Convert many uses of sprintf to snprintf or asprintf

ticket: 6200
status: open

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@21258 dc483132-0cff-0310-8789-dd5450dbe970

27 files changed, 204 insertions, 202 deletions

diff --git a/src/appl/bsd/forward.c b/src/appl/bsd/forward.c
index 53f67e667..a055da290 100644
--- a/src/appl/bsd/forward.c
+++ b/src/appl/bsd/forward.c
@@ -54,7 +54,7 @@ rd_and_store_for_creds(context, auth_context, inbuf, ticket, ccache)
      * the rlogind or rshd. Set the environment variable as well.
      */
   
-    sprintf(ccname, "FILE:/tmp/krb5cc_p%ld", (long) getpid());
+    snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_p%ld", (long) getpid());
     setenv("KRB5CCNAME", ccname, 1);
   
     retval = krb5_cc_resolve(context, ccname, ccache);
diff --git a/src/appl/bsd/kcmd.c b/src/appl/bsd/kcmd.c
index 7d22d5905..755314338 100644
--- a/src/appl/bsd/kcmd.c
+++ b/src/appl/bsd/kcmd.c
@@ -205,7 +205,7 @@ kcmd_connect (int *sp, int *addrfamilyp, struct sockaddr_in *sockinp,
 	fprintf(stderr, "can't connect to %s port 0\n", hname);
 	return -1;
     }
-    sprintf(rport_buf, "%d", ntohs(rport));
+    snprintf(rport_buf, sizeof(rport_buf), "%d", ntohs(rport));
     memset(&aihints, 0, sizeof(aihints));
     aihints.ai_socktype = SOCK_STREAM;
     aihints.ai_flags = AI_CANONNAME;
@@ -334,7 +334,7 @@ setup_secondary_channel (int s, int *fd2p, int *lportp, int *addrfamilyp,
 	FD_SET(s, &xfds);
 	listen(s2, 1);
 	FD_SET(s2, &rfds);
-    	(void) sprintf(num, "%d", *lportp);
+    	(void) snprintf(num, sizeof(num), "%d", *lportp);
 	slen = strlen(num)+1;
     	if (write(s, num, slen) != slen) {
 	    perror("write: setting up stderr");
diff --git a/src/appl/bsd/krcp.c b/src/appl/bsd/krcp.c
index c791aaac4..24994ef5a 100644
--- a/src/appl/bsd/krcp.c
+++ b/src/appl/bsd/krcp.c
@@ -146,7 +146,6 @@ int main(argc, argv)
     char *targ, *host, *src;
     char *suser, *tuser, *thost;
     int i;
-    unsigned int cmdsiz = 30;
     char buf[RCP_BUFSIZ], cmdbuf[30];
     char *cmd = cmdbuf;
     struct servent *sp;
@@ -299,33 +298,25 @@ int main(argc, argv)
     }
 
 #ifdef KERBEROS
-    if (krb_realm != NULL)
-	cmdsiz += strlen(krb_realm);
-    if (krb_cache != NULL)
-	cmdsiz += strlen(krb_cache);
-    if (krb_config != NULL)
-	cmdsiz += strlen(krb_config);
-
-    if ((cmd = (char *)malloc(cmdsiz)) == NULL) {
+    if (asprintf(&cmd, "%srcp %s%s%s%s%s%s%s%s%s",
+		 encryptflag ? "-x " : "",
+
+		 iamrecursive ? " -r" : "", pflag ? " -p" : "", 
+		 targetshouldbedirectory ? " -d" : "",
+		 krb_realm != NULL ? " -k " : "",
+		 krb_realm != NULL ? krb_realm : "",
+		 krb_cache != NULL ? " -c " : "",
+		 krb_cache != NULL ? krb_cache : "",
+		 krb_config != NULL ? " -C " : "",
+		 krb_config != NULL ? krb_config : "") < 0) {
 	fprintf(stderr, "rcp: Cannot malloc.\n");
 	exit(1);
     }
-    (void) sprintf(cmd, "%srcp %s%s%s%s%s%s%s%s%s",
-		   encryptflag ? "-x " : "",
-
-		   iamrecursive ? " -r" : "", pflag ? " -p" : "", 
-		   targetshouldbedirectory ? " -d" : "",
-		   krb_realm != NULL ? " -k " : "",
-		   krb_realm != NULL ? krb_realm : "",
-		   krb_cache != NULL ? " -c " : "",
-		   krb_cache != NULL ? krb_cache : "",
-		   krb_config != NULL ? " -C " : "",
-		   krb_config != NULL ? krb_config : "");
 
 #else /* !KERBEROS */
-    (void) sprintf(cmd, "rcp%s%s%s",
-		   iamrecursive ? " -r" : "", pflag ? " -p" : "", 
-		   targetshouldbedirectory ? " -d" : "");
+    (void) snprintf(cmd, sizeof(cmdbuf), "rcp%s%s%s",
+		    iamrecursive ? " -r" : "", pflag ? " -p" : "", 
+		    targetshouldbedirectory ? " -d" : "");
 #endif /* KERBEROS */
     
