string cleaning; ok tdeval

6 files changed, 140 insertions, 131 deletions

diff --git a/gnu/usr.bin/bc/bc/bc.c b/gnu/usr.bin/bc/bc/bc.c
index e04bed2e845..d86cd30b5d9 100644
--- a/gnu/usr.bin/bc/bc/bc.c
+++ b/gnu/usr.bin/bc/bc/bc.c
@@ -1022,7 +1022,7 @@ case 24:
 				yyerror ("Break outside a for/while");
 			      else
 				{
-				  sprintf (genstr, "J%1d:", break_label);
+				  snprintf (genstr, sizeof genstr, "J%1d:", break_label);
 				  generate (genstr);
 				}
 			    ;
@@ -1035,7 +1035,7 @@ case 25:
 				yyerror ("Continue outside a for");
 			      else
 				{
-				  sprintf (genstr, "J%1d:", continue_label);
+				  snprintf (genstr, sizeof genstr, "J%1d:", continue_label);
 				  generate (genstr);
 				}
 			    ;
@@ -1070,9 +1070,9 @@ case 31:
 				warn ("Comparison in first for expression");
 			      yyvsp[-1].i_value = next_label++;
 			      if (yyvsp[-1].i_value < 0)
-				sprintf (genstr, "N%1d:", yyvsp[-1].i_value);
+				snprintf (genstr, sizeof genstr, "N%1d:", yyvsp[-1].i_value);
 			      else
-				sprintf (genstr, "pN%1d:", yyvsp[-1].i_value);
+				snprintf (genstr, sizeof genstr, "pN%1d:", yyvsp[-1].i_value);
 			      generate (genstr);
 			    ;
     break;}
@@ -1081,11 +1081,11 @@ case 32:
 {
 			      if (yyvsp[-1].i_value < 0) generate ("1");
 			      yyvsp[-1].i_value = next_label++;
-			      sprintf (genstr, "B%1d:J%1d:", yyvsp[-1].i_value, break_label);
+			      snprintf (genstr, sizeof genstr, "B%1d:J%1d:", yyvsp[-1].i_value, break_label);
 			      generate (genstr);
 			      yyval.i_value = continue_label;
 			      continue_label = next_label++;
-			      sprintf (genstr, "N%1d:", continue_label);
+			      snprintf (genstr, sizeof genstr, "N%1d:", continue_label);
 			      generate (genstr);
 			    ;
     break;}
@@ -1095,16 +1095,16 @@ case 33:
 			      if (yyvsp[-1].i_value > 1)
 				warn ("Comparison in third for expression");
 			      if (yyvsp[-1].i_value < 0)
-				sprintf (genstr, "J%1d:N%1d:", yyvsp[-7].i_value, yyvsp[-4].i_value);
+				snprintf (genstr, sizeof genstr, "J%1d:N%1d:", yyvsp[-7].i_value, yyvsp[-4].i_value);
 			      else
-				sprintf (genstr, "pJ%1d:N%1d:", yyvsp[-7].i_value, yyvsp[-4].i_value);
+				snprintf (genstr, sizeof genstr, "pJ%1d:N%1d:", yyvsp[-7].i_value, yyvsp[-4].i_value);
 			      generate (genstr);
 			    ;
     break;}
 case 34:
 #line 235 "bc.y"
 {
-			      sprintf (genstr, "J%1d:N%1d:",
+			      snprintf (genstr, sizeof genstr, "J%1d:N%1d:",
 				       continue_label, break_label);
 			      generate (genstr);
 			      break_label = yyvsp[-13].i_value;
@@ -1116,14 +1116,14 @@ case 35:
 {
 			      yyvsp[-1].i_value = if_label;
 			      if_label = next_label++;
-			      sprintf (genstr, "Z%1d:", if_label);
+			      snprintf (genstr, sizeof genstr, "Z%1d:", if_label);
 			      generate (genstr);
 			    ;
     break;}
 case 36:
 #line 250 "bc.y"
 {
-			      sprintf (genstr, "N%1d:", if_label); 
+			      snprintf (genstr, sizeof genstr, "N%1d:", if_label); 
 			      generate (genstr);
 			      if_label = yyvsp[-5].i_value;
 			    ;
@@ -1132,7 +1132,7 @@ case 37:
 #line 256 "bc.y"
 {
 			      yyvsp[0].i_value = next_label++;
-			      sprintf (genstr, "N%1d:", yyvsp[0].i_value);
+			      snprintf (genstr, sizeof genstr, "N%1d:", yyvsp[0].i_value);
 			      generate (genstr);
 			    ;
     break;}
@@ -1141,14 +1141,14 @@ case 38:
 {
 			      yyvsp[0].i_value = break_label; 
 			      break_label = next_label++;
-			      sprintf (genstr, "Z%1d:", break_label);
+			      snprintf (genstr, sizeof genstr, "Z%1d:", break_label);
 			      generate (genstr);
 			    ;
     break;}
 case 39:
 #line 269 "bc.y"
 {
-			      sprintf (genstr, "J%1d:N%1d:", yyvsp[-7].i_value, break_label);
