From: millert <millert@openbsd.org>
Date: Sun, 15 Sep 1996 22:25:54 +0000 (+0000)
Subject: sprintf -> snprintf paranoia
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=45c72c98602f59cee66f35b40cde794e091a5dc5;p=openbsd

sprintf -> snprintf paranoia
---

diff --git a/bin/ed/buf.c b/bin/ed/buf.c
index 67f57e77d7f..8feb876169a 100644
--- a/bin/ed/buf.c
+++ b/bin/ed/buf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: buf.c,v 1.4 1996/06/25 00:26:02 deraadt Exp $	*/
+/*	$OpenBSD: buf.c,v 1.5 1996/09/15 22:25:54 millert Exp $	*/
 /*	$NetBSD: buf.c,v 1.15 1995/04/23 10:07:28 cgd Exp $	*/
 
 /* buf.c: This file contains the scratch-file buffer rountines for the
@@ -33,7 +33,7 @@
 #if 0
 static char *rcsid = "@(#)buf.c,v 1.4 1994/02/01 00:34:35 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: buf.c,v 1.4 1996/06/25 00:26:02 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: buf.c,v 1.5 1996/09/15 22:25:54 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -67,7 +67,7 @@ get_sbuf_line(lp)
 		sfseek = lp->seek;
 		if (fseek(sfp, sfseek, SEEK_SET) < 0) {
 			fprintf(stderr, "%s\n", strerror(errno));
-			sprintf(errmsg, "cannot seek temp file");
+			snprintf(errmsg, sizeof(errmsg), "cannot seek temp file");
 			return NULL;
 		}
 	}
@@ -75,7 +75,7 @@ get_sbuf_line(lp)
 	REALLOC(sfbuf, sfbufsz, len + 1, NULL);
 	if ((ct = fread(sfbuf, sizeof(char), len, sfp)) <  0 || ct != len) {
 		fprintf(stderr, "%s\n", strerror(errno));
-		sprintf(errmsg, "cannot read temp file");
+		snprintf(errmsg, sizeof(errmsg), "cannot read temp file");
 		return NULL;
 	}
 	sfseek += len;				/* update file position */
@@ -96,14 +96,14 @@ put_sbuf_line(cs)
 
 	if ((lp = (line_t *) malloc(sizeof(line_t))) == NULL) {
 		fprintf(stderr, "%s\n", strerror(errno));
-		sprintf(errmsg, "out of memory");
+		snprintf(errmsg, sizeof(errmsg), "out of memory");
 		return NULL;
 	}
 	/* assert: cs is '\n' terminated */
 	for (s = cs; *s != '\n'; s++)
 		;
 	if (s - cs >= LINECHARS) {
-		sprintf(errmsg, "line too long");
+		snprintf(errmsg, sizeof(errmsg), "line too long");
 		return NULL;
 	}
 	len = s - cs;
@@ -111,7 +111,7 @@ put_sbuf_line(cs)
 	if (seek_write) {
 		if (fseek(sfp, 0L, SEEK_END) < 0) {
 			fprintf(stderr, "%s\n", strerror(errno));
-			sprintf(errmsg, "cannot seek temp file");
+			snprintf(errmsg, sizeof(errmsg), "cannot seek temp file");
 			return NULL;
 		}
 		sfseek = ftell(sfp);
@@ -121,7 +121,7 @@ put_sbuf_line(cs)
 	if ((ct = fwrite(cs, sizeof(char), len, sfp)) < 0 || ct != len) {
 		sfseek = -1;
 		fprintf(stderr, "%s\n", strerror(errno));
-		sprintf(errmsg, "cannot write temp file");
+		snprintf(errmsg, sizeof(errmsg), "cannot write temp file");
 		return NULL;
 	}
 	lp->len = len;
@@ -157,7 +157,7 @@ get_line_node_addr(lp)
 	while (cp != lp && (cp = cp->q_forw) != &buffer_head)
 		n++;
 	if (n && cp == &buffer_head) {
-		sprintf(errmsg, "invalid address");
+		snprintf(errmsg, sizeof(errmsg), "invalid address");
 		return ERR;
 	 }
 	 return n;
@@ -215,7 +215,7 @@ open_sbuf()
 		if (fd != -1)
 			close(fd);
 		fprintf(stderr, "%s: %s\n", sfn, strerror(errno));
-		sprintf(errmsg, "cannot open temp file");
+		snprintf(errmsg, sizeof(errmsg), "cannot open temp file");
 		umask(u);
 		return ERR;
 	}
@@ -231,7 +231,7 @@ close_sbuf()
 	if (sfp) {
 		if (fclose(sfp) < 0) {
 			fprintf(stderr, "%s: %s\n", sfn, strerror(errno));
-			sprintf(errmsg, "cannot close temp file");
+			snprintf(errmsg, sizeof(errmsg), "cannot close temp file");
 			return ERR;
 		}
 		sfp = NULL;
diff --git a/bin/ed/cbc.c b/bin/ed/cbc.c
index 133b5f20303..48fe9ecef5c 100644
--- a/bin/ed/cbc.c
+++ b/bin/ed/cbc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: cbc.c,v 1.2 1996/06/23 14:19:59 deraadt Exp $	*/
+/*	$OpenBSD: cbc.c,v 1.3 1996/09/15 22:25:54 millert Exp $	*/
 /*	$NetBSD: cbc.c,v 1.9 1995/03/21 09:04:36 cgd Exp $	*/
 
