if (firstfname == NULL)
firstfname = defname;
- strcpy(fnbuf, firstfname);
+ // It's the size of fnbuf minus 5 because of the possible 4 char suffix
+ // + trailing null (added by fext()).
+ strncpy(fnbuf, firstfname, sizeof(fnbuf) - 5);
fext(fnbuf, (prg_flag ? ".prg" : ".o"), 1);
objfname = fnbuf;
}