_snprintf unlike sprintf is not guaranteed to null terminate.

radixgeo/coordinateconversion.cc

@@ -4,7 +4,7 @@
 
 #include <algorithm>
 
-#ifdef _WIN32
+#ifdef _MSC_VER
 #if _MSC_VER < 1900
 #define snprintf _snprintf
 #endif
@@ -221,6 +221,7 @@ std::string CoordinateConversion::toString(const UTMCoordinate& utm)
   char buff[120];
   snprintf(buff, sizeof(buff), "%02d %c %f %f", utm.longitude_zone,
            utm.lattitude_zone, utm.easting, utm.northing);
+  buff[119] = '\0';  // null terminate
   return std::string(buff);
 }
 

radixio/arldatastream.cc

@@ -7,7 +7,7 @@
 
 #include <fstream>
 
-#ifdef _WIN32
+#ifdef _MSC_VER
 #if _MSC_VER < 1900
 #define snprintf _snprintf
 #endif

radixio/hysplitcdump.i.hh

@@ -5,7 +5,7 @@
 #include "radixio/eafstream.hh"
 #include "radixio/hysplitcdump.hh"
 
-#ifdef _WIN32
+#ifdef _MSC_VER
 #if _MSC_VER < 1900
 #define snprintf _snprintf
 #endif
@@ -157,7 +157,8 @@ bool HysplitCDumpStream<data_type>::write_to(const std::string &file) const
     // force string to be no more than 4 characters
     char cid[5];
     snprintf(cid, sizeof(cid), "%4s", id.c_str());
-    id = cid;
+    cid[4] = '\0';  // null terminate
+    id     = cid;
   }
   record_length = id.size() + sizeof(int) * 7;
   int year, month, day, hour, forecastHour, minutes, numLocations, packing = 1;
@@ -238,6 +239,7 @@ bool HysplitCDumpStream<data_type>::write_to(const std::string &file) const
     // force string to be no more than 4 characters
     char icid[5];
     snprintf(icid, sizeof(icid), "%4s", pol.c_str());
+    icid[4]         = '\0';  // null terminate
     std::string tmp = icid;
     fstr.writeString(tmp);
     local_pols.push_back(tmp);