 /* cbc.c: This file contains the encryption routines for the ed line editor */
@@ -44,7 +44,7 @@
 #if 0
 static char *rcsid = "@(#)cbc.c,v 1.2 1994/02/01 00:34:36 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: cbc.c,v 1.2 1996/06/23 14:19:59 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: cbc.c,v 1.3 1996/09/15 22:25:54 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -212,7 +212,7 @@ void
 des_error(s)
 	char *s;		/* the message */
 {
-	(void)sprintf(errmsg, "%s", s ? s : strerror(errno));
+	(void)snprintf(errmsg, sizeof(errmsg), "%s", s ? s : strerror(errno));
 }
 
 /*
diff --git a/bin/ed/ed.h b/bin/ed/ed.h
index c710b5bbd97..1f827ff394b 100644
--- a/bin/ed/ed.h
+++ b/bin/ed/ed.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ed.h,v 1.3 1996/08/22 00:35:17 deraadt Exp $	*/
+/*	$OpenBSD: ed.h,v 1.4 1996/09/15 22:25:55 millert Exp $	*/
 /*	$NetBSD: ed.h,v 1.23 1995/03/21 09:04:40 cgd Exp $	*/
 
 /* ed.h: type and constant definitions for the ed editor. */
@@ -116,7 +116,7 @@ if (--mutex == 0) { \
 #define STRTOL(i, p) { \
 	if (((i = strtol(p, &p, 10)) == LONG_MIN || i == LONG_MAX) && \
 	    errno == ERANGE) { \
-		sprintf(errmsg, "number out of range"); \
+		snprintf(errmsg, sizeof(errmsg), "number out of range"); \
 	    	i = 0; \
 		return ERR; \
 	} \
@@ -132,14 +132,14 @@ if ((i) > (n)) { \
 	if ((b) != NULL) { \
 		if ((ts = (char *) realloc((b), ti += max((i), MINBUFSZ))) == NULL) { \
 			fprintf(stderr, "%s\n", strerror(errno)); \
-			sprintf(errmsg, "out of memory"); \
+			snprintf(errmsg, sizeof(errmsg), "out of memory"); \
 			SPL0(); \
 			return err; \
 		} \
 	} else { \
 		if ((ts = (char *) malloc(ti += max((i), MINBUFSZ))) == NULL) { \
 			fprintf(stderr, "%s\n", strerror(errno)); \
-			sprintf(errmsg, "out of memory"); \
+			snprintf(errmsg, sizeof(errmsg), "out of memory"); \
 			SPL0(); \
 			return err; \
 		} \
@@ -157,7 +157,7 @@ if ((i) > (n)) { \
 	SPL1(); \
 	if ((ts = (char *) realloc((b), ti += max((i), MINBUFSZ))) == NULL) { \
 		fprintf(stderr, "%s\n", strerror(errno)); \
-		sprintf(errmsg, "out of memory"); \
+		snprintf(errmsg, sizeof(errmsg), "out of memory"); \
 		SPL0(); \
 		return err; \
 	} \
@@ -289,7 +289,7 @@ extern int sigflags;
 /* global vars */
 extern long addr_last;
 extern long current_addr;
-extern char errmsg[];
+extern char errmsg[MAXPATHLEN + 40];
 extern long first_addr;
 extern int lineno;
 extern long second_addr;
diff --git a/bin/ed/glbl.c b/bin/ed/glbl.c
index 736637994c1..3cbebd97758 100644
--- a/bin/ed/glbl.c
+++ b/bin/ed/glbl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: glbl.c,v 1.2 1996/06/23 14:20:01 deraadt Exp $	*/
+/*	$OpenBSD: glbl.c,v 1.3 1996/09/15 22:25:55 millert Exp $	*/
 /*	$NetBSD: glbl.c,v 1.2 1995/03/21 09:04:41 cgd Exp $	*/
 