+			      snprintf (genstr, sizeof genstr, "J%1d:N%1d:", yyvsp[-7].i_value, break_label);
 			      generate (genstr);
 			      break_label = yyvsp[-4].i_value;
 			    ;
@@ -1178,7 +1178,7 @@ case 48:
 {
 			      warn ("else clause in if statement");
 			      yyvsp[0].i_value = next_label++;
-			      sprintf (genstr, "J%d:N%1d:", yyvsp[0].i_value, if_label); 
+			      snprintf (genstr, sizeof genstr, "J%d:N%1d:", yyvsp[0].i_value, if_label); 
 			      generate (genstr);
 			      if_label = yyvsp[0].i_value;
 			    ;
@@ -1188,7 +1188,7 @@ case 50:
 {
 			      /* Check auto list against parameter list? */
 			      check_params (yyvsp[-5].a_value,yyvsp[0].a_value);
-			      sprintf (genstr, "F%d,%s.%s[",
+			      snprintf (genstr, sizeof genstr, "F%d,%s.%s[",
 				       lookup(yyvsp[-7].s_value,FUNCTDEF), 
 				       arg_str (yyvsp[-5].a_value), arg_str (yyvsp[0].a_value));
 			      generate (genstr);
@@ -1259,7 +1259,7 @@ case 65:
 case 66:
 #line 356 "bc.y"
 {
-			      sprintf (genstr, "K%d:", -lookup (yyvsp[-2].s_value,ARRAY));
+			      snprintf (genstr, sizeof genstr, "K%d:", -lookup (yyvsp[-2].s_value,ARRAY));
 			      generate (genstr);
 			      yyval.a_value = nextarg (NULL,1,FALSE);
 			    ;
@@ -1274,7 +1274,7 @@ case 67:
 case 68:
 #line 367 "bc.y"
 {
-			      sprintf (genstr, "K%d:", -lookup (yyvsp[-2].s_value,ARRAY));
+			      snprintf (genstr, sizeof genstr, "K%d:", -lookup (yyvsp[-2].s_value,ARRAY));
 			      generate (genstr);
 			      yyval.a_value = nextarg (yyvsp[-4].a_value,1,FALSE);
 			    ;
@@ -1306,9 +1306,9 @@ case 73:
 			      if (yyvsp[0].c_value != '=')
 				{
 				  if (yyvsp[-1].i_value < 0)
-				    sprintf (genstr, "DL%d:", -yyvsp[-1].i_value);
+				    snprintf (genstr, sizeof genstr, "DL%d:", -yyvsp[-1].i_value);
 				  else
-				    sprintf (genstr, "l%d:", yyvsp[-1].i_value);
+				    snprintf (genstr, sizeof genstr, "l%d:", yyvsp[-1].i_value);
 				  generate (genstr);
 				}
 			    ;
@@ -1319,13 +1319,13 @@ case 74:
 			      if (yyvsp[0].i_value > 1) warn("comparison in assignment");
 			      if (yyvsp[-2].c_value != '=')
 				{
-				  sprintf (genstr, "%c", yyvsp[-2].c_value);
+				  snprintf (genstr, sizeof genstr, "%c", yyvsp[-2].c_value);
 				  generate (genstr);
 				}
 			      if (yyvsp[-3].i_value < 0)
-				sprintf (genstr, "S%d:", -yyvsp[-3].i_value);
+				snprintf (genstr, sizeof genstr, "S%d:", -yyvsp[-3].i_value);
 			      else
-				sprintf (genstr, "s%d:", yyvsp[-3].i_value);
+				snprintf (genstr, sizeof genstr, "s%d:", yyvsp[-3].i_value);
 			      generate (genstr);
 			      yyval.i_value = 0;
 			    ;
@@ -1335,14 +1335,14 @@ case 75:
 {
 			      warn("&& operator");
 			      yyvsp[0].i_value = next_label++;
-			      sprintf (genstr, "DZ%d:p", yyvsp[0].i_value);
+			      snprintf (genstr, sizeof genstr, "DZ%d:p", yyvsp[0].i_value);
 			      generate (genstr);
 			    ;
     break;}
 case 76:
 #line 426 "bc.y"
 {
-			      sprintf (genstr, "DZ%d:p1N%d:", yyvsp[-2].i_value, yyvsp[-2].i_value);
+			      snprintf (genstr, sizeof genstr, "DZ%d:p1N%d:", yyvsp[-2].i_value, yyvsp[-2].i_value);
 			      generate (genstr);
 			      yyval.i_value = yyvsp[-3].i_value | yyvsp[0].i_value;
 			    ;
@@ -1352,7 +1352,7 @@ case 77:
 {
 			      warn("|| operator");
 			      yyvsp[0].i_value = next_label++;
-			      sprintf (genstr, "B%d:", yyvsp[0].i_value);
+			      snprintf (genstr, sizeof genstr, "B%d:", yyvsp[0].i_value);
 			      generate (genstr);
 			    ;
     break;}
@@ -1361,7 +1361,7 @@ case 78:
 {
 			      int tmplab;
 			      tmplab = next_label++;
-			      sprintf (genstr, "B%d:0J%d:N%d:1N%d:",
+			      snprintf (genstr, sizeof genstr, "B%d:0J%d:N%d:1N%d:",
