Examine all occurrences of sprintf(), strcat(), and str[n]cpy()

for possible buffer overflow problems. Replaced most sprintf()'s
with snprintf(); for others cases, added terminating NUL bytes where
appropriate, replaced constants like "16" with sizeof(), etc.

These changes include several bug fixes, but most changes are for
maintainability's sake. Any instance where it wasn't "immediately
obvious" that a buffer overflow could not occur was made safer.

Reviewed by:	Bruce Evans <bde@zeta.org.au>
Reviewed by:	Matthew Dillon <dillon@apollo.backplane.com>
Reviewed by:	Mike Spengler <mks@networkcs.com>

22 files changed, 80 insertions, 67 deletions

diff --git a/sys/dev/advansys/advansys.c b/sys/dev/advansys/advansys.c
index 40b76e9..de58917 100644
--- a/sys/dev/advansys/advansys.c
+++ b/sys/dev/advansys/advansys.c
@@ -32,7 +32,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: advansys.c,v 1.4 1998/10/15 23:47:14 gibbs Exp $
+ *      $Id: advansys.c,v 1.5 1998/10/29 17:41:34 gibbs Exp $
  */
 /*
  * Ported from:
@@ -134,7 +134,7 @@ adv_name(struct adv_softc *adv)
 {
 	static char name[10];
 
-	sprintf(name, "adv%d", adv->unit);
+	snprintf(name, sizeof(name), "adv%d", adv->unit);
 	return (name);
 }
 
diff --git a/sys/dev/aha/aha.c b/sys/dev/aha/aha.c
index e892865..0fe69c0 100644
--- a/sys/dev/aha/aha.c
+++ b/sys/dev/aha/aha.c
@@ -55,7 +55,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: aha.c,v 1.12 1998/11/10 06:47:09 gibbs Exp $
+ *      $Id: aha.c,v 1.13 1998/11/25 19:12:56 imp Exp $
  */
 
 #include <sys/param.h>
@@ -388,31 +388,31 @@ aha_fetch_adapter_info(struct aha_softc *aha)
 	
 	switch (aha->boardid) {
 	case BOARD_1540_16HEAD_BIOS:
-		strcpy(aha->model, "1540 16 head BIOS");
+		snprintf(aha->model, sizeof(aha->model), "1540 16 head BIOS");
 		break;
 	case BOARD_1540_64HEAD_BIOS:
-		strcpy(aha->model, "1540 64 head BIOS");
+		snprintf(aha->model, sizeof(aha->model), "1540 64 head BIOS");
 		break;
 	case BOARD_1542:
-		strcpy(aha->model, "1540/1542 64 head BIOS");
+		snprintf(aha->model, sizeof(aha->model), "1540/1542 64 head BIOS");
 		break;
 	case BOARD_1640:
-		strcpy(aha->model, "1640");
+		snprintf(aha->model, sizeof(aha->model), "1640");
 		break;
 	case BOARD_1740:
-		strcpy(aha->model, "1740A/1742A/1744");
+		snprintf(aha->model, sizeof(aha->model), "1740A/1742A/1744");
 		break;
 	case BOARD_1542C:
-		strcpy(aha->model, "1542C");
+		snprintf(aha->model, sizeof(aha->model), "1542C");
 		break;
 	case BOARD_1542CF:
-		strcpy(aha->model, "1542CF");
+		snprintf(aha->model, sizeof(aha->model), "1542CF");
 		break;
 	case BOARD_1542CP:
-		strcpy(aha->model, "1542CP");
+		snprintf(aha->model, sizeof(aha->model), "1542CP");
 		break;
 	default:
-		strcpy(aha->model, "Unknown");
+		snprintf(aha->model, sizeof(aha->model), "Unknown");
 		break;
 	}
 	/*
@@ -663,7 +663,7 @@ aha_name(struct aha_softc *aha)
 {
 	static char name[10];
 
