Examine all occurrences of sprintf(), strcat(), and str[n]cpy()

for possible buffer overflow problems. Replaced most sprintf()'s
with snprintf(); for others cases, added terminating NUL bytes where
appropriate, replaced constants like "16" with sizeof(), etc.

These changes include several bug fixes, but most changes are for
maintainability's sake. Any instance where it wasn't "immediately
obvious" that a buffer overflow could not occur was made safer.

Reviewed by:	Bruce Evans <bde@zeta.org.au>
Reviewed by:	Matthew Dillon <dillon@apollo.backplane.com>
Reviewed by:	Mike Spengler <mks@networkcs.com>

125 files changed, 510 insertions, 414 deletions

diff --git a/sys/alpha/alpha/db_disasm.c b/sys/alpha/alpha/db_disasm.c
index bec6145..9fc3b1e 100644
--- a/sys/alpha/alpha/db_disasm.c
+++ b/sys/alpha/alpha/db_disasm.c
@@ -201,7 +201,7 @@ pal_opname(op)
 			return (pal_op_tbl[i].name);
 	}
 
-	sprintf(unk, "0x%x", op);
+	snprintf(unk, sizeof(unk), "0x%x", op);
 	return (unk);
 }
 
@@ -257,7 +257,7 @@ arit_name(op)
 	if (name != NULL)
 		return (name);
 
-	sprintf(unk, "?arit 0x%x?", op);
+	snprintf(unk, sizeof(unk), "?arit 0x%x?", op);
 	return (unk);
 }
 
@@ -307,7 +307,7 @@ logical_name(op)
 	if (name != NULL)
 		return (name);
 
-	sprintf(unk, "?logical 0x%x?", op);
+	snprintf(unk, sizeof(unk), "?logical 0x%x?", op);
 	return (unk);
 }
 
@@ -352,7 +352,7 @@ bitop_name(op)
 	if (name != NULL)
 		return (name);
 
-	sprintf(unk, "?bit 0x%x?", op);
+	snprintf(unk, sizeof(unk), "?bit 0x%x?", op);
 	return (unk);
 }
 
@@ -376,7 +376,7 @@ mul_name(op)
 	if (name != NULL)
 		return (name);
 
-	sprintf(unk, "?mul 0x%x?", op);
+	snprintf(unk, sizeof(unk), "?mul 0x%x?", op);
 	return (unk);
 }
 
@@ -401,7 +401,7 @@ special_name(op)
 	if (name != NULL)
 		return (name);
 
-	sprintf(unk, "?special 0x%x?", op);
+	snprintf(unk, sizeof(unk), "?special 0x%x?", op);
 	return (unk);
 }
 
@@ -440,7 +440,7 @@ intmisc_name(op)
 	case op_ftois: return ("ftois");
 	}
 
-	sprintf(unk, "?intmisc 0x%x?", op);
+	snprintf(unk, sizeof(unk), "?intmisc 0x%x?", op);
 	return (unk);
 }
 
@@ -460,7 +460,7 @@ float_name(tbl, op, type)
 			return (tbl[i].name);
 	}
 
-	sprintf(unk, "?%s 0x%x?", type, op);
+	snprintf(unk, sizeof(unk), "?%s 0x%x?", type, op);
 	return (unk);
 }
 
diff --git a/sys/alpha/alpha/diskslice_machdep.c b/sys/alpha/alpha/diskslice_machdep.c
index e58dfd5..426df40 100644
--- a/sys/alpha/alpha/diskslice_machdep.c
+++ b/sys/alpha/alpha/diskslice_machdep.c
@@ -36,7 +36,7 @@
  *	from: @(#)ufs_disksubr.c	7.16 (Berkeley) 5/4/91
  *	from: ufs_disksubr.c,v 1.8 1994/06/07 01:21:39 phk Exp $
  *	from: i386/isa Id: diskslice_machdep.c,v 1.31 1998/08/10 07:22:14 phk Exp
- *	$Id: diskslice_machdep.c,v 1.4 1998/10/06 08:38:58 dfr Exp $
+ *	$Id: diskslice_machdep.c,v 1.5 1998/10/16 10:13:09 jkh Exp $
  */
 
 #include <sys/param.h>
@@ -421,7 +421,7 @@ extended(dname, dev, strat, lp, ssp, ext_offset, ext_size, base_ext_offset,
 
 			sname = dsname(dname, dkunit(dev), WHOLE_DISK_SLICE,
 				       RAW_PART, partname);
-			strcpy(buf, sname);
+			snprintf(buf, sizeof(buf), "%s", sname);
 			if (strlen(buf) < sizeof buf - 11)
 				strcat(buf, "<extended>");
 			check_part(buf, dp, base_ext_offset, nsectors,
diff --git a/sys/alpha/alpha/machdep.c b/sys/alpha/alpha/machdep.c
index 3f1890c..446ecec 100644
--- a/sys/alpha/alpha/machdep.c
+++ b/sys/alpha/alpha/machdep.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: machdep.c,v 1.24 1998/11/25 09:45:27 dfr Exp $
+ *	$Id: machdep.c,v 1.25 1998/12/04 10:52:47 dfr Exp $
  */
 /*-
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -484,7 +484,7 @@ alpha_unknown_sysname()
 {
 	static char s[128];		/* safe size */
 
-	sprintf(s, "%s family, unknown model variation 0x%lx",
+	snprintf(s, sizeof(s), "%s family, unknown model variation 0x%lx",
 	    platform.family, hwrpb->rpb_variation & SV_ST_MASK);
 	return ((const char *)s);
 }
@@ -676,7 +676,7 @@ alpha_init(pfn, ptb, bim, bip, biv)
 		/* NOTREACHED */
 	}
 	cpuinit[cputype].init(cputype);
-	strcpy(cpu_model, platform.model);
+	snprintf(cpu_model, sizeof(cpu_model), "%s", platform.model);
 
 	/*
 	 * Initalize the real console, so the the bootstrap console is
diff --git a/sys/alpha/alpha/trap.c b/sys/alpha/alpha/trap.c
index ffec15e..9d333c2 100644
--- a/sys/alpha/alpha/trap.c
+++ b/sys/alpha/alpha/trap.c
@@ -1,4 +1,4 @@
-/* $Id: trap.c,v 1.6 1998/11/18 23:51:40 dfr Exp $ */
+/* $Id: trap.c,v 1.7 1998/12/04 10:52:47 dfr Exp $ */
 /* $NetBSD: trap.c,v 1.31 1998/03/26 02:21:46 thorpej Exp $ */
 
 /*
@@ -154,7 +154,7 @@ printtrap(a0, a1, a2, entry, framep, isfatal, user)
 		entryname = "system call";
 		break;
 	default:
-		sprintf(ubuf, "type %lx", entry);
+		snprintf(ubuf, sizeof(ubuf), "type %lx", entry);
 		entryname = (const char *) ubuf;
 		break;
 	}
diff --git a/sys/alpha/pci/apecs.c b/sys/alpha/pci/apecs.c
index c8bbad7..d7f7b6e 100644
--- a/sys/alpha/pci/apecs.c
+++ b/sys/alpha/pci/apecs.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: apecs.c,v 1.2 1998/10/06 14:18:40 dfr Exp $
+ *	$Id: apecs.c,v 1.3 1998/11/15 18:25:16 dfr Exp $
  */
 /*
  * Copyright (c) 1995, 1996 Carnegie-Mellon University.
@@ -514,7 +514,7 @@ apecs_attach(device_t dev)
 
 	set_iointr(alpha_dispatch_intr);
 
-	strcpy(chipset_type, "apecs");
+	snprintf(chipset_type, sizeof(chipset_type), "apecs");
 	chipset_bwx = 0;
 	chipset_ports = APECS_PCI_SIO;
 	chipset_memory = APECS_PCI_SPARSE;
diff --git a/sys/alpha/pci/cia.c b/sys/alpha/pci/cia.c
index 41769ea..c68ef57 100644
--- a/sys/alpha/pci/cia.c
+++ b/sys/alpha/pci/cia.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: cia.c,v 1.12 1998/11/28 09:55:16 dfr Exp $
+ *	$Id: cia.c,v 1.13 1998/12/02 09:33:27 dfr Exp $
  */
 /*-
  * Copyright (c) 1998 The NetBSD Foundation, Inc.
@@ -804,13 +804,13 @@ cia_attach(device_t dev)
 		set_iointr(alpha_dispatch_intr);
 
 	if (cia_ispyxis) {
-		strcpy(chipset_type, "pyxis");
+		snprintf(chipset_type, sizeof(chipset_type), "pyxis");
 		chipset_bwx = 1;
 		chipset_ports = CIA_EV56_BWIO;
 		chipset_memory = CIA_EV56_BWMEM;
 		chipset_dense = CIA_PCI_DENSE;
 	} else {
-		strcpy(chipset_type, "cia");
+		snprintf(chipset_type, sizeof(chipset_type), "cia");
 		chipset_bwx = 0;
 		chipset_ports = CIA_PCI_SIO1;
 		chipset_memory = CIA_PCI_SMEM1;
diff --git a/sys/alpha/pci/lca.c b/sys/alpha/pci/lca.c
index 5cf492f..f3b194d 100644
--- a/sys/alpha/pci/lca.c
+++ b/sys/alpha/pci/lca.c
@@ -23,7 +23,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: lca.c,v 1.3 1998/10/06 14:18:40 dfr Exp $
+ *	$Id: lca.c,v 1.4 1998/11/15 18:25:16 dfr Exp $
  */
 
 #include <sys/param.h>
@@ -397,7 +397,7 @@ lca_attach(device_t dev)
 
 	set_iointr(alpha_dispatch_intr);
 
-	strcpy(chipset_type, "lca");
+	snprintf(chipset_type, sizeof(chipset_type), "lca");
 	chipset_bwx = 0;
 	chipset_ports = LCA_PCI_SIO;
 	chipset_memory = LCA_PCI_SPARSE;
diff --git a/sys/alpha/tc/am7990.c b/sys/alpha/tc/am7990.c
index 6c65f82..d734c15 100644
--- a/sys/alpha/tc/am7990.c
+++ b/sys/alpha/tc/am7990.c
@@ -1,4 +1,4 @@
-/* $Id$ */
+/* $Id: am7990.c,v 1.1 1998/08/20 08:27:10 dfr Exp $ */
 /*	$NetBSD: am7990.c,v 1.43 1998/03/29 22:36:42 mycroft Exp $	*/
 
 /*-
@@ -194,7 +194,8 @@ am7990_config(sc)
 	/* Make sure the chip is stopped. */
 	am7990_stop(sc);
 	/* Initialize ifnet structure. */
-	sprintf(sc->sc_dev.dv_xname, "le%d", sc->unit); 
+	snprintf(sc->sc_dev.dv_xname,
+		sizeof(sc->sc_dev.dv_xname), "le%d", sc->unit); 
 	ifp->if_unit = sc->unit;
 	ifp->if_name = "le";
 	ifp->if_softc = sc;
diff --git a/sys/alpha/tc/espvar.h b/sys/alpha/tc/espvar.h
index ad5d139..b64b774 100644
--- a/sys/alpha/tc/espvar.h
+++ b/sys/alpha/tc/espvar.h
@@ -1,4 +1,4 @@
-/* $Id$ */
+/* $Id: espvar.h,v 1.1 1998/08/20 08:27:10 dfr Exp $ */
 /*	$NetBSD: espvar.h,v 1.3.4.1 1996/09/10 17:28:18 cgd Exp $	*/
 
 /*
@@ -74,8 +74,7 @@ struct ecb {
 #define ECB_TRACE(ecb, msg, a, b) do { \
 	const char *f = "[" msg "]"; \
 	int n = strlen((ecb)->trace); \
-	if (n < (sizeof((ecb)->trace)-100)) \
-		sprintf((ecb)->trace + n, f,  a, b); \
+	snprintf((ecb)->trace + n, sizeof((ecb)->trace) - n, f, a, b); \
 } while(0)
 #else
 #define ECB_TRACE(ecb, msg, a, b)
diff --git a/sys/alpha/tlsb/tlsb.c b/sys/alpha/tlsb/tlsb.c
index 72cf93a..00aff9a 100644
--- a/sys/alpha/tlsb/tlsb.c
+++ b/sys/alpha/tlsb/tlsb.c
@@ -343,7 +343,8 @@ tlsb_node_type_str(u_int32_t dtype)
 
 	default:
 		bzero(tlsb_line, sizeof(tlsb_line));
-		sprintf(tlsb_line, "unknown, dtype 0x%x", dtype);
+		snprintf(tlsb_line, sizeof(tlsb_line),
+			"unknown, dtype 0x%x", dtype);
 		return (tlsb_line);
 	}
 	/* NOTREACHED */
diff --git a/sys/amd64/isa/intr_machdep.c b/sys/amd64/isa/intr_machdep.c
index 3f891f2..08c2049 100644
--- a/sys/amd64/isa/intr_machdep.c
+++ b/sys/amd64/isa/intr_machdep.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)isa.c	7.2 (Berkeley) 5/13/91
- *	$Id: intr_machdep.c,v 1.13 1998/06/18 16:08:46 bde Exp $
+ *	$Id: intr_machdep.c,v 1.14 1998/09/06 22:41:41 tegge Exp $
  */
 
 #include "opt_auto_eoi.h"
@@ -325,7 +325,7 @@ find_device_id(int irq)
 	char *cp;
 	int free_id, id;
 
-	sprintf(buf, "pci irq%d", irq);
+	snprintf(buf, sizeof(buf), "pci irq%d", irq);
 	cp = intrnames;
 	/* default to 0, which corresponds to clk0 */
 	free_id = 0;
diff --git a/sys/amd64/isa/nmi.c b/sys/amd64/isa/nmi.c
index 3f891f2..08c2049 100644
--- a/sys/amd64/isa/nmi.c
+++ b/sys/amd64/isa/nmi.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)isa.c	7.2 (Berkeley) 5/13/91
- *	$Id: intr_machdep.c,v 1.13 1998/06/18 16:08:46 bde Exp $
+ *	$Id: intr_machdep.c,v 1.14 1998/09/06 22:41:41 tegge Exp $
  */
 
 #include "opt_auto_eoi.h"
@@ -325,7 +325,7 @@ find_device_id(int irq)
 	char *cp;
 	int free_id, id;
 
-	sprintf(buf, "pci irq%d", irq);
+	snprintf(buf, sizeof(buf), "pci irq%d", irq);
 	cp = intrnames;
 	/* default to 0, which corresponds to clk0 */
 	free_id = 0;
diff --git a/sys/cam/scsi/scsi_all.c b/sys/cam/scsi/scsi_all.c
index c87b1eb..bc82bf5 100644
--- a/sys/cam/scsi/scsi_all.c
+++ b/sys/cam/scsi/scsi_all.c
@@ -26,7 +26,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: scsi_all.c,v 1.5 1998/10/02 21:00:54 ken Exp $
+ *	$Id: scsi_all.c,v 1.6 1998/10/15 19:08:58 ken Exp $
  */
 
 #include <sys/param.h>
@@ -1563,7 +1563,6 @@ char *
 scsi_cdb_string(u_int8_t *cdb_ptr, char *cdb_string, size_t len)
 {
 	u_int8_t cdb_len;
-	char holdstr[8];
 	int i;
 
 	if (cdb_ptr == NULL)
@@ -1608,17 +1607,9 @@ scsi_cdb_string(u_int8_t *cdb_ptr, char *cdb_string, size_t len)
 			break;
 	}
 	*cdb_string = '\0';
-	for (i = 0; i < cdb_len; i++) {
-		sprintf(holdstr, "%x ", cdb_ptr[i]);
-		/*
-		 * If we're about to exceed the length of the string,
-		 * just return what we've already printed.
-		 */
-		if (strlen(holdstr) + strlen(cdb_string) > len)
-			break;
-
-		strcat(cdb_string, holdstr);
-	}
+	for (i = 0; i < cdb_len; i++)
+		snprintf(cdb_string + strlen(cdb_string),
+		    len - strlen(cdb_string), "%x ", cdb_ptr[i]);
 
 	return(cdb_string);
 }
diff --git a/sys/cam/scsi/scsi_cd.c b/sys/cam/scsi/scsi_cd.c
index 9c6ddb6..8f6fb31 100644
--- a/sys/cam/scsi/scsi_cd.c
+++ b/sys/cam/scsi/scsi_cd.c
@@ -24,7 +24,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: scsi_cd.c,v 1.8 1998/10/22 22:16:56 ken Exp $
+ *      $Id: scsi_cd.c,v 1.9 1998/11/22 23:44:46 ken Exp $
  */
 /*
  * Portions of this driver taken from the original FreeBSD cd driver.
@@ -1691,7 +1691,7 @@ cddone(struct cam_periph *periph, union ccb *done_ccb)
 
 		if ((csio->ccb_h.status & CAM_STATUS_MASK) == CAM_REQ_CMP) {
 
-			sprintf(announce_buf,
+			snprintf(announce_buf, sizeof(announce_buf),
 				"cd present [%lu x %lu byte records]",
 				cdp->disksize, (u_long)cdp->blksize);
 
@@ -1759,7 +1759,8 @@ cddone(struct cam_periph *periph, union ccb *done_ccb)
 				if ((have_sense)
 				 && ((asc == 0x3a) || (asc == 0x04))
 				 && (error_code == SSD_CURRENT_ERROR))
-					sprintf(announce_buf, 
+					snprintf(announce_buf,
+					    sizeof(announce_buf),
 						"Attempt to query device "
 						"size failed: %s, %s",
 						scsi_sense_key_text[sense_key],
diff --git a/sys/cam/scsi/scsi_ch.c b/sys/cam/scsi/scsi_ch.c
index aa0883f..2d0290e 100644
--- a/sys/cam/scsi/scsi_ch.c
+++ b/sys/cam/scsi/scsi_ch.c
@@ -24,7 +24,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: scsi_ch.c,v 1.5 1998/10/22 22:16:56 ken Exp $
+ *      $Id: scsi_ch.c,v 1.6 1998/11/22 23:44:47 ken Exp $
  */
 /*
  * Derived from the NetBSD SCSI changer driver.
@@ -618,7 +618,8 @@ chdone(struct cam_periph *periph, union ccb *done_ccb)
 			softc->sc_picker = softc->sc_firsts[CHET_MT];
 
 #define PLURAL(c)	(c) == 1 ? "" : "s"
-			sprintf(announce_buf, "%d slot%s, %d drive%s, "
+			snprintf(announce_buf, sizeof(announce_buf),
+				"%d slot%s, %d drive%s, "
 				"%d picker%s, %d portal%s",
 		    		softc->sc_counts[CHET_ST],
 				PLURAL(softc->sc_counts[CHET_ST]),
diff --git a/sys/cam/scsi/scsi_da.c b/sys/cam/scsi/scsi_da.c
index cb1d7d2..bd0076f 100644
--- a/sys/cam/scsi/scsi_da.c
+++ b/sys/cam/scsi/scsi_da.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: scsi_da.c,v 1.12 1998/10/22 22:16:56 ken Exp $
+ *      $Id: scsi_da.c,v 1.13 1998/12/02 17:35:28 ken Exp $
  */
 
 #include "opt_hw_wdog.h"
@@ -1286,7 +1286,7 @@ dadone(struct cam_periph *periph, union ccb *done_ccb)
 
 			dasetgeom(periph, rdcap);
 			dp = &softc->params;
-			sprintf(announce_buf,
+			snprintf(announce_buf, sizeof(announce_buf),
 				"%ldMB (%d %d byte sectors: %dH %dS/T %dC)",
 				dp->sectors / ((1024L * 1024L) / dp->secsize),
 				dp->sectors, dp->secsize, dp->heads,
@@ -1350,7 +1350,8 @@ dadone(struct cam_periph *periph, union ccb *done_ccb)
 				 */
 				if ((have_sense) && (asc == 0x3a)
 				 && (error_code == SSD_CURRENT_ERROR))
-					sprintf(announce_buf, 
+					snprintf(announce_buf,
+					    sizeof(announce_buf),
 						"Attempt to query device "
 						"size failed: %s, %s",
 						scsi_sense_key_text[sense_key],
diff --git a/sys/coda/coda_vfsops.c b/sys/coda/coda_vfsops.c
index e282911..79ca465 100644
--- a/sys/coda/coda_vfsops.c
+++ b/sys/coda/coda_vfsops.c
@@ -27,7 +27,7 @@
  * Mellon the rights to redistribute these changes without encumbrance.
  * 
  *  	@(#) src/sys/cfs/coda_vfsops.c,v 1.1.1.1 1998/08/29 21:14:52 rvb Exp $
- *  $Id: coda_vfsops.c,v 1.8 1998/11/03 08:55:06 peter Exp $
+ *  $Id: coda_vfsops.c,v 1.9 1998/11/16 19:48:26 rvb Exp $
  * 
  */
 