 #ifdef POSIX_SIGNALS
@@ -389,22 +380,22 @@ int main(argc, argv)
 		      suser = pwd->pw_name;
 		    else if (!okname(suser))
 		      continue;
-		    (void) sprintf(buf,
+		    (void) snprintf(buf, sizeof(buf),
 #if defined(hpux) || defined(__hpux)
-				   "remsh %s -l %s -n %s %s '%s%s%s:%s'",
+				    "remsh %s -l %s -n %s %s '%s%s%s:%s'",
 #else
-				   "rsh %s -l %s -n %s %s '%s%s%s:%s'",
+				    "rsh %s -l %s -n %s %s '%s%s%s:%s'",
 #endif
-				   host, suser, cmd, src,
-				   tuser ? tuser : "",
-				   tuser ? "@" : "",
+				    host, suser, cmd, src,
+				    tuser ? tuser : "",
+				    tuser ? "@" : "",
 				   thost, targ);
 	       } else
-		   (void) sprintf(buf,
+		   (void) snprintf(buf, sizeof(buf),
 #if defined(hpux) || defined(__hpux)
-				  "remsh %s -n %s %s '%s%s%s:%s'",
+				   "remsh %s -n %s %s '%s%s%s:%s'",
 #else
-				  "rsh %s -n %s %s '%s%s%s:%s'",
+				   "rsh %s -n %s %s '%s%s%s:%s'",
 #endif
 				   argv[i], cmd, src,
 				   tuser ? tuser : "",
@@ -414,8 +405,8 @@ int main(argc, argv)
 	    } else {		/* local to remote */
 		krb5_creds *cred;
 		if (rem == -1) {
-		    (void) sprintf(buf, "%s -t %s",
-				   cmd, targ);
+		    (void) snprintf(buf, sizeof(buf), "%s -t %s",
+				    cmd, targ);
 		    host = thost;
 #ifdef KERBEROS
 		    authopts = AP_OPTS_MUTUAL_REQUIRED;
@@ -525,10 +516,10 @@ int main(argc, argv)
 		}
 	    }
 	    if (src == 0) {		/* local to local */
-		(void) sprintf(buf, "/bin/cp%s%s %s %s",
-			       iamrecursive ? " -r" : "",
-			       pflag ? " -p" : "",
-			       argv[i], argv[argc - 1]);
+		(void) snprintf(buf, sizeof(buf), "/bin/cp%s%s %s %s",
+				iamrecursive ? " -r" : "",
+				pflag ? " -p" : "",
+				argv[i], argv[argc - 1]);
 		(void) susystem(buf);
 	    } else {		/* remote to local */
 		krb5_creds *cred;
@@ -547,7 +538,7 @@ int main(argc, argv)
 		    host = argv[i];
 		    suser = pwd->pw_name;
 		}
-		(void) sprintf(buf, "%s -f %s", cmd, src);
+		(void) snprintf(buf, sizeof(buf), "%s -f %s", cmd, src);
 #ifdef KERBEROS
 		authopts = AP_OPTS_MUTUAL_REQUIRED;
 		status = kcmd(&sock, &host,
@@ -812,16 +803,16 @@ void source(argc, argv)
 	     * Make it compatible with possible future
 	     * versions expecting microseconds.
 	     */
-	    (void) sprintf(buf, "T%ld 0 %ld 0\n",
-			   stb.st_mtime, stb.st_atime);
+	    (void) snprintf(buf, sizeof(buf), "T%ld 0 %ld 0\n",
+			    stb.st_mtime, stb.st_atime);
 	    (void) rcmd_stream_write(rem, buf, strlen(buf), 0);
 	    if (response() < 0) {
 		(void) close(f);
 		continue;
 	    }
 	}
-	(void) sprintf(buf, "C%04o %ld %s\n",
-		       (int) stb.st_mode&07777, (long ) stb.st_size, last);
+	(void) snprintf(buf, sizeof(buf), "C%04o %ld %s\n",
+			(int) stb.st_mode&07777, (long ) stb.st_size, last);
 	(void) rcmd_stream_write(rem, buf, strlen(buf), 0);
 	if (response() < 0) {
 	    (void) close(f);
@@ -881,16 +872,16 @@ void rsource(name, statp)
     else
       last++;
     if (pflag) {
-	(void) sprintf(buf, "T%ld 0 %ld 0\n",
-		       statp->st_mtime, statp->st_atime);
+	(void) snprintf(buf, sizeof(buf), "T%ld 0 %ld 0\n",
+			statp->st_mtime, statp->st_atime);
 	(void) rcmd_stream_write(rem, buf, strlen(buf), 0);
 	if (response() < 0) {
 	    closedir(d);
 	    return;
 	}
     }
-    (void) sprintf(buf, "D%04lo %d %s\n", (long) statp->st_mode&07777, 0, 
-		   last);
+    (void) snprintf(buf, sizeof(buf), "D%04lo %d %s\n",
+		    (long) statp->st_mode&07777, 0, last);
     (void) rcmd_stream_write(rem, buf, strlen(buf), 0);
     if (response() < 0) {
 	closedir(d);
@@ -905,7 +896,7 @@ void rsource(name, statp)
 	    error("%s/%s: Name too long.\n", name, dp->d_name);
 	    continue;
 	}
-	(void) sprintf(buf, "%s/%s", name, dp->d_name);
+	(void) snprintf(buf, sizeof(buf), "%s/%s", name, dp->d_name);
 	bufv[0] = buf;
 	source(1, bufv);
     }
@@ -1092,8 +1083,8 @@ void sink(argc, argv)
 	if (targisdir) {
           if(strlen(targ) + strlen(cp) + 2 >= sizeof(nambuf))
 	    SCREWUP("target name too long");
-	  (void) sprintf(nambuf, "%s%s%s", targ,
-			 *targ ? "/" : "", cp);
+	  (void) snprintf(nambuf, sizeof(nambuf), "%s%s%s", targ,
+			  *targ ? "/" : "", cp);
 	} else {
 	  if (strlen(targ) + 1 >= sizeof (nambuf))
 	    SCREWUP("target name too long");
@@ -1238,7 +1229,7 @@ error(fmt, va_alist)
 
     errs++;
     *cp++ = 1;
-    (void) vsprintf(cp, fmt, ap);
+    (void) vsnprintf(cp, sizeof(buf) - (cp - buf), fmt, ap);
     va_end(ap);
 
     if (iamremote)
diff --git a/src/appl/bsd/krlogin.c b/src/appl/bsd/krlogin.c
index b3272815f..79d3827b5 100644
--- a/src/appl/bsd/krlogin.c
+++ b/src/appl/bsd/krlogin.c
@@ -599,7 +599,8 @@ main(argc, argv)
 		if (ospeed >= 50)
 			/* On some systems, ospeed is the baud rate itself,
 			   not a table index.  */
-			sprintf (term + strlen (term), "%d", ospeed);
+			snprintf (term + strlen (term),
+				  sizeof(term) - strlen(term), "%d", ospeed);
 		else if (ospeed >= sizeof(speeds)/sizeof(char*))
 			/* Past end of table, but not high enough to
 			   look like a real speed.  */
diff --git a/src/appl/bsd/krlogind.c b/src/appl/bsd/krlogind.c
index e42da1449..219ff0199 100644
--- a/src/appl/bsd/krlogind.c
+++ b/src/appl/bsd/krlogind.c
@@ -858,7 +858,7 @@ void doit(f, fromp)
 	/*
 	 * Problems read failed ...
 	 */
-	sprintf(buferror, "Cannot read slave pty %s ",line);
+	snprintf(buferror, sizeof(buferror), "Cannot read slave pty %s ",line);
 	fatalperror(p,buferror);
     }
     close(syncpipe[0]);
@@ -867,7 +867,8 @@ void doit(f, fromp)
 #if defined(KERBEROS) 
     if (do_encrypt) {
 	if (rcmd_stream_write(f, SECURE_MESSAGE, sizeof(SECURE_MESSAGE), 0) < 0){
-	    sprintf(buferror, "Cannot encrypt-write network.");
+	    snprintf(buferror, sizeof(buferror),
+		     "Cannot encrypt-write network.");
 	    fatal(p,buferror);
 	}
     }
@@ -900,7 +901,8 @@ void doit(f, fromp)
 	/*
 	 * Problems write failed ...
 	 */
-	sprintf(buferror,"Cannot write slave pty %s ",line);
+	snprintf(buferror, sizeof(buferror), "Cannot write slave pty %s ",
+		 line);
 	fatalperror(f,buferror);
     }
 
@@ -1179,7 +1181,7 @@ void fatal(f, msg)
 #endif
     
     buf[0] = '\01';		/* error indicator */
-    (void) sprintf(buf + 1, "%s: %s.\r\n",progname, msg);
+    (void) snprintf(buf + 1, sizeof(buf) - 1, "%s: %s.\r\n", progname, msg);
     if ((f == netf) && (pid > 0))
       (void) rcmd_stream_write(f, buf, strlen(buf), 0);
     else
@@ -1213,7 +1215,7 @@ void fatalperror(f, msg)
 {
     char buf[512];
     
-    (void) sprintf(buf, "%s: %s", msg, error_message(errno));
+    (void) snprintf(buf, sizeof(buf), "%s: %s", msg, error_message(errno));
     fatal(f, buf);
 }
 
@@ -1288,18 +1290,14 @@ do_krb_login(host_addr, hostname)
     if (ticket)
 	krb5_free_ticket(bsd_context, ticket);
 
-    if (krusername)
-	msg_fail = (char *)malloc(strlen(krusername) + strlen(lusername) + 80);
-    if (!msg_fail)
-	fatal(netf, "User is not authorized to login to specified account");
-
     if (auth_sent)
-	sprintf(msg_fail, "Access denied because of improper credentials");
+	fatal(netf, "Access denied because of improper credentials");
+    else if (asprintf(&msg_fail,
+		      "User %s is not authorized to login to account %s",
+		      krusername, lusername) >= 0)
+	fatal(netf, msg_fail);
     else
-	sprintf(msg_fail, "User %s is not authorized to login to account %s",
-		krusername, lusername);
-    
-    fatal(netf, msg_fail);
+	fatal(netf, "User is not authorized to login to specified account");
     /* NOTREACHED */
 }
 
diff --git a/src/appl/bsd/krshd.c b/src/appl/bsd/krshd.c
index 2b4c383bf..8570b600e 100644
--- a/src/appl/bsd/krshd.c
+++ b/src/appl/bsd/krshd.c
@@ -164,6 +164,7 @@ char copyright[] =
 Key_schedule v4_schedule;
 #endif
 #include <k5-util.h>
+#include <k5-platform.h>
 