-	sprintf(name, "aha%d", aha->unit);
+	snprintf(name, sizeof(name), "aha%d", aha->unit);
 	return (name);
 }
 
diff --git a/sys/dev/aic7xxx/aic7xxx.c b/sys/dev/aic7xxx/aic7xxx.c
index f0139b9..aec2bfb 100644
--- a/sys/dev/aic7xxx/aic7xxx.c
+++ b/sys/dev/aic7xxx/aic7xxx.c
@@ -36,7 +36,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: aic7xxx.c,v 1.9 1998/10/15 23:49:27 gibbs Exp $
+ *      $Id: aic7xxx.c,v 1.10 1998/11/23 01:33:46 gibbs Exp $
  */
 /*
  * A few notes on features of the driver.
@@ -374,7 +374,7 @@ ahc_name(struct ahc_softc *ahc)
 {
 	static char name[10];
 
-	sprintf(name, "ahc%d", ahc->unit);
+	snprintf(name, sizeof(name), "ahc%d", ahc->unit);
 	return (name);
 }
 
diff --git a/sys/dev/buslogic/bt.c b/sys/dev/buslogic/bt.c
index 1e1f68c..5b00f9a 100644
--- a/sys/dev/buslogic/bt.c
+++ b/sys/dev/buslogic/bt.c
@@ -29,7 +29,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: bt.c,v 1.10 1998/11/10 06:47:11 gibbs Exp $
+ *      $Id: bt.c,v 1.11 1998/11/13 13:23:36 gibbs Exp $
  */
 
  /*
@@ -449,15 +449,15 @@ bt_fetch_adapter_info(struct bt_softc *bt)
 
 	if (esetup_info.bus_type == 'A'
 	 && bt->firmware_ver[0] == '2') {
-		strcpy(bt->model, "542B");
+		snprintf(bt->model, sizeof(bt->model), "542B");
 	} else if (esetup_info.bus_type == 'E'
 		&& (strncmp(bt->firmware_ver, "2.1", 3) == 0
 		 || strncmp(bt->firmware_ver, "2.20", 4) == 0)) {
-		strcpy(bt->model, "742A");
+		snprintf(bt->model, sizeof(bt->model), "742A");
 	} else if (esetup_info.bus_type == 'E'
 		&& bt->firmware_ver[0] == '0') {
 		/* AMI FastDisk EISA Series 441 0.x */
-		strcpy(bt->model, "747A");
+		snprintf(bt->model, sizeof(bt->model), "747A");
 	} else {
 		ha_model_data_t model_data;
 		int i;
@@ -819,7 +819,7 @@ bt_name(struct bt_softc *bt)
 {
 	static char name[10];
 
-	sprintf(name, "bt%d", bt->unit);
+	snprintf(name, sizeof(name), "bt%d", bt->unit);
 	return (name);
 }
 
diff --git a/sys/dev/dpt/dpt_control.c b/sys/dev/dpt/dpt_control.c
index ba4bec9..b28fb67 100644
--- a/sys/dev/dpt/dpt_control.c
+++ b/sys/dev/dpt/dpt_control.c
@@ -36,7 +36,7 @@
  * future.
  */
 
-#ident "$Id: dpt_control.c,v 1.8 1998/08/05 00:54:36 eivind Exp $"
+#ident "$Id: dpt_control.c,v 1.9 1998/09/15 08:33:31 gibbs Exp $"
 
 #include "opt_dpt.h"
 
@@ -782,7 +782,8 @@ dpt_ioctl(dev_t dev, u_long cmd, caddr_t cmdarg, int flags, struct proc * p)
 				compat_softc.ha_npend = dpt->submitted_ccbs_count;
 				compat_softc.ha_active_jobs = dpt->waiting_ccbs_count;
 				strncpy(compat_softc.ha_fw_version,
-					dpt->board_data.firmware, 4);
+				    dpt->board_data.firmware,
+				    sizeof(compat_softc.ha_fw_version));
 				compat_softc.ha_ccb = NULL;
 				compat_softc.ha_cblist = NULL;
 				compat_softc.ha_dev = NULL;
diff --git a/sys/dev/eisa/eisaconf.c b/sys/dev/eisa/eisaconf.c
index 11418e7..b362fd5 100644
--- a/sys/dev/eisa/eisaconf.c
+++ b/sys/dev/eisa/eisaconf.c
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: eisaconf.c,v 1.34 1998/02/09 06:08:09 eivind Exp $
+ *	$Id: eisaconf.c,v 1.35 1998/05/14 19:47:38 gibbs Exp $
  */
 
 #include "opt_eisa.h"
@@ -350,7 +350,7 @@ eisa_reg_end(e_dev)
 	{
 		char string[25];
 