 /* glob.c: This file contains the global command routines for the ed line
@@ -33,7 +33,7 @@
 #if 0
 static char *rcsid = "@(#)glob.c,v 1.1 1994/02/01 00:34:40 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: glbl.c,v 1.2 1996/06/23 14:20:01 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: glbl.c,v 1.3 1996/09/15 22:25:55 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -55,7 +55,7 @@ build_active_list(isgcmd)
 	char delimiter;
 
 	if ((delimiter = *ibufp) == ' ' || delimiter == '\n') {
-		sprintf(errmsg, "invalid pattern delimiter");
+		snprintf(errmsg, sizeof(errmsg), "invalid pattern delimiter");
 		return ERR;
 	} else if ((pat = get_compiled_pattern()) == NULL)
 		return ERR;
@@ -115,13 +115,15 @@ exec_global(interact, gflag)
 			if (n < 0)
 				return ERR;
 			else if (n == 0) {
-				sprintf(errmsg, "unexpected end-of-file");
+				snprintf(errmsg, sizeof(errmsg),
+					 "unexpected end-of-file");
 				return ERR;
 			} else if (n == 1 && !strcmp(ibuf, "\n"))
 				continue;
 			else if (n == 2 && !strcmp(ibuf, "&\n")) {
 				if (cmd == NULL) {
-					sprintf(errmsg, "no previous command");
+					snprintf(errmsg, sizeof(errmsg),
+						 "no previous command");
 					return ERR;
 				} else cmd = ocmd;
 			} else if ((cmd = get_extended_line(&n, 0)) == NULL)
@@ -166,7 +168,7 @@ set_active_node(lp)
 			if ((ts = (line_t **) realloc(active_list, 
 			    (ti += MINBUFSZ) * sizeof(line_t **))) == NULL) {
 				fprintf(stderr, "%s\n", strerror(errno));
-				sprintf(errmsg, "out of memory");
+				snprintf(errmsg, sizeof(errmsg), "out of memory");
 				SPL0();
 				return ERR;
 			}
@@ -175,7 +177,7 @@ set_active_node(lp)
 			if ((ts = (line_t **) malloc((ti += MINBUFSZ) * 
 			    sizeof(line_t **))) == NULL) {
 				fprintf(stderr, "%s\n", strerror(errno));
-				sprintf(errmsg, "out of memory");
+				snprintf(errmsg, sizeof(errmsg), "out of memory");
 				SPL0();
 				return ERR;
 			}
diff --git a/bin/ed/io.c b/bin/ed/io.c
index a05e96a3a9e..fbf1b3cd9d9 100644
--- a/bin/ed/io.c
+++ b/bin/ed/io.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: io.c,v 1.2 1996/06/23 14:20:02 deraadt Exp $	*/
+/*	$OpenBSD: io.c,v 1.3 1996/09/15 22:25:56 millert Exp $	*/
 /*	$NetBSD: io.c,v 1.2 1995/03/21 09:04:43 cgd Exp $	*/
 
 /* io.c: This file contains the i/o routines for the ed line editor */
@@ -32,7 +32,7 @@
 #if 0
 static char *rcsid = "@(#)io.c,v 1.1 1994/02/01 00:34:41 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: io.c,v 1.2 1996/06/23 14:20:02 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: io.c,v 1.3 1996/09/15 22:25:56 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -54,13 +54,13 @@ read_file(fn, n)
 	fp = (*fn == '!') ? popen(fn + 1, "r") : fopen(strip_escapes(fn), "r");
 	if (fp == NULL) {
 		fprintf(stderr, "%s: %s\n", fn, strerror(errno));
-		sprintf(errmsg, "cannot open input file");
+		snprintf(errmsg, sizeof(errmsg), "cannot open input file");
 		return ERR;
 	} else if ((size = read_stream(fp, n)) < 0)
 		return ERR;
 	 else if (((*fn == '!') ?  pclose(fp) : fclose(fp)) < 0) {
 		fprintf(stderr, "%s: %s\n", fn, strerror(errno));
-		sprintf(errmsg, "cannot close input file");
+		snprintf(errmsg, sizeof(errmsg), "cannot close input file");
 		return ERR;
 	}
 	fprintf(stderr, !scripted ? "%lu\n" : "", size);
@@ -144,7 +144,7 @@ get_stream_line(fp)
 		sbuf[i++] = c;
 	else if (ferror(fp)) {
 		fprintf(stderr, "%s\n", strerror(errno));
-		sprintf(errmsg, "cannot read input file");
+		snprintf(errmsg, sizeof(errmsg), "cannot read input file");
 		return ERR;
 	} else if (i) {
 		sbuf[i++] = '\n';
@@ -169,13 +169,13 @@ write_file(fn, mode, n, m)
 	fp = (*fn == '!') ? popen(fn+1, "w") : fopen(strip_escapes(fn), mode);
 	if (fp == NULL) {
 		fprintf(stderr, "%s: %s\n", fn, strerror(errno));
-		sprintf(errmsg, "cannot open output file");
+		snprintf(errmsg, sizeof(errmsg), "cannot open output file");
 		return ERR;
 	} else if ((size = write_stream(fp, n, m)) < 0)
 		return ERR;
 	 else if (((*fn == '!') ?  pclose(fp) : fclose(fp)) < 0) {
 		fprintf(stderr, "%s: %s\n", fn, strerror(errno));
-		sprintf(errmsg, "cannot close output file");
+		snprintf(errmsg, sizeof(errmsg), "cannot close output file");
 		return ERR;
 	}
 	fprintf(stderr, !scripted ? "%lu\n" : "", size);
@@ -225,7 +225,7 @@ put_stream_line(fp, s, len)
 	while (len--)
 		if ((des ? put_des_char(*s++, fp) : fputc(*s++, fp)) < 0) {
 			fprintf(stderr, "%s\n", strerror(errno));
-			sprintf(errmsg, "cannot write file");
+			snprintf(errmsg, sizeof(errmsg), "cannot write file");
 			return ERR;
 		}
 	return 0;
@@ -258,7 +258,7 @@ get_extended_line(sizep, nonl)
 		if ((n = get_tty_line()) < 0)
 			return NULL;
 		else if (n == 0 || ibuf[n - 1] != '\n') {
-			sprintf(errmsg, "unexpected end-of-file");
+			snprintf(errmsg, sizeof(errmsg), "unexpected end-of-file");
 			return NULL;
 		}
 		REALLOC(cvbuf, cvbufsz, l + n, NULL);
@@ -299,7 +299,7 @@ get_tty_line()
 		case EOF:
 			if (ferror(stdin)) {
 				fprintf(stderr, "stdin: %s\n", strerror(errno));
-				sprintf(errmsg, "cannot read stdin");
+				snprintf(errmsg, sizeof(errmsg), "cannot read stdin");
 				clearerr(stdin);
 				ibufp = NULL;
 				return ERR;
diff --git a/bin/ed/main.c b/bin/ed/main.c
index 8033267425e..64e9447299e 100644
--- a/bin/ed/main.c
+++ b/bin/ed/main.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: main.c,v 1.2 1996/06/23 14:20:02 deraadt Exp $	*/
+/*	$OpenBSD: main.c,v 1.3 1996/09/15 22:25:57 millert Exp $	*/
 /*	$NetBSD: main.c,v 1.3 1995/03/21 09:04:44 cgd Exp $	*/
 
