diff --git a/block/qapi.c b/block/qapi.c
index 477659a..c7932eb 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -326,9 +326,30 @@ BlockInfoList *qmp_query_block(Error **errp)
     return NULL;
 }
 
-void bdrv_image_info_dump(ImageInfo *info)
+GCC_FMT_ATTR(3, 4)
+static void snprintf_tail(char **p_buf, int *p_size, const char *fmt, ...)
+{
+    int l;
+    if (*p_size < 1) {
+        return;
+    }
+
+    va_list ap;
+    va_start(ap, fmt);
+    l = vsnprintf(*p_buf, *p_size, fmt, ap);
+    va_end(ap);
+    if (l > 0) {
+        *p_buf += l;
+        *p_size -= l;
+    }
+}
+
+/* Use buf instead of asprintf to reduce memory fragility. */
+char *bdrv_image_info_dump(char *buf, int buf_size, ImageInfo *info)
 {
     char size_buf[128], dsize_buf[128];
+    char *buf1 = buf;
+
     if (!info->has_actual_size) {
         snprintf(dsize_buf, sizeof(dsize_buf), "unavailable");
     } else {
@@ -336,43 +357,49 @@ void bdrv_image_info_dump(ImageInfo *info)
                                 info->actual_size);
     }
     get_human_readable_size(size_buf, sizeof(size_buf), info->virtual_size);
-    printf("image: %s\n"
-           "file format: %s\n"
-           "virtual size: %s (%" PRId64 " bytes)\n"
-           "disk size: %s\n",
-           info->filename, info->format, size_buf,
-           info->virtual_size,
-           dsize_buf);
+    snprintf_tail(&buf1, &buf_size,
+                  "image: %s\n"
+                  "file format: %s\n"
+                  "virtual size: %s (%" PRId64 " bytes)\n"
+                  "disk size: %s\n",
+                  info->filename, info->format, size_buf,
+                  info->virtual_size,
+                  dsize_buf);
 
     if (info->has_encrypted && info->encrypted) {
-        printf("encrypted: yes\n");
+        snprintf_tail(&buf1, &buf_size, "encrypted: yes\n");
     }
 
     if (info->has_cluster_size) {
-        printf("cluster_size: %" PRId64 "\n", info->cluster_size);
+        snprintf_tail(&buf1, &buf_size, "cluster_size: %" PRId64 "\n",
+                 info->cluster_size);
     }
 
     if (info->has_dirty_flag && info->dirty_flag) {
-        printf("cleanly shut down: no\n");
+        snprintf_tail(&buf1, &buf_size, "cleanly shut down: no\n");
     }
 
     if (info->has_backing_filename) {
-        printf("backing file: %s", info->backing_filename);
+        snprintf_tail(&buf1, &buf_size, "backing file: %s",
+                      info->backing_filename);
         if (info->has_full_backing_filename) {
-            printf(" (actual path: %s)", info->full_backing_filename);
+            snprintf_tail(&buf1, &buf_size, " (actual path: %s)",
+                          info->full_backing_filename);
         }
-        putchar('\n');
+        snprintf_tail(&buf1, &buf_size, "\n");
         if (info->has_backing_filename_format) {
-            printf("backing file format: %s\n", info->backing_filename_format);
+            snprintf_tail(&buf1, &buf_size, "backing file format: %s\n",
+                          info->backing_filename_format);
         }
     }
 
     if (info->has_snapshots) {
         SnapshotInfoList *elem;
-        char buf[256];
+        char buf_sn[256];
 
-        printf("Snapshot list:\n");
-        printf("%s\n", bdrv_snapshot_dump(buf, sizeof(buf), NULL));
+        snprintf_tail(&buf1, &buf_size, "Snapshot list:\n");
+        snprintf_tail(&buf1, &buf_size, "%s\n",
+                      bdrv_snapshot_dump(buf_sn, sizeof(buf_sn), NULL));
 
         /* Ideally bdrv_snapshot_dump() would operate on SnapshotInfoList but
          * we convert to the block layer's native QEMUSnapshotInfo for now.
@@ -388,7 +415,9 @@ void bdrv_image_info_dump(ImageInfo *info)
 
             pstrcpy(sn.id_str, sizeof(sn.id_str), elem->value->id);
             pstrcpy(sn.name, sizeof(sn.name), elem->value->name);
-            printf("%s\n", bdrv_snapshot_dump(buf, sizeof(buf), &sn));
+            snprintf_tail(&buf1, &buf_size, "%s\n",
+                          bdrv_snapshot_dump(buf_sn, sizeof(buf_sn), &sn));
         }
     }
+    return buf;
 }
diff --git a/include/block/qapi.h b/include/block/qapi.h
index 5b2762c..4c4677c 100644
--- a/include/block/qapi.h
+++ b/include/block/qapi.h
@@ -38,5 +38,5 @@ int bdrv_query_image_info(BlockDriverState *bs,
 int bdrv_query_info(BlockDriverState *bs,
                     BlockInfo **p_info,
                     Error **errp);
-void bdrv_image_info_dump(ImageInfo *info);
+char *bdrv_image_info_dump(char *buf, int buf_size, ImageInfo *info);
 #endif
diff --git a/qemu-img.c b/qemu-img.c
index 5b229a9..d3fce63 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1606,10 +1606,12 @@ static void dump_json_image_info(ImageInfo *info)
     QDECREF(str);
 }
 
+#define IMAGE_INFO_BUF_SIZE (2048)
 static void dump_human_image_info_list(ImageInfoList *list)
 {
     ImageInfoList *elem;
     bool delim = false;
+    char *buf = g_malloc0(IMAGE_INFO_BUF_SIZE);
 
     for (elem = list; elem; elem = elem->next) {
         if (delim) {
@@ -1617,8 +1619,10 @@ static void dump_human_image_info_list(ImageInfoList *list)
         }
         delim = true;
 
-        bdrv_image_info_dump(elem->value);
+        printf("%s",
+               bdrv_image_info_dump(buf, IMAGE_INFO_BUF_SIZE, elem->value));
     }
+    g_free(buf);
 }
 
 static gboolean str_equal_func(gconstpointer a, gconstpointer b)