@@ -47,6 +47,9 @@
 /*
  * HISTORY
  * $Log: coda_vfsops.c,v $
+ * Revision 1.9  1998/11/16 19:48:26  rvb
+ * A few bug fixes for Robert Watson
+ *
  * Revision 1.8  1998/11/03 08:55:06  peter
  * Support KLD.  We register and unregister two modules. "coda" (the vfs)
  * via VFS_SET(), and "codadev" for the cdevsw entry.  From kldstat -v:
@@ -592,8 +595,8 @@ coda_nb_statfs(vfsp, sbp, p)
     sbp->f_files = NB_SFS_SIZ;
     sbp->f_ffree = NB_SFS_SIZ;
     bcopy((caddr_t)&(vfsp->mnt_stat.f_fsid), (caddr_t)&(sbp->f_fsid), sizeof (fsid_t));
-    strcpy(sbp->f_mntonname, "/coda");
-    strcpy(sbp->f_mntfromname, "CODA");
+    snprintf(sbp->f_mntonname, sizeof(sbp->f_mntonname), "/coda");
+    snprintf(sbp->f_mntfromname, sizeof(sbp->f_mntfromname), "CODA");
 /*  MARK_INT_SAT(CODA_STATFS_STATS); */
     return(0);
 }
diff --git a/sys/compat/linux/linux_misc.c b/sys/compat/linux/linux_misc.c
index 9fdd923..35ce1bf 100644
--- a/sys/compat/linux/linux_misc.c
+++ b/sys/compat/linux/linux_misc.c
@@ -25,7 +25,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- *  $Id: linux_misc.c,v 1.44 1998/09/24 13:25:43 jkh Exp $
+ *  $Id: linux_misc.c,v 1.45 1998/10/05 12:40:42 sos Exp $
  */
 
 #include <sys/param.h>
@@ -746,12 +746,18 @@ linux_newuname(struct proc *p, struct linux_newuname_args *args)
     printf("Linux-emul(%d): newuname(*)\n", p->p_pid);
 #endif
     bzero(&linux_newuname, sizeof(struct linux_newuname_t));
-    strncpy(linux_newuname.sysname, ostype, 64);
-    strncpy(linux_newuname.nodename, hostname, 64);
-    strncpy(linux_newuname.release, osrelease, 64);
-    strncpy(linux_newuname.version, version, 64);
-    strncpy(linux_newuname.machine, machine, 64);
-    strncpy(linux_newuname.domainname, domainname, 64);
+    strncpy(linux_newuname.sysname, ostype,
+	sizeof(linux_newuname.sysname) - 1);
+    strncpy(linux_newuname.nodename, hostname,
+	sizeof(linux_newuname.nodename) - 1);
+    strncpy(linux_newuname.release, osrelease,
+	sizeof(linux_newuname.release) - 1);
+    strncpy(linux_newuname.version, version,
+	sizeof(linux_newuname.version) - 1);
+    strncpy(linux_newuname.machine, machine,
+	sizeof(linux_newuname.machine) - 1);
+    strncpy(linux_newuname.domainname, domainname,
+	sizeof(linux_newuname.domainname) - 1);
     return (copyout((caddr_t)&linux_newuname, (caddr_t)args->buf,
 	    	    sizeof(struct linux_newuname_t)));
 }
diff --git a/sys/contrib/ipfilter/netinet/ip_fil.c b/sys/contrib/ipfilter/netinet/ip_fil.c
index 1075316..6cbdac9 100644
--- a/sys/contrib/ipfilter/netinet/ip_fil.c
+++ b/sys/contrib/ipfilter/netinet/ip_fil.c
@@ -7,7 +7,7 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_fil.c	2.41 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 1.5 1998/06/20 18:37:50 peter Exp $";
+static const char rcsid[] = "@(#)$Id: ip_fil.c,v 1.6 1998/08/15 21:51:53 bde Exp $";
 #endif
 
 #include "opt_ipfilter.h"
@@ -1110,12 +1110,12 @@ ip_t *ip;
 
 # if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
 	(defined(OpenBSD) && (OpenBSD >= 199603))
-	sprintf(fname, "/tmp/%s", ifp->if_xname);
+	snprintf(fname, sizeof(fname), "/tmp/%s", ifp->if_xname);
 	if ((fp = fopen(fname, "a"))) {
 		fclose(fp);
 	}
 # else
-	sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
+	snprintf(fname, sizeof(fname), "/tmp/%s%d", ifp->if_name, ifp->if_unit);
 	if ((fp = fopen(fname, "a"))) {
 		fwrite((char *)ip, ntohs(ip->ip_len), 1, fp);
 		fclose(fp);
@@ -1139,7 +1139,8 @@ char *name;
 	char ifname[32], *s;
 
 	for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
-		(void) sprintf(ifname, "%s%d", ifp->if_name, ifp->if_unit);
+		(void) snprintf(ifname, sizeof(ifname),
+			"%s%d", ifp->if_name, ifp->if_unit);
 		if (!strcmp(name, ifname))
 			return ifp;
 	}
@@ -1190,7 +1191,7 @@ void init_ifp()
 	(defined(OpenBSD) && (OpenBSD >= 199603))
 	for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
 		ifp->if_output = write_output;
-		sprintf(fname, "/tmp/%s", ifp->if_xname);
+		snprintf(fname, sizeof(fname), "/tmp/%s", ifp->if_xname);
 		if ((fp = fopen(fname, "w")))
 			fclose(fp);
 	}
@@ -1198,7 +1199,8 @@ void init_ifp()
 
 	for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
 		ifp->if_output = write_output;
-		sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
+		snprintf(fname, sizeof(fname),
+		    "/tmp/%s%d", ifp->if_name, ifp->if_unit);
 		if ((fp = fopen(fname, "w")))
 			fclose(fp);
 	}
diff --git a/sys/contrib/ipfilter/netinet/ip_ftp_pxy.c b/sys/contrib/ipfilter/netinet/ip_ftp_pxy.c
index 1a66a9b..dd70c81 100644
--- a/sys/contrib/ipfilter/netinet/ip_ftp_pxy.c
+++ b/sys/contrib/ipfilter/netinet/ip_ftp_pxy.c
@@ -165,7 +165,7 @@ nat_t *nat;
 	a4 = a1 & 0xff;
 	a1 >>= 24;
 	olen = s - portbuf + 1;
-	(void) sprintf(newbuf, "PORT %d,%d,%d,%d,%d,%d\r\n",
+	(void) snprintf(newbuf, sizeof(newbuf), "PORT %d,%d,%d,%d,%d,%d\r\n",
 		a1, a2, a3, a4, a5, a6);
 	nlen = strlen(newbuf);
 	inc = nlen - olen;
diff --git a/sys/ddb/db_sym.c b/sys/ddb/db_sym.c
index 60d48ec..8c5f91e 100644
--- a/sys/ddb/db_sym.c
+++ b/sys/ddb/db_sym.c
@@ -23,7 +23,7 @@
  * any improvements or extensions that they make and grant Carnegie the
  * rights to redistribute these changes.
  *
- *	$Id: db_sym.c,v 1.25 1998/07/08 09:11:38 bde Exp $
+ *	$Id: db_sym.c,v 1.26 1998/07/08 10:53:51 bde Exp $
  */
 
 /*
@@ -91,9 +91,7 @@ db_qualify(sym, symtabname)
 	static char     tmp[256];
 
 	db_symbol_values(sym, &symname, 0);
-	strcpy(tmp,symtabname);
-	strcat(tmp,":");
-	strcat(tmp,symname);
+	snprintf(tmp, sizeof(tmp), "%s:%s", symtabname, symname);
 	return tmp;
 }
 
diff --git a/sys/dev/advansys/advansys.c b/sys/dev/advansys/advansys.c
index 40b76e9..de58917 100644
--- a/sys/dev/advansys/advansys.c
+++ b/sys/dev/advansys/advansys.c
@@ -32,7 +32,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: advansys.c,v 1.4 1998/10/15 23:47:14 gibbs Exp $
+ *      $Id: advansys.c,v 1.5 1998/10/29 17:41:34 gibbs Exp $
  */
 /*
  * Ported from:
@@ -134,7 +134,7 @@ adv_name(struct adv_softc *adv)
 {
 	static char name[10];
 
-	sprintf(name, "adv%d", adv->unit);
+	snprintf(name, sizeof(name), "adv%d", adv->unit);
 	return (name);
 }
 
diff --git a/sys/dev/aha/aha.c b/sys/dev/aha/aha.c
index e892865..0fe69c0 100644
--- a/sys/dev/aha/aha.c
+++ b/sys/dev/aha/aha.c
@@ -55,7 +55,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: aha.c,v 1.12 1998/11/10 06:47:09 gibbs Exp $
+ *      $Id: aha.c,v 1.13 1998/11/25 19:12:56 imp Exp $
  */
 
 #include <sys/param.h>
@@ -388,31 +388,31 @@ aha_fetch_adapter_info(struct aha_softc *aha)
 	
 	switch (aha->boardid) {
 	case BOARD_1540_16HEAD_BIOS:
-		strcpy(aha->model, "1540 16 head BIOS");
+		snprintf(aha->model, sizeof(aha->model), "1540 16 head BIOS");
 		break;
 	case BOARD_1540_64HEAD_BIOS:
-		strcpy(aha->model, "1540 64 head BIOS");
+		snprintf(aha->model, sizeof(aha->model), "1540 64 head BIOS");
 		break;
 	case BOARD_1542:
-		strcpy(aha->model, "1540/1542 64 head BIOS");
+		snprintf(aha->model, sizeof(aha->model), "1540/1542 64 head BIOS");
 		break;
 	case BOARD_1640:
-		strcpy(aha->model, "1640");
+		snprintf(aha->model, sizeof(aha->model), "1640");
 		break;
 	case BOARD_1740:
-		strcpy(aha->model, "1740A/1742A/1744");
+		snprintf(aha->model, sizeof(aha->model), "1740A/1742A/1744");
 		break;
 	case BOARD_1542C:
-		strcpy(aha->model, "1542C");
+		snprintf(aha->model, sizeof(aha->model), "1542C");
 		break;
 	case BOARD_1542CF:
-		strcpy(aha->model, "1542CF");
+		snprintf(aha->model, sizeof(aha->model), "1542CF");
 		break;
 	case BOARD_1542CP:
-		strcpy(aha->model, "1542CP");
+		snprintf(aha->model, sizeof(aha->model), "1542CP");
 		break;
 	default:
-		strcpy(aha->model, "Unknown");
+		snprintf(aha->model, sizeof(aha->model), "Unknown");
 		break;
 	}
 	/*
@@ -663,7 +663,7 @@ aha_name(struct aha_softc *aha)
 {
 	static char name[10];
 
-	sprintf(name, "aha%d", aha->unit);
+	snprintf(name, sizeof(name), "aha%d", aha->unit);
 	return (name);
 }
 
diff --git a/sys/dev/aic7xxx/aic7xxx.c b/sys/dev/aic7xxx/aic7xxx.c
index f0139b9..aec2bfb 100644
--- a/sys/dev/aic7xxx/aic7xxx.c
+++ b/sys/dev/aic7xxx/aic7xxx.c
@@ -36,7 +36,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: aic7xxx.c,v 1.9 1998/10/15 23:49:27 gibbs Exp $
+ *      $Id: aic7xxx.c,v 1.10 1998/11/23 01:33:46 gibbs Exp $
  */
 /*
  * A few notes on features of the driver.
@@ -374,7 +374,7 @@ ahc_name(struct ahc_softc *ahc)
 {
 	static char name[10];
 
-	sprintf(name, "ahc%d", ahc->unit);
+	snprintf(name, sizeof(name), "ahc%d", ahc->unit);
 	return (name);
 }
 
diff --git a/sys/dev/buslogic/bt.c b/sys/dev/buslogic/bt.c
index 1e1f68c..5b00f9a 100644
--- a/sys/dev/buslogic/bt.c
+++ b/sys/dev/buslogic/bt.c
@@ -29,7 +29,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *      $Id: bt.c,v 1.10 1998/11/10 06:47:11 gibbs Exp $
+ *      $Id: bt.c,v 1.11 1998/11/13 13:23:36 gibbs Exp $
  */
 
  /*
@@ -449,15 +449,15 @@ bt_fetch_adapter_info(struct bt_softc *bt)
 
 	if (esetup_info.bus_type == 'A'
 	 && bt->firmware_ver[0] == '2') {
-		strcpy(bt->model, "542B");
+		snprintf(bt->model, sizeof(bt->model), "542B");
 	} else if (esetup_info.bus_type == 'E'
 		&& (strncmp(bt->firmware_ver, "2.1", 3) == 0
 		 || strncmp(bt->firmware_ver, "2.20", 4) == 0)) {
-		strcpy(bt->model, "742A");
+		snprintf(bt->model, sizeof(bt->model), "742A");
 	} else if (esetup_info.bus_type == 'E'
 		&& bt->firmware_ver[0] == '0') {
 		/* AMI FastDisk EISA Series 441 0.x */
-		strcpy(bt->model, "747A");
+		snprintf(bt->model, sizeof(bt->model), "747A");
 	} else {
 		ha_model_data_t model_data;
 		int i;
@@ -819,7 +819,7 @@ bt_name(struct bt_softc *bt)
 {
 	static char name[10];
 
-	sprintf(name, "bt%d", bt->unit);
+	snprintf(name, sizeof(name), "bt%d", bt->unit);
 	return (name);
 }
 
diff --git a/sys/dev/dpt/dpt_control.c b/sys/dev/dpt/dpt_control.c
index ba4bec9..b28fb67 100644
--- a/sys/dev/dpt/dpt_control.c
+++ b/sys/dev/dpt/dpt_control.c
@@ -36,7 +36,7 @@
  * future.
  */
 
-#ident "$Id: dpt_control.c,v 1.8 1998/08/05 00:54:36 eivind Exp $"
+#ident "$Id: dpt_control.c,v 1.9 1998/09/15 08:33:31 gibbs Exp $"
 
 #include "opt_dpt.h"
 
@@ -782,7 +782,8 @@ dpt_ioctl(dev_t dev, u_long cmd, caddr_t cmdarg, int flags, struct proc * p)
 				compat_softc.ha_npend = dpt->submitted_ccbs_count;
 				compat_softc.ha_active_jobs = dpt->waiting_ccbs_count;
 				strncpy(compat_softc.ha_fw_version,
-					dpt->board_data.firmware, 4);
+				    dpt->board_data.firmware,
+				    sizeof(compat_softc.ha_fw_version));
 				compat_softc.ha_ccb = NULL;
 				compat_softc.ha_cblist = NULL;
 				compat_softc.ha_dev = NULL;
diff --git a/sys/dev/eisa/eisaconf.c b/sys/dev/eisa/eisaconf.c
index 11418e7..b362fd5 100644
--- a/sys/dev/eisa/eisaconf.c
+++ b/sys/dev/eisa/eisaconf.c
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: eisaconf.c,v 1.34 1998/02/09 06:08:09 eivind Exp $
+ *	$Id: eisaconf.c,v 1.35 1998/05/14 19:47:38 gibbs Exp $
  */
 
 #include "opt_eisa.h"
@@ -350,7 +350,7 @@ eisa_reg_end(e_dev)
 	{
 		char string[25];
 
-		sprintf(string, " on %s0 slot %d",
+		snprintf(string, sizeof(string), " on %s0 slot %d",
 			mainboard_drv.name,
 			e_dev->ioconf.slot);
 		eisa_reg_print(e_dev, string, NULL);
@@ -432,7 +432,7 @@ eisa_reg_intr(e_dev, irq, func, arg, maskptr, shared)
 		return EPERM;
 	}
 
-	sprintf(string, " irq %d", irq);
+	snprintf(string, sizeof(string), " irq %d", irq);
 	eisa_reg_print(e_dev, string, reg_state.num_interrupts ? 
 				      &separator : NULL);
 	reg_state.num_interrupts++;
diff --git a/sys/dev/en/if_en_pci.c b/sys/dev/en/if_en_pci.c
index d1853b5..37db78e 100644
--- a/sys/dev/en/if_en_pci.c
+++ b/sys/dev/en/if_en_pci.c
@@ -259,7 +259,7 @@ int unit;
   enpcis[unit] = scp;			/* lock it in */
   en_cd.cd_devs[unit] = sc;		/* fake a cfdriver structure */
   en_cd.cd_ndevs = NEN;
-  sprintf(sc->sc_dev.dv_xname, "en%d", unit);
+  snprintf(sc->sc_dev.dv_xname, sizeof(sc->sc_dev.dv_xname), "en%d", unit);
   sc->enif.if_unit = unit;
   sc->enif.if_name = "en";
 
diff --git a/sys/dev/en/midway.c b/sys/dev/en/midway.c
index 2e22fd1..44a4659 100644
--- a/sys/dev/en/midway.c
+++ b/sys/dev/en/midway.c
@@ -1278,8 +1278,8 @@ caddr_t data;
 				break;
 		    
 			if ((shadow = pvc_attach(ifp)) != NULL) {
-				sprintf(ifr->ifr_name, "%s%d",
-					shadow->if_name, shadow->if_unit);
+				snprintf(ifr->ifr_name, sizeof(ifr->ifr_name),
+				    "%s%d", shadow->if_name, shadow->if_unit);
 			}
 			else
 				error = ENOBUFS;
@@ -3643,8 +3643,8 @@ static int en_pvctx(sc, pvcreq)
 			       pvcreq->pvc_ifname);
 			return (EINVAL);
 		}
-    		sprintf(pvcreq->pvc_ifname, "%s%d",
-			sc->enif.if_name, sc->enif.if_unit);
+    		snprintf(pvcreq->pvc_ifname, sizeof(pvcreq->pvc_ifname),
+		    "%s%d", sc->enif.if_name, sc->enif.if_unit);
 		
 		ATM_PH_FLAGS(&api.aph) = ATM_PH_PVCSIF |
 			(ATM_PH_FLAGS(pvc_aph) & (ATM_PH_AAL5|ATM_PH_LLCSNAP));
diff --git a/sys/dev/fdc/fdc.c b/sys/dev/fdc/fdc.c
index d6a7659..3bb7737 100644
--- a/sys/dev/fdc/fdc.c
+++ b/sys/dev/fdc/fdc.c
@@ -43,7 +43,7 @@
  * SUCH DAMAGE.
  *
  *	from:	@(#)fd.c	7.4 (Berkeley) 5/25/91
- *	$Id: fd.c,v 1.123 1998/09/15 22:07:24 gibbs Exp $
+ *	$Id: fd.c,v 1.124 1998/10/22 05:58:38 bde Exp $
  *
  */
 
@@ -340,7 +340,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (out_fdc(fdcu, va_arg(ap, int)) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %x failed at out byte %d of %d\n",
 				cmd, n + 1, n_out);
 			return fdc_err(fdcu, msg);
@@ -353,7 +353,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (fd_in(fdcu, ptr) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %02x failed at in byte %d of %d\n",
 				cmd, n + 1, n_in);
 			return fdc_err(fdcu, msg);
diff --git a/sys/dev/hea/eni.c b/sys/dev/hea/eni.c
index 17427e9..c3e63b9a 100644
--- a/sys/dev/hea/eni.c
+++ b/sys/dev/hea/eni.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: eni.c,v 1.2 1998/09/17 09:34:58 phk Exp $
+ *	@(#) $Id: eni.c,v 1.3 1998/10/31 20:06:45 phk Exp $
  *
  */
 
@@ -42,7 +42,7 @@
 #include <dev/hea/eni_var.h>
 
 #ifndef	lint
-__RCSID("@(#) $Id: eni.c,v 1.2 1998/09/17 09:34:58 phk Exp $");
+__RCSID("@(#) $Id: eni.c,v 1.3 1998/10/31 20:06:45 phk Exp $");
 #endif
 
 /*
@@ -496,10 +496,12 @@ eni_pci_attach ( pcici_t config_id, int unit )
 	 * Make a hw version number from the ID register values.
 	 * Format: {Midway ID}.{Mother board ID}.{Daughter board ID}
 	 */
-	sprintf ( eup->eu_config.ac_hard_vers, "%ld/%ld/%ld",
-	    (val >> ID_SHIFT) & ID_MASK,
+	snprintf ( eup->eu_config.ac_hard_vers,
+	    sizeof ( eup->eu_config.ac_hard_vers ),
+		"%ld/%ld/%ld",
+		(val >> ID_SHIFT) & ID_MASK,
 		(val >> MID_SHIFT) & MID_MASK,
-			(val >> DID_SHIFT) & DID_MASK );
+		(val >> DID_SHIFT) & DID_MASK );
 
 	/*
 	 * There is no software version number
diff --git a/sys/dev/hea/eni_if.c b/sys/dev/hea/eni_if.c
index d2c9ad6..49f5e09 100644
--- a/sys/dev/hea/eni_if.c
+++ b/sys/dev/hea/eni_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: eni_if.c,v 1.1 1998/09/15 08:22:53 phk Exp $
+ *	@(#) $Id: eni_if.c,v 1.2 1998/10/31 20:06:45 phk Exp $
  *
  */
 
@@ -43,7 +43,7 @@
 #include <dev/hea/eni_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: eni_if.c,v 1.1 1998/09/15 08:22:53 phk Exp $");
+__RCSID("@(#) $Id: eni_if.c,v 1.2 1998/10/31 20:06:45 phk Exp $");
 #endif
 
 static void	eni_get_stats __P((Eni_unit *));
@@ -194,7 +194,8 @@ eni_atm_ioctl ( code, data, arg )
 		 */
 		if ( eup == NULL )
 			return ( ENXIO );
-		sprintf ( ifname, "%s%d", pip->pif_name, pip->pif_unit );
+		snprintf ( ifname, sizeof(ifname),
+		    "%s%d", pip->pif_name, pip->pif_unit );
 
 		/*
 		 * Cast response structure onto user's buffer
diff --git a/sys/dev/hfa/fore_command.c b/sys/dev/hfa/fore_command.c
index c2ed628..d8e0e9d 100644
--- a/sys/dev/hfa/fore_command.c
+++ b/sys/dev/hfa/fore_command.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_command.c,v 1.2 1998/09/17 09:34:58 phk Exp $
+ *	@(#) $Id: fore_command.c,v 1.3 1998/10/31 20:06:52 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_command.c,v 1.2 1998/09/17 09:34:58 phk Exp $");
+__RCSID("@(#) $Id: fore_command.c,v 1.3 1998/10/31 20:06:52 phk Exp $");
 #endif
 
