diff --git a/src/curses/ui_call_flow.c b/src/curses/ui_call_flow.c
index 3981097..04d3fa5 100644
--- a/src/curses/ui_call_flow.c
+++ b/src/curses/ui_call_flow.c
@@ -309,11 +309,13 @@ call_flow_draw_columns(ui_t *ui)
         }
 
         if (setting_enabled(SETTING_CF_SPLITCALLID) || !column->addr.port) {
-            sprintf(coltext, "%s", column->alias);
+            snprintf(coltext, MAX_SETTING_LEN, "%s", column->alias);
         } else if (setting_enabled(SETTING_DISPLAY_ALIAS)) {
-            sprintf(coltext, "%s:%u", column->alias, column->addr.port);
+            snprintf(coltext, MAX_SETTING_LEN, "%.*s:%u",
+                MAX_SETTING_LEN - 7, column->alias, column->addr.port);
         } else {
-            sprintf(coltext, "%s:%u", column->addr.ip, column->addr.port);
+            snprintf(coltext, MAX_SETTING_LEN, "%.*s:%u",
+                MAX_SETTING_LEN - 7, column->addr.ip, column->addr.port);
         }
 
         mvwprintw(ui->win, 2, 10 + 30 * column->colpos + (22 - strlen(coltext)) / 2, "%s", coltext);