 /* main.c: This file contains the main control and user-interface routines
@@ -39,7 +39,7 @@ char *copyright =
 #if 0
 static char *rcsid = "@(#)main.c,v 1.1 1994/02/01 00:34:42 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: main.c,v 1.2 1996/06/23 14:20:02 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: main.c,v 1.3 1996/09/15 22:25:57 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -104,7 +104,6 @@ char *dps = "*";		/* default command-line prompt */
 
 char *usage = "usage: %s [-] [-sx] [-p string] [name]\n";
 
-extern char errmsg[];
 extern int optind;
 extern char *optarg;
 
@@ -165,7 +164,7 @@ top:
 #endif
 	{
 		fputs("\n?\n", stderr);
-		sprintf(errmsg, "interrupt");
+		snprintf(errmsg, sizeof(errmsg), "interrupt");
 	} else {
 		init_buffers();
 		sigactive = 1;			/* enable signal handlers */
@@ -177,7 +176,7 @@ top:
 		} else if (argc) {
 			fputs("?\n", stderr);
 			if (**argv == '\0')
-				sprintf(errmsg, "invalid filename");
+				snprintf(errmsg, sizeof(errmsg), "invalid filename");
 			if (!isatty(0))
 				quit(2);
 		}
@@ -195,7 +194,7 @@ top:
 		} else if (n == 0) {
 			if (modified && !scripted) {
 				fputs("?\n", stderr);
-				sprintf(errmsg, "warning: file modified");
+				snprintf(errmsg, sizeof(errmsg), "warning: file modified");
 				if (!isatty(0)) {
 					fprintf(stderr, garrulous ? 
 					    "script, line %d: %s\n" :
@@ -210,7 +209,7 @@ top:
 				quit(0);
 		} else if (ibuf[n - 1] != '\n') {
 			/* discard line */
-			sprintf(errmsg, "unexpected end-of-file");
+			snprintf(errmsg, sizeof(errmsg), "unexpected end-of-file");
 			clearerr(stdin);
 			status = ERR;
 			continue;
@@ -228,7 +227,7 @@ top:
 		case EMOD:
 			modified = 0;
 			fputs("?\n", stderr);		/* give warning */
-			sprintf(errmsg, "warning: file modified");
+			snprintf(errmsg, sizeof(errmsg), "warning: file modified");
 			if (!isatty(0)) {
 				fprintf(stderr, garrulous ? 
 				    "script, line %d: %s\n" : 
@@ -288,7 +287,7 @@ extract_addr_range()
 #define	SKIP_BLANKS() while (isspace(*ibufp) && *ibufp != '\n') ibufp++
 
 #define MUST_BE_FIRST() \
-	if (!first) { sprintf(errmsg, "invalid address"); return ERR; }
+	if (!first) { snprintf(errmsg, sizeof(errmsg), "invalid address"); return ERR; }
 