 /*
@@ -341,7 +341,8 @@ fore_cmd_drain(fup)
 					sizeof(struct mac_addr));
 				fup->fu_config.ac_macaddr = 
 					fup->fu_pif.pif_macaddr;
-				sprintf(fup->fu_config.ac_hard_vers,
+				snprintf(fup->fu_config.ac_hard_vers,
+				    sizeof(fup->fu_config.ac_hard_vers),
 					"%ld.%ld.%ld",
 					(fp->pr_hwver >> 16) & 0xff,
 					(fp->pr_hwver >> 8) & 0xff,
diff --git a/sys/dev/hfa/fore_if.c b/sys/dev/hfa/fore_if.c
index 9c8a82d..479e7e6 100644
--- a/sys/dev/hfa/fore_if.c
+++ b/sys/dev/hfa/fore_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_if.c,v 1.1 1998/09/15 08:22:55 phk Exp $
+ *	@(#) $Id: fore_if.c,v 1.2 1998/10/31 20:06:52 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_if.c,v 1.1 1998/09/15 08:22:55 phk Exp $");
+__RCSID("@(#) $Id: fore_if.c,v 1.2 1998/10/31 20:06:52 phk Exp $");
 #endif
 
 
@@ -85,7 +85,8 @@ fore_atm_ioctl(code, data, arg)
 		fup = (Fore_unit *)pip;
 		if ( pip == NULL )
 			return ( ENXIO );
-		sprintf ( ifname, "%s%d", pip->pif_name, pip->pif_unit );
+		snprintf ( ifname, sizeof(ifname),
+		    "%s%d", pip->pif_name, pip->pif_unit );
 
 		/*
 		 * Cast response structure onto user's buffer
diff --git a/sys/dev/hfa/fore_init.c b/sys/dev/hfa/fore_init.c
index eade984..7c1ee96 100644
--- a/sys/dev/hfa/fore_init.c
+++ b/sys/dev/hfa/fore_init.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_init.c,v 1.2 1998/09/17 09:34:59 phk Exp $
+ *	@(#) $Id: fore_init.c,v 1.3 1998/10/31 20:06:53 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_init.c,v 1.2 1998/09/17 09:34:59 phk Exp $");
+__RCSID("@(#) $Id: fore_init.c,v 1.3 1998/10/31 20:06:53 phk Exp $");
 #endif
 
 
@@ -122,7 +122,8 @@ fore_initialize(fup)
 		errmsg = "unsupported microcode version";
 		goto failed;
 	}
-	sprintf(fup->fu_config.ac_firm_vers, "%ld.%ld.%ld",
+	snprintf(fup->fu_config.ac_firm_vers,
+	    sizeof(fup->fu_config.ac_firm_vers), "%ld.%ld.%ld",
 		(vers >> 16) & 0xff, (vers >> 8) & 0xff, vers & 0xff);
 
 #ifdef notdef
diff --git a/sys/dev/hfa/fore_load.c b/sys/dev/hfa/fore_load.c
index 1d5735d..96c59be 100644
--- a/sys/dev/hfa/fore_load.c
+++ b/sys/dev/hfa/fore_load.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: fore_load.c,v 1.2 1998/09/17 09:34:59 phk Exp $
+ *	@(#) $Id: fore_load.c,v 1.3 1998/10/31 20:06:53 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <dev/hfa/fore_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: fore_load.c,v 1.2 1998/09/17 09:34:59 phk Exp $");
+__RCSID("@(#) $Id: fore_load.c,v 1.3 1998/10/31 20:06:53 phk Exp $");
 #endif
 
 
@@ -726,10 +726,12 @@ fore_attach(devinfo_p)
 		val = getprop ( devinfo_p->devi_nodeid, "hw-version", -1 );
 	}
 	if (val != -1) {
-		sprintf(fcp->ac_hard_vers, "%d.%d.%d",
+		snprintf(fcp->ac_hard_vers,
+		    sizeof(fcp->ac_hard_vers), "%d.%d.%d",
 			(val >> 16) & 0xff, (val >> 8) & 0xff, val & 0xff);
 	} else
-		sprintf(fcp->ac_hard_vers, "Unknown");
+		snprintf(fcp->ac_hard_vers,
+		    sizeof(fcp->ac_hard_vers), "Unknown");
 
 	val = getprop ( devinfo_p->devi_nodeid, "serialnumber", -1 );
 	if ( val != -1 )
diff --git a/sys/dev/isp/isp_pci.c b/sys/dev/isp/isp_pci.c
index ae7842b..f22cfe1 100644
--- a/sys/dev/isp/isp_pci.c
+++ b/sys/dev/isp/isp_pci.c
@@ -270,7 +270,7 @@ isp_pci_attach(config_id, unit)
 	    pcs->pci_st == IO_SPACE_MAPPING? "I/O" : "Memory");
 
 	isp = &pcs->pci_isp;
-	(void) sprintf(isp->isp_name, "isp%d", unit);
+	(void) snprintf(isp->isp_name, sizeof(isp->isp_name), "isp%d", unit);
 	isp->isp_osinfo.unit = unit;
 
 	data = pci_conf_read(config_id, PCI_ID_REG);
diff --git a/sys/dev/pcm/isa/mss.c b/sys/dev/pcm/isa/mss.c
index 6ded9bf..56021d9 100644
--- a/sys/dev/pcm/isa/mss.c
+++ b/sys/dev/pcm/isa/mss.c
@@ -1300,7 +1300,7 @@ mss_detect(struct isa_device *dev)
 	}
     }
     BVDDB(printf("mss_detect() - Detected %s\n", name));
-    strcpy(d->name, name);
+    snprintf(d->name, sizeof(d->name), "%s", name);
     dev->id_flags &= ~DV_F_DEV_MASK ;
     dev->id_flags |= (d->bd_id << DV_F_DEV_SHIFT) & DV_F_DEV_MASK ;
     return 1;
@@ -1500,7 +1500,7 @@ cs423x_attach(u_long csn, u_long vend_id, char *name,
 	    tmp_d.bd_id = MD_CS4232 ; /* to short-circuit the detect routine */
 	    break;
 	}
-	strcpy(tmp_d.name, name);
+	snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 	tmp_d.audio_fmt |= AFMT_FULLDUPLEX ;
     }
     write_pnp_parms( &d, ldn );
@@ -1574,7 +1574,7 @@ opti931_attach(u_long csn, u_long vend_id, char *name,
     snddev_last_probed = &tmp_d;
     tmp_d =  d.flags & DV_PNP_SBCODEC ? sb_op_desc : mss_op_desc ;
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     /*
      * My MED3931 v.1.0 allocates 3 bytes for the config space,
@@ -1780,7 +1780,7 @@ guspnp_attach(u_long csn, u_long vend_id, char *name,
     gus_write(tmp_d.conf_base, 0x5b , tmp | 1 );
     BVDDB(printf("GUS: silicon rev %c\n", 'A' + ( ( tmp & 0xf ) >> 4) );)
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     pcmattach(dev);
 }
diff --git a/sys/dev/pcm/isa/sb.c b/sys/dev/pcm/isa/sb.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/pcm/isa/sb.c
+++ b/sys/dev/pcm/isa/sb.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/dev/sound/isa/mss.c b/sys/dev/sound/isa/mss.c
index 6ded9bf..56021d9 100644
--- a/sys/dev/sound/isa/mss.c
+++ b/sys/dev/sound/isa/mss.c
@@ -1300,7 +1300,7 @@ mss_detect(struct isa_device *dev)
 	}
     }
     BVDDB(printf("mss_detect() - Detected %s\n", name));
-    strcpy(d->name, name);
+    snprintf(d->name, sizeof(d->name), "%s", name);
     dev->id_flags &= ~DV_F_DEV_MASK ;
     dev->id_flags |= (d->bd_id << DV_F_DEV_SHIFT) & DV_F_DEV_MASK ;
     return 1;
@@ -1500,7 +1500,7 @@ cs423x_attach(u_long csn, u_long vend_id, char *name,
 	    tmp_d.bd_id = MD_CS4232 ; /* to short-circuit the detect routine */
 	    break;
 	}
-	strcpy(tmp_d.name, name);
+	snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 	tmp_d.audio_fmt |= AFMT_FULLDUPLEX ;
     }
     write_pnp_parms( &d, ldn );
@@ -1574,7 +1574,7 @@ opti931_attach(u_long csn, u_long vend_id, char *name,
     snddev_last_probed = &tmp_d;
     tmp_d =  d.flags & DV_PNP_SBCODEC ? sb_op_desc : mss_op_desc ;
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     /*
      * My MED3931 v.1.0 allocates 3 bytes for the config space,
@@ -1780,7 +1780,7 @@ guspnp_attach(u_long csn, u_long vend_id, char *name,
     gus_write(tmp_d.conf_base, 0x5b , tmp | 1 );
     BVDDB(printf("GUS: silicon rev %c\n", 'A' + ( ( tmp & 0xf ) >> 4) );)
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     pcmattach(dev);
 }
diff --git a/sys/dev/sound/isa/sb.c b/sys/dev/sound/isa/sb.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/sound/isa/sb.c
+++ b/sys/dev/sound/isa/sb.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/dev/sound/isa/sb16.c b/sys/dev/sound/isa/sb16.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/sound/isa/sb16.c
+++ b/sys/dev/sound/isa/sb16.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/dev/sound/isa/sb8.c b/sys/dev/sound/isa/sb8.c
index 2b2e84a..06599ec 100644
--- a/sys/dev/sound/isa/sb8.c
+++ b/sys/dev/sound/isa/sb8.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/fs/coda/coda_vfsops.c b/sys/fs/coda/coda_vfsops.c
index e282911..79ca465 100644
--- a/sys/fs/coda/coda_vfsops.c
+++ b/sys/fs/coda/coda_vfsops.c
@@ -27,7 +27,7 @@
  * Mellon the rights to redistribute these changes without encumbrance.
  * 
  *  	@(#) src/sys/cfs/coda_vfsops.c,v 1.1.1.1 1998/08/29 21:14:52 rvb Exp $
- *  $Id: coda_vfsops.c,v 1.8 1998/11/03 08:55:06 peter Exp $
+ *  $Id: coda_vfsops.c,v 1.9 1998/11/16 19:48:26 rvb Exp $
  * 
  */
 
@@ -47,6 +47,9 @@
 /*
  * HISTORY
  * $Log: coda_vfsops.c,v $
+ * Revision 1.9  1998/11/16 19:48:26  rvb
+ * A few bug fixes for Robert Watson
+ *
  * Revision 1.8  1998/11/03 08:55:06  peter
  * Support KLD.  We register and unregister two modules. "coda" (the vfs)
  * via VFS_SET(), and "codadev" for the cdevsw entry.  From kldstat -v:
@@ -592,8 +595,8 @@ coda_nb_statfs(vfsp, sbp, p)
     sbp->f_files = NB_SFS_SIZ;
     sbp->f_ffree = NB_SFS_SIZ;
     bcopy((caddr_t)&(vfsp->mnt_stat.f_fsid), (caddr_t)&(sbp->f_fsid), sizeof (fsid_t));
-    strcpy(sbp->f_mntonname, "/coda");
-    strcpy(sbp->f_mntfromname, "CODA");
+    snprintf(sbp->f_mntonname, sizeof(sbp->f_mntonname), "/coda");
+    snprintf(sbp->f_mntfromname, sizeof(sbp->f_mntfromname), "CODA");
 /*  MARK_INT_SAT(CODA_STATFS_STATS); */
     return(0);
 }
diff --git a/sys/fs/procfs/procfs_map.c b/sys/fs/procfs/procfs_map.c
index 1a865e6..4dae10a 100644
--- a/sys/fs/procfs/procfs_map.c
+++ b/sys/fs/procfs/procfs_map.c
@@ -36,7 +36,7 @@
  *
  *	@(#)procfs_status.c	8.3 (Berkeley) 2/17/94
  *
- *	$Id: procfs_map.c,v 1.16 1998/02/06 12:13:41 eivind Exp $
+ *	$Id: procfs_map.c,v 1.17 1998/04/29 04:28:22 dyson Exp $
  */
 
 #include <sys/param.h>
@@ -153,7 +153,8 @@ case OBJT_DEVICE:
 		 * format:
 		 *  start, end, resident, private resident, cow, access, type.
 		 */
-		sprintf(mebuffer, "0x%x 0x%x %d %d %d %s%s%s %d %d 0x%x %s %s %s\n",
+		snprintf(mebuffer, sizeof(mebuffer),
+		    "0x%x 0x%x %d %d %d %s%s%s %d %d 0x%x %s %s %s\n",
 			entry->start, entry->end,
 			resident, privateresident, id,
 			(entry->protection & VM_PROT_READ)?"r":"-",
diff --git a/sys/fs/procfs/procfs_vnops.c b/sys/fs/procfs/procfs_vnops.c
index 8a6230e..6879b08 100644
--- a/sys/fs/procfs/procfs_vnops.c
+++ b/sys/fs/procfs/procfs_vnops.c
@@ -36,7 +36,7 @@
  *
  *	@(#)procfs_vnops.c	8.18 (Berkeley) 5/21/95
  *
- *	$Id: procfs_vnops.c,v 1.60 1998/06/25 16:54:41 dt Exp $
+ *	$Id: procfs_vnops.c,v 1.61 1998/07/11 07:45:46 bde Exp $
  */
 
 /*
@@ -528,7 +528,7 @@ procfs_getattr(ap)
 		vap->va_uid = 0;
 		vap->va_gid = 0;
 		vap->va_size = vap->va_bytes =
-		    sprintf(buf, "%ld", (long)curproc->p_pid);
+		    snprintf(buf, sizeof(buf), "%ld", (long)curproc->p_pid);
 		break;
 	}
 
@@ -944,7 +944,7 @@ procfs_readlink(ap)
 	if (VTOPFS(ap->a_vp)->pfs_fileno != PROCFS_FILENO(0, Pcurproc))
 		return (EINVAL);
 
-	len = sprintf(buf, "%ld", (long)curproc->p_pid);
+	len = snprintf(buf, sizeof(buf), "%ld", (long)curproc->p_pid);
 
 	return (uiomove((caddr_t)buf, len, ap->a_uio));
 }
diff --git a/sys/gnu/i386/isa/sound/awe_wave.c b/sys/gnu/i386/isa/sound/awe_wave.c
index 3dc591e..63a1a97 100644
--- a/sys/gnu/i386/isa/sound/awe_wave.c
+++ b/sys/gnu/i386/isa/sound/awe_wave.c
@@ -578,7 +578,7 @@ int attach_awe(void)
 	/* intialize AWE32 hardware */
 	awe_initialize();
 
-	sprintf(awe_info.name, "AWE32-%s (RAM%dk)",
+	snprintf(awe_info.name, sizeof(awe_info.name), "AWE32-%s (RAM%dk)",
 		AWEDRV_VERSION, awe_mem_size/1024);
 #ifdef __FreeBSD__
 	printk("awe0: <SoundBlaster EMU8000 MIDI (RAM%dk)>", awe_mem_size/1024);
diff --git a/sys/i386/eisa/eisaconf.c b/sys/i386/eisa/eisaconf.c
index 11418e7..b362fd5 100644
--- a/sys/i386/eisa/eisaconf.c
+++ b/sys/i386/eisa/eisaconf.c
@@ -28,7 +28,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: eisaconf.c,v 1.34 1998/02/09 06:08:09 eivind Exp $
+ *	$Id: eisaconf.c,v 1.35 1998/05/14 19:47:38 gibbs Exp $
  */
 
 #include "opt_eisa.h"
@@ -350,7 +350,7 @@ eisa_reg_end(e_dev)
 	{
 		char string[25];
 
-		sprintf(string, " on %s0 slot %d",
+		snprintf(string, sizeof(string), " on %s0 slot %d",
 			mainboard_drv.name,
 			e_dev->ioconf.slot);
 		eisa_reg_print(e_dev, string, NULL);
@@ -432,7 +432,7 @@ eisa_reg_intr(e_dev, irq, func, arg, maskptr, shared)
 		return EPERM;
 	}
 
-	sprintf(string, " irq %d", irq);
+	snprintf(string, sizeof(string), " irq %d", irq);
 	eisa_reg_print(e_dev, string, reg_state.num_interrupts ? 
 				      &separator : NULL);
 	reg_state.num_interrupts++;
diff --git a/sys/i386/ibcs2/ibcs2_socksys.c b/sys/i386/ibcs2/ibcs2_socksys.c
index e52bd2c..c7f109a 100644
--- a/sys/i386/ibcs2/ibcs2_socksys.c
+++ b/sys/i386/ibcs2/ibcs2_socksys.c
@@ -146,7 +146,7 @@ ibcs2_getipdomainname(p, uap)
 	int len;
 
 	/* Get the domain name */
-	strcpy(hname, hostname);
+	snprintf(hname, sizeof(hname), "%s", hostname);
 	dptr = index(hname, '.');
 	if ( dptr )
 		dptr++;
@@ -177,7 +177,7 @@ ibcs2_setipdomainname(p, uap)
 		return EINVAL;
 
 	/* Get the host's unqualified name (strip off the domain) */
-	strcpy(hname, hostname);
+	snprintf(hname, sizeof(hname), "%s", hostname);
 	ptr = index(hname, '.');
 	if ( ptr != NULL ) {
 		ptr++;
diff --git a/sys/i386/ibcs2/ibcs2_stat.c b/sys/i386/ibcs2/ibcs2_stat.c
index febf4d2..d3bf6ae 100644
--- a/sys/i386/ibcs2/ibcs2_stat.c
+++ b/sys/i386/ibcs2/ibcs2_stat.c
@@ -221,20 +221,19 @@ ibcs2_utssys(p, uap)
 		struct ibcs2_utsname sut;
 		bzero(&sut, ibcs2_utsname_len);
 
-		strncpy(sut.sysname, IBCS2_UNAME_SYSNAME, sizeof(sut.sysname));
-		strncpy(sut.release, IBCS2_UNAME_RELEASE, sizeof(sut.release));
-		strncpy(sut.version, IBCS2_UNAME_VERSION, sizeof(sut.version));
-		strncpy(machine_name, hostname, sizeof(machine_name));
+		strncpy(sut.sysname,
+			IBCS2_UNAME_SYSNAME, sizeof(sut.sysname) - 1);
+		strncpy(sut.release,
+			IBCS2_UNAME_RELEASE, sizeof(sut.release) - 1);
+		strncpy(sut.version,
+			IBCS2_UNAME_VERSION, sizeof(sut.version) - 1);
+		strncpy(machine_name, hostname, sizeof(machine_name) - 1);
+		machine_name[sizeof(machine_name) - 1] = 0;
 		p = index(machine_name, '.');
 		if ( p )
 			*p = '\0';
-		strncpy(sut.nodename, machine_name, sizeof(sut.nodename));
-		strncpy(sut.machine, machine, sizeof(sut.machine));
-		sut.sysname[sizeof(sut.sysname)-1] = '\0';
-		sut.release[sizeof(sut.release)-1] = '\0';
-		sut.version[sizeof(sut.version)-1] = '\0';
-		sut.nodename[sizeof(sut.nodename)-1] = '\0';
-		sut.machine[sizeof(sut.machine)-1] = '\0';
+		strncpy(sut.nodename, machine_name, sizeof(sut.nodename) - 1);
+		strncpy(sut.machine, machine, sizeof(sut.machine) - 1);
 
 		DPRINTF(("IBCS2 uname: sys=%s rel=%s ver=%s node=%s mach=%s\n",
 			 sut.sysname, sut.release, sut.version, sut.nodename,
diff --git a/sys/i386/ibcs2/ibcs2_xenix.c b/sys/i386/ibcs2/ibcs2_xenix.c
index 0677ede..8ab5556 100644
--- a/sys/i386/ibcs2/ibcs2_xenix.c
+++ b/sys/i386/ibcs2/ibcs2_xenix.c
@@ -27,7 +27,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- *	$Id: ibcs2_xenix.c,v 1.15 1998/06/02 05:39:07 dyson Exp $
+ *	$Id: ibcs2_xenix.c,v 1.16 1998/08/16 01:21:49 bde Exp $
  */
 
 #include <sys/param.h>
@@ -157,14 +157,22 @@ xenix_utsname(struct proc *p, struct xenix_utsname_args *uap)
 