 				       yyvsp[-2].i_value, tmplab, yyvsp[-2].i_value, tmplab);
 			      generate (genstr);
 			      yyval.i_value = yyvsp[-3].i_value | yyvsp[0].i_value;
@@ -1459,9 +1459,9 @@ case 88:
 {
 			      yyval.i_value = 1;
 			      if (yyvsp[0].i_value < 0)
-				sprintf (genstr, "L%d:", -yyvsp[0].i_value);
+				snprintf (genstr, sizeof genstr, "L%d:", -yyvsp[0].i_value);
 			      else
-				sprintf (genstr, "l%d:", yyvsp[0].i_value);
+				snprintf (genstr, sizeof genstr, "l%d:", yyvsp[0].i_value);
 			      generate (genstr);
 			    ;
     break;}
@@ -1493,14 +1493,14 @@ case 91:
 			      yyval.i_value = 1;
 			      if (yyvsp[-1].a_value != NULL)
 				{ 
-				  sprintf (genstr, "C%d,%s:",
+				  snprintf (genstr, sizeof genstr, "C%d,%s:",
 					   lookup (yyvsp[-3].s_value,FUNCT),
 					   call_str (yyvsp[-1].a_value));
 				  free_args (yyvsp[-1].a_value);
 				}
 			      else
 				{
-				  sprintf (genstr, "C%d:", lookup (yyvsp[-3].s_value,FUNCT));
+				  snprintf (genstr, sizeof genstr, "C%d:", lookup (yyvsp[-3].s_value,FUNCT));
 				}
 			      generate (genstr);
 			    ;
@@ -1512,16 +1512,16 @@ case 92:
 			      if (yyvsp[0].i_value < 0)
 				{
 				  if (yyvsp[-1].c_value == '+')
-				    sprintf (genstr, "DA%d:L%d:", -yyvsp[0].i_value, -yyvsp[0].i_value);
+				    snprintf (genstr, sizeof genstr, "DA%d:L%d:", -yyvsp[0].i_value, -yyvsp[0].i_value);
 				  else
-				    sprintf (genstr, "DM%d:L%d:", -yyvsp[0].i_value, -yyvsp[0].i_value);
+				    snprintf (genstr, sizeof genstr, "DM%d:L%d:", -yyvsp[0].i_value, -yyvsp[0].i_value);
 				}
 			      else
 				{
 				  if (yyvsp[-1].c_value == '+')
-				    sprintf (genstr, "i%d:l%d:", yyvsp[0].i_value, yyvsp[0].i_value);
+				    snprintf (genstr, sizeof genstr, "i%d:l%d:", yyvsp[0].i_value, yyvsp[0].i_value);
 				  else
-				    sprintf (genstr, "d%d:l%d:", yyvsp[0].i_value, yyvsp[0].i_value);
+				    snprintf (genstr, sizeof genstr, "d%d:l%d:", yyvsp[0].i_value, yyvsp[0].i_value);
 				}
 			      generate (genstr);
 			    ;
@@ -1532,21 +1532,21 @@ case 93:
 			      yyval.i_value = 1;
 			      if (yyvsp[-1].i_value < 0)
 				{
-				  sprintf (genstr, "DL%d:x", -yyvsp[-1].i_value);
+				  snprintf (genstr, sizeof genstr, "DL%d:x", -yyvsp[-1].i_value);
 				  generate (genstr); 
 				  if (yyvsp[0].c_value == '+')
-				    sprintf (genstr, "A%d:", -yyvsp[-1].i_value);
+				    snprintf (genstr, sizeof genstr, "A%d:", -yyvsp[-1].i_value);
 				  else
-				      sprintf (genstr, "M%d:", -yyvsp[-1].i_value);
+				      snprintf (genstr, sizeof genstr, "M%d:", -yyvsp[-1].i_value);
 				}
 			      else
 				{
-				  sprintf (genstr, "l%d:", yyvsp[-1].i_value);
+				  snprintf (genstr, sizeof genstr, "l%d:", yyvsp[-1].i_value);
 				  generate (genstr);
 				  if (yyvsp[0].c_value == '+')
-				    sprintf (genstr, "i%d:", yyvsp[-1].i_value);
+				    snprintf (genstr, sizeof genstr, "i%d:", yyvsp[-1].i_value);
 				  else
-				    sprintf (genstr, "d%d:", yyvsp[-1].i_value);
+				    snprintf (genstr, sizeof genstr, "d%d:", yyvsp[-1].i_value);
 				}
 			      generate (genstr);
 			    ;
@@ -1685,7 +1685,7 @@ yyerrlab:   /* here on detecting error */
 	  msg = (char *) malloc(size + 15);
 	  if (msg != 0)
 	    {
-	      strcpy(msg, "parse error");
+	      strlcpy(msg, "parse error", size + 15);
 
 	      if (count < 5)
 		{
@@ -1694,9 +1694,10 @@ yyerrlab:   /* here on detecting error */
 		       x < (sizeof(yytname) / sizeof(char *)); x++)
 		    if (yycheck[x + yyn] == x)
 		      {
-			strcat(msg, count == 0 ? ", expecting `" : " or `");
-			strcat(msg, yytname[x]);
-			strcat(msg, "'");
+			strlcat(msg, count == 0 ? ", expecting `" : " or `",
+			    size + 15);