 #ifdef HAVE_PATHS_H
 #include <paths.h>
@@ -940,7 +941,7 @@ void doit(f, fromp)
        privileges. */
     if (port) {
 	/* Place entry into wtmp */
-	sprintf(ttyn,"krsh%ld",(long) (getpid() % 9999999));
+	snprintf(ttyn,sizeof(ttyn),"krsh%ld",(long) (getpid() % 9999999));
 	pty_logwtmp(ttyn,locuser,sane_host);
     }
     /*      We are simply execing a program over rshd : log entry into wtmp,
@@ -1422,12 +1423,10 @@ void doit(f, fromp)
     strncat(homedir, pwd->pw_dir, sizeof(homedir)-6);
     strncat(shell, pwd->pw_shell, sizeof(shell)-7);
     strncat(username, pwd->pw_name, sizeof(username)-6);
-    path = (char *) malloc(strlen(kprogdir) + strlen(path_rest) + 7);
-    if (path == NULL) {
+    if (asprintf(&path, "PATH=%s:%s", kprogdir, path_rest) < 0) {
         perror("malloc");
 	_exit(1);
     }
-    sprintf(path, "PATH=%s:%s", kprogdir, path_rest);
     envinit[PATHENV] = path;
 
     /* If we have KRB5CCNAME set, then copy into the
@@ -1436,10 +1435,8 @@ void doit(f, fromp)
      */
     if (getenv("KRB5CCNAME")) {
 	int i;
-	char *buf2 = (char *)malloc(strlen(getenv("KRB5CCNAME"))
-			 		   +strlen("KRB5CCNAME=")+1);
-	if (buf2) {
-	  sprintf(buf2, "KRB5CCNAME=%s",getenv("KRB5CCNAME"));
+	char *buf2;
+	if (asprintf(&buf2, "KRB5CCNAME=%s",getenv("KRB5CCNAME")) >= 0) {
 
 	  for (i = 0; envinit[i]; i++);
 	  envinit[i] = buf2;
@@ -1459,10 +1456,10 @@ void doit(f, fromp)
 			  NI_NUMERICHOST | NI_NUMERICSERV);
       if (aierr)
 	  goto skip_localaddr_env;
-      sprintf(local_addr,  "KRB5LOCALADDR=%s", hbuf);
+      snprintf(local_addr, sizeof(local_addr), "KRB5LOCALADDR=%s", hbuf);
       envinit[i++] =local_addr;
 
-      sprintf(local_port,  "KRB5LOCALPORT=%s", sbuf);
+      snprintf(local_port, sizeof(local_port), "KRB5LOCALPORT=%s", sbuf);
       envinit[i++] =local_port;
     skip_localaddr_env:
 
@@ -1471,10 +1468,10 @@ void doit(f, fromp)
 			  NI_NUMERICHOST | NI_NUMERICSERV);
       if (aierr)
 	  goto skip_remoteaddr_env;
-      sprintf(remote_addr, "KRB5REMOTEADDR=%s", hbuf);
+      snprintf(remote_addr, sizeof(remote_addr), "KRB5REMOTEADDR=%s", hbuf);
       envinit[i++] =remote_addr;
 
-      sprintf(remote_port, "KRB5REMOTEPORT=%s", sbuf);
+      snprintf(remote_port, sizeof(remote_port), "KRB5REMOTEPORT=%s", sbuf);
       envinit[i++] =remote_port;
 
     skip_remoteaddr_env:
@@ -1488,11 +1485,8 @@ void doit(f, fromp)
 	    char *buf2;
 
 	    if(getenv(save_env[cnt])) {
-		    buf2 = (char *)malloc(strlen(getenv(save_env[cnt]))
-					 +strlen(save_env[cnt])+2);
-		    if (buf2) {
-			    sprintf(buf2, "%s=%s", save_env[cnt], 
-				    getenv(save_env[cnt]));
+		    if (asprintf(&buf2, "%s=%s", save_env[cnt], 
+				 getenv(save_env[cnt])) >= 0) {
 			    for (i = 0; envinit[i]; i++);
 			    envinit[i] = buf2;
 		    }
@@ -1583,8 +1577,8 @@ error(fmt, va_alist)
 #endif
 
     *cp++ = 1;
-    (void) sprintf(cp, "%s: ", progname);
-    (void) vsprintf(buf+strlen(buf), fmt, ap);
+    (void) snprintf(cp, sizeof(buf) - (cp - buf), "%s: ", progname);
+    (void) vsnprintf(buf+strlen(buf), sizeof(buf) - strlen(buf), fmt, ap);
     va_end(ap);
     (void) write(2, buf, strlen(buf));
     syslog(LOG_ERR ,"%s",buf+1);
@@ -1617,7 +1611,8 @@ char *makejtmp(uid, gid, jid)
     register char *endc, *tdp = &tmpdir[strlen(tmpdir)];
     register int i;
     
-    sprintf(tdp, "%s/jtmp.%06d", JTMPDIR, jid);
+    snprintf(tdp, sizeof(tmpdir) - (tdp - tmpdir), "%s/jtmp.%06d",
+	     JTMPDIR, jid);
     endc = &tmpdir[strlen(tmpdir)];
     
     endc[1] = '\0';
@@ -2048,7 +2043,7 @@ void fatal(f, msg)
 #endif
 
     buf[0] = '\01';             /* error indicator */
-    (void) sprintf(buf + 1, "%s: %s.\r\n",progname, msg);
+    (void) snprintf(buf + 1, sizeof(buf) - 1, "%s: %s.\r\n",progname, msg);
     if ((f == netf) && (pid > 0))
       (void) rcmd_stream_write(f, buf, strlen(buf), 0);
     else
diff --git a/src/appl/bsd/login.c b/src/appl/bsd/login.c
index a0348c273..419f0e158 100644
--- a/src/appl/bsd/login.c
+++ b/src/appl/bsd/login.c
@@ -529,7 +529,8 @@ void k_init (ttyn)
 
     /* Set up the credential cache environment variable */
     if (!getenv(KRB5_ENV_CCNAME)) {
-	sprintf(ccfile, "FILE:/tmp/krb5cc_p%ld", (long) getpid());
+	snprintf(ccfile, sizeof(ccfile), "FILE:/tmp/krb5cc_p%ld",
+		 (long) getpid());
 	setenv(KRB5_ENV_CCNAME, ccfile, 1);
 	krb5_cc_set_default_name(kcontext, ccfile);
 	unlink(ccfile+strlen("FILE:"));
@@ -571,7 +572,7 @@ static int k5_get_password (user_pwstring, pwsize)
 {
     krb5_error_code code;
     char prompt[255];			
-    sprintf(prompt,"Password for %s", username);
+    snprintf(prompt, sizeof(prompt), "Password for %s", username);
 