 	DPRINTF(("IBCS2: 'xenix sco_utsname'\n"));
 	bzero(&ibcs2_sco_uname, sizeof(struct ibcs2_sco_utsname));
-	strncpy(ibcs2_sco_uname.sysname, ostype, 8);
-	strncpy(ibcs2_sco_uname.nodename, hostname, 8);
-	strncpy(ibcs2_sco_uname.release, osrelease, 15);
-	strncpy(ibcs2_sco_uname.kernelid, version, 19);
-	strncpy(ibcs2_sco_uname.machine, machine, 8);
-	bcopy("ISA/EISA", ibcs2_sco_uname.bustype, 8);
-	bcopy("no charge", ibcs2_sco_uname.sysserial, 9);
-	bcopy("unlim", ibcs2_sco_uname.numusers, 8);
+	strncpy(ibcs2_sco_uname.sysname, ostype,
+		sizeof(ibcs2_sco_uname.sysname) - 1);
+	strncpy(ibcs2_sco_uname.nodename, hostname,
+		sizeof(ibcs2_sco_uname.nodename) - 1);
+	strncpy(ibcs2_sco_uname.release, osrelease,
+		sizeof(ibcs2_sco_uname.release) - 1);
+	strncpy(ibcs2_sco_uname.kernelid, version,
+		sizeof(ibcs2_sco_uname.kernelid) - 1);
+	strncpy(ibcs2_sco_uname.machine, machine,
+		sizeof(ibcs2_sco_uname.machine) - 1);
+	strncpy(ibcs2_sco_uname.bustype, "ISA/EISA",
+		sizeof(ibcs2_sco_uname.bustype) - 1);
+	strncpy(ibcs2_sco_uname.sysserial, "no charge",
+		sizeof(ibcs2_sco_uname.sysserial) - 1);
+	strncpy(ibcs2_sco_uname.numusers, "unlim",
+		sizeof(ibcs2_sco_uname.numusers) - 1);
 	ibcs2_sco_uname.sysorigin = 0xFFFF;
 	ibcs2_sco_uname.sysoem = 0xFFFF;
 	ibcs2_sco_uname.numcpu = 1;
diff --git a/sys/i386/isa/atapi.c b/sys/i386/isa/atapi.c
index 44cdc4e..357d8d1 100644
--- a/sys/i386/isa/atapi.c
+++ b/sys/i386/isa/atapi.c
@@ -380,7 +380,7 @@ static char *cmdname (u_char cmd)
 	case 0xbd: return ("ATAPI_MECH_STATUS"); 
 	case 0xbe: return ("READ_CD");
 	}
-	sprintf (buf, "[0x%x]", cmd);
+	snprintf (buf, sizeof(buf), "[0x%x]", cmd);
 	return (buf);
 }
 
diff --git a/sys/i386/isa/bs/bs_isa.c b/sys/i386/isa/bs/bs_isa.c
index 7215de6..644dc0e 100644
--- a/sys/i386/isa/bs/bs_isa.c
+++ b/sys/i386/isa/bs/bs_isa.c
@@ -59,7 +59,8 @@ bs_args_copy(bsc, ia, hw)
 		bsc->sm_offset = 0;
 
 	bsc->sc_cfgflags = DVCFG_MINOR(ia->ia_cfgflags);
-	strcpy(bsc->sc_dvname, bsc->sc_dev.dv_xname);
+	snprintf(bsc->sc_dvname, sizeof(bsc->sc_dvname),
+		"%s", bsc->sc_dev.dv_xname);
 }
 
 static int
diff --git a/sys/i386/isa/bs/bsif.c b/sys/i386/isa/bs/bsif.c
index 58e7203..fc02971 100644
--- a/sys/i386/isa/bs/bsif.c
+++ b/sys/i386/isa/bs/bsif.c
@@ -158,7 +158,7 @@ bsprobe(dev)
 	else
 		bsc->sm_offset = (u_long) 0;
 
-	sprintf(bsc->sc_dvname, "bs%d", unit);
+	snprintf(bsc->sc_dvname, sizeof(bsc->sc_dvname), "bs%d", unit);
 
 	if (dev->id_iobase == 0)
 	{
diff --git a/sys/i386/isa/cx.c b/sys/i386/isa/cx.c
index b4fb324..74322b7 100644
--- a/sys/i386/isa/cx.c
+++ b/sys/i386/isa/cx.c
@@ -417,7 +417,8 @@ int cxioctl (dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
 			case 8: o->iftype = c->board->if8type; break;
 			}
 			if (c->master != c->ifp)
-				sprintf (o->master, "%s%d", c->master->if_name,
+				snprintf (o->master, sizeof(o->master),
+				    "%s%d", c->master->if_name,
 					c->master->if_unit);
 			else
 				*o->master = 0;
diff --git a/sys/i386/isa/diskslice_machdep.c b/sys/i386/isa/diskslice_machdep.c
index ab9d4ba..adfd39c 100644
--- a/sys/i386/isa/diskslice_machdep.c
+++ b/sys/i386/isa/diskslice_machdep.c
@@ -35,7 +35,7 @@
  *
  *	from: @(#)ufs_disksubr.c	7.16 (Berkeley) 5/4/91
  *	from: ufs_disksubr.c,v 1.8 1994/06/07 01:21:39 phk Exp $
- *	$Id: diskslice_machdep.c,v 1.30 1998/07/25 16:35:06 bde Exp $
+ *	$Id: diskslice_machdep.c,v 1.31 1998/08/10 07:22:14 phk Exp $
  */
 
 #include <sys/param.h>
@@ -405,7 +405,7 @@ extended(dname, dev, strat, lp, ssp, ext_offset, ext_size, base_ext_offset,
 
 			sname = dsname(dname, dkunit(dev), WHOLE_DISK_SLICE,
 				       RAW_PART, partname);
-			strcpy(buf, sname);
+			snprintf(buf, sizeof(buf), "%s", sname);
 			if (strlen(buf) < sizeof buf - 11)
 				strcat(buf, "<extended>");
 			check_part(buf, dp, base_ext_offset, nsectors,
diff --git a/sys/i386/isa/fd.c b/sys/i386/isa/fd.c
index d6a7659..3bb7737 100644
--- a/sys/i386/isa/fd.c
+++ b/sys/i386/isa/fd.c
@@ -43,7 +43,7 @@
  * SUCH DAMAGE.
  *
  *	from:	@(#)fd.c	7.4 (Berkeley) 5/25/91
- *	$Id: fd.c,v 1.123 1998/09/15 22:07:24 gibbs Exp $
+ *	$Id: fd.c,v 1.124 1998/10/22 05:58:38 bde Exp $
  *
  */
 
@@ -340,7 +340,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (out_fdc(fdcu, va_arg(ap, int)) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %x failed at out byte %d of %d\n",
 				cmd, n + 1, n_out);
 			return fdc_err(fdcu, msg);
@@ -353,7 +353,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (fd_in(fdcu, ptr) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %02x failed at in byte %d of %d\n",
 				cmd, n + 1, n_in);
 			return fdc_err(fdcu, msg);
diff --git a/sys/i386/isa/intr_machdep.c b/sys/i386/isa/intr_machdep.c
index 3f891f2..08c2049 100644
--- a/sys/i386/isa/intr_machdep.c
+++ b/sys/i386/isa/intr_machdep.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)isa.c	7.2 (Berkeley) 5/13/91
- *	$Id: intr_machdep.c,v 1.13 1998/06/18 16:08:46 bde Exp $
+ *	$Id: intr_machdep.c,v 1.14 1998/09/06 22:41:41 tegge Exp $
  */
 
 #include "opt_auto_eoi.h"
@@ -325,7 +325,7 @@ find_device_id(int irq)
 	char *cp;
 	int free_id, id;
 
-	sprintf(buf, "pci irq%d", irq);
+	snprintf(buf, sizeof(buf), "pci irq%d", irq);
 	cp = intrnames;
 	/* default to 0, which corresponds to clk0 */
 	free_id = 0;
diff --git a/sys/i386/isa/loran.c b/sys/i386/isa/loran.c
index 8b16501..20385bd 100644
--- a/sys/i386/isa/loran.c
+++ b/sys/i386/isa/loran.c
@@ -6,7 +6,7 @@
  * this stuff is worth it, you can buy me a beer in return.   Poul-Henning Kamp
  * ----------------------------------------------------------------------------
  *
- * $Id: loran.c,v 1.10 1998/10/23 10:45:10 phk Exp $
+ * $Id: loran.c,v 1.11 1998/10/24 19:55:09 phk Exp $
  *
  * This device-driver helps the userland controlprogram for a LORAN-C
  * receiver avoid monopolizing the CPU.
@@ -577,7 +577,8 @@ loranintr(int unit)
 	outb(PAR, par);
 
 	if (status) {
-		sprintf(lorantext, "Missed: %02x %d %d this:%p next:%p (dummy=%p)\n", 
+		snprintf(lorantext, sizeof(lorantext),
+		    "Missed: %02x %d %d this:%p next:%p (dummy=%p)\n", 
 		    status, count, delay, this, next, &dummy);
 		loranerror = 1;
 	}
diff --git a/sys/i386/isa/nmi.c b/sys/i386/isa/nmi.c
index 3f891f2..08c2049 100644
--- a/sys/i386/isa/nmi.c
+++ b/sys/i386/isa/nmi.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	from: @(#)isa.c	7.2 (Berkeley) 5/13/91
- *	$Id: intr_machdep.c,v 1.13 1998/06/18 16:08:46 bde Exp $
+ *	$Id: intr_machdep.c,v 1.14 1998/09/06 22:41:41 tegge Exp $
  */
 
 #include "opt_auto_eoi.h"
@@ -325,7 +325,7 @@ find_device_id(int irq)
 	char *cp;
 	int free_id, id;
 
-	sprintf(buf, "pci irq%d", irq);
+	snprintf(buf, sizeof(buf), "pci irq%d", irq);
 	cp = intrnames;
 	/* default to 0, which corresponds to clk0 */
 	free_id = 0;
diff --git a/sys/i386/isa/pcvt/pcvt_sup.c b/sys/i386/isa/pcvt/pcvt_sup.c
index 3b00191..de7f938 100644
--- a/sys/i386/isa/pcvt/pcvt_sup.c
+++ b/sys/i386/isa/pcvt/pcvt_sup.c
@@ -261,7 +261,7 @@ vgaioctl(Dev_t dev, int cmd, caddr_t data, int flag)
 static void
 vgapcvtid(struct pcvtid *data)
 {
-	strcpy(data->name, PCVTIDNAME);
+	snprintf(data->name, sizeof(data->name), "%s", PCVTIDNAME);
 	data->rmajor	= PCVTIDMAJOR;
 	data->rminor	= PCVTIDMINOR;
 }
diff --git a/sys/i386/isa/snd/ad1848.c b/sys/i386/isa/snd/ad1848.c
index 6ded9bf..56021d9 100644
--- a/sys/i386/isa/snd/ad1848.c
+++ b/sys/i386/isa/snd/ad1848.c
@@ -1300,7 +1300,7 @@ mss_detect(struct isa_device *dev)
 	}
     }
     BVDDB(printf("mss_detect() - Detected %s\n", name));
-    strcpy(d->name, name);
+    snprintf(d->name, sizeof(d->name), "%s", name);
     dev->id_flags &= ~DV_F_DEV_MASK ;
     dev->id_flags |= (d->bd_id << DV_F_DEV_SHIFT) & DV_F_DEV_MASK ;
     return 1;
@@ -1500,7 +1500,7 @@ cs423x_attach(u_long csn, u_long vend_id, char *name,
 	    tmp_d.bd_id = MD_CS4232 ; /* to short-circuit the detect routine */
 	    break;
 	}
-	strcpy(tmp_d.name, name);
+	snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 	tmp_d.audio_fmt |= AFMT_FULLDUPLEX ;
     }
     write_pnp_parms( &d, ldn );
@@ -1574,7 +1574,7 @@ opti931_attach(u_long csn, u_long vend_id, char *name,
     snddev_last_probed = &tmp_d;
     tmp_d =  d.flags & DV_PNP_SBCODEC ? sb_op_desc : mss_op_desc ;
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     /*
      * My MED3931 v.1.0 allocates 3 bytes for the config space,
@@ -1780,7 +1780,7 @@ guspnp_attach(u_long csn, u_long vend_id, char *name,
     gus_write(tmp_d.conf_base, 0x5b , tmp | 1 );
     BVDDB(printf("GUS: silicon rev %c\n", 'A' + ( ( tmp & 0xf ) >> 4) );)
 
-    strcpy(tmp_d.name, name);
+    snprintf(tmp_d.name, sizeof(tmp_d.name), "%s", name);
 
     pcmattach(dev);
 }
diff --git a/sys/i386/isa/snd/sb_dsp.c b/sys/i386/isa/snd/sb_dsp.c
index 2b2e84a..06599ec 100644
--- a/sys/i386/isa/snd/sb_dsp.c
+++ b/sys/i386/isa/snd/sb_dsp.c
@@ -739,7 +739,8 @@ sb_dsp_init(snddev_info *d, struct isa_device *dev)
 
     }
 
-    sprintf(d->name, fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
+    snprintf(d->name, sizeof(d->name),
+	fmt, (d->bd_id >> 8) &0xff, d->bd_id & 0xff);
 
     sb_mix_init(d);
 }
diff --git a/sys/i386/isa/snd/sound.c b/sys/i386/isa/snd/sound.c
index 6a26c07..3253af9 100644
--- a/sys/i386/isa/snd/sound.c
+++ b/sys/i386/isa/snd/sound.c
@@ -1300,19 +1300,21 @@ init_status(snddev_info *d)
 
     if (status_len != 0) /* only do init once */
 	return ;
-    sprintf(status_buf,
+    snprintf(status_buf, sizeof(status_buf),
 	"FreeBSD Audio Driver (981002) "  __DATE__ " " __TIME__ "\n"
 	"Installed devices:\n");
 
     for (i = 0; i < NPCM_MAX; i++) {
         if (pcm_info[i].open)
-            sprintf(status_buf + strlen(status_buf),
+            snprintf(status_buf + strlen(status_buf),
+		sizeof(status_buf) - strlen(status_buf),
 		"pcm%d: <%s> at 0x%x irq %d dma %d:%d\n",
 		i, pcm_info[i].name, pcm_info[i].io_base,
 		pcm_info[i].irq,
 		pcm_info[i].dbuf_out.chan, pcm_info[i].dbuf_in.chan);
         if (midi_info[i].open)
-            sprintf(status_buf + strlen(status_buf),
+            snprintf(status_buf + strlen(status_buf),
+		sizeof(status_buf) - strlen(status_buf),
 		"midi%d: <%s> at 0x%x irq %d dma %d:%d\n",
 		i, midi_info[i].name, midi_info[i].io_base,
 		midi_info[i].irq,
@@ -1325,7 +1327,8 @@ init_status(snddev_info *d)
 	    case 4 : s = "OPL4"; break;
 	    }
 
-            sprintf(status_buf + strlen(status_buf),
+            snprintf(status_buf + strlen(status_buf),
+		sizeof(status_buf) - strlen(status_buf),
 		"sequencer%d: <%s> at 0x%x (not functional)\n",
 		i, s, pcm_info[i].synth_base);
 	}
diff --git a/sys/i386/isa/sound/ad1848.c b/sys/i386/isa/sound/ad1848.c
index fbd5051..08b0a1e 100644
--- a/sys/i386/isa/sound/ad1848.c
+++ b/sys/i386/isa/sound/ad1848.c
@@ -1440,11 +1440,13 @@ ad1848_init(char *name, int io_base, int irq,
     outb(io_Status(devc), 0);	/* Clear pending interrupts */
 
     if (name != NULL && name[0] != 0)
-	sprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
-	    "%s (%s)", name, devc->chip_name);
+	snprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
+	    sizeof(ad1848_pcm_operations[nr_ad1848_devs].name),
+		"%s (%s)", name, devc->chip_name);
     else
-	sprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
-	    "Generic audio codec (%s)", devc->chip_name);
+	snprintf(ad1848_pcm_operations[nr_ad1848_devs].name,
+	    sizeof(ad1848_pcm_operations[nr_ad1848_devs].name),
+		"Generic audio codec (%s)", devc->chip_name);
 
     conf_printf2(ad1848_pcm_operations[nr_ad1848_devs].name,
 	     devc->base, devc->irq, dma_playback, dma_capture);
diff --git a/sys/i386/isa/sound/gus_wave.c b/sys/i386/isa/sound/gus_wave.c
index 9b3ab0b..54d36cb 100644
--- a/sys/i386/isa/sound/gus_wave.c
+++ b/sys/i386/isa/sound/gus_wave.c
@@ -4517,9 +4517,11 @@ gus_wave_init(struct address_info * hw_config)
     }
 
     if (gus_pnp_seen) {
-	sprintf(gus_info.name, "Gravis %s (%dk)", model_num, (int) gus_mem_size / 1024);
+	snprintf(gus_info.name, sizeof(gus_info.name),
+	    "Gravis %s (%dk)", model_num, (int) gus_mem_size / 1024);
     } else {
-	sprintf(gus_info.name, "Gravis UltraSound %s (%dk)", model_num, (int) gus_mem_size / 1024);
+	snprintf(gus_info.name, sizeof(gus_info.name),
+	    "Gravis UltraSound %s (%dk)", model_num, (int) gus_mem_size / 1024);
     }
     conf_printf(gus_info.name, hw_config);
 
diff --git a/sys/i386/isa/sound/mpu401.c b/sys/i386/isa/sound/mpu401.c
index fdfb94d..0bd1412 100644
--- a/sys/i386/isa/sound/mpu401.c
+++ b/sys/i386/isa/sound/mpu401.c
@@ -1002,7 +1002,8 @@ attach_mpu401(struct address_info * hw_config)
 			MPU_CAP_CLS | MPU_CAP_2PORT;
 
 	revision_char = (devc->revision == 0x7f) ? 'M' : ' ';
-	sprintf(mpu_synth_info[num_midis].name,
+	snprintf(mpu_synth_info[num_midis].name,
+	    sizeof(mpu_synth_info[num_midis].name),
 		"MQX-%d%c MIDI Interface #%d",
 		ports,
 		revision_char,
@@ -1015,7 +1016,8 @@ attach_mpu401(struct address_info * hw_config)
 
 	devc->capabilities |= MPU_CAP_SYNC | MPU_CAP_FSK;
 
-	sprintf(mpu_synth_info[num_midis].name,
+	snprintf(mpu_synth_info[num_midis].name,
+	    sizeof(mpu_synth_info[num_midis].name),
 	    "MPU-401 %d.%d%c Midi interface #%d",
 	    (int) (devc->version & 0xf0) >> 4,
 	    devc->version & 0x0f,
diff --git a/sys/i386/isa/sound/pas2_card.c b/sys/i386/isa/sound/pas2_card.c
index 06ab9f2..dc78afa 100644
--- a/sys/i386/isa/sound/pas2_card.c
+++ b/sys/i386/isa/sound/pas2_card.c
@@ -325,7 +325,7 @@ attach_pas_card(struct address_info * hw_config)
 		if ((pas_model = pas_read(CHIP_REV))) {
 			char            temp[100];
 
-			sprintf(temp,
+			snprintf(temp, sizeof(temp),
 			      "%s rev %d", pas_model_names[(int) pas_model],
 				pas_read(BOARD_REV_ID));
 			conf_printf(temp, hw_config);
diff --git a/sys/i386/isa/sound/pcm86.c b/sys/i386/isa/sound/pcm86.c
index 0df86b1..4efec0d 100644
--- a/sys/i386/isa/sound/pcm86.c
+++ b/sys/i386/isa/sound/pcm86.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- * $Id: pcm86.c,v 1.3 1997/02/22 09:38:14 peter Exp $
+ * $Id: pcm86.c,v 1.4 1997/06/03 10:25:41 kato Exp $
  */
 
 /*
@@ -1890,7 +1890,8 @@ pcm86_detect(struct address_info *hw_config)
     outb(opna_iobase + 2, 0x30);
 
     /* Ok.  Detection finished. */
-    sprintf(pcm86_operations.name, board_name[pcm_s.board_type]);
+    snprintf(pcm86_operations.name, sizeof(pcm86_operations.name),
+	"%s", board_name[pcm_s.board_type]);
     pcm_initialized = NO;
     pcm_s.irq = irq;
 
diff --git a/sys/i386/isa/sound/pss.c b/sys/i386/isa/sound/pss.c
index 17acfb2..a6a5b65 100644
--- a/sys/i386/isa/sound/pss.c
+++ b/sys/i386/isa/sound/pss.c
@@ -348,7 +348,7 @@ attach_pss(struct address_info * hw_config)
 #endif
 
 	pss_initialized = 1;
-	sprintf(tmp, "ECHO-PSS  Rev. %d", id);
+	snprintf(tmp, sizeof(tmp), "ECHO-PSS  Rev. %d", id);
 	conf_printf(tmp, hw_config);
 
 	return;
diff --git a/sys/i386/isa/sound/sb16_dsp.c b/sys/i386/isa/sound/sb16_dsp.c
index ad9be54..f94675b 100644
--- a/sys/i386/isa/sound/sb16_dsp.c
+++ b/sys/i386/isa/sound/sb16_dsp.c
@@ -450,8 +450,8 @@ sb16_dsp_init(struct address_info * hw_config)
     if (sbc_major < 4)
 	return;		/* Not a SB16 */
 
-    sprintf(sb16_dsp_operations.name, "SoundBlaster 16 %d.%d",
-		sbc_major, sbc_minor);
+    snprintf(sb16_dsp_operations.name, sizeof(sb16_dsp_operations.name),
+	"SoundBlaster 16 %d.%d", sbc_major, sbc_minor);
 
     conf_printf(sb16_dsp_operations.name, hw_config);
 
diff --git a/sys/i386/isa/sound/sb_dsp.c b/sys/i386/isa/sound/sb_dsp.c
index 1cf52c5..7d48ec8 100644
--- a/sys/i386/isa/sound/sb_dsp.c
+++ b/sys/i386/isa/sound/sb_dsp.c
@@ -1081,7 +1081,8 @@ sb_dsp_init(struct address_info * hw_config)
 	fmt = "SoundBlaster %d.%d" ;
     }
 
-    sprintf(sb_dsp_operations.name, fmt, sbc_major, sbc_minor);
+    snprintf(sb_dsp_operations.name, sizeof(sb_dsp_operations.name),
+	fmt, sbc_major, sbc_minor);
     conf_printf(sb_dsp_operations.name, hw_config);
 
