diff -ur lcms-1.15.orig/include/lcms.h lcms-1.15/include/lcms.h
--- lcms-1.15.orig/include/lcms.h	2005-11-26 15:23:47.000000000 +0100
+++ lcms-1.15/include/lcms.h	2006-03-20 16:42:07.000000000 +0100
@@ -930,7 +930,7 @@
 
 LCMSAPI BOOL          LCMSEXPORT cmsTakeCharTargetData(cmsHPROFILE hProfile, char** Data, size_t* len);
                                                   
-LCMSAPI int           LCMSEXPORT cmsReadICCText(cmsHPROFILE hProfile, icTagSignature sig, char *Text);
+LCMSAPI int           LCMSEXPORT cmsReadICCTextBounded(cmsHPROFILE hProfile, icTagSignature sig, char *Text,size_t);
 
 typedef struct {
 
@@ -1112,7 +1112,7 @@
 
 // Named color support
 typedef struct {                
-                char Name[MAX_PATH];
+                char Name[MAX_PATH]; // Looks like waste. -- uwe
                 WORD PCS[3];
                 WORD DeviceColorant[MAXCHANNELS];
                 
@@ -1372,6 +1372,7 @@
 // Signal error from inside lcms code
 
 void cdecl cmsSignalError(int ErrorCode, const char *ErrorText, ...);
+void cdecl cmsoom(void);
 
 // Alignment handling (needed in ReadLUT16 and ReadLUT8)
 
@@ -1686,7 +1687,7 @@
 void cdecl cmsLab2XYZEncoded(WORD Lab[3], WORD XYZ[3]);
 
 // Retrieve text representation of WP
-void cdecl _cmsIdentifyWhitePoint(char *Buffer, LPcmsCIEXYZ WhitePt);
+void cdecl _cmsIdentifyWhitePointBounded(char *Buffer, size_t n, LPcmsCIEXYZ WhitePt);
 
 // Quantize to WORD in a (MaxSamples - 1) domain
 WORD cdecl _cmsQuantizeVal(double i, int MaxSamples);
diff -ur lcms-1.15.orig/jpegicc/jpegicc.c lcms-1.15/jpegicc/jpegicc.c
--- lcms-1.15.orig/jpegicc/jpegicc.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/jpegicc/jpegicc.c	2006-03-20 08:58:20.000000000 +0100
@@ -91,6 +91,7 @@
 
 } ErrorHandler;
 
+/*
 static
 void ConsoleWarningHandler(const char* module, const char* fmt, va_list ap)
 {
@@ -120,6 +121,7 @@
        fprintf(stderr, "\nError");
        fprintf(stderr, " %s\n", e);
 }
+*/
 
 // Force an error and exit w/ return code 1
 
@@ -128,8 +130,9 @@
 {
        va_list args;
 
+       fprintf(stderr,"\nError %s: ",PROGNAME);
        va_start(args, frm);
-       ConsoleErrorHandler(PROGNAME, frm, args);
+       vfprintf(stderr,frm,args);
        va_end(args);
        exit(1);
 }
diff -ur lcms-1.15.orig/matlab/icctrans.c lcms-1.15/matlab/icctrans.c
--- lcms-1.15.orig/matlab/icctrans.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/matlab/icctrans.c	2006-03-20 15:35:59.000000000 +0100
@@ -72,12 +72,16 @@
 BOOL FatalError(const char *frm, ...)
 {
     va_list args;
-    char Buffer[1024];
+    char *Buffer;
     
     va_start(args, frm);
-    vsprintf(Buffer, frm, args);
+    if (-1==vasprintf(&Buffer, frm, args)) {
+      write(2,"out of memory\n",14);
+      _exit(1);
+    }
     mexErrMsgTxt(Buffer);   
     va_end(args);
+    free(Buffer);
     
