rem: sprintf(tmpbuf, "0x%x",
add: snprintf(tmpbuf, sizeof(tmpbuf), "0x%x",
context: ExpandOptions(WScreen *scr, char *cmdline){    int ptr, optr, state, len, olen;    char *out, *nout;    char *selection=NULL;    char *user_input=NULL;#if defined(OFFIX_DND) || defined(XDND)    char *dropped_thing=NULL;#endif    char tmpbuf[TMPBUFSIZE];    int slen;    len = strlen(cmdline);    olen = len+1;    out = malloc(olen);    if (!out) {	wwarning(_("out of memory during expansion of \"%s\""));	return NULL;    }    *out = 0;    ptr = 0; 			       /* input line pointer */    optr = 0;			       /* output line pointer */    state = S_NORMAL;    while (ptr < len) {	switch (state) {	 case S_NORMAL:	    switch (cmdline[ptr]) {	     case '\\':		state = S_ESCAPE;		break;	     case '%':		state = S_OPTION;		break;	     default:		state = S_NORMAL;		out[optr++]=cmdline[ptr];		break;	    }	    break;	 case S_ESCAPE:	    switch (cmdline[ptr]) {	     case 'n':		out[optr++]=10;		break;			     case 'r':		out[optr++]=13;		break;			     case 't':		out[optr++]=9;		break;			     default:		out[optr++]=cmdline[ptr];	    }	    state = S_NORMAL;	    break;	 case S_OPTION:	    state = S_NORMAL;	    switch (cmdline[ptr]) {	     case 'w':		if (scr->focused_window		    && scr->focused_window->flags.focused) {		    sprintf(tmpbuf, "0x%x", 			    (unsigned int)scr->focused_window->client_win);		    slen = strlen(tmpbuf);		    olen += slen;		    nout = realloc(out,olen);		    if (!nout) {			wwarning(_("out of memory during expansion of \"%w\""));			goto error;		    }		    out = nout;		    strcat(out,tmpbuf);		    optr+=slen;		} else {		    out[optr++]=' ';		}		break;			     case 'W':		sprintf(tmpbuf, "0x%x", 			(unsigned int)scr->current_workspace + 1);		slen = strlen(tmpbuf);		olen += slen;		nout = realloc(out,olen);		if (!nout) {		    wwarning(_("out of memory during expansion of \"%W\""));		    goto error;		}		out = nout;		strcat(out,tmpbuf);		optr+=slen;		break;			     case 'a':		ptr++;		user_input = getuserinput(scr, cmdline, &ptr); 		if (user_input) {		    slen = strlen(user_input);		    olen += slen;		    nout = realloc(out,olen);		    if (!nout) {			wwarning(_("out of memory during expansion of \"%a\""));			goto error;		    }		    out = nout;		    strcat(out,user_input);		    optr+=slen;		} else {		    /* Not an error, but user has Canceled the dialog box.		     * This will make the command to not be performed. */		    goto error;		}		break;#if defined(OFFIX_DND) || defined(XDND)	     case 'd':#ifdef XDND		if(scr->xdestring) {		    dropped_thing = wstrdup(scr->xdestring);		}#endif		if (!dropped_thing) {		    dropped_thing = get_dnd_selection(scr);		}		if (!dropped_thing) {		    scr->flags.dnd_data_convertion_status = 1;		    goto error;		}		slen = strlen(dropped_thing);		olen += slen;		nout = realloc(out,olen);		if (!nout) {		    wwarning(_("out of memory during expansion of \"%d\""));		    goto error;		}		out = nout;		strcat(out,dropped_thing);		optr+=slen;		break;#endif /* OFFIX_DND */			     case 's':		if (!selection) {		    selection = getselection(scr);		}		if (!selection) {		    wwarning(_("selection not available"));		    goto error;		}		slen = strlen(selection);		olen += slen;		nout = realloc(out,olen);		if (!nout) {		    wwarning(_("out of memory during expansion of \"%s\""));		    goto error;		}		out = nout;		strcat(out,selection);		optr+=slen;		break;	     default:		out[optr++]='%';		out[optr++]=cmdline[ptr];	    }	    break;	}	out[optr]=0;	ptr++;    }    if (selection)      XFree(selection);    return out;        error:    wfree(out);    if (selection)      XFree(selection);    return NULL;}