 #if defined(CONFIG_SB16) && defined(CONFIG_SBPRO)
diff --git a/sys/i386/isa/sound/sound_timer.c b/sys/i386/isa/sound/sound_timer.c
index 8450b2d..cef7596 100644
--- a/sys/i386/isa/sound/sound_timer.c
+++ b/sys/i386/isa/sound/sound_timer.c
@@ -335,7 +335,7 @@ sound_timer_init(struct sound_lowlev_timer * t, char *name)
     else
 	n = num_sound_timers++;
 
-    strcpy(sound_timer.info.name, name);
+    snprintf(sound_timer.info.name, sizeof(sound_timer.info.name), "%s", name);
 
     sound_timer_devs[n] = &sound_timer;
 }
diff --git a/sys/i386/linux/linux_misc.c b/sys/i386/linux/linux_misc.c
index 9fdd923..35ce1bf 100644
--- a/sys/i386/linux/linux_misc.c
+++ b/sys/i386/linux/linux_misc.c
@@ -25,7 +25,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- *  $Id: linux_misc.c,v 1.44 1998/09/24 13:25:43 jkh Exp $
+ *  $Id: linux_misc.c,v 1.45 1998/10/05 12:40:42 sos Exp $
  */
 
 #include <sys/param.h>
@@ -746,12 +746,18 @@ linux_newuname(struct proc *p, struct linux_newuname_args *args)
     printf("Linux-emul(%d): newuname(*)\n", p->p_pid);
 #endif
     bzero(&linux_newuname, sizeof(struct linux_newuname_t));
-    strncpy(linux_newuname.sysname, ostype, 64);
-    strncpy(linux_newuname.nodename, hostname, 64);
-    strncpy(linux_newuname.release, osrelease, 64);
-    strncpy(linux_newuname.version, version, 64);
-    strncpy(linux_newuname.machine, machine, 64);
-    strncpy(linux_newuname.domainname, domainname, 64);
+    strncpy(linux_newuname.sysname, ostype,
+	sizeof(linux_newuname.sysname) - 1);
+    strncpy(linux_newuname.nodename, hostname,
+	sizeof(linux_newuname.nodename) - 1);
+    strncpy(linux_newuname.release, osrelease,
+	sizeof(linux_newuname.release) - 1);
+    strncpy(linux_newuname.version, version,
+	sizeof(linux_newuname.version) - 1);
+    strncpy(linux_newuname.machine, machine,
+	sizeof(linux_newuname.machine) - 1);
+    strncpy(linux_newuname.domainname, domainname,
+	sizeof(linux_newuname.domainname) - 1);
     return (copyout((caddr_t)&linux_newuname, (caddr_t)args->buf,
 	    	    sizeof(struct linux_newuname_t)));
 }
diff --git a/sys/isa/fd.c b/sys/isa/fd.c
index d6a7659..3bb7737 100644
--- a/sys/isa/fd.c
+++ b/sys/isa/fd.c
@@ -43,7 +43,7 @@
  * SUCH DAMAGE.
  *
  *	from:	@(#)fd.c	7.4 (Berkeley) 5/25/91
- *	$Id: fd.c,v 1.123 1998/09/15 22:07:24 gibbs Exp $
+ *	$Id: fd.c,v 1.124 1998/10/22 05:58:38 bde Exp $
  *
  */
 
@@ -340,7 +340,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (out_fdc(fdcu, va_arg(ap, int)) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %x failed at out byte %d of %d\n",
 				cmd, n + 1, n_out);
 			return fdc_err(fdcu, msg);
@@ -353,7 +353,7 @@ fd_cmd(fdcu_t fdcu, int n_out, ...)
 		if (fd_in(fdcu, ptr) < 0)
 		{
 			char msg[50];
-			sprintf(msg,
+			snprintf(msg, sizeof(msg),
 				"cmd %02x failed at in byte %d of %d\n",
 				cmd, n + 1, n_in);
 			return fdc_err(fdcu, msg);
diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c
index 0989b03..25b7031 100644
--- a/sys/kern/imgact_elf.c
+++ b/sys/kern/imgact_elf.c
@@ -26,7 +26,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- *	$Id: imgact_elf.c,v 1.41 1998/10/18 15:55:12 peter Exp $
+ *	$Id: imgact_elf.c,v 1.42 1998/10/25 17:44:50 phk Exp $
  */
 
 #include "opt_rlimit.h"
@@ -548,8 +548,8 @@ exec_elf_imgact(struct image_params *imgp)
 
 	imgp->proc->p_sysent = brand_info->sysvec;
 	if (interp != NULL) {
-		strcpy(path, brand_info->emul_path);
-		strcat(path, interp);
+		snprintf(path, sizeof(path), "%s%s",
+		    brand_info->emul_path, interp);
                 if ((error = elf_load_file(imgp->proc, path, &addr,
 		    &imgp->entry_addr)) != 0) {
                         uprintf("ELF interpreter %s not found\n", path);
diff --git a/sys/kern/kern_shutdown.c b/sys/kern/kern_shutdown.c
index d2f7116..3a2c650 100644
--- a/sys/kern/kern_shutdown.c
+++ b/sys/kern/kern_shutdown.c
@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kern_shutdown.c	8.3 (Berkeley) 1/21/94
- * $Id: kern_shutdown.c,v 1.41 1998/10/30 05:41:15 msmith Exp $
+ * $Id: kern_shutdown.c,v 1.42 1998/11/13 22:40:37 msmith Exp $
  */
 
 #include "opt_ddb.h"
@@ -427,7 +427,7 @@ panic(const char *fmt, ...)
 		panicstr = fmt;
 
 	va_start(ap, fmt);
-	(void)vsprintf(buf, fmt, ap);
+	(void)vsnprintf(buf, sizeof(buf), fmt, ap);
 	if (panicstr == fmt)
 		panicstr = buf;
 	va_end(ap);
diff --git a/sys/kern/kern_sysctl.c b/sys/kern/kern_sysctl.c
index c3e221f..0d5f22e 100644
--- a/sys/kern/kern_sysctl.c
+++ b/sys/kern/kern_sysctl.c
@@ -37,7 +37,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kern_sysctl.c	8.4 (Berkeley) 4/14/94
- * $Id: kern_sysctl.c,v 1.77 1998/09/05 17:13:27 bde Exp $
+ * $Id: kern_sysctl.c,v 1.78 1998/10/16 03:55:00 peter Exp $
  */
 
 #include "opt_compat.h"
@@ -225,7 +225,7 @@ sysctl_sysctl_name SYSCTL_HANDLER_ARGS
 
 	while (namelen) {
 		if (!lsp) {
-			sprintf(buf,"%d",*name);
+			snprintf(buf,sizeof(buf),"%d",*name);
 			if (req->oldidx)
 				error = SYSCTL_OUT(req, ".", 1);
 			if (!error)
diff --git a/sys/kern/subr_autoconf.c b/sys/kern/subr_autoconf.c
index 2ab21f5..8dfba39 100644
--- a/sys/kern/subr_autoconf.c
+++ b/sys/kern/subr_autoconf.c
@@ -41,7 +41,7 @@
  *
  *	@(#)subr_autoconf.c	8.1 (Berkeley) 6/10/93
  *
- * $Id: subr_autoconf.c,v 1.5 1997/09/21 22:00:18 gibbs Exp $
+ * $Id: subr_autoconf.c,v 1.6 1997/11/18 12:43:41 bde Exp $
  */
 
 #include <sys/param.h>
@@ -341,7 +341,7 @@ evcnt_attach(dev, name, ev)
 	/* ev->ev_next = NULL; */
 	ev->ev_dev = dev;
 	/* ev->ev_count = 0; */
-	strcpy(ev->ev_name, name);
+	snprintf(ev->ev_name, sizeof(ev->ev_name), "%s", name);
 	*nextp = ev;
 	nextp = &ev->ev_next;
 }
diff --git a/sys/kern/subr_devstat.c b/sys/kern/subr_devstat.c
index 5d8f4a8..8976c3b 100644
--- a/sys/kern/subr_devstat.c
+++ b/sys/kern/subr_devstat.c
@@ -25,7 +25,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: subr_devstat.c,v 1.5 1998/11/14 21:58:51 wollman Exp $
+ *	$Id: subr_devstat.c,v 1.6 1998/11/15 23:57:22 ken Exp $
  */
 
 #include <sys/param.h>
@@ -73,6 +73,7 @@ devstat_add_entry(struct devstat *ds, const char *dev_name,
 	ds->device_number = devstat_current_devnumber++;
 	ds->unit_number = unit_number;
 	strncpy(ds->device_name, dev_name, DEVSTAT_NAME_LEN);
+	ds->device_name[DEVSTAT_NAME_LEN - 1] = 0;
 	ds->block_size = block_size;
 	ds->flags = flags;
 	ds->device_type = device_type;
diff --git a/sys/kern/subr_diskmbr.c b/sys/kern/subr_diskmbr.c
index ab9d4ba..adfd39c 100644
--- a/sys/kern/subr_diskmbr.c
+++ b/sys/kern/subr_diskmbr.c
@@ -35,7 +35,7 @@
  *
  *	from: @(#)ufs_disksubr.c	7.16 (Berkeley) 5/4/91
  *	from: ufs_disksubr.c,v 1.8 1994/06/07 01:21:39 phk Exp $
- *	$Id: diskslice_machdep.c,v 1.30 1998/07/25 16:35:06 bde Exp $
+ *	$Id: diskslice_machdep.c,v 1.31 1998/08/10 07:22:14 phk Exp $
  */
 
 #include <sys/param.h>
@@ -405,7 +405,7 @@ extended(dname, dev, strat, lp, ssp, ext_offset, ext_size, base_ext_offset,
 
 			sname = dsname(dname, dkunit(dev), WHOLE_DISK_SLICE,
 				       RAW_PART, partname);
-			strcpy(buf, sname);
+			snprintf(buf, sizeof(buf), "%s", sname);
 			if (strlen(buf) < sizeof buf - 11)
 				strcat(buf, "<extended>");
 			check_part(buf, dp, base_ext_offset, nsectors,
diff --git a/sys/kern/subr_diskslice.c b/sys/kern/subr_diskslice.c
index 83590e6..8a4eef6 100644
--- a/sys/kern/subr_diskslice.c
+++ b/sys/kern/subr_diskslice.c
@@ -43,7 +43,7 @@
  *	from: wd.c,v 1.55 1994/10/22 01:57:12 phk Exp $
  *	from: @(#)ufs_disksubr.c	7.16 (Berkeley) 5/4/91
  *	from: ufs_disksubr.c,v 1.8 1994/06/07 01:21:39 phk Exp $
- *	$Id: subr_diskslice.c,v 1.58 1998/08/23 20:16:34 phk Exp $
+ *	$Id: subr_diskslice.c,v 1.59 1998/10/17 09:46:42 bde Exp $
  */
 
 #include "opt_devfs.h"
@@ -680,13 +680,14 @@ dsname(dname, unit, slice, part, partname)
 
 	if (strlen(dname) > 16)
 		dname = "nametoolong";
-	sprintf(name, "%s%d", dname, unit);
+	snprintf(name, sizeof(name), "%s%d", dname, unit);
 	partname[0] = '\0';
 	if (slice != WHOLE_DISK_SLICE || part != RAW_PART) {
 		partname[0] = 'a' + part;
 		partname[1] = '\0';
 		if (slice != COMPATIBILITY_SLICE)
-			sprintf(name + strlen(name), "s%d", slice - 1);
+			snprintf(name + strlen(name),
+			    sizeof(name) - strlen(name), "s%d", slice - 1);
 	}
 	return (name);
 }
diff --git a/sys/kern/vfs_export.c b/sys/kern/vfs_export.c
index 971c005..6111120 100644
--- a/sys/kern/vfs_export.c
+++ b/sys/kern/vfs_export.c
@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)vfs_subr.c	8.31 (Berkeley) 5/26/95
- * $Id: vfs_subr.c,v 1.172 1998/10/31 07:42:03 peter Exp $
+ * $Id: vfs_subr.c,v 1.173 1998/10/31 14:20:39 peter Exp $
  */
 
 /*
@@ -1902,7 +1902,7 @@ vprint(label, vp)
 	char *label;
 	register struct vnode *vp;
 {
-	char buf[64];
+	char buf[96];
 
 	if (label != NULL)
 		printf("%s: %p: ", label, (void *)vp);
diff --git a/sys/kern/vfs_subr.c b/sys/kern/vfs_subr.c
index 971c005..6111120 100644
--- a/sys/kern/vfs_subr.c
+++ b/sys/kern/vfs_subr.c
@@ -36,7 +36,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)vfs_subr.c	8.31 (Berkeley) 5/26/95
- * $Id: vfs_subr.c,v 1.172 1998/10/31 07:42:03 peter Exp $
+ * $Id: vfs_subr.c,v 1.173 1998/10/31 14:20:39 peter Exp $
  */
 
 /*
@@ -1902,7 +1902,7 @@ vprint(label, vp)
 	char *label;
 	register struct vnode *vp;
 {
-	char buf[64];
+	char buf[96];
 
 	if (label != NULL)
 		printf("%s: %p: ", label, (void *)vp);
diff --git a/sys/miscfs/kernfs/kernfs_vnops.c b/sys/miscfs/kernfs/kernfs_vnops.c
index 4280ef1..c08bdd3 100644
--- a/sys/miscfs/kernfs/kernfs_vnops.c
+++ b/sys/miscfs/kernfs/kernfs_vnops.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)kernfs_vnops.c	8.15 (Berkeley) 5/21/95
- * $Id: kernfs_vnops.c,v 1.34 1998/06/25 16:54:18 dt Exp $
+ * $Id: kernfs_vnops.c,v 1.35 1998/07/30 17:40:45 bde Exp $
  */
 
 /*
@@ -133,13 +133,13 @@ kernfs_xread(kt, buf, len, lenp)
 	case KTT_TIME: {
 		struct timeval tv;
 		microtime(&tv);
-		sprintf(buf, "%ld %ld\n", tv.tv_sec, tv.tv_usec);
+		snprintf(buf, len, "%ld %ld\n", tv.tv_sec, tv.tv_usec);
 		break;
 	}
 
 	case KTT_INT: {
 		int *ip = kt->kt_data;
-		sprintf(buf, "%d\n", *ip);
+		snprintf(buf, len, "%d\n", *ip);
 		break;
 	}
 
@@ -181,7 +181,7 @@ kernfs_xread(kt, buf, len, lenp)
 	}
 
 	case KTT_AVENRUN:
-		sprintf(buf, "%lu %lu %lu %ld\n",
+		snprintf(buf, len, "%lu %lu %lu %ld\n",
 		    (u_long)averunnable.ldavg[0], (u_long)averunnable.ldavg[1],
 		    (u_long)averunnable.ldavg[2], averunnable.fscale);
 		break;
diff --git a/sys/miscfs/procfs/procfs_map.c b/sys/miscfs/procfs/procfs_map.c
index 1a865e6..4dae10a 100644
--- a/sys/miscfs/procfs/procfs_map.c
+++ b/sys/miscfs/procfs/procfs_map.c
@@ -36,7 +36,7 @@
  *
  *	@(#)procfs_status.c	8.3 (Berkeley) 2/17/94
  *
- *	$Id: procfs_map.c,v 1.16 1998/02/06 12:13:41 eivind Exp $
+ *	$Id: procfs_map.c,v 1.17 1998/04/29 04:28:22 dyson Exp $
  */
 
 #include <sys/param.h>
@@ -153,7 +153,8 @@ case OBJT_DEVICE:
 		 * format:
 		 *  start, end, resident, private resident, cow, access, type.
 		 */
-		sprintf(mebuffer, "0x%x 0x%x %d %d %d %s%s%s %d %d 0x%x %s %s %s\n",
+		snprintf(mebuffer, sizeof(mebuffer),
+		    "0x%x 0x%x %d %d %d %s%s%s %d %d 0x%x %s %s %s\n",
 			entry->start, entry->end,
 			resident, privateresident, id,
 			(entry->protection & VM_PROT_READ)?"r":"-",
diff --git a/sys/miscfs/procfs/procfs_vnops.c b/sys/miscfs/procfs/procfs_vnops.c
index 8a6230e..6879b08 100644
--- a/sys/miscfs/procfs/procfs_vnops.c
+++ b/sys/miscfs/procfs/procfs_vnops.c
@@ -36,7 +36,7 @@
  *
  *	@(#)procfs_vnops.c	8.18 (Berkeley) 5/21/95
  *
- *	$Id: procfs_vnops.c,v 1.60 1998/06/25 16:54:41 dt Exp $
+ *	$Id: procfs_vnops.c,v 1.61 1998/07/11 07:45:46 bde Exp $
  */
 
 /*
@@ -528,7 +528,7 @@ procfs_getattr(ap)
 		vap->va_uid = 0;
 		vap->va_gid = 0;
 		vap->va_size = vap->va_bytes =
-		    sprintf(buf, "%ld", (long)curproc->p_pid);
+		    snprintf(buf, sizeof(buf), "%ld", (long)curproc->p_pid);
 		break;
 	}
 
@@ -944,7 +944,7 @@ procfs_readlink(ap)
 	if (VTOPFS(ap->a_vp)->pfs_fileno != PROCFS_FILENO(0, Pcurproc))
 		return (EINVAL);
 
-	len = sprintf(buf, "%ld", (long)curproc->p_pid);
+	len = snprintf(buf, sizeof(buf), "%ld", (long)curproc->p_pid);
 
 	return (uiomove((caddr_t)buf, len, ap->a_uio));
 }
diff --git a/sys/net/if.c b/sys/net/if.c
index 295ae4d..0ac5738 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)if.c	8.3 (Berkeley) 1/4/94
- *	$Id: if.c,v 1.61 1998/07/20 13:21:56 dfr Exp $
+ *	$Id: if.c,v 1.62 1998/08/12 22:51:59 wpaul Exp $
  */
 
 #include "opt_compat.h"
@@ -143,7 +143,8 @@ if_attach(ifp)
 	/*
 	 * create a Link Level name for this device
 	 */
-	namelen = sprintf(workbuf, "%s%d", ifp->if_name, ifp->if_unit);
+	namelen = snprintf(workbuf, sizeof(workbuf),
+	    "%s%d", ifp->if_name, ifp->if_unit);
 #define _offsetof(t, m) ((int)((caddr_t)&((t *)0)->m))
 	masklen = _offsetof(struct sockaddr_dl, sdl_data[0]) + namelen;
 	socksize = masklen + ifp->if_addrlen;
@@ -792,7 +793,8 @@ ifconf(cmd, data)
 		char workbuf[64];
 		int ifnlen;
 
-		ifnlen = sprintf(workbuf, "%s%d", ifp->if_name, ifp->if_unit);
+		ifnlen = snprintf(workbuf, sizeof(workbuf),
+		    "%s%d", ifp->if_name, ifp->if_unit);
 		if(ifnlen + 1 > sizeof ifr.ifr_name) {
 			error = ENAMETOOLONG;
 		} else {
diff --git a/sys/net/if_atmsubr.c b/sys/net/if_atmsubr.c
index a41bfaf..9f56a9b 100644
--- a/sys/net/if_atmsubr.c
+++ b/sys/net/if_atmsubr.c
@@ -521,14 +521,16 @@ pvc_ioctl(shadow, cmd, data)
 	 */
 	switch (cmd) {
 	case SIOCGPVCSIF:
-		sprintf(ifr->ifr_name, "%s%d", ifp->if_name, ifp->if_unit);
+		snprintf(ifr->ifr_name, sizeof(ifr->ifr_name),
+		    "%s%d", ifp->if_name, ifp->if_unit);
 		return (0);
 
 	case SIOCGPVCTX:
 		do {
 			struct pvctxreq *pvcreq = (struct pvctxreq *)data;
 
-			sprintf(pvcreq->pvc_ifname, "%s%d",
+			snprintf(pvcreq->pvc_ifname,
+			    sizeof(pvcreq->pvc_ifname), "%s%d",
 				ifp->if_name, ifp->if_unit);
 			pvcreq->pvc_aph = pvcsif->sif_aph;
 		} while (0);
diff --git a/sys/net/if_mib.c b/sys/net/if_mib.c
index 268669d..2e8f331 100644
--- a/sys/net/if_mib.c
+++ b/sys/net/if_mib.c
@@ -26,7 +26,7 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: if_mib.c,v 1.4 1997/02/22 09:41:02 peter Exp $
+ *	$Id: if_mib.c,v 1.5 1997/08/02 14:32:38 bde Exp $
  */
 
 #include <sys/param.h>
@@ -89,7 +89,8 @@ sysctl_ifdata SYSCTL_HANDLER_ARGS /* XXX bad syntax! */
 		return ENOENT;
 
 	case IFDATA_GENERAL:
-		ifnlen = sprintf(workbuf, "%s%d", ifp->if_name, ifp->if_unit);
+		ifnlen = snprintf(workbuf, sizeof(workbuf),
+		    "%s%d", ifp->if_name, ifp->if_unit);
 		if(ifnlen + 1 > sizeof ifmd.ifmd_name) {
 			return ENAMETOOLONG;
 		} else {
diff --git a/sys/net/if_spppsubr.c b/sys/net/if_spppsubr.c
index e5b040d..aeb9550 100644
--- a/sys/net/if_spppsubr.c
+++ b/sys/net/if_spppsubr.c
@@ -17,7 +17,7 @@
  *
  * From: Version 2.4, Thu Apr 30 17:17:21 MSD 1997
  *
- * $Id: if_spppsubr.c,v 1.44 1998/10/06 20:47:53 joerg Exp $
+ * $Id: if_spppsubr.c,v 1.45 1998/10/06 21:12:45 joerg Exp $
  */
 