     return FALSE;               
 }
diff -ur lcms-1.15.orig/samples/icctrans.c lcms-1.15/samples/icctrans.c
--- lcms-1.15.orig/samples/icctrans.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/samples/icctrans.c	2006-03-20 09:03:57.000000000 +0100
@@ -350,25 +350,22 @@
 static
 void PrintRange(const char* C, double v, double Range)
 {
-    char Prefix[20];
-
-    Prefix[0] = 0;
     if (!lTerse)
-        sprintf(Prefix, "%s=", C);
+        printf("%s=", C);
 
     if (InHexa)
     {
         if (Width16)
-            printf("%s0x%x ", Prefix, (int) floor(v + .5));
+            printf("0x%x ", (int) floor(v + .5));
         else
-            printf("%s0x%x ", Prefix, (int) floor(v / 257. + .5));
+            printf("0x%x ", (int) floor(v / 257. + .5));
 
     }
     else
     {       
 
         double out = (v * Range) / 65535.0;        
-        printf("%s%.2f ", Prefix, out);
+        printf("%.2f ", out);
     }
 }
 
@@ -707,7 +704,7 @@
 
         for (i=0; i < _cmsChannelsOf(InputColorSpace); i++) {
 
-            char Name[100];
+            char Name[20];
 
             sprintf(Name, "Channel #%d", i+1);
             Encoded[i] = GetVal(Name);
diff -ur lcms-1.15.orig/samples/wtpt.c lcms-1.15/samples/wtpt.c
--- lcms-1.15.orig/samples/wtpt.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/samples/wtpt.c	2006-03-20 08:50:47.000000000 +0100
@@ -44,7 +44,7 @@
        char Buffer[1024];
 
 		
-	   _cmsIdentifyWhitePoint(Buffer, WtPt);
+	   _cmsIdentifyWhitePointBounded(Buffer, sizeof(Buffer), WtPt);
        printf("%s\n", Buffer);
        
        cmsXYZ2Lab(NULL, &Lab, WtPt);
diff -ur lcms-1.15.orig/src/cmscgats.c lcms-1.15/src/cmscgats.c
--- lcms-1.15.orig/src/cmscgats.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/src/cmscgats.c	2006-03-09 12:03:14.000000000 +0100
@@ -395,16 +395,19 @@
 static
 BOOL SynError(LPIT8 it8, const char *Txt, ...)
 {
-        char Buffer[256], ErrMsg[1024];
+        char *Buffer, *ErrMsg;
         va_list args;
 
         va_start(args, Txt);
-        vsprintf(Buffer, Txt, args);
+        if (-1==vasprintf(&Buffer, Txt, args)) cmsoom();
         va_end(args);
 
-        sprintf(ErrMsg, "%s: Line %d, %s", it8->FileName, it8->lineno, Buffer);
+        if (-1==asprintf(&ErrMsg, "%s: Line %d, %s", it8->FileName, 
+		it8->lineno, Buffer)) cmsoom();
         it8->sy = SSYNERROR;
         cmsSignalError(LCMS_ERRC_ABORTED, ErrMsg);
+	free(Buffer);
+	free(ErrMsg);
         return FALSE;
 }
 
@@ -1167,7 +1170,7 @@
 BOOL LCMSEXPORT cmsIT8SetPropertyDbl(LCMSHANDLE hIT8, const char* cProp, double Val)
 {
     LPIT8 it8 = (LPIT8) hIT8;
-    char Buffer[1024];
+    char Buffer[256];
    
     sprintf(Buffer, it8->DoubleFormatter, Val);
 
@@ -1177,7 +1180,7 @@
 BOOL LCMSEXPORT cmsIT8SetPropertyHex(LCMSHANDLE hIT8, const char* cProp, int Val)
 {
     LPIT8 it8 = (LPIT8) hIT8;
-    char Buffer[1024];
+    char Buffer[256];
    
     sprintf(Buffer, "%d", Val);
 
@@ -1387,12 +1390,13 @@
 static
 void Writef(LPSAVESTREAM f, const char* frm, ...)
 {
-    char Buffer[4096];
+    char *Buffer;
     va_list args;
 
     va_start(args, frm);
-    vsprintf(Buffer, frm, args);
+    if (-1==vasprintf(&Buffer, frm, args)) cmsoom();
     WriteStr(f, Buffer);
+    free(Buffer);
     va_end(args);
 
