%% Y zoom %d%%)", oimage->title,
 	    xzoom, yzoom);
   }
+  buf[BUFSIZ-1] = '\0';
   if (!changetitle)
     strcpy(buf,oimage->title);
 
Index: xli-1.17.0+20061110/reduce.c
===================================================================
--- xli-1.17.0+20061110.orig/reduce.c
+++ xli-1.17.0+20061110/reduce.c
@@ -178,7 +178,8 @@ Image *reduce(Image *image, unsigned col
 	/* get destination image */
 	depth = colorsToDepth(OutColors);
 	new_image = newRGBImage(image->width, image->height, depth);
-	sprintf(buf, "%s (%d colors)", image->title, OutColors);
+	snprintf(buf, BUFSIZ, "%s (%d colors)", image->title, OutColors);
+	buf[BUFSIZ-1] = '\0';
 	new_image->title = dupString(buf);
 	new_image->gamma = image->gamma;
 
Index: xli-1.17.0+20061110/pbm.c
===================================================================
--- xli-1.17.0+20061110.orig/pbm.c
+++ xli-1.17.0+20061110/pbm.c
@@ -108,8 +108,7 @@ static int pbmReadRawInt(ZFILE * zf, int
 	return src;
 }
 
-static int isPBM(ZFILE * zf, char *name,
-	unsigned int *width, unsigned int *height, unsigned int *maxval,
+static int isPBM(ZFILE * zf, char *name, int *width, int *height, int *maxval,
 	unsigned int verbose)
 {
 	byte buf[4];
@@ -161,10 +160,10 @@ static int isPBM(ZFILE * zf, char *name,
 
 	if (memToVal(buf, 2) == memToVal((byte *) "P2", 2)) {
 		if (((*width = pbmReadInt(zf)) < 0)
-				|| ((*height = pbmReadInt(zf)) < 0))
+				|| ((*height = pbmReadInt(zf)) < 0)
+				|| ((*maxval = pbmReadInt(zf)) < 0))
 			return (NOTPBM);
 
-		*maxval = pbmReadInt(zf);
 		if (verbose) {
 			printf("%s is a %dx%d PGM image with %d levels\n",
 				name, *width, *height, (*maxval + 1));
@@ -174,10 +173,10 @@ static int isPBM(ZFILE * zf, char *name,
 
 	if (memToVal(buf, 2) == memToVal((byte *) "P5", 2)) {
 		if (((*width = pbmReadInt(zf)) < 0)
-				|| ((*height = pbmReadInt(zf)) < 0))
+				|| ((*height = pbmReadInt(zf)) < 0)
+				|| ((*maxval = pbmReadInt(zf)) < 0))
 			return (NOTPBM);
 
-		*maxval = pbmReadInt(zf);
 		if (verbose)
 			printf("%s is a %dx%d Raw PGM image with %d levels\n",
 				name, *width, *height, (*maxval + 1));
@@ -185,11 +184,11 @@ static int isPBM(ZFILE * zf, char *name,
 	}
 
 	if (memToVal(buf, 2) == memToVal((byte *) "P3", 2)) {
-		if (((*width = pbmReadInt(zf)) < 0) ||
-				((*height = pbmReadInt(zf)) < 0))
+		if (((*width = pbmReadInt(zf)) < 0)
+				|| ((*height = pbmReadInt(zf)) < 0)
+				|| ((*maxval = pbmReadInt(zf)) < 0))
 			return (NOTPBM);
 
-		*maxval = pbmReadInt(zf);
 		if (verbose) {
 			printf("%s is a %dx%d PPM image with %d levels\n",
 				name, *width, *height, (*maxval + 1));
@@ -198,11 +197,11 @@ static int isPBM(ZFILE * zf, char *name,
 	}
 
 	if (memToVal(buf, 2) == memToVal((byte *) "P6", 2)) {
-		if (((*width = pbmReadInt(zf)) < 0) ||
-				((*height = pbmReadInt(zf)) < 0))
+		if (((*width = pbmReadInt(zf)) < 0)
+				|| ((*height = pbmReadInt(zf)) < 0)
+				|| ((*maxval = pbmReadInt(zf)) < 0))
 			return (NOTPBM);
 
-		*maxval = pbmReadInt(zf);
 		if (verbose) {
 			printf("%s is a %dx%d Raw PPM image with %d levels\n",
 				name, *width, *height, (*maxval + 1));
@@ -215,7 +214,7 @@ static int isPBM(ZFILE * zf, char *name,
 int pbmIdent(char *fullname, char *name)
 {
 	ZFILE *zf;
-	unsigned int width, height, maxval, ret;
+	int width, height, maxval, ret;
 
 	if (!(zf = zopen(fullname)))
 		return (0);
@@ -234,7 +233,8 @@ Image *pbmLoad(char *fullname, ImageOpti
 	Image *image = 0;
 	int pbm_type;
 	unsigned int x, y;
-	unsigned int width, height, maxval, fmaxval, depth, fdepth;
+	int width, height, maxval, fmaxval;
+	unsigned int depth, fdepth;
 	unsigned int linelen;
 	byte srcmask, destmask;
 	byte *destptr = 0, *destline;