 #include <sys/param.h>
@@ -4029,7 +4029,7 @@ sppp_cp_type_name(u_char type)
 	case ECHO_REPLY: return "echo-reply";
 	case DISC_REQ:   return "discard-req";
 	}
-	sprintf (buf, "0x%x", type);
+	snprintf (buf, sizeof(buf), "0x%x", type);
 	return buf;
 }
 
@@ -4052,7 +4052,7 @@ sppp_auth_type_name(u_short proto, u_char type)
 		case PAP_NAK:		return "nak";
 		}
 	}
-	sprintf (buf, "0x%x", type);
+	snprintf (buf, sizeof(buf), "0x%x", type);
 	return buf;
 }
 
@@ -4069,7 +4069,7 @@ sppp_lcp_opt_name(u_char opt)
 	case LCP_OPT_PROTO_COMP:	return "proto-comp";
 	case LCP_OPT_ADDR_COMP:		return "addr-comp";
 	}
-	sprintf (buf, "0x%x", opt);
+	snprintf (buf, sizeof(buf), "0x%x", opt);
 	return buf;
 }
 
@@ -4082,7 +4082,7 @@ sppp_ipcp_opt_name(u_char opt)
 	case IPCP_OPT_COMPRESSION:	return "compression";
 	case IPCP_OPT_ADDRESS:		return "address";
 	}
-	sprintf (buf, "0x%x", opt);
+	snprintf (buf, sizeof(buf), "0x%x", opt);
 	return buf;
 }
 
@@ -4127,7 +4127,7 @@ sppp_proto_name(u_short proto)
 	case PPP_PAP:	return "pap";
 	case PPP_CHAP:	return "chap";
 	}
-	sprintf(buf, "0x%x", (unsigned)proto);
+	snprintf(buf, sizeof(buf), "0x%x", (unsigned)proto);
 	return buf;
 }
 
diff --git a/sys/net/if_vlan.c b/sys/net/if_vlan.c
index d6149e9..2488b31 100644
--- a/sys/net/if_vlan.c
+++ b/sys/net/if_vlan.c
@@ -26,7 +26,7 @@
  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: if_vlan.c,v 1.2 1998/05/15 20:02:47 wollman Exp $
+ *	$Id: if_vlan.c,v 1.3 1998/08/23 03:07:10 wollman Exp $
  */
 
 /*
@@ -334,8 +334,8 @@ vlan_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
 	case SIOCGETVLAN:
 		bzero(&vlr, sizeof vlr);
 		if (ifv->ifv_p) {
-			sprintf(vlr.vlr_parent, "%s%d", ifv->ifv_p->if_name,
-				ifv->ifv_p->if_unit);
+			snprintf(vlr.vlr_parent, sizeof(vlr.vlr_parent),
+			    "%s%d", ifv->ifv_p->if_name, ifv->ifv_p->if_unit);
 			vlr.vlr_tag = ifv->ifv_tag;
 		}
 		error = copyout(&vlr, ifr->ifr_data, sizeof vlr);
diff --git a/sys/netatm/atm_device.c b/sys/netatm/atm_device.c
index dca6a00..d68134f 100644
--- a/sys/netatm/atm_device.c
+++ b/sys/netatm/atm_device.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: atm_device.c,v 1.2 1998/09/17 09:34:59 phk Exp $
+ *	@(#) $Id: atm_device.c,v 1.3 1998/10/31 20:06:54 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <netatm/kern_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: atm_device.c,v 1.2 1998/09/17 09:34:59 phk Exp $");
+__RCSID("@(#) $Id: atm_device.c,v 1.3 1998/10/31 20:06:54 phk Exp $");
 #endif
 
 
@@ -874,7 +874,7 @@ atm_dev_pdu_print(cup, cvp, m, msg)
 {
 	char		buf[128];
 
-	sprintf(buf, "%s vcc=(%d,%d)", msg, 
+	snprintf(buf, sizeof(buf), "%s vcc=(%d,%d)", msg, 
 		cvp->cv_connvc->cvc_vcc->vc_vpi, 
 		cvp->cv_connvc->cvc_vcc->vc_vci);
 
diff --git a/sys/netatm/atm_if.c b/sys/netatm/atm_if.c
index 6ae7734..a360955 100644
--- a/sys/netatm/atm_if.c
+++ b/sys/netatm/atm_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: atm_if.c,v 1.1 1998/09/15 08:22:57 phk Exp $
+ *	@(#) $Id: atm_if.c,v 1.2 1998/10/31 20:06:54 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <netatm/kern_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: atm_if.c,v 1.1 1998/09/15 08:22:57 phk Exp $");
+__RCSID("@(#) $Id: atm_if.c,v 1.2 1998/10/31 20:06:54 phk Exp $");
 #endif
 
 
@@ -326,8 +326,8 @@ atm_physif_ioctl(code, data, arg)
 		KM_ZERO((caddr_t)&apr, sizeof(apr));
 		smp = pip->pif_sigmgr;
 		sip = pip->pif_siginst;
-		(void) sprintf(apr.anp_intf, "%s%d", pip->pif_name,
-				pip->pif_unit );
+		(void) snprintf(apr.anp_intf, sizeof(apr.anp_intf),
+			"%s%d", pip->pif_name, pip->pif_unit );
 		if ( pip->pif_nif )
 		{
 			strcpy(apr.anp_nif_pref, pip->pif_nif->nif_if.if_name);
@@ -380,14 +380,14 @@ atm_physif_ioctl(code, data, arg)
 		 * Fill in info to be returned
 		 */
 		KM_ZERO((caddr_t)&anr, sizeof(anr));
-		(void) sprintf(anr.anp_intf, "%s%d", ifp->if_name,
-				ifp->if_unit);
+		(void) snprintf(anr.anp_intf, sizeof(anr.anp_intf),
+		    "%s%d", ifp->if_name, ifp->if_unit);
 		IFP_TO_IA(ifp, ia);
 		if (ia) {
 			anr.anp_proto_addr = *ia->ia_ifa.ifa_addr;
 		}
-		(void) sprintf(anr.anp_phy_intf, "%s%d", pip->pif_name,
-				pip->pif_unit);
+		(void) snprintf(anr.anp_phy_intf, sizeof(anr.anp_phy_intf),
+		    "%s%d", pip->pif_name, pip->pif_unit);
 
 		/*
 		 * Copy data to user buffer
@@ -410,7 +410,8 @@ atm_physif_ioctl(code, data, arg)
 		pip = (struct atm_pif *)arg;
 		if ( pip == NULL )
 			return ( ENXIO );
-		sprintf ( ifname, "%s%d", pip->pif_name, pip->pif_unit );
+		snprintf ( ifname, sizeof(ifname),
+		    "%s%d", pip->pif_name, pip->pif_unit );
 
 		/*
 		 * Cast response into users buffer
@@ -572,8 +573,8 @@ atm_physif_ioctl(code, data, arg)
 		 * Fill in info to be returned
 		 */
 		KM_ZERO((caddr_t)&acr, sizeof(acr));
-		(void) sprintf(acr.acp_intf, "%s%d", pip->pif_name,
-				pip->pif_unit);
+		(void) snprintf(acr.acp_intf, sizeof(acr.acp_intf),
+		    "%s%d", pip->pif_name, pip->pif_unit);
 		KM_COPY((caddr_t)acp, (caddr_t)&acr.acp_cfg,
 				sizeof(Atm_config));
 
diff --git a/sys/netatm/atm_socket.c b/sys/netatm/atm_socket.c
index 537e8ae..004fba4 100644
--- a/sys/netatm/atm_socket.c
+++ b/sys/netatm/atm_socket.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: atm_socket.c,v 1.1 1998/09/15 08:22:58 phk Exp $
+ *	@(#) $Id: atm_socket.c,v 1.2 1998/10/31 20:06:54 phk Exp $
  *
  */
 
@@ -38,7 +38,7 @@
 #include <netatm/kern_include.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: atm_socket.c,v 1.1 1998/09/15 08:22:58 phk Exp $");
+__RCSID("@(#) $Id: atm_socket.c,v 1.2 1998/10/31 20:06:54 phk Exp $");
 #endif
 
 
@@ -1207,8 +1207,8 @@ atm_sock_getopt(so, sopt, atp)
 			struct ifnet		*ifp;
 
 			ifp = &ap->nif->nif_if;
-			(void) sprintf(netif.net_intf, "%s%d",
-					ifp->if_name, ifp->if_unit);
+			(void) snprintf(netif.net_intf, sizeof(netif.net_intf),
+			    "%s%d", ifp->if_name, ifp->if_unit);
 			return (sooptcopyout(sopt, &netif,
 					sizeof netif));
 		} else {
diff --git a/sys/netatm/ipatm/ipatm_usrreq.c b/sys/netatm/ipatm/ipatm_usrreq.c
index 41bf42a..6fc94d6 100644
--- a/sys/netatm/ipatm/ipatm_usrreq.c
+++ b/sys/netatm/ipatm/ipatm_usrreq.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: ipatm_usrreq.c,v 1.1 1998/09/15 08:23:01 phk Exp $
+ *	@(#) $Id: ipatm_usrreq.c,v 1.2 1998/10/31 20:06:55 phk Exp $
  *
  */
 
@@ -42,7 +42,7 @@
 #include <netatm/ipatm/ipatm_serv.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: ipatm_usrreq.c,v 1.1 1998/09/15 08:23:01 phk Exp $");
+__RCSID("@(#) $Id: ipatm_usrreq.c,v 1.2 1998/10/31 20:06:55 phk Exp $");
 #endif
 
 
@@ -333,7 +333,8 @@ ipatm_ioctl(code, data, arg1)
 					AF_INET;
 				SATOSIN(&aivr.aip_dst_addr)->sin_addr.s_addr = 
 					ivp->iv_dst.s_addr;
-				(void) sprintf(aivr.aip_intf, "%s%d",
+				(void) snprintf(aivr.aip_intf,
+				    sizeof(aivr.aip_intf), "%s%d",
 					inp->inf_nif->nif_if.if_name,
 					inp->inf_nif->nif_if.if_unit);
 				if ((ivp->iv_conn) &&
diff --git a/sys/netatm/sigpvc/sigpvc_if.c b/sys/netatm/sigpvc/sigpvc_if.c
index b7117be..d17a761 100644
--- a/sys/netatm/sigpvc/sigpvc_if.c
+++ b/sys/netatm/sigpvc/sigpvc_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: sigpvc_if.c,v 1.1 1998/09/15 08:23:02 phk Exp $
+ *	@(#) $Id: sigpvc_if.c,v 1.2 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -46,7 +46,7 @@
 #include <netatm/sigpvc/sigpvc_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: sigpvc_if.c,v 1.1 1998/09/15 08:23:02 phk Exp $");
+__RCSID("@(#) $Id: sigpvc_if.c,v 1.2 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 
@@ -604,7 +604,8 @@ sigpvc_ioctl(code, data, arg1)
 			/*
 			 * Fill in info to be returned
 			 */
-			(void) sprintf(avr.avp_intf, "%s%d", 
+			(void) snprintf(avr.avp_intf, sizeof(avr.avp_intf),
+				"%s%d",
 				pvp->pv_pif->pif_name, pvp->pv_pif->pif_unit);
 			avr.avp_vpi = vcp->vc_vpi;
 			avr.avp_vci = vcp->vc_vci;
diff --git a/sys/netatm/spans/spans_arp.c b/sys/netatm/spans/spans_arp.c
index bdcacc6..a324fc4 100644
--- a/sys/netatm/spans/spans_arp.c
+++ b/sys/netatm/spans/spans_arp.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_arp.c,v 1.1 1998/09/15 08:23:02 phk Exp $
+ *	@(#) $Id: spans_arp.c,v 1.2 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -44,7 +44,7 @@
 #include <netatm/spans/spans_cls.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_arp.c,v 1.1 1998/09/15 08:23:02 phk Exp $");
+__RCSID("@(#) $Id: spans_arp.c,v 1.2 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 
@@ -1089,7 +1089,8 @@ spansarp_ioctl(code, data, arg1)
 					AF_INET;
 				SATOSIN(&aar.aap_arp_addr)->sin_addr.s_addr =
 					sap->sa_dstip.s_addr;
-				(void) sprintf(aar.aap_intf, "%s%d",
+				(void) snprintf(aar.aap_intf,
+				    sizeof(aar.aap_intf), "%s%d",
 					clp->cls_ipnif->inf_nif->nif_if.if_name,
 					clp->cls_ipnif->inf_nif->nif_if.if_unit
 					);
diff --git a/sys/netatm/spans/spans_cls.c b/sys/netatm/spans/spans_cls.c
index f4a6ba8..17dc135 100644
--- a/sys/netatm/spans/spans_cls.c
+++ b/sys/netatm/spans/spans_cls.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_cls.c,v 1.1 1998/09/15 08:23:03 phk Exp $
+ *	@(#) $Id: spans_cls.c,v 1.2 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -44,7 +44,7 @@
 #include <netatm/spans/spans_cls.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_cls.c,v 1.1 1998/09/15 08:23:03 phk Exp $");
+__RCSID("@(#) $Id: spans_cls.c,v 1.2 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 
@@ -842,7 +842,7 @@ spanscls_pdu_print(clp, m, msg)
 {
 	char		buf[128];
 
-	sprintf(buf, "spanscls %s:\n", msg);
+	snprintf(buf, sizeof(buf), "spanscls %s:\n", msg);
 	atm_pdu_print(m, buf);
 }
 
diff --git a/sys/netatm/spans/spans_if.c b/sys/netatm/spans/spans_if.c
index e03f36b..4557f26 100644
--- a/sys/netatm/spans/spans_if.c
+++ b/sys/netatm/spans/spans_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_if.c,v 1.2 1998/09/17 09:35:00 phk Exp $
+ *	@(#) $Id: spans_if.c,v 1.3 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -46,7 +46,7 @@
 #include <netatm/spans/spans_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_if.c,v 1.2 1998/09/17 09:35:00 phk Exp $");
+__RCSID("@(#) $Id: spans_if.c,v 1.3 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 /*
@@ -972,7 +972,8 @@ spans_ioctl(code, data, arg1)
 			/*
 			 * Fill out the response struct for the VCC
 			 */
-			(void) sprintf(rsp.avp_intf, "%s%d",
+			(void) snprintf(rsp.avp_intf,
+				    sizeof(rsp.avp_intf), "%s%d",
 					spp->sp_pif->pif_name,
 					spp->sp_pif->pif_unit);
 			rsp.avp_vpi = svp->sv_vpi;
diff --git a/sys/netatm/spans/spans_print.c b/sys/netatm/spans/spans_print.c
index 96e963b..99e8c94 100644
--- a/sys/netatm/spans/spans_print.c
+++ b/sys/netatm/spans/spans_print.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: spans_print.c,v 1.2 1998/09/17 09:35:00 phk Exp $
+ *	@(#) $Id: spans_print.c,v 1.3 1998/10/31 20:06:56 phk Exp $
  *
  */
 
@@ -41,7 +41,7 @@
 #include <netatm/spans/spans_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: spans_print.c,v 1.2 1998/09/17 09:35:00 phk Exp $");
+__RCSID("@(#) $Id: spans_print.c,v 1.3 1998/10/31 20:06:56 phk Exp $");
 #endif
 
 /*
@@ -54,17 +54,17 @@ __RCSID("@(#) $Id: spans_print.c,v 1.2 1998/09/17 09:35:00 phk Exp $");
 /*
  * Local functions
  */
-static void	spans_msgtype_str __P((spans_msgtype *, char *));
+static void	spans_msgtype_str __P((spans_msgtype *, char *, int));
 static void	spans_print_msgbody __P((spans_msgbody *));
-static void	spans_result_str __P((spans_result *, char *));
+static void	spans_result_str __P((spans_result *, char *, int));
 
 #ifdef LONGPRINT
 
 static void	inc_indent __P((void));
 static void	dec_indent __P((void));
-static void	spans_aal_str __P((spans_aal *, char *));
-static void	spans_query_type_str __P((spans_query_type *, char *));
-static void	spans_state_str __P((spans_query_type *, char *));
+static void	spans_aal_str __P((spans_aal *, char *, int));
+static void	spans_query_type_str __P((spans_query_type *, char *, int));
+static void	spans_state_str __P((spans_query_type *, char *, int));
 static void	spans_print_version __P((spans_version *));
 static void	spans_print_vpvc __P((spans_vpvc *));
 static void	spans_print_vpvc_pref __P((spans_vpvc_pref *));
@@ -132,9 +132,10 @@ dec_indent()
 }
 
 static void
-spans_aal_str(objp, dest)
+spans_aal_str(objp, dest, len)
 	spans_aal *objp;
 	char *dest;
+	int len;
 {
 	static char	*aal_names[] = {
 		"SPANS_AAL0",
@@ -146,9 +147,9 @@ spans_aal_str(objp, dest)
 	};
 
 	if (*objp < SPANS_AAL0 || *objp > SPANS_AAL5) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)", aal_names[(int)*objp],
+		snprintf(dest, len, "%s (%d)", aal_names[(int)*objp],
 				(int)*objp);
 	}
 }
@@ -156,9 +157,10 @@ spans_aal_str(objp, dest)
 #endif 
 
 static void
-spans_result_str(objp, dest)
+spans_result_str(objp, dest, len)
 	spans_result *objp;
 	char *dest;
+	int len;
 {
 	static char	*result_names[] = {
 		"SPANS_OK",
@@ -169,17 +171,18 @@ spans_result_str(objp, dest)
 	};
 
 	if (*objp < SPANS_OK || *objp > SPANS_BADDEST) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)",
+		snprintf(dest, len, "%s (%d)",
 				result_names[(int)*objp], (int)*objp);
 	}
 }
 
 static void
-spans_msgtype_str(objp, dest)
+spans_msgtype_str(objp, dest, len)
 	spans_msgtype *objp;
 	char *dest;
+	int len;
 {
 	int	i;
 
@@ -225,7 +228,7 @@ spans_msgtype_str(objp, dest)
 	 */
 	for (i=0; msgtype_names[i].name; i++) {
 		if (*objp == msgtype_names[i].type) {
-			sprintf(dest, "%s (%d)",
+			snprintf(dest, len, "%s (%d)",
 					msgtype_names[i].name,
 					(int)*objp);
 			return;
@@ -235,15 +238,16 @@ spans_msgtype_str(objp, dest)
 	/*
 	 * Type was not found--return an error indicator
 	 */
-	sprintf(dest, "Invalid (%d)", (int)*objp);
+	snprintf(dest, len, "Invalid (%d)", (int)*objp);
 }
 
 #ifdef LONGPRINT 
 
 static void
-spans_query_type_str(objp, dest)
+spans_query_type_str(objp, dest, len)
 	spans_query_type *objp;
 	char *dest;
+	int len;
 {
 	static char	*query_names[] = {
 		"SPANS_QUERY_NORMAL",
@@ -253,17 +257,18 @@ spans_query_type_str(objp, dest)
 
 	if (*objp < SPANS_QUERY_NORMAL ||
 			*objp > SPANS_QUERY_END_TO_END) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)", query_names[(int)*objp],
+		snprintf(dest, len, "%s (%d)", query_names[(int)*objp],
 				(int)*objp);
 	}
 }
 
 static void
-spans_state_str(objp, dest)
+spans_state_str(objp, dest, len)
 	spans_query_type *objp;
 	char *dest;
+	int len;
 {
 	static char	*state_names[] = {
 		"SPANS_CONN_OPEN",
@@ -273,9 +278,9 @@ spans_state_str(objp, dest)
 	};
 
 	if (*objp < SPANS_CONN_OPEN || *objp > SPANS_CONN_CLOSED) {
-		sprintf(dest, "Invalid (%d)", (int)*objp);
+		snprintf(dest, len, "Invalid (%d)", (int)*objp);
 	} else {
-		sprintf(dest, "%s (%d)", state_names[(int)*objp],
+		snprintf(dest, len, "%s (%d)", state_names[(int)*objp],
 				(int)*objp);
 	}
 }
@@ -357,7 +362,7 @@ spans_print_aal(objp)
 {
 	char		aal_str[80];
 
-	spans_aal_str(objp, aal_str);
+	spans_aal_str(objp, aal_str, sizeof(aal_str));
 	printf("%sspans_aal            %s\n", spans_indent, aal_str);
 }
 
@@ -367,7 +372,7 @@ spans_print_result(objp)
 {
 	char		result_str[80];
 
-	spans_result_str(objp, result_str);
+	spans_result_str(objp, result_str, sizeof(result_str));
 	printf("%sspans_result         %s\n", spans_indent, result_str);
 }
 
@@ -377,7 +382,7 @@ spans_print_msgtype(objp)
 {
 	char		msgtype_str[80];
 
-	spans_msgtype_str(objp, msgtype_str);
+	spans_msgtype_str(objp, msgtype_str, sizeof(msgtype_str));
 	printf("%sspans_msgtype        %s\n", spans_indent, msgtype_str);
 }
 