     /* reduce opportunities to be swapped out */
     code = krb5_read_password(kcontext, prompt, 0, user_pwstring, &pwsize);
@@ -1800,13 +1801,13 @@ int main(argc, argv)
 	    if (hostname) {
 		char buf[BUFSIZ];
 #ifdef UT_HOSTSIZE
-		(void) sprintf(buf,
+		(void) snprintf(buf, sizeof(buf),
 			       "ROOT LOGIN (krb) %s from %.*s, %s.%s@%s",
 			       tty, UT_HOSTSIZE, hostname,
 			       kdata->pname, kdata->pinst,
 			       kdata->prealm);
 #else
-		(void) sprintf(buf,
+		(void) snprintf(buf, sizeof(buf),
 			       "ROOT LOGIN (krb) %s from %s, %s.%s@%s",
 			       tty, hostname,
 			       kdata->pname, kdata->pinst,
@@ -2104,7 +2105,7 @@ void check_mail()
 {
     char tbuf[MAXPATHLEN+2];
     struct stat st;
-    (void)sprintf(tbuf, "%s/%s", MAILDIR, pwd->pw_name);
+    (void)snprintf(tbuf, sizeof(tbuf), "%s/%s", MAILDIR, pwd->pw_name);
     if (stat(tbuf, &st) == 0 && st.st_size != 0)
 	printf("You have %smail.\n",
 	       (st.st_mtime > st.st_atime) ? "new " : "");
diff --git a/src/appl/bsd/v4rcp.c b/src/appl/bsd/v4rcp.c
index 6baadf891..85357e997 100644
--- a/src/appl/bsd/v4rcp.c
+++ b/src/appl/bsd/v4rcp.c
@@ -388,8 +388,9 @@ int main(argc, argv)
 
 		    case 'P':		/* Set port to use.  */
 			port = atoi(*argv);
-			sprintf(portarg, " -p%d", port);
-			sprintf(rcpportarg, " -P%d", port);
+			snprintf(portarg, sizeof(portarg), " -p%d", port);
+			snprintf(rcpportarg, sizeof(rcpportarg), " -P%d",
+				 port);
 			port = htons(port);
 			goto next_arg;
 
@@ -410,7 +411,8 @@ int main(argc, argv)
 			  usage();
 			strncpy(krb_realm,*argv,REALM_SZ);
 			krb_realm[REALM_SZ-1] = 0;
-			sprintf(realmarg, " -k %s", krb_realm);
+			snprintf(realmarg, sizeof(realmarg), " -k %s",
+				 krb_realm);
 			goto next_arg;
 #endif /* KERBEROS */
 		    /* The rest of these are not for users. */
@@ -539,16 +541,17 @@ notreg:
 			 * Make it compatible with possible future
 			 * versions expecting microseconds.
 			 */
-			(void) sprintf(buf, "T%ld 0 %ld 0\n",
-			    stb.st_mtime, stb.st_atime);
+			(void) snprintf(buf, sizeof(buf), "T%ld 0 %ld 0\n",
+					stb.st_mtime, stb.st_atime);
 			kstream_write (krem, buf, strlen (buf));
 			if (response() < 0) {
 				(void) close(f);
 				continue;
 			}
 		}
-		(void) sprintf(buf, "C%04o %ld %s\n",
-		    (unsigned int) stb.st_mode&07777, (long) stb.st_size, last);
+		(void) snprintf(buf, sizeof(buf), "C%04o %ld %s\n",
+				(unsigned int) stb.st_mode&07777,
+				(long) stb.st_size, last);
 		kstream_write (krem, buf, strlen (buf));
 		if (response() < 0) {
 			(void) close(f);
@@ -606,15 +609,15 @@ void rsource(name, statp)
 	else
 		last++;
 	if (pflag) {
-		(void) sprintf(buf, "T%ld 0 %ld 0\n",
-		    statp->st_mtime, statp->st_atime);
+		(void) snprintf(buf, sizeof(buf), "T%ld 0 %ld 0\n",
+				statp->st_mtime, statp->st_atime);
 		kstream_write (krem, buf, strlen (buf));
 		if (response() < 0) {
 			closedir(d);
 			return;
 		}
 	}
-	(void) sprintf(buf, "D%04o %d %s\n",
+	(void) sprintf(buf, sizeof(buf), "D%04o %d %s\n",
 		       (unsigned int) statp->st_mode&07777, 0, last);
 	kstream_write (krem, buf, strlen (buf));
 	if (response() < 0) {
@@ -630,7 +633,7 @@ void rsource(name, statp)
 			error("%s/%s: Name too long.\n", name, dp->d_name);
 			continue;
 		}
-		(void) sprintf(buf, "%s/%s", name, dp->d_name);
+		(void) snprintf(buf, sizeof(buf), "%s/%s", name, dp->d_name);
 		bufv[0] = buf;
 		source(1, bufv);
 	}
diff --git a/src/appl/gss-sample/gss-client.c b/src/appl/gss-sample/gss-client.c
index 0ee268499..390d6e56f 100644
--- a/src/appl/gss-sample/gss-client.c
+++ b/src/appl/gss-sample/gss-client.c
@@ -567,20 +567,24 @@ call_server(host, port, oid, service_name, gss_flags, auth_flag,
 static void
 parse_oid(char *mechanism, gss_OID * oid)
 {
-    char   *mechstr = 0, *cp;
+    char   *mechstr = 0;
     gss_buffer_desc tok;
     OM_uint32 maj_stat, min_stat;
+    size_t i, mechlen = strlen(mechanism);
 
     if (isdigit((int) mechanism[0])) {
-	mechstr = malloc(strlen(mechanism) + 5);
+	mechstr = malloc(mechlen + 5);
 	if (!mechstr) {
 	    fprintf(stderr, "Couldn't allocate mechanism scratch!\n");
 	    return;
 	}
-	sprintf(mechstr, "{ %s }", mechanism);
-	for (cp = mechstr; *cp; cp++)
-	    if (*cp == '.')
-		*cp = ' ';
+	mechstr[0] = '{';
+	mechstr[1] = ' ';
+	for (i = 0; i < mechlen; i++)
+	  mechstr[i + 2] = (mechanism[i] == '.') ? ' ' : mechanism[i];
+	mechstr[mechlen + 2] = ' ';
+	mechstr[mechlen + 3] = ' ';
+	mechstr[mechlen + 4] = '\0';
 	tok.value = mechstr;
     } else
 	tok.value = mechanism;
diff --git a/src/appl/gssftp/ftp/ftp.c b/src/appl/gssftp/ftp/ftp.c
index af5732c58..ababc5d59 100644
--- a/src/appl/gssftp/ftp/ftp.c
+++ b/src/appl/gssftp/ftp/ftp.c
@@ -530,7 +530,7 @@ int command(char *fmt, ...)
 	}
 	oldintr = signal(SIGINT, cmdabort);
 	va_start(ap, fmt);
-	vsprintf(in, fmt, ap);
+	vsnprintf(in, FTP_BUFSIZ, fmt, ap);
 	va_end(ap);
 again:	if (secure_command(in) == 0)
 		return(0);
@@ -2012,7 +2012,8 @@ int do_auth()
 	  for (trial = 0; trial < n_gss_trials; trial++) {
 	    /* ftp@hostname first, the host@hostname */
 	    /* the V5 GSSAPI binding canonicalizes this for us... */
-	    sprintf(stbuf, "%s@%s", gss_trials[trial].service_name, hostname);
+	    snprintf(stbuf, sizeof(stbuf), "%s@%s",
+		     gss_trials[trial].service_name, hostname);
 	    if (debug)
 	      fprintf(stderr, "Trying to authenticate to <%s>\n", stbuf);
 