 /*  next_addr: return the next line address in the command buffer */
 long
@@ -358,7 +357,8 @@ next_addr()
 			if (ibufp == hd)
 				return EOF;
 			else if (addr < 0 || addr_last < addr) {
-				sprintf(errmsg, "invalid address");
+				snprintf(errmsg, sizeof(errmsg),
+					 "invalid address");
 				return ERR;
 			} else
 				return addr;
@@ -377,10 +377,10 @@ next_addr()
 	if (extract_addr_range() < 0) \
 		return ERR; \
 	else if (addr_cnt == 0) { \
-		sprintf(errmsg, "destination expected"); \
+		snprintf(errmsg, sizeof(errmsg), "destination expected"); \
 		return ERR; \
 	} else if (second_addr < 0 || addr_last < second_addr) { \
-		sprintf(errmsg, "invalid address"); \
+		snprintf(errmsg, sizeof(errmsg), "invalid address"); \
 		return ERR; \
 	} \
 	addr = second_addr; \
@@ -396,7 +396,7 @@ next_addr()
 	if (extract_addr_range() < 0) \
 		return ERR; \
 	if (second_addr < 0 || addr_last < second_addr) { \
-		sprintf(errmsg, "invalid address"); \
+		snprintf(errmsg, sizeof(errmsg), "invalid address"); \
 		return ERR; \
 	} \
 	addr = second_addr; \
@@ -424,7 +424,7 @@ next_addr()
 		} \
 	} while (!done); \
 	if (*ibufp++ != '\n') { \
-		sprintf(errmsg, "invalid command suffix"); \
+		snprintf(errmsg, sizeof(errmsg), "invalid command suffix"); \
 		return ERR; \
 	} \
 }
@@ -493,10 +493,11 @@ exec_command()
 		/* fall through */
 	case 'E':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		} else if (!isspace(*ibufp)) {
-			sprintf(errmsg, "unexpected command suffix");
+			snprintf(errmsg, sizeof(errmsg),
+				 "unexpected command suffix");
 			return ERR;
 		} else if ((fnp = get_filename()) == NULL)
 			return ERR;
@@ -511,7 +512,7 @@ exec_command()
 		if (*fnp && *fnp != '!') strcpy(old_filename, fnp);
 #ifdef BACKWARDS
 		if (*fnp == '\0' && *old_filename == '\0') {
-			sprintf(errmsg, "no current filename");
+			snprintf(errmsg, sizeof(errmsg), "no current filename");
 			return ERR;
 		}
 #endif
@@ -523,15 +524,16 @@ exec_command()
 		break;
 	case 'f':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		} else if (!isspace(*ibufp)) {
-			sprintf(errmsg, "unexpected command suffix");
+			snprintf(errmsg, sizeof(errmsg),
+				 "unexpected command suffix");
 			return ERR;
 		} else if ((fnp = get_filename()) == NULL)
 			return ERR;
 		else if (*fnp == '!') {
-			sprintf(errmsg, "invalid redirection");
+			snprintf(errmsg, sizeof(errmsg), "invalid redirection");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -543,7 +545,8 @@ exec_command()
 	case 'G':
 	case 'V':
 		if (isglobal) {
-			sprintf(errmsg, "cannot nest global commands");
+			snprintf(errmsg, sizeof(errmsg),
+				 "cannot nest global commands");
 			return ERR;
 		} else if (check_addr_range(1, addr_last) < 0)
 			return ERR;
@@ -557,7 +560,7 @@ exec_command()
 		break;
 	case 'h':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -565,7 +568,7 @@ exec_command()
 		break;
 	case 'H':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -574,7 +577,7 @@ exec_command()
 		break;
 	case 'i':
 		if (second_addr == 0) {
-			sprintf(errmsg, "invalid address");
+			snprintf(errmsg, sizeof(errmsg), "invalid address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -594,7 +597,7 @@ exec_command()
 	case 'k':
 		c = *ibufp++;
 		if (second_addr == 0) {
-			sprintf(errmsg, "invalid address");
+			snprintf(errmsg, sizeof(errmsg), "invalid address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -614,7 +617,7 @@ exec_command()
 			return ERR;
 		GET_THIRD_ADDR(addr);
 		if (first_addr <= addr && addr < second_addr) {
-			sprintf(errmsg, "invalid destination");
+			snprintf(errmsg, sizeof(errmsg), "invalid destination");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -640,7 +643,7 @@ exec_command()
 		break;
 	case 'P':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -649,7 +652,7 @@ exec_command()
 	case 'q':
 	case 'Q':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -657,7 +660,8 @@ exec_command()
 		break;
 	case 'r':
 		if (!isspace(*ibufp)) {
-			sprintf(errmsg, "unexpected command suffix");
+			snprintf(errmsg, sizeof(errmsg),
+				 "unexpected command suffix");
 			return ERR;
 		} else if (addr_cnt == 0)
 			second_addr = addr_last;
@@ -669,7 +673,7 @@ exec_command()
 			strcpy(old_filename, fnp);
 #ifdef BACKWARDS
 		if (*fnp == '\0' && *old_filename == '\0') {
-			sprintf(errmsg, "no current filename");
+			snprintf(errmsg, sizeof(errmsg), "no current filename");
 			return ERR;
 		}
 #endif
@@ -704,18 +708,21 @@ exec_command()
 				break;
 			default:
 				if (sflags) {
-					sprintf(errmsg, "invalid command suffix");
+					snprintf(errmsg, sizeof(errmsg),
+						 "invalid command suffix");
 					return ERR;
 				}
 			}
 		} while (sflags && *ibufp != '\n');
 		if (sflags && !pat) {
-			sprintf(errmsg, "no previous substitution");
+			snprintf(errmsg, sizeof(errmsg),
+				 "no previous substitution");
 			return ERR;
 		} else if (sflags & SGG)
 			sgnum = 0;		/* override numeric arg */
 		if (*ibufp != '\n' && *(ibufp + 1) == '\n') {
-			sprintf(errmsg, "invalid pattern delimiter");
+			snprintf(errmsg, sizeof(errmsg),
+				 "invalid pattern delimiter");
 			return ERR;
 		}
 		tpat = pat;
@@ -776,7 +783,7 @@ exec_command()
 		break;
 	case 'u':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
@@ -790,7 +797,8 @@ exec_command()
 			ibufp++;
 		}
 		if (!isspace(*ibufp)) {
-			sprintf(errmsg, "unexpected command suffix");
+			snprintf(errmsg, sizeof(errmsg),
+				 "unexpected command suffix");
 			return ERR;
 		} else if ((fnp = get_filename()) == NULL)
 			return ERR;
@@ -803,7 +811,7 @@ exec_command()
 			strcpy(old_filename, fnp);
 #ifdef BACKWARDS
 		if (*fnp == '\0' && *old_filename == '\0') {
-			sprintf(errmsg, "no current filename");
+			snprintf(errmsg, sizeof(errmsg), "no current filename");
 			return ERR;
 		}
 #endif
@@ -817,14 +825,14 @@ exec_command()
 		break;
 	case 'x':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		}
 		GET_COMMAND_SUFFIX();
 #ifdef DES
 		des = get_keyword();
 #else
-		sprintf(errmsg, "crypt unavailable");
+		snprintf(errmsg, sizeof(errmsg), "crypt unavailable");
 		return ERR;
 #endif
 		break;
@@ -849,7 +857,7 @@ exec_command()
 		break;
 	case '!':
 		if (addr_cnt > 0) {
-			sprintf(errmsg, "unexpected address");
+			snprintf(errmsg, sizeof(errmsg), "unexpected address");
 			return ERR;
 		} else if ((sflags = get_shell_command()) < 0)
 			return ERR;
@@ -868,7 +876,7 @@ exec_command()
 			return ERR;
 		break;
 	default:
-		sprintf(errmsg, "unknown command");
+		snprintf(errmsg, sizeof(errmsg), "unknown command");
 		return ERR;
 	}
 	return gflag;
@@ -886,7 +894,7 @@ check_addr_range(n, m)
 	}
 	if (first_addr > second_addr || 1 > first_addr ||
 	    second_addr > addr_last) {
-		sprintf(errmsg, "invalid address");
+		snprintf(errmsg, sizeof(errmsg), "invalid address");
 		return ERR;
 	}
 	return 0;
@@ -917,7 +925,7 @@ get_matching_node_addr(pat, dir)
 				return n;
 		}
 	} while (n != current_addr);
-	sprintf(errmsg, "no match");
+	snprintf(errmsg, sizeof(errmsg), "no match");
 	return  ERR;
 }
 