+			strlcat(msg, yytname[x], size + 15);
+			strlcat(msg, "'", size + 15);
 			count++;
 		      }
 		}
diff --git a/gnu/usr.bin/bc/bc/bc.y b/gnu/usr.bin/bc/bc/bc.y
index 81e77a88e58..921f66581e0 100644
--- a/gnu/usr.bin/bc/bc/bc.y
+++ b/gnu/usr.bin/bc/bc/bc.y
@@ -171,7 +171,7 @@ statement 		: Warranty
 				yyerror ("Break outside a for/while");
 			      else
 				{
-				  sprintf (genstr, "J%1d:", break_label);
+				  snprintf (genstr, sizeof genstr, "J%1d:", break_label);
 				  generate (genstr);
 				}
 			    }
@@ -182,7 +182,7 @@ statement 		: Warranty
 				yyerror ("Continue outside a for");
 			      else
 				{
-				  sprintf (genstr, "J%1d:", continue_label);
+				  snprintf (genstr, sizeof genstr, "J%1d:", continue_label);
 				  generate (genstr);
 				}
 			    }
@@ -205,20 +205,20 @@ statement 		: Warranty
 				warn ("Comparison in first for expression");
 			      $4 = next_label++;
 			      if ($4 < 0)
-				sprintf (genstr, "N%1d:", $4);
+				snprintf (genstr, sizeof genstr, "N%1d:", $4);
 			      else
-				sprintf (genstr, "pN%1d:", $4);
+				snprintf (genstr, sizeof genstr, "pN%1d:", $4);
 			      generate (genstr);
 			    }
 			  opt_expression ';'
 			    {
 			      if ($7 < 0) generate ("1");
 			      $7 = next_label++;
-			      sprintf (genstr, "B%1d:J%1d:", $7, break_label);
+			      snprintf (genstr, sizeof genstr, "B%1d:J%1d:", $7, break_label);
 			      generate (genstr);
 			      $<i_value>$ = continue_label;
 			      continue_label = next_label++;
-			      sprintf (genstr, "N%1d:", continue_label);
+			      snprintf (genstr, sizeof genstr, "N%1d:", continue_label);
 			      generate (genstr);
 			    }
 			  opt_expression ')'
@@ -226,14 +226,14 @@ statement 		: Warranty
 			      if ($10 > 1)
 				warn ("Comparison in third for expression");
 			      if ($10 < 0)
-				sprintf (genstr, "J%1d:N%1d:", $4, $7);
+				snprintf (genstr, sizeof genstr, "J%1d:N%1d:", $4, $7);
 			      else
-				sprintf (genstr, "pJ%1d:N%1d:", $4, $7);
+				snprintf (genstr, sizeof genstr, "pJ%1d:N%1d:", $4, $7);
 			      generate (genstr);
 			    }
 			  opt_newline statement
 			    {
-			      sprintf (genstr, "J%1d:N%1d:",
+			      snprintf (genstr, sizeof genstr, "J%1d:N%1d:",
 				       continue_label, break_label);
 			      generate (genstr);
 			      break_label = $1;
@@ -243,31 +243,31 @@ statement 		: Warranty
 			    {
 			      $3 = if_label;
 			      if_label = next_label++;
-			      sprintf (genstr, "Z%1d:", if_label);
+			      snprintf (genstr, sizeof genstr, "Z%1d:", if_label);
 			      generate (genstr);
 			    }
 			  opt_newline statement  opt_else
 			    {
-			      sprintf (genstr, "N%1d:", if_label); 
+			      snprintf (genstr, sizeof genstr, "N%1d:", if_label); 
 			      generate (genstr);
 			      if_label = $3;
 			    }
 			| While 
 			    {
 			      $1 = next_label++;
-			      sprintf (genstr, "N%1d:", $1);
+			      snprintf (genstr, sizeof genstr, "N%1d:", $1);
 			      generate (genstr);
 			    }
 			'(' expression 
 			    {
 			      $4 = break_label; 
 			      break_label = next_label++;
-			      sprintf (genstr, "Z%1d:", break_label);
+			      snprintf (genstr, sizeof genstr, "Z%1d:", break_label);
 			      generate (genstr);
 			    }
 			')' opt_newline statement
 			    {
-			      sprintf (genstr, "J%1d:N%1d:", $1, break_label);
+			      snprintf (genstr, sizeof genstr, "J%1d:N%1d:", $1, break_label);
 			      generate (genstr);
 			      break_label = $4;
 			    }
@@ -294,7 +294,7 @@ opt_else		: /* nothing */
 			    {
 			      warn ("else clause in if statement");
 			      $1 = next_label++;
-			      sprintf (genstr, "J%d:N%1d:", $1, if_label); 
+			      snprintf (genstr, sizeof genstr, "J%d:N%1d:", $1, if_label); 