 }
@@ -1884,14 +1888,15 @@
                                     if (IsAvailableOnList(Table->HeaderList, Label, &p)) {
 
                                         // Available, keep type and table
-                                        char Buffer[256];
+                                        char *Buffer;
 
                                         char *Type  = p ->Value;
                                         int  nTable = k;                                        
 
-                                        sprintf(Buffer, "%s %d %s", Label, nTable, Type );
+                                        if (-1==asprintf(&Buffer, "%s %d %s", Label, nTable, Type )) cmsoom();
                                                                                 
                                         SetData(it8, i, idField, Buffer);
+					free(Buffer);
                                     }
                                 }
 
@@ -2277,8 +2282,8 @@
     LPIT8 it8 = (LPIT8) hIT8;
     char Buff[256];
 
-        sprintf(Buff, it8->DoubleFormatter, Val);
-        return cmsIT8SetData(hIT8, cPatch, cSample, Buff);
+    sprintf(Buff, it8->DoubleFormatter, Val);
+    return cmsIT8SetData(hIT8, cPatch, cSample, Buff);
 
 }
 
diff -ur lcms-1.15.orig/src/cmserr.c lcms-1.15/src/cmserr.c
--- lcms-1.15.orig/src/cmserr.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/src/cmserr.c	2006-03-09 11:55:30.000000000 +0100
@@ -36,6 +36,15 @@
 static int nDoAbort = LCMS_ERROR_ABORT;
 static cmsErrorHandlerFunction UserErrorHandler = (cmsErrorHandlerFunction) NULL;
 
+void cmsoom(void)
+{
+	const char *msg="lcms: out of memory\n";
+	if (EOF==fputs(msg,stderr))
+		write(2,msg,strlen(msg)); // XXX Windows?
+	// the one thing a program without memory can do: exit.
+	exit(1);
+}
+
 
 int LCMSEXPORT cmsErrorAction(int nAction)
 {
@@ -54,57 +63,50 @@
 // Default error handler
 
 
-void cmsSignalError(int ErrorCode, const char *ErrorText, ...)
+void 
+cmsSignalError(int ErrorCode, const char *ErrorText,...)
 {
-       va_list args;
-
-       
-       if (nDoAbort == LCMS_ERROR_IGNORE) return;
+	char *Buffer;
+	va_list args;
 
-        va_start(args, ErrorText);
+	if (nDoAbort == LCMS_ERROR_IGNORE)
+		return;
 
-        if (UserErrorHandler != NULL) {
-
-            char Buffer[1024];
-            
-            vsprintf(Buffer, ErrorText, args);
-            va_end(args);   
-
-            if (UserErrorHandler(ErrorCode, Buffer)) {     
-                   
-                return;
-            }
-       }
+	va_start(args, ErrorText);
+	if (-1 == vasprintf(&Buffer, ErrorText, args)) cmsoom();
+	va_end(args);
+
+	if (UserErrorHandler != NULL) {
+		if (UserErrorHandler(ErrorCode, Buffer)) {
+			free(Buffer);
+			return;
+		}
+	}
 
 #if defined( __CONSOLE__ ) || defined( NON_WINDOWS )
 
-              fprintf(stderr, "lcms: Error #%d; ", ErrorCode);
-              vfprintf(stderr, ErrorText, args);
-              fprintf(stderr, "\n");
-              va_end(args);
+	fprintf(stderr, "lcms: Error #%d; ", ErrorCode);
+	fprintf(stderr, "%s\n", Buffer);
 