@@ -934,7 +942,7 @@ get_filename()
 	if (*ibufp != '\n') {
 		SKIP_BLANKS();
 		if (*ibufp == '\n') {
-			sprintf(errmsg, "invalid filename");
+			snprintf(errmsg, sizeof(errmsg), "invalid filename");
 			return NULL;
 		} else if ((ibufp = get_extended_line(&n, 1)) == NULL)
 			return NULL;
@@ -945,13 +953,13 @@ get_filename()
 			if (n) printf("%s\n", shcmd + 1);
 			return shcmd;
 		} else if (n - 1 > MAXPATHLEN) {
-			sprintf(errmsg, "filename too long");
+			snprintf(errmsg, sizeof(errmsg), "filename too long");
 			return  NULL;
 		}
 	}
 #ifndef BACKWARDS
 	else if (*old_filename == '\0') {
-		sprintf(errmsg, "no current filename");
+		snprintf(errmsg, sizeof(errmsg), "no current filename");
 		return  NULL;
 	}
 #endif
@@ -976,7 +984,7 @@ get_shell_command()
 	int j = 0;
 
 	if (red) {
-		sprintf(errmsg, "shell access restricted");
+		snprintf(errmsg, sizeof(errmsg), "shell access restricted");
 		return ERR;
 	} else if ((s = ibufp = get_extended_line(&j, 1)) == NULL)
 		return ERR;
@@ -1001,7 +1009,8 @@ get_shell_command()
 			else if (shcmd == NULL)
 #endif
 			{
-				sprintf(errmsg, "no previous command");
+				snprintf(errmsg, sizeof(errmsg),
+					 "no previous command");
 				return ERR;
 			} else {
 				REALLOC(buf, n, i + shcmdi, ERR);
@@ -1012,7 +1021,8 @@ get_shell_command()
 			break;
 		case '%':
 			if (*old_filename  == '\0') {
-				sprintf(errmsg, "no current filename");
+				snprintf(errmsg, sizeof(errmsg),
+					 "no current filename");
 				return ERR;
 			}
 			j = strlen(s = strip_escapes(old_filename));
@@ -1239,7 +1249,7 @@ display_lines(from, to, gflag)
 	char *s;
 