 			      generate (genstr);
 			      if_label = $1;
 			    }
@@ -304,7 +304,7 @@ function 		: Define NAME '(' opt_parameter_list ')' opt_newline
 			    {
 			      /* Check auto list against parameter list? */
 			      check_params ($4,$9);
-			      sprintf (genstr, "F%d,%s.%s[",
+			      snprintf (genstr, sizeof genstr, "F%d,%s.%s[",
 				       lookup($2,FUNCTDEF), 
 				       arg_str ($4), arg_str ($9));
 			      generate (genstr);
@@ -354,7 +354,7 @@ argument_list 		: expression
 			    }
 			| NAME '[' ']'
 			    {
-			      sprintf (genstr, "K%d:", -lookup ($1,ARRAY));
+			      snprintf (genstr, sizeof genstr, "K%d:", -lookup ($1,ARRAY));
 			      generate (genstr);
 			      $$ = nextarg (NULL,1,FALSE);
 			    }
@@ -365,7 +365,7 @@ argument_list 		: expression
 			    }
 			| argument_list ',' NAME '[' ']'
 			    {
-			      sprintf (genstr, "K%d:", -lookup ($3,ARRAY));
+			      snprintf (genstr, sizeof genstr, "K%d:", -lookup ($3,ARRAY));
 			      generate (genstr);
 			      $$ = nextarg ($1,1,FALSE);
 			    }
@@ -393,9 +393,9 @@ expression		:  named_expression ASSIGN_OP
 			      if ($2 != '=')
 				{
 				  if ($1 < 0)
-				    sprintf (genstr, "DL%d:", -$1);
+				    snprintf (genstr, sizeof genstr, "DL%d:", -$1);
 				  else
-				    sprintf (genstr, "l%d:", $1);
+				    snprintf (genstr, sizeof genstr, "l%d:", $1);
 				  generate (genstr);
 				}
 			    }
@@ -404,13 +404,13 @@ expression		:  named_expression ASSIGN_OP
 			      if ($4 > 1) warn("comparison in assignment");
 			      if ($2 != '=')
 				{
-				  sprintf (genstr, "%c", $2);
+				  snprintf (genstr, sizeof genstr, "%c", $2);
 				  generate (genstr);
 				}
 			      if ($1 < 0)
-				sprintf (genstr, "S%d:", -$1);
+				snprintf (genstr, sizeof genstr, "S%d:", -$1);
 			      else
-				sprintf (genstr, "s%d:", $1);
+				snprintf (genstr, sizeof genstr, "s%d:", $1);
 			      generate (genstr);
 			      $$ = 0;
 			    }
@@ -419,12 +419,12 @@ expression		:  named_expression ASSIGN_OP
 			    {
 			      warn("&& operator");
 			      $2 = next_label++;
-			      sprintf (genstr, "DZ%d:p", $2);
+			      snprintf (genstr, sizeof genstr, "DZ%d:p", $2);
 			      generate (genstr);
 			    }
 			  expression
 			    {
-			      sprintf (genstr, "DZ%d:p1N%d:", $2, $2);
+			      snprintf (genstr, sizeof genstr, "DZ%d:p1N%d:", $2, $2);
 			      generate (genstr);
 			      $$ = $1 | $4;
 			    }
@@ -432,14 +432,14 @@ expression		:  named_expression ASSIGN_OP
 			    {
 			      warn("|| operator");
 			      $2 = next_label++;
-			      sprintf (genstr, "B%d:", $2);
+			      snprintf (genstr, sizeof genstr, "B%d:", $2);
 			      generate (genstr);
 			    }
 			  expression
  			    {
 			      int tmplab;
 			      tmplab = next_label++;
-			      sprintf (genstr, "B%d:0J%d:N%d:1N%d:",
+			      snprintf (genstr, sizeof genstr, "B%d:0J%d:N%d:1N%d:",
 				       $2, tmplab, $2, tmplab);
 			      generate (genstr);
 			      $$ = $1 | $4;
@@ -517,9 +517,9 @@ expression		:  named_expression ASSIGN_OP
 			    {
 			      $$ = 1;
 			      if ($1 < 0)
-				sprintf (genstr, "L%d:", -$1);
+				snprintf (genstr, sizeof genstr, "L%d:", -$1);
 			      else
-				sprintf (genstr, "l%d:", $1);
+				snprintf (genstr, sizeof genstr, "l%d:", $1);
 			      generate (genstr);
 			    }
 			| NUMBER
@@ -545,14 +545,14 @@ expression		:  named_expression ASSIGN_OP
 			      $$ = 1;
 			      if ($3 != NULL)
 				{ 
-				  sprintf (genstr, "C%d,%s:",
+				  snprintf (genstr, sizeof genstr, "C%d,%s:",
 					   lookup ($1,FUNCT),
 					   call_str ($3));
 				  free_args ($3);
 				}
 			      else
 				{
-				  sprintf (genstr, "C%d:", lookup ($1,FUNCT));