-		sprintf(string, " on %s0 slot %d",
+		snprintf(string, sizeof(string), " on %s0 slot %d",
 			mainboard_drv.name,
 			e_dev->ioconf.slot);
 		eisa_reg_print(e_dev, string, NULL);
@@ -432,7 +432,7 @@ eisa_reg_intr(e_dev, irq, func, arg, maskptr, shared)
 		return EPERM;
 	}
 
-	sprintf(string, " irq %d", irq);
+	snprintf(string, sizeof(string), " irq %d", irq);
 	eisa_reg_print(e_dev, string, reg_state.num_interrupts ? 
 				      &separator : NULL);
 	reg_state.num_interrupts++;
diff --git a/sys/dev/en/if_en_pci.c b/sys/dev/en/if_en_pci.c
index d1853b5..37db78e 100644
--- a/sys/dev/en/if_en_pci.c
+++ b/sys/dev/en/if_en_pci.c
@@ -259,7 +259,7 @@ int unit;
   enpcis[unit] = scp;			/* lock it in */
   en_cd.cd_devs[unit] = sc;		/* fake a cfdriver structure */
   en_cd.cd_ndevs = NEN;
-  sprintf(sc->sc_dev.dv_xname, "en%d", unit);
+  snprintf(sc->sc_dev.dv_xname, sizeof(sc->sc_dev.dv_xname), "en%d", unit);
   sc->enif.if_unit = unit;
   sc->enif.if_name = "en";
 
diff --git a/sys/dev/en/midway.c b/sys/dev/en/midway.c
index 2e22fd1..44a4659 100644
--- a/sys/dev/en/midway.c
+++ b/sys/dev/en/midway.c
@@ -1278,8 +1278,8 @@ caddr_t data;
 				break;
 		    
 			if ((shadow = pvc_attach(ifp)) != NULL) {
-				sprintf(ifr->ifr_name, "%s%d",
-					shadow->if_name, shadow->if_unit);
+				snprintf(ifr->ifr_name, sizeof(ifr->ifr_name),
+				    "%s%d", shadow->if_name, shadow->if_unit);
 			}
 			else
 				error = ENOBUFS;
@@ -3643,8 +3643,8 @@ static int en_pvctx(sc, pvcreq)
 			       pvcreq->pvc_ifname);
 			return (EINVAL);
 		}
-    		sprintf(pvcreq->pvc_ifname, "%s%d",
-			sc->enif.if_name, sc->enif.if_unit);
+    		snprintf(pvcreq->pvc_ifname, sizeof(pvcreq->pvc_ifname),
+		    "%s%d", sc->enif.if_name, sc->enif.if_unit);
 		
 		ATM_PH_FLAGS(&api.aph) = ATM_PH_PVCSIF |
 			(ATM_PH_FLAGS(pvc_aph) & (ATM_PH_AAL5|ATM_PH_LLCSNAP));
diff --git a/sys/dev/fdc/fdc.c b/sys/dev/fdc/fdc.c
index d6a7659..3bb7737 100644
--- a/sys/dev/fdc/fdc.c
+++ b/sys/dev/fdc/fdc.c
@@ -43,7 +43,7 @@
  * SUCH DAMAGE.
  *
  *	from:	@(#)fd.c	7.4 (Berkeley) 5/25/91
- *	$Id: fd.c,v 1.123 1998/09/15 22:07:24 gibbs Exp $
+ *	$Id: fd.c,v 1.124 1998/10/22 05:58:38 bde Exp $
  *
  */
 
@@ -340,7 +340,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (out_fdc(fdcu, va_arg(ap, int)) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %x failed at out byte %d of %d\n",
 				cmd, n + 1, n_out);
 			return fdc_err(fdcu, msg);
@@ -353,7 +353,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (fd_in(fdcu, ptr) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %02x failed at in byte %d of %d\n",
 				cmd, n + 1, n_in);
 			return fdc_err(fdcu, msg);
diff --git a/sys/dev/hea/eni.c b/sys/dev/hea/eni.c
index 17427e9..c3e63b9a 100644
--- a/sys/dev/hea/eni.c
+++ b/sys/dev/hea/eni.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: eni.c,v 1.2 1998/09/17 09:34:58 phk Exp $
+ *	@(#) $Id: eni.c,v 1.3 1998/10/31 20:06:45 phk Exp $
  *
  */
 
