diff --git a/src/bin/jp2/opj_compress.c b/src/bin/jp2/opj_compress.c
index 3131a4334..1a8cb53db 100644
--- a/src/bin/jp2/opj_compress.c
+++ b/src/bin/jp2/opj_compress.c
@@ -654,9 +654,13 @@ static int parse_cmdline_encoder(int argc, char **argv,
         case 'O': {         /* output format */
             char outformat[50];
             char *of = opj_optarg;
-            sprintf(outformat, ".%s", of);
-            img_fol->set_out_format = 1;
-            parameters->cod_format = get_file_format(outformat);
+            if (strlen(opj_optarg) < sizeof(outformat)) {
+                sprintf(outformat, ".%s", of);
+                img_fol->set_out_format = 1;
+                parameters->cod_format = get_file_format(outformat);
+            } else {
+                parameters->cod_format = -1;
+            }
             switch (parameters->cod_format) {
             case J2K_CFMT:
             case JP2_CFMT:
diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c
index 088f3a29b..81f85cce3 100644
--- a/src/bin/jp2/opj_decompress.c
+++ b/src/bin/jp2/opj_decompress.c
@@ -662,9 +662,13 @@ int parse_cmdline_decoder(int argc, char **argv,
         case 'O': {         /* output format */
             char outformat[50];
             char *of = opj_optarg;
-            sprintf(outformat, ".%s", of);
-            img_fol->set_out_format = 1;
-            parameters->cod_format = get_file_format(outformat);
+            if (strlen(opj_optarg) < sizeof(outformat)) {
+                sprintf(outformat, ".%s", of);
+                img_fol->set_out_format = 1;
+                parameters->cod_format = get_file_format(outformat);
+            } else {
+                parameters->cod_format = -1;
+            }
             switch (parameters->cod_format) {
             case PGX_DFMT:
                 img_fol->out_format = "pgx";
diff --git a/src/bin/jpwl/opj_jpwl_compress.c b/src/bin/jpwl/opj_jpwl_compress.c
index 28f0670c0..182ca42bf 100644
--- a/src/bin/jpwl/opj_jpwl_compress.c
+++ b/src/bin/jpwl/opj_jpwl_compress.c
@@ -768,9 +768,13 @@ static int parse_cmdline_encoder(int argc, char **argv,
         case 'O': {         /* output format */
             char outformat[50];
             char *of = opj_optarg;
-            sprintf(outformat, ".%s", of);
-            img_fol->set_out_format = 1;
-            parameters->cod_format = get_file_format(outformat);
+            if (strlen(opj_optarg) < sizeof(outformat)) {
+                sprintf(outformat, ".%s", of);
+                img_fol->set_out_format = 1;
+                parameters->cod_format = get_file_format(outformat);
+            } else {
+                parameters->cod_format = -1;
+            }
             switch (parameters->cod_format) {
             case J2K_CFMT:
             case JP2_CFMT:
diff --git a/src/bin/jpwl/opj_jpwl_decompress.c b/src/bin/jpwl/opj_jpwl_decompress.c
index ffe84e54e..313566d02 100644
--- a/src/bin/jpwl/opj_jpwl_decompress.c
+++ b/src/bin/jpwl/opj_jpwl_decompress.c
@@ -345,9 +345,13 @@ int parse_cmdline_decoder(int argc, char **argv, opj_dparameters_t *parameters,
         case 'O': {         /* output format */
             char outformat[50];
             char *of = opj_optarg;
-            sprintf(outformat, ".%s", of);
-            img_fol->set_out_format = 1;
-            parameters->cod_format = get_file_format(outformat);
+            if (strlen(opj_optarg) < sizeof(outformat)) {
+                sprintf(outformat, ".%s", of);
+                img_fol->set_out_format = 1;
+                parameters->cod_format = get_file_format(outformat);
+            } else {
+                parameters->cod_format = -1;
+            }
             switch (parameters->cod_format) {
             case PGX_DFMT:
                 img_fol->out_format = "pgx";