+				  snprintf (genstr, sizeof genstr, "C%d:", lookup ($1,FUNCT));
 				}
 			      generate (genstr);
 			    }
@@ -562,16 +562,16 @@ expression		:  named_expression ASSIGN_OP
 			      if ($2 < 0)
 				{
 				  if ($1 == '+')
-				    sprintf (genstr, "DA%d:L%d:", -$2, -$2);
+				    snprintf (genstr, sizeof genstr, "DA%d:L%d:", -$2, -$2);
 				  else
-				    sprintf (genstr, "DM%d:L%d:", -$2, -$2);
+				    snprintf (genstr, sizeof genstr, "DM%d:L%d:", -$2, -$2);
 				}
 			      else
 				{
 				  if ($1 == '+')
-				    sprintf (genstr, "i%d:l%d:", $2, $2);
+				    snprintf (genstr, sizeof genstr, "i%d:l%d:", $2, $2);
 				  else
-				    sprintf (genstr, "d%d:l%d:", $2, $2);
+				    snprintf (genstr, sizeof genstr, "d%d:l%d:", $2, $2);
 				}
 			      generate (genstr);
 			    }
@@ -580,21 +580,21 @@ expression		:  named_expression ASSIGN_OP
 			      $$ = 1;
 			      if ($1 < 0)
 				{
-				  sprintf (genstr, "DL%d:x", -$1);
+				  snprintf (genstr, sizeof genstr, "DL%d:x", -$1);
 				  generate (genstr); 
 				  if ($2 == '+')
-				    sprintf (genstr, "A%d:", -$1);
+				    snprintf (genstr, sizeof genstr, "A%d:", -$1);
 				  else
-				      sprintf (genstr, "M%d:", -$1);
+				      snprintf (genstr, sizeof genstr, "M%d:", -$1);
 				}
 			      else
 				{
-				  sprintf (genstr, "l%d:", $1);
+				  snprintf (genstr, sizeof genstr, "l%d:", $1);
 				  generate (genstr);
 				  if ($2 == '+')
-				    sprintf (genstr, "i%d:", $1);
+				    snprintf (genstr, sizeof genstr, "i%d:", $1);
 				  else
-				    sprintf (genstr, "d%d:", $1);
+				    snprintf (genstr, sizeof genstr, "d%d:", $1);
 				}
 			      generate (genstr);
 			    }
diff --git a/gnu/usr.bin/bc/bc/sbc.y b/gnu/usr.bin/bc/bc/sbc.y
index 9e1bd339ead..968c35d46d2 100644
--- a/gnu/usr.bin/bc/bc/sbc.y
+++ b/gnu/usr.bin/bc/bc/sbc.y
@@ -138,7 +138,7 @@ statement 		: Warranty
 				yyerror ("Break outside a for/while");
 			      else
 				{
-				  sprintf (genstr, "J%1d:", break_label);
+				  snprintf (genstr, sizeof genstr, "J%1d:", break_label);
 				  generate (genstr);
 				}
 			    }
@@ -156,26 +156,26 @@ statement 		: Warranty
 			  '(' expression ';'
 			    {
 			      $4 = next_label++;
-			      sprintf (genstr, "pN%1d:", $4);
+			      snprintf (genstr, sizeof genstr, "pN%1d:", $4);
 			      generate (genstr);
 			    }
 			  relational_expression ';'
 			    {
 			      $7 = next_label++;
-			      sprintf (genstr, "B%1d:J%1d:", $7, break_label);
+			      snprintf (genstr, sizeof genstr, "B%1d:J%1d:", $7, break_label);
 			      generate (genstr);
 			      $<i_value>$ = next_label++;
-			      sprintf (genstr, "N%1d:", $<i_value>$);
+			      snprintf (genstr, sizeof genstr, "N%1d:", $<i_value>$);
 			      generate (genstr);
 			    }
 			  expression ')'
 			    {
-			      sprintf (genstr, "pJ%1d:N%1d:", $4, $7);
+			      snprintf (genstr, sizeof genstr, "pJ%1d:N%1d:", $4, $7);
 			      generate (genstr);
 			    }
 			  statement
 			    {
-			      sprintf (genstr, "J%1d:N%1d:", $<i_value>9,
+			      snprintf (genstr, sizeof genstr, "J%1d:N%1d:", $<i_value>9,
 				       break_label);
 			      generate (genstr);
 			      break_label = $1;
@@ -183,30 +183,30 @@ statement 		: Warranty
 			| If '(' relational_expression ')' 
 			    {
 			      $3 = next_label++;
-			      sprintf (genstr, "Z%1d:", $3);
+			      snprintf (genstr, sizeof genstr, "Z%1d:", $3);
 			      generate (genstr);
 			    }
 			  statement
 			    {
-			      sprintf (genstr, "N%1d:", $3); 
+			      snprintf (genstr, sizeof genstr, "N%1d:", $3); 
 			      generate (genstr);
 			    }
 			| While 
 			    {
 			      $1 = next_label++;
-			      sprintf (genstr, "N%1d:", $1);
+			      snprintf (genstr, sizeof genstr, "N%1d:", $1);
 			      generate (genstr);
 			    }
 			'(' relational_expression 
 			    {
 			      $4 = break_label; 
 			      break_label = next_label++;
-			      sprintf (genstr, "Z%1d:", break_label);
+			      snprintf (genstr, sizeof genstr, "Z%1d:", break_label);
 			      generate (genstr);
 			    }
 			')' statement
 			    {
-			      sprintf (genstr, "J%1d:N%1d:", $1, break_label);
+			      snprintf (genstr, sizeof genstr, "J%1d:N%1d:", $1, break_label);
 			      generate (genstr);
 			      break_label = $4;
 			    }
@@ -217,7 +217,7 @@ function 		: Define NAME '(' opt_parameter_list ')' '{'
        			  NEWLINE opt_auto_define_list 
 			    {
 			      check_params ($4,$8);
-			      sprintf (genstr, "F%d,%s.%s[", lookup($2,FUNCT),
+			      snprintf (genstr, sizeof genstr, "F%d,%s.%s[", lookup($2,FUNCT),
 				       arg_str ($4), arg_str ($8));
 			      generate (genstr);
 			      free_args ($4);
@@ -305,9 +305,9 @@ expression		: named_expression ASSIGN_OP
 			      if ($2 != '=')
 				{
 				  if ($1 < 0)
-				    sprintf (genstr, "DL%d:", -$1);
+				    snprintf (genstr, sizeof genstr, "DL%d:", -$1);
 				  else
-				    sprintf (genstr, "l%d:", $1);
+				    snprintf (genstr, sizeof genstr, "l%d:", $1);
 				  generate (genstr);
 				}
 			    }
@@ -316,13 +316,13 @@ expression		: named_expression ASSIGN_OP
 			      $$ = 0;
 			      if ($2 != '=')
 				{
-				  sprintf (genstr, "%c", $2);
+				  snprintf (genstr, sizeof genstr, "%c", $2);
 				  generate (genstr);
 				}
 			      if ($1 < 0)
-				sprintf (genstr, "S%d:", -$1);
+				snprintf (genstr, sizeof genstr, "S%d:", -$1);
 			      else
-				sprintf (genstr, "s%d:", $1);
+				snprintf (genstr, sizeof genstr, "s%d:", $1);
 			      generate (genstr);
 			    }
 			| expression '+' expression
@@ -343,9 +343,9 @@ expression		: named_expression ASSIGN_OP
 			    {
 			      $$ = 1;
 			      if ($1 < 0)
-				sprintf (genstr, "L%d:", -$1);
+				snprintf (genstr, sizeof genstr, "L%d:", -$1);
 			      else
-				sprintf (genstr, "l%d:", $1);
+				snprintf (genstr, sizeof genstr, "l%d:", $1);
 			      generate (genstr);
 			    }
 			| NUMBER
@@ -374,12 +374,12 @@ expression		: named_expression ASSIGN_OP
 			      $$ = 1;
 			      if ($3 != NULL)
 				{ 
-				  sprintf (genstr, "C%d,%s:", lookup($1,FUNCT),
+				  snprintf (genstr, sizeof genstr, "C%d,%s:", lookup($1,FUNCT),
 					   arg_str ($3));
 				  free_args ($3);
 				}
 			      else
-				  sprintf (genstr, "C%d:", lookup($1,FUNCT));
+				  snprintf (genstr, sizeof genstr, "C%d:", lookup($1,FUNCT));
 			      generate (genstr);
 			    }
 			| INCR_DECR named_expression
@@ -388,16 +388,16 @@ expression		: named_expression ASSIGN_OP
 			      if ($2 < 0)
 				{
 				  if ($1 == '+')
-				    sprintf (genstr, "DA%d:L%d:", -$2, -$2);
+				    snprintf (genstr, sizeof genstr, "DA%d:L%d:", -$2, -$2);
 				  else
-				    sprintf (genstr, "DM%d:L%d:", -$2, -$2);
+				    snprintf (genstr, sizeof genstr, "DM%d:L%d:", -$2, -$2);
 				}
 			      else
 				{
 				  if ($1 == '+')
-				    sprintf (genstr, "i%d:l%d:", $2, $2);
+				    snprintf (genstr, sizeof genstr, "i%d:l%d:", $2, $2);
 				  else
-				    sprintf (genstr, "d%d:l%d:", $2, $2);
+				    snprintf (genstr, sizeof genstr, "d%d:l%d:", $2, $2);
 				}
 			      generate (genstr);
 			    }
@@ -406,21 +406,21 @@ expression		: named_expression ASSIGN_OP
 			      $$ = 1;
 			      if ($1 < 0)
 				{
-				  sprintf (genstr, "DL%d:x", -$1);
+				  snprintf (genstr, sizeof genstr, "DL%d:x", -$1);
 				  generate (genstr); 
 				  if ($2 == '+')
-				    sprintf (genstr, "A%d:", -$1);
+				    snprintf (genstr, sizeof genstr, "A%d:", -$1);
