2 files changed, 38 insertions, 5 deletions

diff --git a/src/lib/core/conda.c b/src/lib/core/conda.c
index 3ef4d62..a12bdee 100644
--- a/src/lib/core/conda.c
+++ b/src/lib/core/conda.c
@@ -49,10 +49,31 @@ int micromamba(const struct MicromambaInfo *info, char *command, ...) {
     }
 
     char cmd[STASIS_BUFSIZ] = {0};
-    snprintf(cmd, sizeof(cmd), "%s -r %s -p %s ", mmbin, info->conda_prefix, info->conda_prefix);
     va_list args;
+    int cmd_len = snprintf(cmd, sizeof(cmd), "%s -r %s -p %s ", mmbin, info->conda_prefix, info->conda_prefix);
+    if (cmd_len < 0) {
+        SYSERROR("%s", "Unable to build argument list for micromamba");
+        va_end(args);
+        return -1;
+    }
+    if ((size_t) cmd_len > sizeof(cmd)) {
+        SYSERROR("%s", "micromamba command truncated");
+        va_end(args);
+        return -1;
+    }
+
     va_start(args, command);
-    vsprintf(cmd + strlen(cmd), command, args);
+    cmd_len = vsnprintf(cmd + strlen(cmd), sizeof(cmd) - cmd_len, command, args);
+    if (cmd_len < 0) {
+        SYSERROR("%s", "Unable to append arguments to micromamba command");
+        va_end(args);
+        return -1;
+    }
+    if ((size_t) cmd_len > sizeof(cmd)) {
+        SYSERROR("%s", "micromamba command truncated while appending arguments");
+        va_end(args);
+        return -1;
+    }
     va_end(args);
 
     mkdirs(info->conda_prefix, 0755);
diff --git a/src/lib/core/utils.c b/src/lib/core/utils.c
index 6795931..16f9dbe 100644
--- a/src/lib/core/utils.c
+++ b/src/lib/core/utils.c
@@ -462,9 +462,21 @@ void msg(unsigned type, char *fmt, ...) {
         snprintf(header, sizeof(header), STASIS_COLOR_BLUE "  ->%s" STASIS_COLOR_RESET, status);
     }
 
-    fprintf(stream, "%s", header);
-    vfprintf(stream, fmt, args);
-    fprintf(stream, "%s", STASIS_COLOR_RESET);
+    if (fprintf(stream, "%s", header) < 0) {
+        SYSERROR("%s", "unable to write message header to stream");
+        return;
+    }
+
+    const int len = vfprintf(stream, fmt, args);
+    if (len < 0) {
+        SYSERROR("%s", "unable to write message to stream");
+        return;
+    }
+
+    if (fprintf(stream, "%s", STASIS_COLOR_RESET) < 0) {
+        SYSERROR("%s", "unable to write message footer to stream");
+        return;
+    }
     va_end(args);
 }