@@ -2236,7 +2237,7 @@ static void abort_remote(FILE *din)
 	 * send IAC in urgent mode instead of DM because 4.3BSD places oob mark
 	 * after urgent byte rather than before as is protocol now
 	 */
-	sprintf(buf, "%c%c%c", IAC, IP, IAC);
+	snprintf(buf, sizeof(buf), "%c%c%c", IAC, IP, IAC);
 	if (send(SOCKETNO(fileno(cout)), buf, 3, MSG_OOB) != 3)
 		PERROR_SOCKET("abort");
 	putc(DM, cout);
diff --git a/src/appl/gssftp/ftp/ruserpass.c b/src/appl/gssftp/ftp/ruserpass.c
index 3495dda4e..6e603e459 100644
--- a/src/appl/gssftp/ftp/ruserpass.c
+++ b/src/appl/gssftp/ftp/ruserpass.c
@@ -136,7 +136,7 @@ ruserpass(host, aname, apass, aacct)
 	hdir = getenv("HOME");
 	if (hdir == NULL)
 		hdir = ".";
-	(void) sprintf(buf, "%s/.netrc", hdir);
+	(void) snprintf(buf, sizeof(buf), "%s/.netrc", hdir);
 	cfile = fopen(buf, "r");
 	if (cfile == NULL) {
 		if (errno != ENOENT)
diff --git a/src/appl/gssftp/ftpd/ftpd.c b/src/appl/gssftp/ftpd/ftpd.c
index 30fe19a81..7522c50ce 100644
--- a/src/appl/gssftp/ftpd/ftpd.c
+++ b/src/appl/gssftp/ftpd/ftpd.c
@@ -773,7 +773,8 @@ user(name)
 				syslog(LOG_ERR, "user: username too long");
 				name = "[username too long]";
 			}
-			sprintf(buf, "GSSAPI user %s is%s authorized as %s",
+			snprintf(buf, sizeof(buf),
+				 "GSSAPI user %s is%s authorized as %s",
 				(char *) client_name.value, 
 				authorized ? "" : " not",
 				name);
@@ -797,7 +798,8 @@ user(name)
 				syslog(LOG_ERR, "user: username too long");
 				name = "[username too long]";
 			}
-			sprintf(buf, "Kerberos user %s%s%s@%s is%s authorized as %s",
+			snprintf(buf, sizeof(buf),
+				 "Kerberos user %s%s%s@%s is%s authorized as %s",
 				kdata.pname, *kdata.pinst ? "." : "",
 				kdata.pinst, kdata.prealm,
 				authorized ? "" : " not", name);
@@ -947,7 +949,8 @@ char *name, *passwd;
 		return 0;
 	my_creds.client = me;
 
-	sprintf(ccname, "FILE:/tmp/krb5cc_ftpd%ld", (long) getpid());
+	snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_ftpd%ld",
+		 (long) getpid());
 	if (krb5_cc_resolve(kcontext, ccname, &ccache))
 		return(0);
 	if (krb5_cc_initialize(kcontext, ccache, me))
@@ -986,7 +989,8 @@ char *name, *passwd;
 	if (krb_get_lrealm(realm, 1) != KSUCCESS)
 		goto nuke_ccache;
 
-	sprintf(ccname, "%s_ftpd%ld", TKT_ROOT, (long) getpid());
+	snprintf(ccname, sizeof(ccname), "%s_ftpd%ld", TKT_ROOT,
+		 (long) getpid());
 	krb_set_tkt_string(ccname);
 
 	if (krb_get_pw_in_tkt(name, "", realm, "krbtgt", realm, 1, passwd))
@@ -1116,7 +1120,7 @@ login(passwd, logincode)
 	(void) initgroups(pw->pw_name, pw->pw_gid);
 
 	/* open wtmp before chroot */
-	(void) sprintf(ttyline, "ftp%ld", (long) getpid());
+	(void) snprintf(ttyline, sizeof(ttyline), "ftp%ld", (long) getpid());
 	pty_logwtmp(ttyline, pw->pw_name, rhost_sane);
 	logged_in = 1;
 
@@ -1168,9 +1172,8 @@ login(passwd, logincode)
 	if (guest) {
 		reply(230, "Guest login ok, access restrictions apply.");
 #ifdef SETPROCTITLE
-		sprintf(proctitle, "%s: anonymous/%.*s", rhost_sane,
-		    sizeof(proctitle) - strlen(rhost_sane) -
-		    sizeof(": anonymous/"), passwd);
+		snprintf(proctitle, sizeof(proctitle), "%s: anonymous/%.*s",
+			 rhost_sane, passwd);
 		setproctitle(proctitle);
 #endif /* SETPROCTITLE */
 		if (logging)
@@ -1183,7 +1186,8 @@ login(passwd, logincode)
 			reply(230, "User %s logged in.", pw->pw_name);
 		}
 #ifdef SETPROCTITLE
-		sprintf(proctitle, "%s: %s", rhost_sane, pw->pw_name);
+		snprintf(proctitle, sizeof(proctitle), "%s: %s",
+			 rhost_sane, pw->pw_name);
 		setproctitle(proctitle);
 #endif /* SETPROCTITLE */
 		if (logging)
@@ -1219,7 +1223,7 @@ retrieve(cmd, name)
 			reply(501, "filename too long");
 			return;
 		}
-		(void) sprintf(line, cmd, name), name = line;
+		(void) snprintf(line, sizeof(line), cmd, name), name = line;
 		fin = ftpd_popen(line, "r"), closefunc = ftpd_pclose;
 		st.st_size = -1;
 #ifndef NOSTBLKSIZE
@@ -1401,7 +1405,8 @@ dataconn(name, size, fmode)
 	byte_count = 0;
 	if (size != (off_t) -1)
 		/* cast size to long in case sizeof(off_t) > sizeof(long) */
-		(void) sprintf (sizebuf, " (%ld bytes)", (long)size);
+		(void) snprintf (sizebuf, sizeof(sizebuf), " (%ld bytes)",
+				 (long)size);
 	else
 		sizebuf[0] = '\0';
 	if (pdata >= 0) {
@@ -1665,7 +1670,7 @@ statfilecmd(filename)
 		reply(501, "filename too long");
 		return;
 	}
-	(void) sprintf(line, "/bin/ls -lgA %s", filename);
+	(void) snprintf(line, sizeof(line), "/bin/ls -lgA %s", filename);
 	fin = ftpd_popen(line, "r");
 	lreply(211, "status of %s:", filename);
 	p = str;
@@ -1714,8 +1719,8 @@ statcmd()
 
 	lreply(211, "%s FTP server status:", hostname);
 	reply(0, "     %s", version);
-	sprintf(str, "     Connected to %s", remotehost[0] ? remotehost : "");
-	sprintf(&str[strlen(str)], " (%s)", rhost_addra);
+	snprintf(str, sizeof(str), "     Connected to %s (%s)",
+		 remotehost[0] ? remotehost : "", rhost_addra);
 	reply(0, "%s", str);
 	if (auth_type) reply(0, "     Authentication type: %s", auth_type);
 	if (logged_in) {
@@ -1730,22 +1735,16 @@ statcmd()
 	else
 		reply(0, "     Waiting for user name");
 	reply(0, "     Protection level: %s", levelnames[dlevel]);
-	sprintf(str, "     TYPE: %s", typenames[type]);
-	if (type == TYPE_A || type == TYPE_E)
-		sprintf(&str[strlen(str)], ", FORM: %s", formnames[form]);
+	snprintf(str, sizeof(str), "     TYPE: %s", typenames[type]);
+	if (type == TYPE_A || type == TYPE_E) {
+		snprintf(&str[strlen(str)], sizeof(str) - strlen(str),
+			 ", FORM: %s", formnames[form]);
+	}
 	if (type == TYPE_L)
-#if 1
 		strncat(str, " 8", sizeof (str) - strlen(str) - 1);
-#else
-/* this is silly. -- eichin@cygnus.com */
-#if NBBY == 8
-		sprintf(&str[strlen(str)], " %d", NBBY);
-#else
-		sprintf(&str[strlen(str)], " %d", bytesize);	/* need definition! */
-#endif
-#endif
-	sprintf(&str[strlen(str)], "; STRUcture: %s; transfer MODE: %s",
-	    strunames[stru], modenames[mode]);
+	snprintf(&str[strlen(str)], sizeof(str) - strlen(str),
+		 "; STRUcture: %s; transfer MODE: %s",
+		 strunames[stru], modenames[mode]);
 	reply(0, "%s", str);
 	if (data != -1)
 		strlcpy(str, "     Data connection open", sizeof(str));
@@ -1801,10 +1800,10 @@ reply(n, fmt, p0, p1, p2, p3, p4, p5)
 	va_list ap;
 
