--- csv_util.c.orig	2008-10-14 17:52:52.000000000 +0200
+++ csv_util.c	2009-01-08 22:35:35.000000000 +0100
@@ -652,7 +652,7 @@
 		    index++;
 		    break;
 		case '%':
-		    sprintf( buff+strlen(buff), subformat );
+		    sprintf( buff+strlen(buff), "%s", subformat );
 		    break;
 		default:
 		    fatal(MYNAME ": invalid format specifier\n");
@@ -661,7 +661,7 @@
 	    }
 	}
 	else {
-	    sprintf( buff+strlen(buff), subformat );
+	    sprintf( buff+strlen(buff), "%s", subformat );
 	}
 	formatptr += strlen(subformat);
     } 
--- shape.c.orig	2006-08-13 02:16:20.000000000 +0200
+++ shape.c	2009-01-08 22:41:51.000000000 +0100
@@ -75,7 +75,7 @@
 				txt = xstrappend( txt, txtName  );
 			}
 			txt = xstrappend( txt,  "\n" );
-			fatal( txt );
+			fatal( "%s", txt );
 		}
 		if ( strchr(opt_name, '+')) {
 			nameidx = -2;
--- pathaway.c.orig	2007-07-24 10:51:26.000000000 +0200
+++ pathaway.c	2009-01-08 22:45:32.000000000 +0100
@@ -600,7 +600,7 @@
 	if (fabs(wpt->altitude) < 9999.0)	
 	{
 	    tmp = str_pool_get(32);
-	    snprintf(tmp, 32, ppdb_fmt_float(METERS_TO_FEET(wpt->altitude)));
+	    snprintf(tmp, 32, "%s", ppdb_fmt_float(METERS_TO_FEET(wpt->altitude)));
 	    buff = ppdb_strcat(buff, tmp, NULL, &len);
 	}
 	buff = ppdb_strcat(buff, ",", NULL, &len);
--- gopal.c.orig	2008-09-19 00:08:51.000000000 +0200
+++ gopal.c	2009-01-08 22:48:13.000000000 +0100
@@ -92,7 +92,7 @@
 	if (i != 8)
 	{
 		snprintf(tmp,sizeof(tmp),"\"%s\"\n",line);
-		fprintf(stderr,tmp);
+		fprintf(stderr,"%s",tmp);
 	}
 	return i;
 }