Don't use formatted output in WCMD_setshow_sortenv.
Don't use unsafe vsprintf in WCMD_output.

programs/wcmd/builtins.c

diff --git a/programs/wcmd/builtins.c b/programs/wcmd/builtins.c
index 0d1a259..394a9bc 100644
--- a/programs/wcmd/builtins.c
+++ b/programs/wcmd/builtins.c
@@ -792,8 +792,10 @@
   qsort( str, count, sizeof (char*), WCMD_compare );
 
   /* print it */
-  for( i=0; i<count; i++ )
-    WCMD_output("%s\n", str[i] );
+  for( i=0; i<count; i++ ) {
+      WCMD_output_asis(str[i]);
+      WCMD_output_asis("\n");
+  }
 
   LocalFree( str );
 }

programs/wcmd/wcmdmain.c

diff --git a/programs/wcmd/wcmdmain.c b/programs/wcmd/wcmdmain.c
index e61423e..0a008a4 100644
--- a/programs/wcmd/wcmdmain.c
+++ b/programs/wcmd/wcmdmain.c
@@ -789,10 +789,15 @@
 
 va_list ap;
 char string[1024];
+int ret;
 
   va_start(ap,format);
-  vsprintf (string, format, ap);
+  ret = vsnprintf (string, sizeof( string), format, ap);
   va_end(ap);
+  if( ret >= sizeof( string)) {
+       WCMD_output_asis("ERR: output truncated in WCMD_output\n" );
+       string[sizeof( string) -1] = '\0';
+  }
   WCMD_output_asis(string);
 }