 	va_start(ap, fmt);
-	vsprintf(buf, fmt, ap);
+	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 #else
-	sprintf(buf, fmt, p0, p1, p2, p3, p4, p5);
+	snprintf(buf, sizeof(buf), fmt, p0, p1, p2, p3, p4, p5);
 #endif
 
 	if (auth_type) {
@@ -1814,7 +1813,7 @@ reply(n, fmt, p0, p1, p2, p3, p4, p5)
 		 */
 		char in[FTP_BUFSIZ*3/2], out[FTP_BUFSIZ*3/2];
 		int length = 0, kerror;
-		if (n) sprintf(in, "%d%c", n, cont_char);
+		if (n) snprintf(in, sizeof(in), "%d%c", n, cont_char);
 		else in[0] = '\0';
 		strncat(in, buf, sizeof (in) - strlen(in) - 1);
 #ifdef KRB5_KRB4_COMPAT
@@ -1919,10 +1918,10 @@ lreply(n, fmt, p0, p1, p2, p3, p4, p5)
 	va_list ap;
 
 	va_start(ap, fmt);
-	vsprintf(buf, fmt, ap);
+	vsnprintf(buf, sizeof(buf), fmt, ap);
 	va_end(ap);
 #else
-	sprintf(buf, fmt, p0, p1, p2, p3, p4, p5);
+	snprintf(buf, sizeof(buf), fmt, p0, p1, p2, p3, p4, p5);
 #endif
 	cont_char = '-';
 	reply(n, "%s", buf);
@@ -2084,7 +2083,7 @@ dolog(sin4)
 		exit(1);
 	}
 #ifdef SETPROCTITLE
-	sprintf(proctitle, "%s: connected", rhost_sane);
+	snprintf(proctitle, sizeof(proctitle), "%s: connected", rhost_sane);
 	setproctitle(proctitle);
 #endif /* SETPROCTITLE */
 
@@ -2231,7 +2230,7 @@ gunique(local)
 	cp = new + strlen(new);
 	*cp++ = '.';
 	for (count = 1; count < 100; count++) {
-		(void) sprintf(cp, "%d", count);
+		(void) snprintf(cp, sizeof(new) - (cp - new), "%d", count);
 		if (stat(new, &st) < 0)
 			return(new);
 	}
@@ -2414,7 +2413,8 @@ char *adata;
 		localname[sizeof(localname) - 1] = '\0';
 
 		for (gservice = gss_services; *gservice; gservice++) {
-			sprintf(service_name, "%s@%s", *gservice, localname);
+			snprintf(service_name, sizeof(service_name),
+				 "%s@%s", *gservice, localname);
 			name_buf.value = service_name;
 			name_buf.length = strlen(name_buf.value) + 1;
 			if (debug)
@@ -2723,7 +2723,8 @@ send_file_list(whichfiles)
 				ret = -2; /* XXX */
 				goto data_err;
 			}
-			sprintf(nbuf, "%s/%s", dirname, dir->d_name);
+			snprintf(nbuf, sizeof(nbuf), "%s/%s",
+				 dirname, dir->d_name);
 
 			/*
 			 * We have to do a stat to insure it's
@@ -2929,7 +2930,8 @@ ftpd_gss_convert_creds(name, creds)
 	if (krb5_parse_name(kcontext, name, &me))
 		return;
 
-	sprintf(ccname, "FILE:/tmp/krb5cc_ftpd%ld", (long) getpid());
+	snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_ftpd%ld",
+		 (long) getpid());
 	if (krb5_cc_resolve(kcontext, ccname, &ccache))
 		return;
 	if (krb5_cc_initialize(kcontext, ccache, me))
@@ -2962,7 +2964,8 @@ ftpd_gss_convert_creds(name, creds)
 	if (krb524_convert_creds_kdc(kcontext, v5creds, &v4creds))
 		goto cleanup;
 
-	sprintf(ccname, "%s_ftpd%ld", TKT_ROOT, (long) getpid());
+	snprintf(ccname, sizeof(ccname), "%s_ftpd%ld",
+		 TKT_ROOT, (long) getpid());
 	krb_set_tkt_string(ccname);
 
 	if (in_tkt(v4creds.pname, v4creds.pinst) != KSUCCESS)
diff --git a/src/appl/libpty/getpty.c b/src/appl/libpty/getpty.c
index 995b22770..e5bf2854b 100644
--- a/src/appl/libpty/getpty.c
+++ b/src/appl/libpty/getpty.c
@@ -105,7 +105,7 @@ ptyint_getpty_ext(int *fd, char *slave, int slavelength, int do_grantpt)
 	    return PTY_GETPTY_FSTAT;
 	}
 	ptynum = (int)(stb.st_rdev&0xFF);
-	sprintf(slavebuf, "/dev/ttyp%x", ptynum);
+	snprintf(slavebuf, sizeof(slavebuf), "/dev/ttyp%x", ptynum);
 	if (strlen(slavebuf) > slavelength - 1) {
 	    close(*fd);
 	    *fd = -1;
@@ -115,7 +115,7 @@ ptyint_getpty_ext(int *fd, char *slave, int slavelength, int do_grantpt)
 	return 0;
     } else {
     	for (cp = "pqrstuvwxyzPQRST";*cp; cp++) {
-	    sprintf(slavebuf,"/dev/ptyXX");
+	    snprintf(slavebuf,sizeof(slavebuf),"/dev/ptyXX");
 	    slavebuf[sizeof("/dev/pty") - 1] = *cp;
 	    slavebuf[sizeof("/dev/ptyp") - 1] = '0';
 	    if (stat(slavebuf, &stb) < 0)
diff --git a/src/appl/libpty/logwtmp.c b/src/appl/libpty/logwtmp.c
index 21a35d3a9..03cfab48f 100644
--- a/src/appl/libpty/logwtmp.c
+++ b/src/appl/libpty/logwtmp.c
@@ -73,7 +73,7 @@ pty_logwtmp(const char *tty, const char *user, const char *host)
 	cp = tty + len - 2;
     else
 	cp = tty;
-    sprintf(utmp_id, "kr%s", cp);
+    snprintf(utmp_id, sizeof(utmp_id), "kr%s", cp);
     strncpy(utx.ut_id, utmp_id, sizeof(utx.ut_id));
 
 #ifdef HAVE_SETUTXENT
diff --git a/src/appl/sample/sserver/sserver.c b/src/appl/sample/sserver/sserver.c
index 2cb971baf..39710fb2b 100644
--- a/src/appl/sample/sserver/sserver.c
+++ b/src/appl/sample/sserver/sserver.c
@@ -210,12 +210,15 @@ main(argc, argv)
     }
 
     /* Get client name */
+    repbuf[sizeof(repbuf) - 1] = '\0';
     retval = krb5_unparse_name(context, ticket->enc_part2->client, &cname);
     if (retval){
 	syslog(LOG_ERR, "unparse failed: %s", error_message(retval));
-        sprintf(repbuf, "You are <unparse error>\n");
+	strncpy(repbuf, "You are <unparse error>\n", sizeof(repbuf) - 1);
     } else {
-        sprintf(repbuf, "You are %s\n", cname);
+	strncpy(repbuf, "You are ", sizeof(repbuf) - 1);
+	strncat(repbuf, cname, sizeof(repbuf) - 1 - strlen(repbuf));
+	strncat(repbuf, "\n", sizeof(repbuf) - 1 - strlen(repbuf));
 	free(cname);
     }
     xmitlen = htons(strlen(repbuf));
diff --git a/src/appl/telnet/libtelnet/auth.c b/src/appl/telnet/libtelnet/auth.c
index 28b8ae8d1..84dc5eb5c 100644
--- a/src/appl/telnet/libtelnet/auth.c
+++ b/src/appl/telnet/libtelnet/auth.c
@@ -658,7 +658,7 @@ auth_gen_printsub(data, cnt, buf, buflen)
 	buf[buflen-2] = '*';
 	buflen -= 2;
 	for (; cnt > 0; cnt--, data++) {
-		sprintf((char *)tbuf, " %d", *data);
+		snprintf((char *)tbuf, sizeof(tbuf), " %d", *data);
 		for (cp = tbuf; *cp && buflen > 0; --buflen)
 			*buf++ = *cp++;
 		if (buflen <= 0)
diff --git a/src/appl/telnet/libtelnet/enc_des.c b/src/appl/telnet/libtelnet/enc_des.c
index c399d22c7..aa00ae27e 100644
--- a/src/appl/telnet/libtelnet/enc_des.c
+++ b/src/appl/telnet/libtelnet/enc_des.c
@@ -550,28 +550,28 @@ fb64_printsub(data, cnt, buf, buflen, type)
 
