--- lbbs/src/menu.c	2025/05/05 02:54:27	1.26
+++ lbbs/src/menu.c	2025/05/05 11:46:04	1.28
@@ -50,7 +50,8 @@ int load_menu(MENU_SET *p_menu_set, cons
 		return -1;
 	}
 
-	strcpy(p_menu_set->conf_file, conf_file);
+	strncpy(p_menu_set->conf_file, conf_file, sizeof(p_menu_set->conf_file) - 1);
+	p_menu_set->conf_file[sizeof(p_menu_set->conf_file) - 1] = '\0';
 
 	while (fgets(buffer, sizeof(buffer), fin))
 	{
@@ -64,7 +65,7 @@ int load_menu(MENU_SET *p_menu_set, cons
 				strncpy(temp, buffer + pmatch[1].rm_so,
 						pmatch[1].rm_eo - pmatch[1].rm_so);
 				temp[pmatch[1].rm_eo - pmatch[1].rm_so] = '\0';
-				sprintf(screen_filename, "%s/MENU_SCR_%s", MENU_TEMP_DIR, temp);
+				snprintf(screen_filename, sizeof(screen_filename), "%s/MENU_SCR_%s", MENU_TEMP_DIR, temp);
 
 				if ((fout = fopen(screen_filename, "w")) == NULL)
 				{
@@ -249,8 +250,9 @@ int load_menu(MENU_SET *p_menu_set, cons
 								buffer + pmatch[3].rm_so,
 								pmatch[3].rm_eo - pmatch[3].rm_so);
 						temp[pmatch[3].rm_eo - pmatch[3].rm_so] = '\0';
-						sprintf(p_menu_set->p_menu[i]->screen.filename,
-								"%s/MENU_SCR_%s", MENU_TEMP_DIR, temp);
+						snprintf(p_menu_set->p_menu[i]->screen.filename,
+								 sizeof(p_menu_set->p_menu[i]->screen.filename),
+								 "%s/MENU_SCR_%s", MENU_TEMP_DIR, temp);
 						continue;
 					}
 				}
@@ -514,7 +516,9 @@ int reload_menu(MENU_SET *p_menu_set)
 	int result;
 	char conf_file[FILE_PATH_LEN];
 
-	strncpy(conf_file, p_menu_set->conf_file, sizeof(conf_file));
+	strncpy(conf_file, p_menu_set->conf_file, sizeof(conf_file) - 1);
+	conf_file[sizeof(conf_file) - 1] = '\0';
+
 	unload_menu(p_menu_set);
 	result = load_menu(p_menu_set, conf_file);