@@ -717,7 +722,8 @@ spans_print_parm_query_req(objp)
 	printf("%sspans_parm_query_req\n", spans_indent);
 	inc_indent();
 	spans_print_atm_conn(&objp->qyreq_conn);
-	spans_query_type_str(&objp->qyreq_type, query_type_str);
+	spans_query_type_str(&objp->qyreq_type,
+		query_type_str, sizeof(query_type_str));
 	printf("%sqyreq_type           %s\n", spans_indent, query_type_str);
 	dec_indent();
 }
@@ -731,9 +737,11 @@ spans_print_parm_query_rsp(objp)
 	printf("%sspans_parm_query_rsp\n", spans_indent);
 	inc_indent();
 	spans_print_atm_conn(&objp->qyrsp_conn);
-	spans_query_type_str(&objp->qyrsp_type, query_type_str);
+	spans_query_type_str(&objp->qyrsp_type,
+		query_type_str, sizeof(query_type_str));
 	printf("%sqyrsp_type           %s\n", spans_indent, query_type_str);
-	spans_state_str(&objp->qyrsp_state, state_type_str);
+	spans_state_str(&objp->qyrsp_state,
+		state_type_str, sizeof(state_type_str));
 	printf("%sqyrsp_state          %s\n", spans_indent, state_type_str);
 	printf("%sqyrsp_data           0x%x\n", spans_indent,
 			objp->qyrsp_data);
@@ -877,7 +885,7 @@ spans_print_msgbody(objp)
 	spans_parm_rclose_rsp	*rcrsp_p;
 	spans_parm_rclose_cnf	*rccnf_p;
 
-	spans_msgtype_str(&objp->mb_type, msgtype_str);
+	spans_msgtype_str(&objp->mb_type, msgtype_str, sizeof(msgtype_str));
 	printf("%s: ", msgtype_str);
 	switch (objp->mb_type) {
 	case SPANS_STAT_REQ:
@@ -889,7 +897,7 @@ spans_print_msgbody(objp)
 		strncpy(daddr, spans_addr_print(&stind_p->stind_es_addr),
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&stind_p->stind_sw_addr),
-				sizeof(daddr));
+				sizeof(saddr));
 		printf("sw_epoch=0x%lx, es_addr=%s, sw_addr=0x%s",
 				stind_p->stind_sw_epoch,
 				daddr, saddr);
@@ -939,7 +947,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&oprsp_p->oprsp_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&oprsp_p->oprsp_result, result_str);
+		spans_result_str(&oprsp_p->oprsp_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d, vp.vc=%d.%d",
 				result_str, daddr, saddr,
 				oprsp_p->oprsp_conn.con_dsap,
@@ -953,7 +962,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&opcnf_p->opcnf_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&opcnf_p->opcnf_result, result_str);
+		spans_result_str(&opcnf_p->opcnf_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d, vp.vc=%d.%d",
 				result_str, daddr, saddr,
 				opcnf_p->opcnf_conn.con_dsap,
@@ -989,7 +999,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&clrsp_p->clrsp_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&clrsp_p->clrsp_result, result_str);
+		spans_result_str(&clrsp_p->clrsp_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				clrsp_p->clrsp_conn.con_dsap,
@@ -1001,7 +1012,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&clcnf_p->clcnf_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&clcnf_p->clcnf_result, result_str);
+		spans_result_str(&clcnf_p->clcnf_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				clcnf_p->clcnf_conn.con_dsap,
@@ -1035,7 +1047,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&rcrsp_p->rcrsp_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&rcrsp_p->rcrsp_result, result_str);
+		spans_result_str(&rcrsp_p->rcrsp_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				rcrsp_p->rcrsp_conn.con_dsap,
@@ -1047,7 +1060,8 @@ spans_print_msgbody(objp)
 				sizeof(daddr));
 		strncpy(saddr, spans_addr_print(&rccnf_p->rccnf_conn.con_src),
 				sizeof(saddr));
-		spans_result_str(&rccnf_p->rccnf_result, result_str);
+		spans_result_str(&rccnf_p->rccnf_result, result_str,
+			sizeof(result_str));
 		printf("result=%s, daddr=%s, saddr=%s, dsap=%d, ssap=%d",
 				result_str, daddr, saddr,
 				rccnf_p->rccnf_conn.con_dsap,
diff --git a/sys/netatm/uni/sscf_uni.c b/sys/netatm/uni/sscf_uni.c
index 49e7186..b734524 100644
--- a/sys/netatm/uni/sscf_uni.c
+++ b/sys/netatm/uni/sscf_uni.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: sscf_uni.c,v 1.2 1998/09/17 09:35:01 phk Exp $
+ *	@(#) $Id: sscf_uni.c,v 1.3 1998/10/31 20:07:00 phk Exp $
  *
  */
 
@@ -43,7 +43,7 @@
 #include <netatm/uni/sscf_uni_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: sscf_uni.c,v 1.2 1998/09/17 09:35:01 phk Exp $");
+__RCSID("@(#) $Id: sscf_uni.c,v 1.3 1998/10/31 20:07:00 phk Exp $");
 #endif
 
 
@@ -310,7 +310,7 @@ sscf_uni_pdu_print(uvp, m, msg)
 	struct vccb	*vcp;
 
 	vcp = uvp->uv_connvc->cvc_vcc;
-	sprintf(buf, "sscf_uni %s: vcc=(%d,%d)\n",
+	snprintf(buf, sizeof(buf), "sscf_uni %s: vcc=(%d,%d)\n",
 			msg, vcp->vc_vpi, vcp->vc_vci);
 	atm_pdu_print(m, buf);
 }
diff --git a/sys/netatm/uni/sscop_pdu.c b/sys/netatm/uni/sscop_pdu.c
index 86522b9..0356284 100644
--- a/sys/netatm/uni/sscop_pdu.c
+++ b/sys/netatm/uni/sscop_pdu.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: sscop_pdu.c,v 1.1 1998/09/15 08:23:07 phk Exp $
+ *	@(#) $Id: sscop_pdu.c,v 1.2 1998/10/31 20:07:00 phk Exp $
  *
  */
 
@@ -44,7 +44,7 @@
 #include <netatm/uni/sscop_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: sscop_pdu.c,v 1.1 1998/09/15 08:23:07 phk Exp $");
+__RCSID("@(#) $Id: sscop_pdu.c,v 1.2 1998/10/31 20:07:00 phk Exp $");
 #endif
 
 /*
@@ -1231,7 +1231,8 @@ sscop_pdu_print(sop, m, msg)
 	struct vccb	*vcp;
 
 	vcp = sop->so_connvc->cvc_vcc;
-	sprintf(buf, "sscop %s: vcc=(%d,%d)\n", msg, vcp->vc_vpi, vcp->vc_vci);
+	snprintf(buf, sizeof(buf),
+	    "sscop %s: vcc=(%d,%d)\n", msg, vcp->vc_vpi, vcp->vc_vci);
 	atm_pdu_print(m, buf);
 }
 
diff --git a/sys/netatm/uni/uniarp.c b/sys/netatm/uni/uniarp.c
index b972541..9aae374 100644
--- a/sys/netatm/uni/uniarp.c
+++ b/sys/netatm/uni/uniarp.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: uniarp.c,v 1.2 1998/09/17 09:35:01 phk Exp $
+ *	@(#) $Id: uniarp.c,v 1.3 1998/10/31 20:07:00 phk Exp $
  *
  */
 
@@ -43,7 +43,7 @@
 #include <netatm/uni/uniip_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: uniarp.c,v 1.2 1998/09/17 09:35:01 phk Exp $");
+__RCSID("@(#) $Id: uniarp.c,v 1.3 1998/10/31 20:07:00 phk Exp $");
 #endif
 
 
@@ -1022,7 +1022,8 @@ uniarp_ioctl(code, data, arg1)
 					AF_INET;
 				SATOSIN(&aar.aap_arp_addr)->sin_addr.s_addr =
 					uap->ua_dstip.s_addr;
-				(void) sprintf(aar.aap_intf, "%s%d",
+				(void) snprintf(aar.aap_intf,
+				    sizeof(aar.aap_intf), "%s%d",
 					nip->nif_if.if_name,
 					nip->nif_if.if_unit);
 				aar.aap_flags = uap->ua_flags;
@@ -1076,7 +1077,8 @@ uniarp_ioctl(code, data, arg1)
 			 */
 			SATOSIN(&aar.aap_arp_addr)->sin_family = AF_INET;
 			SATOSIN(&aar.aap_arp_addr)->sin_addr.s_addr = 0;
-			(void) sprintf(aar.aap_intf, "%s%d",
+			(void) snprintf(aar.aap_intf,
+			    sizeof(aar.aap_intf), "%s%d",
 				nip->nif_if.if_name, nip->nif_if.if_unit);
 			aar.aap_flags = 0;
 			aar.aap_origin = uap->ua_origin;
@@ -1157,7 +1159,8 @@ updbuf:
 			 * Fill in info to be returned
 			 */
 			nip = uip->uip_ipnif->inf_nif;
-			(void) sprintf(asr.asp_intf, "%s%d",
+			(void) snprintf(asr.asp_intf,
+			    sizeof(asr.asp_intf), "%s%d",
 				nip->nif_if.if_name, nip->nif_if.if_unit);
 			asr.asp_state = uip->uip_arpstate;
 			if (uip->uip_arpstate == UIAS_SERVER_ACTIVE) {
diff --git a/sys/netatm/uni/uniarp_cache.c b/sys/netatm/uni/uniarp_cache.c
index c5bf5ae..88a26a5 100644
--- a/sys/netatm/uni/uniarp_cache.c
+++ b/sys/netatm/uni/uniarp_cache.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: uniarp_cache.c,v 1.1 1998/09/15 08:23:09 phk Exp $
+ *	@(#) $Id: uniarp_cache.c,v 1.2 1998/10/31 20:07:00 phk Exp $
  *
  */
 
@@ -43,7 +43,7 @@
 #include <netatm/uni/uniip_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: uniarp_cache.c,v 1.1 1998/09/15 08:23:09 phk Exp $");
+__RCSID("@(#) $Id: uniarp_cache.c,v 1.2 1998/10/31 20:07:00 phk Exp $");
 #endif
 
 
@@ -79,6 +79,7 @@ uniarp_cache_svc(uip, ip, atm, atmsub, origin)
 
 #ifdef DIAGNOSTIC
 	strncpy(abuf, unisig_addr_print(atmsub), sizeof(abuf));
+	abuf[sizeof(abuf) - 1] = 0;
 	ATM_DEBUG4("cache_svc: ip=%s, atm=(%s,%s), origin=%d\n",
 		inet_ntoa(*ip), unisig_addr_print(atm), abuf, origin);
 #endif
@@ -156,6 +157,7 @@ uniarp_cache_svc(uip, ip, atm, atmsub, origin)
 			if (ipuap->ua_ivp != NULL) {
 				strncpy(abuf, unisig_addr_print(atmsub),
 					sizeof(abuf));
+				abuf[sizeof(abuf) - 1] = 0;
 				log(LOG_WARNING, 
 					"uniarp: duplicate IP address %s from %s,%s\n",
 					inet_ntoa(*ip), unisig_addr_print(atm),
@@ -185,6 +187,7 @@ uniarp_cache_svc(uip, ip, atm, atmsub, origin)
 		}
 
 		strncpy(abuf, unisig_addr_print(atmsub), sizeof(abuf));
+		abuf[sizeof(abuf) - 1] = 0;
 		log(LOG_WARNING, 
 			"uniarp: ATM address for %s changed to %s,%s\n",
 			inet_ntoa(*ip), unisig_addr_print(atm), abuf);
@@ -328,6 +331,7 @@ uniarp_cache_pvc(ivp, ip, atm, atmsub)
 		vci = ivp->iv_conn->co_connvc->cvc_vcc->vc_vci;
 	}
 	strncpy(buf, unisig_addr_print(atmsub), sizeof(buf));
+	buf[sizeof(buf) - 1] = 0;
 	ATM_DEBUG5("cache_pvc: vcc=(%d,%d), ip=%s, atm=(%s,%s)\n",
 		vpi, vci, inet_ntoa(*ip), unisig_addr_print(atm), buf);
 #endif
diff --git a/sys/netatm/uni/uniarp_input.c b/sys/netatm/uni/uniarp_input.c
index 9ef6225..b621ac3 100644
--- a/sys/netatm/uni/uniarp_input.c
+++ b/sys/netatm/uni/uniarp_input.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: uniarp_input.c,v 1.1 1998/09/15 08:23:09 phk Exp $
+ *	@(#) $Id: uniarp_input.c,v 1.2 1998/10/31 20:07:00 phk Exp $
  *
  */
 
@@ -43,7 +43,7 @@
 #include <netatm/uni/uniip_var.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: uniarp_input.c,v 1.1 1998/09/15 08:23:09 phk Exp $");
+__RCSID("@(#) $Id: uniarp_input.c,v 1.2 1998/10/31 20:07:00 phk Exp $");
 #endif
 
 
@@ -846,7 +846,8 @@ uniarp_pdu_print(ivp, m, msg)
 	struct vccb	*vcp;
 
 	vcp = ivp->iv_conn->co_connvc->cvc_vcc;
-	sprintf(buf, "uniarp %s: vcc=(%d,%d)\n", msg, vcp->vc_vpi, vcp->vc_vci);
+	snprintf(buf, sizeof(buf),
+	    "uniarp %s: vcc=(%d,%d)\n", msg, vcp->vc_vpi, vcp->vc_vci);
 	atm_pdu_print(m, buf);
 }
 
diff --git a/sys/netatm/uni/unisig_if.c b/sys/netatm/uni/unisig_if.c
index e1cfc8f..c85e462 100644
--- a/sys/netatm/uni/unisig_if.c
+++ b/sys/netatm/uni/unisig_if.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: unisig_if.c,v 1.2 1998/09/17 09:35:02 phk Exp $
+ *	@(#) $Id: unisig_if.c,v 1.3 1998/10/31 20:07:01 phk Exp $
  *
  */
 
@@ -47,7 +47,7 @@
 #include <netatm/uni/unisig_msg.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: unisig_if.c,v 1.2 1998/09/17 09:35:02 phk Exp $");
+__RCSID("@(#) $Id: unisig_if.c,v 1.3 1998/10/31 20:07:01 phk Exp $");
 #endif
 
 
@@ -894,7 +894,8 @@ unisig_ioctl(code, data, arg1)
 			/*
 			 * Fill out the response struct for the VCC
 			 */
-			(void) sprintf(rsp.avp_intf, "%s%d",
+			(void) snprintf(rsp.avp_intf,
+				    sizeof(rsp.avp_intf), "%s%d",
 					usp->us_pif->pif_name,
 					usp->us_pif->pif_unit);
 			rsp.avp_vpi = uvp->uv_vpi;
diff --git a/sys/netatm/uni/unisig_util.c b/sys/netatm/uni/unisig_util.c
index 6a3afb8..a3a2ab2 100644
--- a/sys/netatm/uni/unisig_util.c
+++ b/sys/netatm/uni/unisig_util.c
@@ -23,7 +23,7 @@
  * Copies of this Software may be made, however, the above copyright
  * notice must be reproduced on all copies.
  *
- *	@(#) $Id: unisig_util.c,v 1.2 1998/09/17 09:35:02 phk Exp $
+ *	@(#) $Id: unisig_util.c,v 1.3 1998/10/31 20:07:01 phk Exp $
  *
  */
 
@@ -42,7 +42,7 @@
 #include <netatm/uni/unisig_msg.h>
 
 #ifndef lint
-__RCSID("@(#) $Id: unisig_util.c,v 1.2 1998/09/17 09:35:02 phk Exp $");
+__RCSID("@(#) $Id: unisig_util.c,v 1.3 1998/10/31 20:07:01 phk Exp $");
 #endif
 
 
@@ -303,7 +303,8 @@ unisig_addr_print(p)
 				 * two-digit hex representation of the
 				 * NSAP byte in the output buffer
 				 */
-				sprintf(t_buff, "%x", *cp + 512);
+				snprintf(t_buff, sizeof(t_buff),
+					"%x", *cp + 512);
 				strcpy(op, &t_buff[strlen(t_buff)-2]);
 				op++; op++;
 				cp++;
@@ -325,7 +326,8 @@ unisig_addr_print(p)
 		 * Print the IA5 characters of the E.164 address
 		 */
 		for(i=0; i<p->address_length; i++) {
-			sprintf(&strbuff[strlen(strbuff)], "%c",
+			snprintf(strbuff + strlen(strbuff),
+			    sizeof(strbuff) - strlen(strbuff), "%c",
 				((Atm_addr_e164 *)p->address)->aae_addr[i]);
 		}
 		break;
@@ -346,7 +348,7 @@ unisig_addr_print(p)
 		/*
 		 * Print the address as two words xxxxx.yyyyyyyy
 		 */
-		sprintf(strbuff, "%x.%x", u1.w, u2.w);
+		snprintf(strbuff, sizeof(strbuff), "%x.%x", u1.w, u2.w);
 		break;
 
 	case T_ATM_ABSENT:
diff --git a/sys/netinet/ip_divert.c b/sys/netinet/ip_divert.c
index 87ae671..b39948e 100644
--- a/sys/netinet/ip_divert.c
+++ b/sys/netinet/ip_divert.c
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	$Id: ip_divert.c,v 1.33 1998/07/02 06:31:25 julian Exp $
+ *	$Id: ip_divert.c,v 1.34 1998/07/06 09:06:58 julian Exp $
  */
 
 #include "opt_inet.h"
@@ -197,8 +197,8 @@ div_input(struct mbuf *m, int hlen)
 	/*
 	 * Record the incoming interface name whenever we have one.
 	 */
+	bzero(&divsrc.sin_zero, sizeof(divsrc.sin_zero));
 	if (m->m_pkthdr.rcvif) {
-		char	name[32];
 		/*
 		 * Hide the actual interface name in there in the 
 		 * sin_zero array. XXX This needs to be moved to a
@@ -217,9 +217,9 @@ div_input(struct mbuf *m, int hlen)
 		 * this iface name will come along for the ride.
 		 * (see div_output for the other half of this.)
 		 */ 
-		sprintf(name, "%s%d",
-			m->m_pkthdr.rcvif->if_name, m->m_pkthdr.rcvif->if_unit);
-		strncpy(divsrc.sin_zero, name, 7);
+		snprintf(divsrc.sin_zero, sizeof(divsrc.sin_zero),
+			"%s%d", m->m_pkthdr.rcvif->if_name,
+			m->m_pkthdr.rcvif->if_unit);
 	}
 
 	/* Put packet on socket queue, if any */
diff --git a/sys/netinet/ip_fil.c b/sys/netinet/ip_fil.c
index 1075316..6cbdac9 100644
--- a/sys/netinet/ip_fil.c
+++ b/sys/netinet/ip_fil.c
@@ -7,7 +7,7 @@
  */
 #if !defined(lint)
 static const char sccsid[] = "@(#)ip_fil.c	2.41 6/5/96 (C) 1993-1995 Darren Reed";
-static const char rcsid[] = "@(#)$Id: ip_fil.c,v 1.5 1998/06/20 18:37:50 peter Exp $";
+static const char rcsid[] = "@(#)$Id: ip_fil.c,v 1.6 1998/08/15 21:51:53 bde Exp $";
 #endif
 
 #include "opt_ipfilter.h"
@@ -1110,12 +1110,12 @@ ip_t *ip;
 
 # if (defined(NetBSD) && (NetBSD <= 1991011) && (NetBSD >= 199606)) || \
 	(defined(OpenBSD) && (OpenBSD >= 199603))
-	sprintf(fname, "/tmp/%s", ifp->if_xname);
+	snprintf(fname, sizeof(fname), "/tmp/%s", ifp->if_xname);
 	if ((fp = fopen(fname, "a"))) {
 		fclose(fp);
 	}
 # else
-	sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
+	snprintf(fname, sizeof(fname), "/tmp/%s%d", ifp->if_name, ifp->if_unit);
 	if ((fp = fopen(fname, "a"))) {
 		fwrite((char *)ip, ntohs(ip->ip_len), 1, fp);
 		fclose(fp);
@@ -1139,7 +1139,8 @@ char *name;
 	char ifname[32], *s;
 
 	for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
-		(void) sprintf(ifname, "%s%d", ifp->if_name, ifp->if_unit);
+		(void) snprintf(ifname, sizeof(ifname),
+			"%s%d", ifp->if_name, ifp->if_unit);
 		if (!strcmp(name, ifname))
 			return ifp;
 	}
@@ -1190,7 +1191,7 @@ void init_ifp()
 	(defined(OpenBSD) && (OpenBSD >= 199603))
 	for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
 		ifp->if_output = write_output;
-		sprintf(fname, "/tmp/%s", ifp->if_xname);
+		snprintf(fname, sizeof(fname), "/tmp/%s", ifp->if_xname);
 		if ((fp = fopen(fname, "w")))
 			fclose(fp);
 	}
@@ -1198,7 +1199,8 @@ void init_ifp()
 
 	for (ifa = ifneta; ifa && (ifp = *ifa); ifa++) {
 		ifp->if_output = write_output;
-		sprintf(fname, "/tmp/%s%d", ifp->if_name, ifp->if_unit);
+		snprintf(fname, sizeof(fname),
+		    "/tmp/%s%d", ifp->if_name, ifp->if_unit);
 		if ((fp = fopen(fname, "w")))
 			fclose(fp);
 	}
diff --git a/sys/netinet/ip_ftp_pxy.c b/sys/netinet/ip_ftp_pxy.c
index 1a66a9b..dd70c81 100644
--- a/sys/netinet/ip_ftp_pxy.c
+++ b/sys/netinet/ip_ftp_pxy.c
@@ -165,7 +165,7 @@ nat_t *nat;
 	a4 = a1 & 0xff;
 	a1 >>= 24;
 	olen = s - portbuf + 1;
-	(void) sprintf(newbuf, "PORT %d,%d,%d,%d,%d,%d\r\n",
+	(void) snprintf(newbuf, sizeof(newbuf), "PORT %d,%d,%d,%d,%d,%d\r\n",
 		a1, a2, a3, a4, a5, a6);
 	nlen = strlen(newbuf);
 	inc = nlen - olen;
diff --git a/sys/netipx/ipx.c b/sys/netipx/ipx.c
index ab2f42a..752c2dc 100644
--- a/sys/netipx/ipx.c
+++ b/sys/netipx/ipx.c
@@ -33,7 +33,7 @@
  * 
  *	@(#)ipx.c
  *
- * $Id: ipx.c,v 1.11 1997/06/26 19:35:42 jhay Exp $
+ * $Id: ipx.c,v 1.12 1998/06/07 17:12:18 dfr Exp $
  */
 