 	if (!from) {
-		sprintf(errmsg, "invalid address");
+		snprintf(errmsg, sizeof(errmsg), "invalid address");
 		return ERR;
 	}
 	ep = get_addressed_line_node(INC_MOD(to, addr_last));
@@ -1266,7 +1276,7 @@ mark_line_node(lp, n)
 	int n;
 {
 	if (!islower(n)) {
-		sprintf(errmsg, "invalid mark character");
+		snprintf(errmsg, sizeof(errmsg), "invalid mark character");
 		return ERR;
 	} else if (mark[n - 'a'] == NULL)
 		markno++;
@@ -1281,7 +1291,7 @@ get_marked_node_addr(n)
 	int n;
 {
 	if (!islower(n)) {
-		sprintf(errmsg, "invalid mark character");
+		snprintf(errmsg, sizeof(errmsg), "invalid mark character");
 		return ERR;
 	}
 	return get_line_node_addr(mark[n - 'a']);
@@ -1312,7 +1322,7 @@ dup_line_node(lp)
 
 	if ((np = (line_t *) malloc(sizeof(line_t))) == NULL) {
 		fprintf(stderr, "%s\n", strerror(errno));
-		sprintf(errmsg, "out of memory");
+		snprintf(errmsg, sizeof(errmsg), "out of memory");
 		return NULL;
 	}
 	np->seek = lp->seek;
@@ -1432,7 +1442,7 @@ is_legal_filename(s)
 	char *s;
 {
 	if (red && (*s == '!' || !strcmp(s, "..") || strchr(s, '/'))) {
-		sprintf(errmsg, "shell access restricted");
+		snprintf(errmsg, sizeof(errmsg), "shell access restricted");
 		return 0;
 	}
 	return 1;
diff --git a/bin/ed/re.c b/bin/ed/re.c
index 93534bd9a9e..64d98990670 100644
--- a/bin/ed/re.c
+++ b/bin/ed/re.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: re.c,v 1.2 1996/06/23 14:20:03 deraadt Exp $	*/
+/*	$OpenBSD: re.c,v 1.3 1996/09/15 22:25:57 millert Exp $	*/
 /*	$NetBSD: re.c,v 1.14 1995/03/21 09:04:48 cgd Exp $	*/
 
 /* re.c: This file contains the regular expression interface routines for
@@ -33,7 +33,7 @@
 #if 0
 static char *rcsid = "@(#)re.c,v 1.6 1994/02/01 00:34:43 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: re.c,v 1.2 1996/06/23 14:20:03 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: re.c,v 1.3 1996/09/15 22:25:57 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -56,10 +56,11 @@ get_compiled_pattern()
 	int n;
 
 	if ((delimiter = *ibufp) == ' ') {
-		sprintf(errmsg, "invalid pattern delimiter");
+		snprintf(errmsg, sizeof(errmsg), "invalid pattern delimiter");
 		return NULL;
 	} else if (delimiter == '\n' || *++ibufp == '\n' || *ibufp == delimiter) {
-		if (!exp) sprintf(errmsg, "no previous pattern");
+		if (!exp)
+			snprintf(errmsg, sizeof(errmsg), "no previous pattern");
 		return exp;
 	} else if ((exps = extract_pattern(delimiter)) == NULL)
 		return NULL;
@@ -68,7 +69,7 @@ get_compiled_pattern()
 		regfree(exp);
 	else if ((exp = (pattern_t *) malloc(sizeof(pattern_t))) == NULL) {
 		fprintf(stderr, "%s\n", strerror(errno));
-		sprintf(errmsg, "out of memory");
+		snprintf(errmsg, sizeof(errmsg), "out of memory");
 		return NULL;
 	}
 	patlock = 0;
@@ -99,13 +100,15 @@ extract_pattern(delimiter)
 			break;
 		case '[':
 			if ((nd = parse_char_class(++nd)) == NULL) {
-				sprintf(errmsg, "unbalanced brackets ([])");
+				snprintf(errmsg, sizeof(errmsg),
+					 "unbalanced brackets ([])");
 				return NULL;
 			}
 			break;
 		case '\\':
 			if (*++nd == '\n') {
-				sprintf(errmsg, "trailing backslash (\\)");
+				snprintf(errmsg, sizeof(errmsg),
+					 "trailing backslash (\\)");
 				return NULL;
 			}
 			break;
diff --git a/bin/ed/sub.c b/bin/ed/sub.c
index 71fb8ef6007..0234dc2ba21 100644
--- a/bin/ed/sub.c
+++ b/bin/ed/sub.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: sub.c,v 1.2 1996/06/23 14:20:04 deraadt Exp $	*/
+/*	$OpenBSD: sub.c,v 1.3 1996/09/15 22:25:58 millert Exp $	*/
 /*	$NetBSD: sub.c,v 1.4 1995/03/21 09:04:50 cgd Exp $	*/
 
