{
        int found;
        const char *arguments[] = { pgm, "", "", "", path, "", "", "", NULL };
-       char hexbuf[4][60];
+       char hexbuf[4][GIT_SHA1_HEXSZ + 1];
        char ownbuf[4][60];
 
        if (pos >= active_nr)
                if (strcmp(ce->name, path))
                        break;
                found++;
-               strcpy(hexbuf[stage], sha1_to_hex(ce->sha1));
-               sprintf(ownbuf[stage], "%o", ce->ce_mode);
+               sha1_to_hex_r(hexbuf[stage], ce->sha1);
+               xsnprintf(ownbuf[stage], sizeof(ownbuf[stage]), "%o", ce->ce_mode);
                arguments[stage] = hexbuf[stage];
                arguments[stage + 4] = ownbuf[stage];
        } while (++pos < active_nr);