@@ -42,7 +42,7 @@
 #include <dev/hea/eni_var.h>
 
 #ifndef	lint
-__RCSID("@(#) $Id: eni.c,v 1.2 1998/09/17 09:34:58 phk Exp $");
+__RCSID("@(#) $Id: eni.c,v 1.3 1998/10/31 20:06:45 phk Exp $");
 #endif
 
 /*
@@ -496,10 +496,12 @@ eni_pci_attach ( pcici_t config_id, int unit )
 	 * Make a hw version number from the ID register values.
 	 * Format: {Midway ID}.{Mother board ID}.{Daughter board ID}
 	 */
-	sprintf ( eup->eu_config.ac_hard_vers, "%ld/%ld/%ld",
-	    (val >> ID_SHIFT) & ID_MASK,
+	snprintf ( eup->eu_config.ac_hard_vers,
+	    sizeof ( eup->eu_config.ac_hard_vers ),
+		"%ld/%ld/%ld",
+		(val >> ID_SHIFT) & ID_MASK,
 		(val >> MID_SHIFT) & MID_MASK,
-			(val >> DID_SHIFT) & DID_MASK );
+		(val >> DID_SHIFT) & DID_MASK );
 
 	/*
 	 * There is no software version number
diff --git a/sys/dev/hea/eni_if.c b/sys/dev/hea/eni_if.c
index d2c9ad6..49f5e09 100644
--- a/sys/dev/hea/eni_if.c
+++ b/sys/dev/hea/eni_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: eni_if.c,v 1.1 1998/09/15 08:22:53 phk Exp $
+ *	@(#) $Id: eni_if.c,v 1.2 1998/10/31 20:06:45 phk Exp $
  *
  */
 
@@ -43,7 +43,7 @@
 #include <dev/hea/eni_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: eni_if.c,v 1.1 1998/09/15 08:22:53 phk Exp $");
+__RCSID("@(#) $Id: eni_if.c,v 1.2 1998/10/31 20:06:45 phk Exp $");
 #endif
 
 static void	eni_get_stats __P((Eni_unit *));
@@ -194,7 +194,8 @@ eni_atm_ioctl ( code, data, arg )
 		 */
 		if ( eup == NULL )
 			return ( ENXIO );
-		sprintf ( ifname, "%s%d", pip->pif_name, pip->pif_unit );
+		snprintf ( ifname, sizeof(ifname),
+		    "%s%d", pip->pif_name, pip->pif_unit );
 
 		/*
 		 * Cast response structure onto user's buffer
diff --git a/sys/dev/hfa/fore_command.c b/sys/dev/hfa/fore_command.c
index c2ed628..d8e0e9d 100644
--- a/sys/dev/hfa/fore_command.c
+++ b/sys/dev/hfa/fore_command.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_command.c,v 1.2 1998/09/17 09:34:58 phk Exp $
+ *	@(#) $Id: fore_command.c,v 1.3 1998/10/31 20:06:52 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_command.c,v 1.2 1998/09/17 09:34:58 phk Exp $");
+__RCSID("@(#) $Id: fore_command.c,v 1.3 1998/10/31 20:06:52 phk Exp $");
 #endif
 
 /*
@@ -341,7 +341,8 @@ fore_cmd_drain(fup)
 					sizeof(struct mac_addr));
 				fup->fu_config.ac_macaddr = 
 					fup->fu_pif.pif_macaddr;
-				sprintf(fup->fu_config.ac_hard_vers,
+				snprintf(fup->fu_config.ac_hard_vers,
+				    sizeof(fup->fu_config.ac_hard_vers),
 					"%ld.%ld.%ld",
 					(fp->pr_hwver >> 16) & 0xff,
 					(fp->pr_hwver >> 8) & 0xff,
diff --git a/sys/dev/hfa/fore_if.c b/sys/dev/hfa/fore_if.c
index 9c8a82d..479e7e6 100644
--- a/sys/dev/hfa/fore_if.c
+++ b/sys/dev/hfa/fore_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_if.c,v 1.1 1998/09/15 08:22:55 phk Exp $
+ *	@(#) $Id: fore_if.c,v 1.2 1998/10/31 20:06:52 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_if.c,v 1.1 1998/09/15 08:22:55 phk Exp $");
+__RCSID("@(#) $Id: fore_if.c,v 1.2 1998/10/31 20:06:52 phk Exp $");
 #endif
 