 #include <sys/param.h>
@@ -359,7 +359,7 @@ register struct ipx_addr *addr;
 		net = "*";
 	else {
 		q = work.x_net.c_net;
-		sprintf(cnet, "%x%x%x%x",
+		snprintf(cnet, sizeof(cnet), "%x%x%x%x",
 			q[0], q[1], q[2], q[3]);
 		for (p = cnet; *p == '0' && p < cnet + 8; p++)
 			continue;
@@ -372,7 +372,7 @@ register struct ipx_addr *addr;
 		host = "*";
 	else {
 		q = work.x_host.c_host;
-		sprintf(chost, "%x%x%x%x%x%x",
+		snprintf(chost, sizeof(chost), "%x%x%x%x%x%x",
 			q[0], q[1], q[2], q[3], q[4], q[5]);
 		for (p = chost; *p == '0' && p < chost + 12; p++)
 			continue;
@@ -382,9 +382,9 @@ register struct ipx_addr *addr;
 	if (port) {
 		if (strcmp(host, "*") == 0) {
 			host = "";
-			sprintf(cport, "%x", port);
+			snprintf(cport, sizeof(cport), "%x", port);
 		} else
-			sprintf(cport, ".%x", port);
+			snprintf(cport, sizeof(cport), ".%x", port);
 	} else
 		*cport = 0;
 
diff --git a/sys/netnatm/natm.c b/sys/netnatm/natm.c
index c3ebc08a..e7fca3d 100644
--- a/sys/netnatm/natm.c
+++ b/sys/netnatm/natm.c
@@ -333,8 +333,8 @@ natm_usr_peeraddr(struct socket *so, struct sockaddr **nam)
     bzero(snatm, sizeof(*snatm));
     snatm->snatm_len = sizeof(*snatm);
     snatm->snatm_family = AF_NATM;
-    sprintf(snatm->snatm_if, "%s%d", npcb->npcb_ifp->if_name,
-	    npcb->npcb_ifp->if_unit);
+    snprintf(snatm->snatm_if, sizeof(snatm->snatm_if),
+	"%s%d", npcb->npcb_ifp->if_name, npcb->npcb_ifp->if_unit);
     snatm->snatm_vci = npcb->npcb_vci;
     snatm->snatm_vpi = npcb->npcb_vpi;
     *nam = dup_sockaddr((struct sockaddr *)snatm, 0);
@@ -623,8 +623,8 @@ struct proc *p;
 #if defined(__NetBSD__) || defined(__OpenBSD__)
       bcopy(npcb->npcb_ifp->if_xname, snatm->snatm_if, sizeof(snatm->snatm_if));
 #elif defined(__FreeBSD__)
-      sprintf(snatm->snatm_if, "%s%d", npcb->npcb_ifp->if_name,
-	npcb->npcb_ifp->if_unit);
+      snprintf(snatm->snatm_if, sizeof(snatm->snatm_if),
+	"%s%d", npcb->npcb_ifp->if_name, npcb->npcb_ifp->if_unit);
 #endif
       snatm->snatm_vci = npcb->npcb_vci;
       snatm->snatm_vpi = npcb->npcb_vpi;
diff --git a/sys/nfs/bootp_subr.c b/sys/nfs/bootp_subr.c
index b6947ca..ca64638 100644
--- a/sys/nfs/bootp_subr.c
+++ b/sys/nfs/bootp_subr.c
@@ -1,4 +1,4 @@
-/*	$Id: bootp_subr.c,v 1.15 1998/08/23 03:07:16 wollman Exp $	*/
+/*	$Id: bootp_subr.c,v 1.16 1998/12/03 20:28:23 dillon Exp $	*/
 
 /*
  * Copyright (c) 1995 Gordon Ross, Adam Glass
@@ -774,7 +774,8 @@ bootpc_init(void)
   bzero(&ireq, sizeof(ireq));
   for (ifp = TAILQ_FIRST(&ifnet); ifp != 0; ifp = TAILQ_NEXT(ifp,if_link))
   {
-    sprintf(ireq.ifr_name, "%s%d", ifp->if_name, ifp->if_unit);
+    snprintf(ireq.ifr_name, sizeof(ireq.ifr_name),
+	"%s%d", ifp->if_name, ifp->if_unit);
 #ifdef BOOTP_WIRED_TO
     if (strcmp(ireq.ifr_name, __XSTRING(BOOTP_WIRED_TO)) == 0)
         break;
@@ -885,7 +886,7 @@ bootpc_init(void)
   myaddr.sin_addr = reply.yiaddr;
 
   ip = ntohl(myaddr.sin_addr.s_addr);
-  sprintf(lookup_path,"swap.%d.%d.%d.%d",
+  snprintf(lookup_path, sizeof(lookup_path), "swap.%d.%d.%d.%d",
 	  ip >> 24, (ip >> 16) & 255 ,(ip >> 8) & 255 ,ip & 255 );
 
   printip("My ip address",myaddr.sin_addr);
diff --git a/sys/nfs/nfs_vfsops.c b/sys/nfs/nfs_vfsops.c
index eb379b5..cc4775b 100644
--- a/sys/nfs/nfs_vfsops.c
+++ b/sys/nfs/nfs_vfsops.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)nfs_vfsops.c	8.12 (Berkeley) 5/20/95
- * $Id: nfs_vfsops.c,v 1.77 1998/09/29 23:15:53 mckusick Exp $
+ * $Id: nfs_vfsops.c,v 1.78 1998/10/31 15:31:26 peter Exp $
  */
 
 #include <sys/param.h>
@@ -486,7 +486,7 @@ nfs_mountroot(mp)
 	nd->root_args.fh = nd->root_fh;
 	nd->root_args.fhsize = nd->root_fhsize;
 	l = ntohl(nd->root_saddr.sin_addr.s_addr);
-	sprintf(buf,"%ld.%ld.%ld.%ld:%s",
+	snprintf(buf, sizeof(buf), "%ld.%ld.%ld.%ld:%s",
 		(l >> 24) & 0xff, (l >> 16) & 0xff,
 		(l >>  8) & 0xff, (l >>  0) & 0xff,nd->root_hostnam);
 	printf("NFS ROOT: %s\n",buf);
@@ -512,7 +512,7 @@ nfs_mountroot(mp)
 		nd->swap_args.fh = nd->swap_fh;
 		nd->swap_args.fhsize = nd->swap_fhsize;
 		l = ntohl(nd->swap_saddr.sin_addr.s_addr);
-		sprintf(buf,"%ld.%ld.%ld.%ld:%s",
+		snprintf(buf, sizeof(buf), "%ld.%ld.%ld.%ld:%s",
 			(l >> 24) & 0xff, (l >> 16) & 0xff,
 			(l >>  8) & 0xff, (l >>  0) & 0xff,nd->swap_hostnam);
 		printf("NFS SWAP: %s\n",buf);
diff --git a/sys/nfsclient/bootp_subr.c b/sys/nfsclient/bootp_subr.c
index b6947ca..ca64638 100644
--- a/sys/nfsclient/bootp_subr.c
+++ b/sys/nfsclient/bootp_subr.c
@@ -1,4 +1,4 @@
-/*	$Id: bootp_subr.c,v 1.15 1998/08/23 03:07:16 wollman Exp $	*/
+/*	$Id: bootp_subr.c,v 1.16 1998/12/03 20:28:23 dillon Exp $	*/
 
 /*
  * Copyright (c) 1995 Gordon Ross, Adam Glass
@@ -774,7 +774,8 @@ bootpc_init(void)
   bzero(&ireq, sizeof(ireq));
   for (ifp = TAILQ_FIRST(&ifnet); ifp != 0; ifp = TAILQ_NEXT(ifp,if_link))
   {
-    sprintf(ireq.ifr_name, "%s%d", ifp->if_name, ifp->if_unit);
+    snprintf(ireq.ifr_name, sizeof(ireq.ifr_name),
+	"%s%d", ifp->if_name, ifp->if_unit);
 #ifdef BOOTP_WIRED_TO
     if (strcmp(ireq.ifr_name, __XSTRING(BOOTP_WIRED_TO)) == 0)
         break;
@@ -885,7 +886,7 @@ bootpc_init(void)
   myaddr.sin_addr = reply.yiaddr;
 
   ip = ntohl(myaddr.sin_addr.s_addr);
-  sprintf(lookup_path,"swap.%d.%d.%d.%d",
+  snprintf(lookup_path, sizeof(lookup_path), "swap.%d.%d.%d.%d",
 	  ip >> 24, (ip >> 16) & 255 ,(ip >> 8) & 255 ,ip & 255 );
 
   printip("My ip address",myaddr.sin_addr);
diff --git a/sys/nfsclient/nfs_vfsops.c b/sys/nfsclient/nfs_vfsops.c
index eb379b5..cc4775b 100644
--- a/sys/nfsclient/nfs_vfsops.c
+++ b/sys/nfsclient/nfs_vfsops.c
@@ -34,7 +34,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)nfs_vfsops.c	8.12 (Berkeley) 5/20/95
- * $Id: nfs_vfsops.c,v 1.77 1998/09/29 23:15:53 mckusick Exp $
+ * $Id: nfs_vfsops.c,v 1.78 1998/10/31 15:31:26 peter Exp $
  */
 
 #include <sys/param.h>
@@ -486,7 +486,7 @@ nfs_mountroot(mp)
 	nd->root_args.fh = nd->root_fh;
 	nd->root_args.fhsize = nd->root_fhsize;
 	l = ntohl(nd->root_saddr.sin_addr.s_addr);
-	sprintf(buf,"%ld.%ld.%ld.%ld:%s",
+	snprintf(buf, sizeof(buf), "%ld.%ld.%ld.%ld:%s",
 		(l >> 24) & 0xff, (l >> 16) & 0xff,
 		(l >>  8) & 0xff, (l >>  0) & 0xff,nd->root_hostnam);
 	printf("NFS ROOT: %s\n",buf);
@@ -512,7 +512,7 @@ nfs_mountroot(mp)
 		nd->swap_args.fh = nd->swap_fh;
 		nd->swap_args.fhsize = nd->swap_fhsize;
 		l = ntohl(nd->swap_saddr.sin_addr.s_addr);
-		sprintf(buf,"%ld.%ld.%ld.%ld:%s",
+		snprintf(buf, sizeof(buf), "%ld.%ld.%ld.%ld:%s",
 			(l >> 24) & 0xff, (l >> 16) & 0xff,
 			(l >>  8) & 0xff, (l >>  0) & 0xff,nd->swap_hostnam);
 		printf("NFS SWAP: %s\n",buf);
diff --git a/sys/pc98/pc98/atcompat_diskslice.c b/sys/pc98/pc98/atcompat_diskslice.c
index c25afaf..ad51bc0 100644
--- a/sys/pc98/pc98/atcompat_diskslice.c
+++ b/sys/pc98/pc98/atcompat_diskslice.c
@@ -35,7 +35,7 @@
  *
  *	from: @(#)ufs_disksubr.c	7.16 (Berkeley) 5/4/91
  *	from: ufs_disksubr.c,v 1.8 1994/06/07 01:21:39 phk Exp $
- *	$Id: atcompat_diskslice.c,v 1.11 1998/07/27 09:49:22 kato Exp $
+ *	$Id: atcompat_diskslice.c,v 1.12 1998/08/10 16:55:54 kato Exp $
  */
 
 /*
@@ -423,7 +423,7 @@ atcompat_extended(dname, dev, strat, lp, ssp, ext_offset, ext_size,
 
 			sname = dsname(dname, dkunit(dev), WHOLE_DISK_SLICE,
 				       RAW_PART, partname);
-			strcpy(buf, sname);
+			snprintf(buf, sizeof(buf), "%s", sname);
 			if (strlen(buf) < sizeof buf - 11)
 				strcat(buf, "<extended>");
 			check_part(buf, dp, base_ext_offset, nsectors,
diff --git a/sys/pc98/pc98/diskslice_machdep.c b/sys/pc98/pc98/diskslice_machdep.c
index e2688ff..5370462d 100644
--- a/sys/pc98/pc98/diskslice_machdep.c
+++ b/sys/pc98/pc98/diskslice_machdep.c
@@ -35,7 +35,7 @@
  *
  *	from: @(#)ufs_disksubr.c	7.16 (Berkeley) 5/4/91
  *	from: ufs_disksubr.c,v 1.8 1994/06/07 01:21:39 phk Exp $
- *	$Id: diskslice_machdep.c,v 1.15 1998/07/27 09:49:23 kato Exp $
+ *	$Id: diskslice_machdep.c,v 1.16 1998/08/10 16:55:54 kato Exp $
  */
 
 /*
@@ -470,7 +470,7 @@ reread_mbr:
 		sp->ds_size = pc98_size;
 		sp->ds_type = dp->dp_mid;
 		sp->ds_subtype = dp->dp_sid;
-		strncpy(sp->ds_name, dp->dp_name, 16);
+		strncpy(sp->ds_name, dp->dp_name, sizeof(sp->ds_name));
 #else
 		sp->ds_offset = mbr_offset + dp->dp_start;
 		sp->ds_size = dp->dp_size;
@@ -580,7 +580,7 @@ extended(dname, dev, strat, lp, ssp, ext_offset, ext_size, base_ext_offset,
 
 			sname = dsname(dname, dkunit(dev), WHOLE_DISK_SLICE,
 				       RAW_PART, partname);
-			strcpy(buf, sname);
+			snprintf(buf, sizeof(buf), "%s", sname);
 			if (strlen(buf) < sizeof buf - 11)
 				strcat(buf, "<extended>");
 			check_part(buf, dp, base_ext_offset, nsectors,
@@ -611,7 +611,7 @@ extended(dname, dev, strat, lp, ssp, ext_offset, ext_size, base_ext_offset,
 			sp->ds_size = pc98_size;
 			sp->ds_type = dp->dp_mid;
 			sp->ds_subtype = dp->dp_sid;
-			strncpy(sp->ds_name, dp->dp_name, 16);
+			strncpy(sp->ds_name, dp->dp_name, sizeof(sp->ds_name));
 #else
 			sp->ds_offset = ext_offset + dp->dp_start;
 			sp->ds_size = dp->dp_size;
diff --git a/sys/pci/if_en_pci.c b/sys/pci/if_en_pci.c
index d1853b5..37db78e 100644
--- a/sys/pci/if_en_pci.c
+++ b/sys/pci/if_en_pci.c
@@ -259,7 +259,7 @@ int unit;
   enpcis[unit] = scp;			/* lock it in */
   en_cd.cd_devs[unit] = sc;		/* fake a cfdriver structure */
   en_cd.cd_ndevs = NEN;
-  sprintf(sc->sc_dev.dv_xname, "en%d", unit);
+  snprintf(sc->sc_dev.dv_xname, sizeof(sc->sc_dev.dv_xname), "en%d", unit);
   sc->enif.if_unit = unit;
   sc->enif.if_name = "en";
 
diff --git a/sys/pci/isp_pci.c b/sys/pci/isp_pci.c
index ae7842b..f22cfe1 100644
--- a/sys/pci/isp_pci.c
+++ b/sys/pci/isp_pci.c
@@ -270,7 +270,7 @@ isp_pci_attach(config_id, unit)
 	    pcs->pci_st == IO_SPACE_MAPPING? "I/O" : "Memory");
 
 	isp = &pcs->pci_isp;
-	(void) sprintf(isp->isp_name, "isp%d", unit);
+	(void) snprintf(isp->isp_name, sizeof(isp->isp_name), "isp%d", unit);
 	isp->isp_osinfo.unit = unit;
 
 	data = pci_conf_read(config_id, PCI_ID_REG);
diff --git a/sys/pci/ncr.c b/sys/pci/ncr.c
index 3703322..0171ba9 100644
--- a/sys/pci/ncr.c
+++ b/sys/pci/ncr.c
@@ -1,6 +1,6 @@
 /**************************************************************************
 **
-**  $Id: ncr.c,v 1.136 1998/09/29 09:14:52 bde Exp $
+**  $Id: ncr.c,v 1.137 1998/10/15 23:17:49 gibbs Exp $
 **
 **  Device driver for the   NCR 53C8XX   PCI-SCSI-Controller Family.
 **
@@ -1357,7 +1357,7 @@ static	void	ncr_attach	(pcici_t tag, int unit);
 
 
 static char ident[] =
-	"\n$Id: ncr.c,v 1.136 1998/09/29 09:14:52 bde Exp $\n";
+	"\n$Id: ncr.c,v 1.137 1998/10/15 23:17:49 gibbs Exp $\n";
 
 static const u_long	ncr_version = NCR_VERSION	* 11
 	+ (u_long) sizeof (struct ncb)	*  7
@@ -1410,7 +1410,7 @@ DATA_SET (pcidevice_set, ncr_device);
 static char *ncr_name (ncb_p np)
 {
 	static char name[10];
-	sprintf(name, "ncr%d", np->unit);
+	snprintf(name, sizeof(name), "ncr%d", np->unit);
 	return (name);
 }
 
diff --git a/sys/pci/pci_compat.c b/sys/pci/pci_compat.c
index d2f9ebf..9048953 100644
--- a/sys/pci/pci_compat.c
+++ b/sys/pci/pci_compat.c
@@ -23,7 +23,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
- * $Id: pci_compat.c,v 1.12 1998/10/06 14:18:40 dfr Exp $
+ * $Id: pci_compat.c,v 1.13 1998/11/09 08:03:01 peter Exp $
  *
  */
 
@@ -427,6 +427,7 @@ pci_drvattach(struct pci_devinfo *dinfo)
 		else
 			strncpy(dinfo->conf.pd_name, "????",
 				sizeof(dinfo->conf.pd_name));
+		dinfo->conf.pd_name[sizeof(dinfo->conf.pd_name) - 1] = 0;
 
 		dinfo->conf.pd_unit = unit;
 
diff --git a/sys/pci/pcisupport.c b/sys/pci/pcisupport.c
index a422972..6a46960 100644
--- a/sys/pci/pcisupport.c
+++ b/sys/pci/pcisupport.c
@@ -1,6 +1,6 @@
 /**************************************************************************
 **
-**  $Id: pcisupport.c,v 1.74 1998/11/26 21:57:52 n_hibma Exp $
+**  $Id: pcisupport.c,v 1.75 1998/12/01 21:50:58 sos Exp $
 **
 **  Device driver for DEC/INTEL PCI chipsets.
 **
@@ -102,10 +102,12 @@ generic_pci_bridge (pcici_t tag)
 		case 5:	strcpy(tmpbuf, "PCI to PCMCIA"); break;
 		case 7:	strcpy(tmpbuf, "PCI to CardBus"); break;
 		default: 
-			sprintf(tmpbuf, "PCI to 0x%x", classreg>>16 & 0xff); 
+			snprintf(tmpbuf, sizeof(tmpbuf),
+			    "PCI to 0x%x", classreg>>16 & 0xff); 
 			break;
 	}
-	sprintf(tmpbuf+strlen(tmpbuf), " bridge (vendor=%04x device=%04x)",
+	snprintf(tmpbuf+strlen(tmpbuf), sizeof(tmpbuf)-strlen(tmpbuf),
+	    " bridge (vendor=%04x device=%04x)",
 	    id & 0xffff, (id >> 16) & 0xffff);
 	descr = malloc (strlen(tmpbuf) +1, M_DEVBUF, M_WAITOK);
 	strcpy(descr, tmpbuf);
diff --git a/sys/vm/vm_zone.c b/sys/vm/vm_zone.c
index 910c621..3c52819 100644
--- a/sys/vm/vm_zone.c
+++ b/sys/vm/vm_zone.c
@@ -11,7 +11,7 @@
  * 2. Absolutely no warranty of function or purpose is made by the author
  *	John S. Dyson.
  *
- * $Id: vm_zone.c,v 1.22 1998/10/09 00:24:49 jdp Exp $
+ * $Id: vm_zone.c,v 1.23 1998/10/31 17:21:31 peter Exp $
  */
 
 #include <sys/param.h>
@@ -388,7 +388,8 @@ sysctl_vm_zone SYSCTL_HANDLER_ARGS
 	char tmpbuf[128];
 	char tmpname[14];
 
-	sprintf(tmpbuf, "\nITEM            SIZE     LIMIT    USED    FREE  REQUESTS\n");
+	snprintf(tmpbuf, sizeof(tmpbuf),
+	    "\nITEM            SIZE     LIMIT    USED    FREE  REQUESTS\n");
 	error = SYSCTL_OUT(req, tmpbuf, strlen(tmpbuf));
 	if (error)
 		return (error);
@@ -413,7 +414,7 @@ sysctl_vm_zone SYSCTL_HANDLER_ARGS
 			tmpbuf[0] = '\n';
 		}
 
-		sprintf(tmpbuf + offset,
+		snprintf(tmpbuf + offset, sizeof(tmpbuf) - offset,
 			"%s %6.6u, %8.8u, %6.6u, %6.6u, %8.8u\n",
 			tmpname, curzone->zsize, curzone->zmax,
 			(curzone->ztotal - curzone->zfreecnt),