 	switch(data[2]) {
 	case FB64_IV:
-		sprintf(lbuf, "%s_IV", type);
+		snprintf(lbuf, sizeof(lbuf), "%s_IV", type);
 		cp = lbuf;
 		goto common;
 
 	case FB64_IV_OK:
-		sprintf(lbuf, "%s_IV_OK", type);
+		snprintf(lbuf, sizeof(lbuf), "%s_IV_OK", type);
 		cp = lbuf;
 		goto common;
 
 	case FB64_IV_BAD:
-		sprintf(lbuf, "%s_IV_BAD", type);
+		snprintf(lbuf, sizeof(lbuf), "%s_IV_BAD", type);
 		cp = lbuf;
 		goto common;
 
 	default:
-		sprintf(lbuf, " %d (unknown)", data[2]);
+		snprintf(lbuf, sizeof(lbuf), " %d (unknown)", data[2]);
 		cp = lbuf;
 	common:
 		for (; (buflen > 0) && (*buf = *cp++); buf++)
 			buflen--;
 		for (i = 3; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
+			snprintf(lbuf, sizeof(lbuf), " %d", data[i]);
 			for (cp = lbuf; (buflen > 0) && (*buf = *cp++); buf++)
 				buflen--;
 		}
diff --git a/src/appl/telnet/libtelnet/encrypt.c b/src/appl/telnet/libtelnet/encrypt.c
index e99f346c4..6317eceb3 100644
--- a/src/appl/telnet/libtelnet/encrypt.c
+++ b/src/appl/telnet/libtelnet/encrypt.c
@@ -984,7 +984,7 @@ encrypt_gen_printsub(data, cnt, buf, buflen)
 	buf[buflen-2] = '*';
 	buflen -= 2;;
 	for (; cnt > 0; cnt--, data++) {
-		sprintf(tbuf, " %d", *data);
+		snprintf(tbuf, sizeof(tbuf), " %d", *data);
 		for (cp = tbuf; *cp && buflen > 0; --buflen)
 			*buf++ = *cp++;
 		if (buflen <= 0)
diff --git a/src/appl/telnet/libtelnet/forward.c b/src/appl/telnet/libtelnet/forward.c
index 09d558906..98dcb7897 100644
--- a/src/appl/telnet/libtelnet/forward.c
+++ b/src/appl/telnet/libtelnet/forward.c
@@ -57,7 +57,7 @@ rd_and_store_for_creds(context, auth_context, inbuf, ticket)
     if ((retval = krb5_rd_cred(context, auth_context, inbuf, &creds, NULL)))
 	return(retval);
 
-    sprintf(ccname, "FILE:/tmp/krb5cc_p%ld", (long) getpid());
+    snprintf(ccname, sizeof(ccname), "FILE:/tmp/krb5cc_p%ld", (long) getpid());
     setenv("KRB5CCNAME", ccname, 1);
 
     if ((retval = krb5_cc_resolve(context, ccname, &ccache)))
diff --git a/src/appl/telnet/libtelnet/kerberos.c b/src/appl/telnet/libtelnet/kerberos.c
index 7e0d7360c..925e9023e 100644
--- a/src/appl/telnet/libtelnet/kerberos.c
+++ b/src/appl/telnet/libtelnet/kerberos.c
@@ -674,12 +674,12 @@ kerberos4_printsub(data, cnt, buf, buflen)
 		goto common2;
 
 	default:
-		sprintf(lbuf, " %d (unknown)", data[3]);
+		snprintf(lbuf, sizeof(lbuf), " %d (unknown)", data[3]);
 		strncpy((char *)buf, lbuf, buflen);
 	common2:
 		BUMP(buf, buflen);
 		for (i = 4; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
+			snprintf(lbuf, sizeof(lbuf), " %d", data[i]);
 			strncpy((char *)buf, lbuf, buflen);
 			BUMP(buf, buflen);
 		}
diff --git a/src/appl/telnet/libtelnet/kerberos5.c b/src/appl/telnet/libtelnet/kerberos5.c
index 06c6e9847..40eb184ac 100644
--- a/src/appl/telnet/libtelnet/kerberos5.c
+++ b/src/appl/telnet/libtelnet/kerberos5.c
@@ -465,10 +465,10 @@ kerberos5_is(ap, data, cnt)
 					       ticket->server,0)->length] = '\0';
 		    if (strcmp("host", princ)) {
                         if(strlen(princ) < sizeof(errbuf) - 39) {
-                            (void) sprintf(errbuf, "incorrect service name: \"%s\" != \"host\"",
+			    (void) snprintf(errbuf, sizeof(errbuf), "incorrect service name: \"%s\" != \"host\"",
                                            princ);
                         } else {
-                            (void) sprintf(errbuf, "incorrect service name: principal != \"host\"");
+                            (void) snprintf(errbuf, sizeof(errbuf), "incorrect service name: principal != \"host\"");
                         }
 			goto errout;
 		    }
@@ -811,12 +811,12 @@ kerberos5_printsub(data, cnt, buf, buflen)
 #endif	/* FORWARD */
 
 	default:
-		sprintf(lbuf, " %d (unknown)", data[3]);
+		snprintf(lbuf, sizeof(lbuf), " %d (unknown)", data[3]);
 		strncpy((char *)buf, lbuf, buflen);
 	common2:
 		BUMP(buf, buflen);
 		for (i = 4; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
+			snprintf(lbuf, sizeof(lbuf), " %d", data[i]);
 			strncpy((char *)buf, lbuf, buflen);
 			BUMP(buf, buflen);
 		}
diff --git a/src/appl/telnet/libtelnet/spx.c b/src/appl/telnet/libtelnet/spx.c
index b12bd09cf..449ddc4f7 100644
--- a/src/appl/telnet/libtelnet/spx.c
+++ b/src/appl/telnet/libtelnet/spx.c
@@ -561,12 +561,12 @@ spx_printsub(data, cnt, buf, buflen)
 		goto common2;
 
 	default:
-		sprintf(lbuf, " %d (unknown)", data[3]);
+		snprintf(lbuf, sizeof(lbuf), " %d (unknown)", data[3]);
 		strncpy((char *)buf, lbuf, buflen);
 	common2:
 		BUMP(buf, buflen);
 		for (i = 4; i < cnt; i++) {
-			sprintf(lbuf, " %d", data[i]);
+			snprintf(lbuf, sizeof(lbuf), " %d", data[i]);
 			strncpy((char *)buf, lbuf, buflen);
 			BUMP(buf, buflen);
 		}
diff --git a/src/appl/telnet/telnet/commands.c b/src/appl/telnet/telnet/commands.c
index 92418dbed..f82f3e680 100644
--- a/src/appl/telnet/telnet/commands.c
+++ b/src/appl/telnet/telnet/commands.c
@@ -1747,8 +1747,8 @@ env_find(var)
 env_init()
 {
 	extern char **environ;
-	register char **epp, *cp;
-	register struct env_lst *ep;
+	char **epp, *cp;
+	struct env_lst *ep;
 
 	for (epp = environ; *epp; epp++) {
 		if ((cp = strchr(*epp, '='))) {
@@ -1772,8 +1772,7 @@ env_init()
 
 		gethostname(hbuf, 256);
 		hbuf[256] = '\0';
-		cp = (char *)malloc(strlen(hbuf) + strlen(cp2) + 1);
-		sprintf((char *)cp, "%s%s", hbuf, cp2);
+		asprintf(&cp, "%s%s", hbuf, cp2);
 		free(ep->value);
 		ep->value = (unsigned char *)cp;
 	}
diff --git a/src/appl/telnet/telnet/telnet.c b/src/appl/telnet/telnet/telnet.c
index 3b8a82d74..be00687e7 100644
--- a/src/appl/telnet/telnet/telnet.c
+++ b/src/appl/telnet/telnet/telnet.c
@@ -79,6 +79,8 @@
 #include <libtelnet/misc-proto.h>
 #endif	/* defined(AUTHENTICATION) || defined(ENCRYPTION)  */
 