 
@@ -85,7 +85,8 @@ fore_atm_ioctl(code, data, arg)
 		fup = (Fore_unit *)pip;
 		if ( pip == NULL )
 			return ( ENXIO );
-		sprintf ( ifname, "%s%d", pip->pif_name, pip->pif_unit );
+		snprintf ( ifname, sizeof(ifname),
+		    "%s%d", pip->pif_name, pip->pif_unit );
 
 		/*
 		 * Cast response structure onto user's buffer
diff --git a/sys/dev/hfa/fore_init.c b/sys/dev/hfa/fore_init.c
index eade984..7c1ee96 100644
--- a/sys/dev/hfa/fore_init.c
+++ b/sys/dev/hfa/fore_init.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_init.c,v 1.2 1998/09/17 09:34:59 phk Exp $
+ *	@(#) $Id: fore_init.c,v 1.3 1998/10/31 20:06:53 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_init.c,v 1.2 1998/09/17 09:34:59 phk Exp $");
+__RCSID("@(#) $Id: fore_init.c,v 1.3 1998/10/31 20:06:53 phk Exp $");
 #endif
 
 
@@ -122,7 +122,8 @@ fore_initialize(fup)
 		errmsg = "unsupported microcode version";
 		goto failed;
 	}
-	sprintf(fup->fu_config.ac_firm_vers, "%ld.%ld.%ld",
+	snprintf(fup->fu_config.ac_firm_vers,
+	    sizeof(fup->fu_config.ac_firm_vers), "%ld.%ld.%ld",
 		(vers >> 16) & 0xff, (vers >> 8) & 0xff, vers & 0xff);
 
 #ifdef notdef
diff --git a/sys/dev/hfa/fore_load.c b/sys/dev/hfa/fore_load.c
index 1d5735d..96c59be 100644
--- a/sys/dev/hfa/fore_load.c
+++ b/sys/dev/hfa/fore_load.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_load.c,v 1.2 1998/09/17 09:34:59 phk Exp $
+ *	@(#) $Id: fore_load.c,v 1.3 1998/10/31 20:06:53 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_load.c,v 1.2 1998/09/17 09:34:59 phk Exp $");
+__RCSID("@(#) $Id: fore_load.c,v 1.3 1998/10/31 20:06:53 phk Exp $");
 #endif
 
 
@@ -726,10 +726,12 @@ fore_attach(devinfo_p)
 		val = getprop ( devinfo_p->devi_nodeid, "hw-version", -1 );
 	}
 	if (val != -1) {
-		sprintf(fcp->ac_hard_vers, "%d.%d.%d",
+		snprintf(fcp->ac_hard_vers,
+		    sizeof(fcp->ac_hard_vers), "%d.%d.%d",
 			(val >> 16) & 0xff, (val >> 8) & 0xff, val & 0xff);
 	} else
-		sprintf(fcp->ac_hard_vers, "Unknown");
+		snprintf(fcp->ac_hard_vers,
+		    sizeof(fcp->ac_hard_vers), "Unknown");
 
 	val = getprop ( devinfo_p->devi_nodeid, "serialnumber", -1 );
 	if ( val != -1 )
diff --git a/sys/dev/isp/isp_pci.c b/sys/dev/isp/isp_pci.c
index ae7842b..f22cfe1 100644
--- a/sys/dev/isp/isp_pci.c
+++ b/sys/dev/isp/isp_pci.c
@@ -270,7 +270,7 @@ isp_pci_attach(config_id, unit)
 	    pcs->pci_st == IO_SPACE_MAPPING? "I/O" : "Memory");
 
 	isp = &pcs->pci_isp;
-	(void) sprintf(isp->isp_name, "isp%d", unit);
+	(void) snprintf(isp->isp_name, sizeof(isp->isp_name), "isp%d", unit);
 	isp->isp_osinfo.unit = unit;
 
