diff -p -up poldek-0.20/cli/ls.c.format~ poldek-0.20/cli/ls.c
--- poldek-0.20/cli/ls.c.format~	2009-03-05 03:24:11.529917059 +0100
+++ poldek-0.20/cli/ls.c	2009-03-05 03:24:46.986467419 +0100
@@ -85,7 +85,7 @@ error_t parse_opt(int key, char *arg, st
     switch (key) {
         case 'l':
             if (cmdctx->_flags & OPT_LS_GROUP) {
-                logn(LOGERR, errmsg_excl);
+                logn(LOGERR, "%s", errmsg_excl);
                 return EINVAL;
             }
             
@@ -98,7 +98,7 @@ error_t parse_opt(int key, char *arg, st
 
         case 'G':
             if (cmdctx->_flags & OPT_LS_LONG) {
-                logn(LOGERR, errmsg_excl);
+                logn(LOGERR, "%s", errmsg_excl);
                 return EINVAL;
             }
 
diff -p -up poldek-0.20/misc.c.format~ poldek-0.20/misc.c
--- poldek-0.20/misc.c.format~	2009-03-05 03:13:02.618166975 +0100
+++ poldek-0.20/misc.c	2009-03-05 03:13:24.943918498 +0100
@@ -571,7 +571,7 @@ static char *get_env(char *dest, int siz
     }
     
     if (strcmp(name, "HOME") == 0 && (pw = getpwuid(getuid()))) {
-        snprintf(dest, size, pw->pw_dir);
+        snprintf("%s", dest, size, pw->pw_dir);
         val = dest;
     }
 
diff -p -up poldek-0.20/vfile/vfetch.c.format~ poldek-0.20/vfile/vfetch.c
--- poldek-0.20/vfile/vfetch.c.format~	2005-09-11 15:07:07.000000000 +0200
+++ poldek-0.20/vfile/vfetch.c	2009-03-05 02:34:22.532166341 +0100
@@ -296,7 +296,7 @@ int vfile__vf_fetch(const char *url, con
         } else {            /* redirected */
             char url[PATH_MAX];
                 
-            snprintf(url, sizeof(url), req->url);
+            snprintf(url, sizeof(url), "%s", req->url);
             vf_request_free(req);
             req = NULL;
             rc = vf_fetch(req->url, destdir, flags, NULL);
diff -p -up poldek-0.20/vfile/vfff/http.c.format~ poldek-0.20/vfile/vfff/http.c
--- poldek-0.20/vfile/vfff/http.c.format~	2005-05-15 17:47:04.000000000 +0200
+++ poldek-0.20/vfile/vfff/http.c	2009-03-05 02:34:22.532166341 +0100
@@ -848,7 +848,7 @@ int is_redirected_connection(struct http
     if (HTTP_STATUS_IS_REDIR(resp->code)) {
         const char *redirto = http_resp_get_hdr(resp, "location");
         if (redirto && *redirto != '\0') 
-            snprintf(rreq->redirected_to, sizeof(rreq->redirected_to), redirto);
+            snprintf(rreq->redirected_to, sizeof(rreq->redirected_to), "%s", redirto);
         else 
             vfff_set_err(ENOENT, "wrong or empty redirect location");
         
diff -p -up poldek-0.20/vfile/vfile.c.format~ poldek-0.20/vfile/vfile.c
--- poldek-0.20/vfile/vfile.c.format~	2005-10-07 21:00:19.000000000 +0200
+++ poldek-0.20/vfile/vfile.c	2009-03-05 02:34:22.532166341 +0100
@@ -546,7 +546,7 @@ void vfile_close(struct vfile *vf) 
         n_assert(vf_url_type(vf->vf_path) & VFURL_LOCAL);
         if (vf_decompressable(vf->vf_path, NULL, 0)) {
             char src[PATH_MAX], *p;
-            snprintf(src, sizeof(src), vf->vf_path);
+            snprintf(src, sizeof(src), "%s", vf->vf_path);
             p = strrchr(src, '.');
             n_assert(p);
             *p = '\0';