-              if (nDoAbort == LCMS_ERROR_ABORT) exit(1);
+	if (nDoAbort == LCMS_ERROR_ABORT)
+		exit(1);
 #else
-              {
-              char Buffer1[1024];
-              char Buffer2[256];
-
-              sprintf(Buffer1, "Error #%x; ", ErrorCode);
-              vsprintf(Buffer2, ErrorText, args);
-              strcat(Buffer1, Buffer2);
-              MessageBox(NULL, Buffer1, "Little cms",
-                                          MB_OK|MB_ICONSTOP|MB_TASKMODAL);
-              va_end(args);
-
-              if (nDoAbort == LCMS_ERROR_ABORT) {
+	{
+		char *Buffer2;
+		if (-1==vasprintf(&Buffer2,"Error #%d; %s",ErrorCode,Buffer))
+			cmsoom();
+		MessageBox(NULL, Buffer2, "Little cms",
+			   MB_OK | MB_ICONSTOP | MB_TASKMODAL);
+		va_end(args);
+		free(Buffer2);
 
+		if (nDoAbort == LCMS_ERROR_ABORT) {
 #ifdef __BORLANDC__
-                    _cexit();
+			_cexit();
 #endif
-
-                  FatalAppExit(0, "lcms is terminating application");
-              }
-
-              }
+			FatalAppExit(0, "lcms is terminating application");
+		}
+	}
 #endif
+        free(Buffer);
 }
diff -ur lcms-1.15.orig/src/cmsio1.c lcms-1.15/src/cmsio1.c
--- lcms-1.15.orig/src/cmsio1.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/src/cmsio1.c	2006-03-20 16:37:26.000000000 +0100
@@ -1475,7 +1475,8 @@
 // Take an ASCII item
 
 
-int LCMSEXPORT cmsReadICCText(cmsHPROFILE hProfile, icTagSignature sig, char *Name)
+int LCMSEXPORT cmsReadICCTextBounded(cmsHPROFILE hProfile, icTagSignature sig, 
+	char *Name, size_t limit)
 {
     LPLCMSICCPROFILE    Icc = (LPLCMSICCPROFILE) (LPSTR) hProfile;
     size_t              offset, size;
@@ -1484,11 +1485,13 @@
     n = _cmsSearchTag(Icc, sig, TRUE);
     if (n < 0)         
         return -1;
+
+    if (Icc -> TagSizes[n] > limit) 
+	return -1;
     
     if (!Icc -> stream) {
-
         CopyMemory(Name, Icc -> TagPtrs[n], Icc -> TagSizes[n]);
-        return (int) Icc -> TagSizes[n];
+        return Icc -> TagSizes[n];
     }
 
     offset = Icc -> TagOffsets[n];
@@ -1909,7 +1912,8 @@
 
        if (cmsIsTag(hProfile, icSigDeviceMfgDescTag)) {
 
-            cmsReadICCText(hProfile, icSigDeviceMfgDescTag, Manufacturer);
+            cmsReadICCTextBounded(hProfile, icSigDeviceMfgDescTag, 
+		Manufacturer, sizeof(Manufacturer));
        }
 
     return Manufacturer;
@@ -1926,7 +1930,8 @@
 
        if (cmsIsTag(hProfile, icSigDeviceModelDescTag)) {
 
-            cmsReadICCText(hProfile, icSigDeviceModelDescTag, Model);
+            cmsReadICCTextBounded(hProfile, icSigDeviceModelDescTag, 
+		Model, sizeof(Model));
        }
 
     return Model;
@@ -1942,7 +1947,8 @@
 
        if (cmsIsTag(hProfile, icSigCopyrightTag)) {
 
-            cmsReadICCText(hProfile, icSigCopyrightTag, Copyright);
+            cmsReadICCTextBounded(hProfile, icSigCopyrightTag, 
+		Copyright, sizeof(Copyright));
        }
 
     return Copyright;
@@ -1961,19 +1967,22 @@
     
     if (cmsIsTag(hProfile, icSigDeviceMfgDescTag)) {
         
-        cmsReadICCText(hProfile, icSigDeviceMfgDescTag, Manufacturer);
+        cmsReadICCTextBounded(hProfile, icSigDeviceMfgDescTag, 
+		Manufacturer, sizeof(Manufacturer));
     }
     
     if (cmsIsTag(hProfile, icSigDeviceModelDescTag)) {
         
-        cmsReadICCText(hProfile, icSigDeviceModelDescTag, Model);
+        cmsReadICCTextBounded(hProfile, icSigDeviceModelDescTag, 
+		Model, sizeof(Model));
     }
     
     if (!Manufacturer[0] && !Model[0]) {
         
         if (cmsIsTag(hProfile, icSigProfileDescriptionTag)) {
             
-            cmsReadICCText(hProfile, icSigProfileDescriptionTag, Name);
+            cmsReadICCTextBounded(hProfile, icSigProfileDescriptionTag, 
+		Name, sizeof(Name));
             return Name;
         }
         else return "{no name}";
@@ -1983,8 +1992,11 @@
     if (!Manufacturer[0] || 
             strncmp(Model, Manufacturer, 8) == 0 || strlen(Model) > 30)
         strcpy(Name, Model);
-    else
-        sprintf(Name, "%s - %s", Model, Manufacturer);
+    else {
+	int r;
+	r=snprintf(Name,sizeof(Name),"%s - %s",Model, Manufacturer);
+	if (r>=sizeof(Name)) return "{too long}";
+   }
     
     return Name;
     
@@ -1999,7 +2011,8 @@
 
        if (cmsIsTag(hProfile, icSigProfileDescriptionTag)) {
 
-              cmsReadICCText(hProfile, icSigProfileDescriptionTag, Name);
+              cmsReadICCTextBounded(hProfile, icSigProfileDescriptionTag, 
+			Name, sizeof(Name));
        }
        else return cmsTakeProductName(hProfile);
 
@@ -2009,22 +2022,35 @@
        return Name;
 }
 
+struct xstr { char *p; size_t l; size_t a; };
+static void xstrcats(struct xstr *x, const char *s) {
+  unsigned int l=strlen(s);
+  if (x->l+l+1 >x->a) {  // +1 for null.
+    x->a= (x->a > 1024) ? x->a+1024: x->a+256;
+    x->p=realloc(x->p,x->a);
+    if (!x->p) cmsoom();
+  }
+  memcpy(x->p+x->l,s,l);
+  x->l+=0;
+  x->p[x->l]=0;
+}
+
+
 
 const char*  LCMSEXPORT cmsTakeProductInfo(cmsHPROFILE hProfile)
 {       
        LPLCMSICCPROFILE  Icc = (LPLCMSICCPROFILE) (LPSTR) hProfile;
-
-       static char Info[4096];
-
-       Info[0] = '\0';
+       static struct xstr info;
+       info.l=0;
 
        if (cmsIsTag(hProfile, icSigProfileDescriptionTag))
        {
        char Desc[1024];
 
-       cmsReadICCText(hProfile, icSigProfileDescriptionTag, Desc);
-       strcat(Info, Desc);
-       strcat(Info, "\r\n\r\n");
+       cmsReadICCTextBounded(hProfile, icSigProfileDescriptionTag, 
+		Desc, sizeof(Desc));
+       xstrcats(&info, Desc);
+       xstrcats(&info, "\r\n\r\n");
        }
 
 
@@ -2032,9 +2058,10 @@
        {
        char Copyright[2048];
 
-       cmsReadICCText(hProfile, icSigCopyrightTag, Copyright);
-       strcat(Info, Copyright);
-       strcat(Info, "\r\n\r\n");
+       cmsReadICCTextBounded(hProfile, icSigCopyrightTag, 
+		Copyright, sizeof(Copyright));
+       xstrcats(&info, Copyright);
+       xstrcats(&info, "\r\n\r\n");
        }
 
 
@@ -2049,9 +2076,9 @@
        {
        char MonCal[1024];
 
-       cmsReadICCText(hProfile, K007, MonCal);
-       strcat(Info, MonCal);
-       strcat(Info, "\r\n\r\n");
+       cmsReadICCTextBounded(hProfile, K007, MonCal, sizeof(MonCal));
+       xstrcats(&info, MonCal);
+       xstrcats(&info, "\r\n\r\n");
        }
        else
        {
@@ -2059,16 +2086,16 @@
        char WhiteStr[1024];
 
        cmsTakeMediaWhitePoint(&WhitePt, hProfile);
-       _cmsIdentifyWhitePoint(WhiteStr, &WhitePt);
-       strcat(WhiteStr, "\r\n\r\n");
-       strcat(Info, WhiteStr);
+       _cmsIdentifyWhitePointBounded(WhiteStr, sizeof(WhiteStr), &WhitePt);
+       xstrcats(&info, "\r\n\r\n");
+       xstrcats(&info, WhiteStr);
        }
 
 
        if (Icc -> stream) {
-              strcat(Info, Icc -> PhysicalFile);
+              xstrcats(&info, Icc->PhysicalFile);
        }
-       return Info;
+       return info.p;
 }
 
 // Extract the target data as a big string. Does not signal if tag is not present.
@@ -2086,7 +2113,7 @@
 
 
     *len =  Icc -> TagSizes[n];
-    *Data = (char*) malloc(*len + 1);
+    *Data = (char*) malloc(*len + 1); // +1? why? -- uwe
 
     if (!*Data) {
 
@@ -2094,7 +2121,7 @@
         return FALSE;
     }
 
-    if (cmsReadICCText(hProfile, icSigCharTargetTag, *Data) < 0) 
+    if (cmsReadICCTextBounded(hProfile, icSigCharTargetTag, *Data,*len +1) < 0) 
         return FALSE;
 
     (*Data)[*len] = 0;  // Force a zero marker. Shouldn't be needed, but is 
diff -ur lcms-1.15.orig/src/cmsps2.c lcms-1.15/src/cmsps2.c
--- lcms-1.15.orig/src/cmsps2.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/src/cmsps2.c	2006-03-20 15:34:39.000000000 +0100
@@ -399,18 +399,19 @@
 {
         va_list args;
         LPBYTE pt;
-        BYTE Buffer[2048];
+	BYTE *b;
 
         va_start(args, frm);
 
-        vsprintf((char*) Buffer, frm, args);
+        if (-1==vasprintf((char **) &b, frm, args)) cmsoom();
 
-        for (pt = Buffer; *pt; pt++)  {
+        for (pt = b; *pt; pt++)  {
 
             WriteRawByte(m, *pt);               
         }
 
         va_end(args);       
+	free(b);
 }
 
 
@@ -1551,7 +1552,8 @@
     int i, nColors, nColorant;
     DWORD OutputFormat;
     char ColorName[32];
-    char Colorant[128];
+    char Colorant[128]; // enough until _cmsChannelsOf return >= 22 or
+                        // BuildColorantList uses more bytes per element.
 
     nColorant = _cmsChannelsOf(cmsGetColorSpace(hNamedColor));
     OutputFormat = CHANNELS_SH(nColorant) | BYTES_SH(2);
diff -ur lcms-1.15.orig/src/cmswtpnt.c lcms-1.15/src/cmswtpnt.c
--- lcms-1.15.orig/src/cmswtpnt.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/src/cmswtpnt.c	2006-03-20 08:47:33.000000000 +0100
@@ -420,7 +420,7 @@
        n = 0;
        for (i=40; i < 150; i ++)
        {
-              sprintf(pts[n].Name, "D%d", i);
+              snprintf(pts[n].Name,sizeof(pts[n].Name), "D%d", i);
               cmsWhitePointFromTemp((int) (i*100.0), &pts[n].Val);
               n++;
        }
@@ -429,7 +429,8 @@
 }
 
 
-void _cmsIdentifyWhitePoint(char *Buffer, LPcmsCIEXYZ WhitePt)
+void _cmsIdentifyWhitePointBounded(char *Buffer, size_t BSize,
+	LPcmsCIEXYZ WhitePt)
 {
        int i, n;
        cmsCIExyY Val;
@@ -459,15 +460,13 @@
 
               T = Robertson(&Val);
 
-              if (T > 0) 
-                sprintf(Buffer, "White point near %dK", (int) T);                                                     
-              else
-              {
-              sprintf(Buffer, "Unknown white point (X:%1.2g, Y:%1.2g, Z:%1.2g)",
-                                          WhitePt -> X, WhitePt -> Y, WhitePt -> Z);
-              
+              if (T > 0)  {
+                snprintf(Buffer, BSize, "White point near %dK", (int) T);
+	      } else {
+                snprintf(Buffer, BSize, 
+			"Unknown white point (X:%1.2g, Y:%1.2g, Z:%1.2g)",
+                       WhitePt -> X, WhitePt -> Y, WhitePt -> Z);
               }
-              
 }
 
 
diff -ur lcms-1.15.orig/testbed/testcms.c lcms-1.15/testbed/testcms.c
--- lcms-1.15.orig/testbed/testcms.c	2005-11-25 12:11:16.000000000 +0100
+++ lcms-1.15/testbed/testcms.c	2006-03-20 09:09:37.000000000 +0100
@@ -2010,7 +2010,7 @@
 
         cmsDoTransform(rgb2lab, nc2 ->List[i].DeviceColorant, nc2 ->List[i].PCS, 1);        
         
-        sprintf(nc2 ->List[i].Name, "Color #%d", i);
+        snprintf(nc2 ->List[i].Name, sizeof(nc2->List[i].Name),"Color #%d", i);
 
     }
 
diff -ur lcms-1.15.orig/tifficc/tiffdiff.c lcms-1.15/tifficc/tiffdiff.c
--- lcms-1.15.orig/tifficc/tiffdiff.c	2005-11-25 12:11:17.000000000 +0100
+++ lcms-1.15/tifficc/tiffdiff.c	2006-03-20 09:12:59.000000000 +0100
@@ -57,7 +57,7 @@
 
 static cmsHPROFILE hLab;
 
-
+/*
 static
 void ConsoleWarningHandler(const char* module, const char* fmt, va_list ap)
 {
@@ -89,6 +89,7 @@
        fprintf(stderr, " %s\n", e);
        fflush(stderr);
 }
+*/
 
 
 
@@ -100,7 +101,8 @@
        va_list args;
 
        va_start(args, frm);
-       ConsoleErrorHandler("TIFFDIFF", frm, args);
+       fprintf(stderr,"\nError TIFFDIFF: ");
+       fvprintf(stderr,frm,args);
        va_end(args);
 
        if (hLab)     cmsCloseProfile(hLab);
@@ -628,12 +630,12 @@
 {
     LCMSHANDLE hIT8 = cmsIT8Alloc();
     time_t ltime;
-    char Buffer[256];
+    char *Buffer;
 
     cmsIT8SetSheetType(hIT8, "TIFFDIFF");
     
-   
-    sprintf(Buffer, "Differences between %s and %s", TiffName1, TiffName2);
+    if (-1==asprintf(&Buffer, "Differences between %s and %s", 
+      TiffName3, TiffName2)) cmsoom();
   
     cmsIT8SetComment(hIT8, Buffer);
 
diff -ur lcms-1.15.orig/tifficc/tifficc.c lcms-1.15/tifficc/tifficc.c
--- lcms-1.15.orig/tifficc/tifficc.c	2005-11-25 12:11:17.000000000 +0100
+++ lcms-1.15/tifficc/tifficc.c	2006-03-20 09:14:50.000000000 +0100
@@ -80,7 +80,7 @@
 
 // Console error & warning
 
-
+/*
 static
 void ConsoleWarningHandler(const char* module, const char* fmt, va_list ap)
 {
@@ -112,6 +112,7 @@
        fprintf(stderr, " %s\n", e);
        fflush(stderr);
 }
+*/
 
 
 
@@ -123,7 +124,8 @@
        va_list args;
 
        va_start(args, frm);
-       ConsoleErrorHandler("TIFFICC", frm, args);
+       fprintf(stderr,"\nError TIFFICC: ");
+       fvprintf(stderr,frm,args);
        va_end(args);
        exit(1);
 }
@@ -134,9 +136,9 @@
 void Warning(const char *frm, ...)
 {
        va_list args;
-
        va_start(args, frm);
-       ConsoleWarningHandler("TIFFICC", frm, args);
+       fprintf(stderr,"\nWarning TIFFICC: ");
+       fvprintf(stderr,frm,args);
        va_end(args);
 }
 