 	data = pci_conf_read(config_id, PCI_ID_REG);
diff --git a/sys/dev/pcm/isa/mss.c b/sys/dev/pcm/isa/mss.c
index 6ded9bf..56021d9 100644
--- a/sys/dev/pcm/isa/mss.c
+++ b/sys/dev/pcm/isa/mss.c
@@ -1300,7 +1300,7 @@ mss_detect(struct isa_device *dev)
 	}
     }
     BVDDB(printf("mss_detect() - Detected %s\n", name));
-    strcpy(d->name, name);
+    snprintf(d->name, sizeof(d->name), "%s", name);
     dev->id_flags &= ~DV_F_DEV_MASK ;
     dev->id_flags |= (d->bd_id << DV_F_DEV_SHIFT) & DV_F_DEV_MASK ;
     return 1;
@@ -1500,7 +1500,7 @@ cs423x_attach(u_long csn, u_long vend_id, char *name,
 	    tmp_d.bd_id = MD_CS4232 ; /* to short-circuit the detect routine */
 	    break;
 	}
-	strcpy(tmp_d.name, name);
+	snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 	tmp_d.audio_fmt |= AFMT_FULLDUPLEX ;
     }
     write_pnp_parms( &d, ldn );
@@ -1574,7 +1574,7 @@ opti931_attach(u_long csn, u_long vend_id, char *name,
     snddev_last_probed = &tmp_d;
     tmp_d =  d.flags & DV_PNP_SBCODEC ? sb_op_desc : mss_op_desc ;
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     /*
      * My MED3931 v.1.0 allocates 3 bytes for the config space,
@@ -1780,7 +1780,7 @@ guspnp_attach(u_long csn, u_long vend_id, char *name,
     gus_write(tmp_d.conf_base, 0x5b , tmp | 1 );
     BVDDB(printf("GUS: silicon rev %c\n", 'A' + ( ( tmp & 0xf ) >> 4) );)
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     pcmattach(dev);
 }
diff --git a/sys/dev/pcm/isa/sb.c b/sys/dev/pcm/isa/sb.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/pcm/isa/sb.c
+++ b/sys/dev/pcm/isa/sb.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/dev/sound/isa/mss.c b/sys/dev/sound/isa/mss.c
index 6ded9bf..56021d9 100644
--- a/sys/dev/sound/isa/mss.c
+++ b/sys/dev/sound/isa/mss.c
@@ -1300,7 +1300,7 @@ mss_detect(struct isa_device *dev)
 	}
     }
     BVDDB(printf("mss_detect() - Detected %s\n", name));
-    strcpy(d->name, name);
+    snprintf(d->name, sizeof(d->name), "%s", name);
     dev->id_flags &= ~DV_F_DEV_MASK ;
     dev->id_flags |= (d->bd_id << DV_F_DEV_SHIFT) & DV_F_DEV_MASK ;
     return 1;
@@ -1500,7 +1500,7 @@ cs423x_attach(u_long csn, u_long vend_id, char *name,
 	    tmp_d.bd_id = MD_CS4232 ; /* to short-circuit the detect routine */
 	    break;
 	}
-	strcpy(tmp_d.name, name);
+	snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 	tmp_d.audio_fmt |= AFMT_FULLDUPLEX ;
     }
     write_pnp_parms( &d, ldn );
@@ -1574,7 +1574,7 @@ opti931_attach(u_long csn, u_long vend_id, char *name,
     snddev_last_probed = &tmp_d;
     tmp_d =  d.flags & DV_PNP_SBCODEC ? sb_op_desc : mss_op_desc ;
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     /*
      * My MED3931 v.1.0 allocates 3 bytes for the config space,
@@ -1780,7 +1780,7 @@ guspnp_attach(u_long csn, u_long vend_id, char *name,
     gus_write(tmp_d.conf_base, 0x5b , tmp | 1 );
     BVDDB(printf("GUS: silicon rev %c\n", 'A' + ( ( tmp & 0xf ) >> 4) );)
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     pcmattach(dev);
 }
diff --git a/sys/dev/sound/isa/sb.c b/sys/dev/sound/isa/sb.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/sound/isa/sb.c
+++ b/sys/dev/sound/isa/sb.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/dev/sound/isa/sb16.c b/sys/dev/sound/isa/sb16.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/sound/isa/sb16.c
+++ b/sys/dev/sound/isa/sb16.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/dev/sound/isa/sb8.c b/sys/dev/sound/isa/sb8.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/sound/isa/sb8.c
+++ b/sys/dev/sound/isa/sb8.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }