Hello.
Source code says:
char output_name[200]; /* FIXME: dangerous limit */
[...]
input_name = argv[optind];
[...]
strcpy (output_name, input_name);
This can't be good. Gentoo patchset doesn't cover this.
Please fix.
[1] https://bugs.gentoo.org/594444