 				  else
-				    sprintf (genstr, "M%d:", -$1);
+				    snprintf (genstr, sizeof genstr, "M%d:", -$1);
 				}
 			      else
 				{
-				  sprintf (genstr, "l%d:", $1);
+				  snprintf (genstr, sizeof genstr, "l%d:", $1);
 				  generate (genstr);
 				  if ($2 == '+')
-				    sprintf (genstr, "i%d:", $1);
+				    snprintf (genstr, sizeof genstr, "i%d:", $1);
 				  else
-				    sprintf (genstr, "d%d:", $1);
+				    snprintf (genstr, sizeof genstr, "d%d:", $1);
 				}
 			      generate (genstr);
 			    }
diff --git a/gnu/usr.bin/bc/bc/util.c b/gnu/usr.bin/bc/bc/util.c
index 514df266a14..c2cce26c8fe 100644
--- a/gnu/usr.bin/bc/bc/util.c
+++ b/gnu/usr.bin/bc/bc/util.c
@@ -45,9 +45,12 @@ strcopyof (str)
      char *str;
 {
   char *temp;
+  size_t len;
 
-  temp = (char *) bc_malloc (strlen (str)+1);
-  return (strcpy (temp,str));
+  len = strlen (str)+1;
+  temp = (char *) bc_malloc (len);
+  strlcpy (temp,str,len);
+  return (temp);
 }
 
 
@@ -91,13 +94,18 @@ make_arg_str (args, len)
 {
   char *temp;
   char sval[20];
+  size_t l;
 
   /* Recursive call. */
   if (args != NULL)
-    temp = make_arg_str (args->next, len+12);
+    {
+      l = len+12;
+      temp = make_arg_str (args->next, l);
+    }
   else
     {
-      temp = (char *) bc_malloc (len);
+      l = len;
+      temp = (char *) bc_malloc (l);
       *temp = 0;
       return temp;
     }
@@ -105,15 +113,15 @@ make_arg_str (args, len)
   /* Add the current number to the end of the string. */
   if (args->arg_is_var)
     if (len != 1) 
-      sprintf (sval, "*%d,", args->av_name);
+      snprintf (sval, sizeof sval, "*%d,", args->av_name);
     else
-      sprintf (sval, "*%d", args->av_name);
+      snprintf (sval, sizeof sval, "*%d", args->av_name);
   else
     if (len != 1) 
-      sprintf (sval, "%d,", args->av_name);
+      snprintf (sval, sizeof sval, "%d,", args->av_name);
     else
-      sprintf (sval, "%d", args->av_name);
-  temp = strcat (temp, sval);
+      snprintf (sval, sizeof sval, "%d", args->av_name);
+  strlcat (temp, sval, l);
   return (temp);
 }
 
@@ -815,7 +823,7 @@ rt_error (mesg, va_alist)
 #else
   va_start (args);
 #endif
-  vsprintf (error_mesg, mesg, args);
+  vsnprintf (error_mesg, sizeof error_mesg, mesg, args);
   va_end (args);
   
   fprintf (stderr, "Runtime error (func=%s, adr=%d): %s\n",
@@ -851,7 +859,7 @@ rt_warn (mesg, va_alist)
 #else
   va_start (args);
 #endif
-  vsprintf (error_mesg, mesg, args);
+  vsnprintf (error_mesg, sizeof error_mesg, mesg, args);
   va_end (args);
 
   fprintf (stderr, "Runtime warning (func=%s, adr=%d): %s\n",
diff --git a/gnu/usr.bin/bc/dc/numeric.c b/gnu/usr.bin/bc/dc/numeric.c
index d5abf13a0d5..442bf660a51 100644
--- a/gnu/usr.bin/bc/dc/numeric.c
+++ b/gnu/usr.bin/bc/dc/numeric.c
@@ -554,7 +554,7 @@ rt_error (mesg, va_alist)
 #else
   va_start (args);
 #endif
-  vsprintf (error_mesg, mesg, args);
+  vsnprintf (error_mesg, sizeof error_mesg, mesg, args);
   va_end (args);
   
   fprintf (stderr, "Runtime error: %s\n", error_mesg);
@@ -588,7 +588,7 @@ rt_warn (mesg, va_alist)
 #else
   va_start (args);
 #endif
-  vsprintf (error_mesg, mesg, args);
+  vsnprintf (error_mesg, sizeof error_mesg, mesg, args);
   va_end (args);
 
   fprintf (stderr, "Runtime warning: %s\n", error_mesg);
diff --git a/gnu/usr.bin/bc/lib/number.c b/gnu/usr.bin/bc/lib/number.c
index 469d44c8b19..33f5b374523 100644
--- a/gnu/usr.bin/bc/lib/number.c
+++ b/gnu/usr.bin/bc/lib/number.c
@@ -1291,7 +1291,7 @@ out_long (val, size, space, out_char)
   int len, ix;
 
   if (space) (*out_char) (' ');
-  sprintf (digits, "%ld", val);
+  snprintf (digits, sizeof digits, "%ld", val);
   len = strlen (digits);
   while (size > len)
     {