Index: libcaca-0.99.beta20/caca/codec/export.c
===================================================================
--- libcaca-0.99.beta20.orig/caca/codec/export.c
+++ libcaca-0.99.beta20/caca/codec/export.c
@@ -969,22 +969,22 @@ static void *export_tga(caca_canvas_t co
     cur = data = malloc(*bytes);
 
     /* ID Length */
-    cur += write_u8(cur, 0);
+    *cur++ = 0;
     /* Color Map Type: no colormap */
-    cur += write_u8(cur, 0);
+    *cur++ = 0;
     /* Image Type: uncompressed truecolor */
-    cur += write_u8(cur, 2);
+    *cur++ = 2;
     /* Color Map Specification: no color map */
     memset(cur, 0, 5); cur += 5;
 
     /* Image Specification */
-    cur += sprintf(cur, "%c%c", 0, 0); /* X Origin */
-    cur += sprintf(cur, "%c%c", 0, 0); /* Y Origin */
-    cur += sprintf(cur, "%c%c", w & 0xff, w >> 8); /* Width */
-    cur += sprintf(cur, "%c%c", h & 0xff, h >> 8); /* Height */
-    cur += write_u8(cur, 32); /* Pixel Depth */
-    cur += write_u8(cur, 40); /* Image Descriptor */
-
+    *cur++ = 0; *cur++ = 0; /* X Origin */
+    *cur++ = 0; *cur++ = 0; /* Y Origin */
+    *cur++ = w & 0xff; *cur++ = w >> 8; /* Width */
+    *cur++ = h & 0xff; *cur++ = h >> 8; /* Height */
+    *cur++ = 32; /* Pixel Depth */
+    *cur++ = 40; /* Image Descriptor */
+    
     /* Image ID: no ID */
     /* Color Map Data: no colormap */
 
@@ -1020,9 +1020,13 @@ static void *export_troff(caca_canvas_t
      *  + 4 bytes = 33
      * Each line has a \n (1) and maybe 0xc2 0xa0 (2)
      * Header has .nf\n (3)
+     * Kludge alert:
+     * The sprintf functions all append a NUL byte, so
+     * add one byte for any terminating NUL byte,
+     * but don't tell the caller.
      */
     *bytes = 3 + cv->height * 3 + (cv->width * cv->height * 33);
-    cur = data = malloc(*bytes);
+    cur = data = malloc(*bytes + 1); /* Add space for a terminating NUL byte */
 
     cur += write_string(cur, ".nf\n");