 /* sub.c: This file contains the substitution routines for the ed 
@@ -33,7 +33,7 @@
 #if 0
 static char *rcsid = "@(#)sub.c,v 1.1 1994/02/01 00:34:44 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: sub.c,v 1.2 1996/06/23 14:20:04 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: sub.c,v 1.3 1996/09/15 22:25:58 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -88,7 +88,8 @@ extract_subst_template()
 
 	if (*ibufp == '%' && *(ibufp + 1) == delimiter) {
 		ibufp++;
-		if (!rhbuf) sprintf(errmsg, "no previous substitution");
+		if (!rhbuf)
+			snprintf(errmsg, sizeof(errmsg), "no previous substitution");
 		return rhbuf;
 	}
 	while (*ibufp != delimiter) {
@@ -165,7 +166,7 @@ search_and_replace(pat, gflag, kth)
 	}
 	current_addr = xa;
 	if  (nsubs == 0 && !(gflag & GLB)) {
-		sprintf(errmsg, "no match");
+		snprintf(errmsg, sizeof(errmsg), "no match");
 		return ERR;
 	} else if ((gflag & (GPR | GLS | GNP)) &&
 	    display_lines(current_addr, current_addr, gflag) < 0)
@@ -223,7 +224,7 @@ substitute_matching_text(pat, lp, gflag, kth)
 		i = eot - txt;
 		REALLOC(rbuf, rbufsz, off + i + 2, ERR);
 		if (i > 0 && !rm[0].rm_eo && (gflag & GSG)) {
-			sprintf(errmsg, "infinite substitution loop");
+			snprintf(errmsg, sizeof(errmsg), "infinite substitution loop");
 			return  ERR;
 		}
 		if (isbinary)
diff --git a/bin/ed/undo.c b/bin/ed/undo.c
index dbb0fdebe09..4fa60d2cf9c 100644
--- a/bin/ed/undo.c
+++ b/bin/ed/undo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: undo.c,v 1.2 1996/06/23 14:20:04 deraadt Exp $	*/
+/*	$OpenBSD: undo.c,v 1.3 1996/09/15 22:25:58 millert Exp $	*/
 /*	$NetBSD: undo.c,v 1.2 1995/03/21 09:04:52 cgd Exp $	*/
 
 /* undo.c: This file contains the undo routines for the ed line editor */
@@ -32,7 +32,7 @@
 #if 0
 static char *rcsid = "@(#)undo.c,v 1.1 1994/02/01 00:34:44 alm Exp";
 #else
-static char rcsid[] = "$OpenBSD: undo.c,v 1.2 1996/06/23 14:20:04 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: undo.c,v 1.3 1996/09/15 22:25:58 millert Exp $";
 #endif
 #endif /* not lint */
 
@@ -57,7 +57,7 @@ push_undo_stack(type, from, to)
 	if (ustack == NULL &&
 	    (ustack = (undo_t *) malloc((usize = USIZE) * sizeof(undo_t))) == NULL) {
 		fprintf(stderr, "%s\n", strerror(errno));
-		sprintf(errmsg, "out of memory");
+		snprintf(errmsg, sizeof(errmsg), "out of memory");
 		return NULL;
 	}
 #endif
@@ -72,7 +72,7 @@ push_undo_stack(type, from, to)
 	}
 	/* out of memory - release undo stack */
 	fprintf(stderr, "%s\n", strerror(errno));
-	sprintf(errmsg, "out of memory");
+	snprintf(errmsg, sizeof(errmsg), "out of memory");
 	clear_undo_stack();
 	free(ustack);
 	ustack = NULL;
@@ -100,7 +100,7 @@ pop_undo_stack()
 	long o_addr_last = addr_last;
 
 	if (u_current_addr == -1 || u_addr_last == -1) {
-		sprintf(errmsg, "nothing to undo");
+		snprintf(errmsg, sizeof(errmsg), "nothing to undo");
 		return ERR;
 	} else if (u_p)
 		modified = 1;
diff --git a/bin/expr/expr.c b/bin/expr/expr.c
index 14538ee5b87..49b1736ba8e 100644
--- a/bin/expr/expr.c
+++ b/bin/expr/expr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: expr.c,v 1.3 1996/06/23 14:20:10 deraadt Exp $	*/
+/*	$OpenBSD: expr.c,v 1.4 1996/09/15 22:27:38 millert Exp $	*/
 /*	$NetBSD: expr.c,v 1.3.6.1 1996/06/04 20:41:47 cgd Exp $	*/
 
 /*
@@ -157,7 +157,7 @@ to_string(vp)
 	if (tmp == NULL) {
 		err(2, NULL);
 	}
-	sprintf(tmp, "%d", vp->u.i);
+	snprintf(tmp, 25, "%d", vp->u.i);
 	vp->type = string;
 	vp->u.s = tmp;
 }