+#include <k5-platform.h>
+
 static int is_unique (char *, char **, char **);
 
 
@@ -867,8 +869,8 @@ suboption()
 	    name = gettermname();
 	    len = strlen(name) + 4 + 2;
 	    if (len < NETROOM()) {
-		sprintf((char *)temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_TTYPE,
-				TELQUAL_IS, name, IAC, SE);
+		snprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c",
+			 IAC, SB, TELOPT_TTYPE, TELQUAL_IS, name, IAC, SE);
 		ring_supply_data(&netoring, temp, len);
 		printsub('>', &temp[2], len-2);
 	    } else {
@@ -889,8 +891,8 @@ suboption()
 
 	    TerminalSpeeds(&ispeed, &o_speed);
 
-	    sprintf((char *)temp, "%c%c%c%c%ld,%ld%c%c", IAC, SB, TELOPT_TSPEED,
-		    TELQUAL_IS, o_speed, ispeed, IAC, SE);
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%ld,%ld%c%c", IAC,
+		     SB, TELOPT_TSPEED, TELQUAL_IS, o_speed, ispeed, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 
 	    if (len < NETROOM()) {
@@ -995,8 +997,8 @@ suboption()
 		send_wont(TELOPT_XDISPLOC, 1);
 		break;
 	    }
-	    sprintf((char *)temp, "%c%c%c%c%s%c%c", IAC, SB, TELOPT_XDISPLOC,
-		    TELQUAL_IS, dp, IAC, SE);
+	    snprintf((char *)temp, sizeof(temp), "%c%c%c%c%s%c%c",
+		     IAC, SB, TELOPT_XDISPLOC, TELQUAL_IS, dp, IAC, SE);
 	    len = strlen((char *)temp+4) + 4;	/* temp[3] is 0 ... */
 
 	    if (len < NETROOM()) {
diff --git a/src/appl/telnet/telnet/utilities.c b/src/appl/telnet/telnet/utilities.c
index 4b198dabf..4a076e530 100644
--- a/src/appl/telnet/telnet/utilities.c
+++ b/src/appl/telnet/telnet/utilities.c
@@ -61,6 +61,8 @@
 #include <libtelnet/encrypt.h>
 #endif
 
+#include <k5-platform.h>
+
 FILE	*NetTrace = 0;		/* Not in bss, since needs to stay */
 int	prettydump;
 
@@ -646,7 +648,7 @@ printsub(direction, pointer, length)
 		}
 		{
 		    char tbuf[64];
-		    sprintf(tbuf, "%s%s%s%s%s",
+		    snprintf(tbuf, sizeof(tbuf), "%s%s%s%s%s",
 			pointer[2]&MODE_EDIT ? "|EDIT" : "",
 			pointer[2]&MODE_TRAPSIG ? "|TRAPSIG" : "",
 			pointer[2]&MODE_SOFT_TAB ? "|SOFT_TAB" : "",
diff --git a/src/appl/telnet/telnetd/slc.c b/src/appl/telnet/telnetd/slc.c
index 613674b01..8f32f433a 100644
--- a/src/appl/telnet/telnetd/slc.c
+++ b/src/appl/telnet/telnetd/slc.c
@@ -154,8 +154,8 @@ start_slc(getit)
 	slcchange = 0;
 	if (getit)
 		init_termbuf();
-	(void) sprintf((char *)slcbuf, "%c%c%c%c",
-					IAC, SB, TELOPT_LINEMODE, LM_SLC);
+	(void) snprintf((char *)slcbuf, sizeof(slcbuf), "%c%c%c%c",
+			IAC, SB, TELOPT_LINEMODE, LM_SLC);
 	slcptr = slcbuf + 4;
 
 }  /* end of start_slc */
@@ -195,8 +195,9 @@ end_slc(bufp)
 			*bufp = &slcbuf[4];
 			return(slcptr - slcbuf - 4);
 		} else {
-			(void) sprintf((char *)slcptr, "%c%c", IAC, SE);
-			slcptr += 2;
+			*slcptr++ = IAC;
+			*slcptr++ = SE;
+			*slcptr = 0;
 			len = slcptr - slcbuf;
 			netwrite(slcbuf, len);
 			netflush();  /* force it out immediately */
diff --git a/src/appl/telnet/telnetd/sys_term.c b/src/appl/telnet/telnetd/sys_term.c
index d86bafd8f..5c08c7606 100644
--- a/src/appl/telnet/telnetd/sys_term.c
+++ b/src/appl/telnet/telnetd/sys_term.c
@@ -1133,7 +1133,8 @@ startslave(host, autologin, autoname)
 	 */
 	if ((i = open(INIT_FIFO, O_WRONLY)) < 0) {
 		char tbuf[128];
-		(void) sprintf(tbuf, "Can't open %s\n", INIT_FIFO);
+		(void) snprintf(tbuf, sizeof(tbuf), "Can't open %s\n",
+				INIT_FIFO);
 		fatalperror(net, tbuf);
 	}
 	memset((char *)&request, 0, sizeof(request));
@@ -1156,7 +1157,8 @@ startslave(host, autologin, autoname)
 #endif /* BFTPDAEMON */
 	if (write(i, (char *)&request, sizeof(request)) < 0) {
 		char tbuf[128];
-		(void) sprintf(tbuf, "Can't write to %s\n", INIT_FIFO);
+		(void) snprintf(tbuf, sizeof(tbuf), "Can't write to %s\n",
+				INIT_FIFO);
 		fatalperror(net, tbuf);
 	}
 	(void) close(i);
@@ -1168,7 +1170,7 @@ startslave(host, autologin, autoname)
 		if (i == 3 || n >= 0 || !gotalarm)
 			break;
 		gotalarm = 0;
-		sprintf(tbuf, "telnetd: waiting for /etc/init to start login process on %s\r\n", line);
+		snprintf(tbuf, sizeof(tbuf), "telnetd: waiting for /etc/init to start login process on %s\r\n", line);
 		(void) write(net, tbuf, strlen(tbuf));
 	}
 	if (n < 0 && gotalarm)
@@ -1355,13 +1357,9 @@ start_login(host, autologin, name)
 			write(xpty, name, len);
 			write(xpty, name, len);
 			memset(speed, 0, sizeof(speed));
-			strncpy(speed,
-				(cp = getenv("TERM")) ? cp : "",
-				sizeof(speed)-1-(10*sizeof(def_rspeed)/4)-1);
-			/* 1 for /, () for the number, 1 for trailing 0. */
-			sprintf(speed + strlen(speed),
-				"/%d",
-				(def_rspeed > 0) ? def_rspeed : 9600);
+			snprintf(speed, sizeof(speed), "%s/%d",
+				 (cp = getenv("TERM")) ? cp : "",
+				 (def_rspeed > 0) ? def_rspeed : 9600);
 			len = strlen(speed)+1;
 			write(xpty, speed, len);