string cleaning; parts by me, then parts by hin, then more parts by me.

since this is not a very important part of the source tree, and since it
does compile, i am dumping it in now.

25 files changed, 88 insertions, 80 deletions

diff --git a/kerberosIV/src/lib/krb/get_krbrlm.c b/kerberosIV/src/lib/krb/get_krbrlm.c
index c722b740221..2ba809b617d 100644
--- a/kerberosIV/src/lib/krb/get_krbrlm.c
+++ b/kerberosIV/src/lib/krb/get_krbrlm.c
@@ -115,7 +115,7 @@ krb_get_lrealm(char *r, int n)
       if (strcmp(t, no_default_realm) == 0)
 	return KFAILURE;	/* Can't figure out default realm */
 
-      strcpy(r, t);
+      strlcpy(r, t, REALM_SZ);
       return KSUCCESS;
     }
     else
diff --git a/kerberosIV/src/lib/krb/kntoln.c b/kerberosIV/src/lib/krb/kntoln.c
index c1af718c666..8843204abb0 100644
--- a/kerberosIV/src/lib/krb/kntoln.c
+++ b/kerberosIV/src/lib/krb/kntoln.c
@@ -61,7 +61,7 @@ krb_kntoln(AUTH_DAT *ad, char *lname)
         return(KFAILURE);
     if (strcmp(ad->prealm, lrealm))
         return(KFAILURE);
-    strcpy(lname, ad->pname);
+    strlcpy(lname, ad->pname, sizeof lname);
     return(KSUCCESS);
 }
 
@@ -124,22 +124,22 @@ an_to_ln(AUTH_DAT *ad, char *lname)
 	    return(KFAILURE);
 	}
 	/* Got it! */
-	strcpy(lname,val.dptr);
+	strlcpy(lname,val.dptr, REALM_SZ);
 	return(KSUCCESS);
-    } else strcpy(lname,ad->pname);
+    } else strlcpy(lname, ad->pname, REALM_SZ);
     return(KSUCCESS);
 }
 
 void
 an_to_a(AUTH_DAT *ad, char *str)
 {
-    strcpy(str, ad->pname);
+    strlcpy(str, ad->pname, ANAME_SZ+INST_SZ+REALM_SZ+2);
     if(*ad->pinst) {
-	strcat(str, ".");
-	strcat(str, ad->pinst);
+	strlcat(str, ".", ANAME_SZ+INST_SZ+REALM_SZ+2);
+	strlcat(str, ad->pinst, ANAME_SZ+INST_SZ+REALM_SZ+2);
     }
-    strcat(str, "@");
-    strcat(str, ad->prealm);
+    strlcat(str, "@", ANAME_SZ+INST_SZ+REALM_SZ+2);
+    strlcat(str, ad->prealm, ANAME_SZ+INST_SZ+REALM_SZ+2);
 }
 
 /*
@@ -150,15 +150,17 @@ an_to_a(AUTH_DAT *ad, char *str)
 int
 a_to_an(char *str, AUTH_DAT *ad)
 {
-    char *buf = (char *)malloc(strlen(str)+1);
+    char *buf;
     char *rlm, *inst, *princ;
+    size_t len = strlen(str) + 1;
 
+    buf = (char *)malloc(len);
     if(!(*lrealm) && (krb_get_lrealm(lrealm,1) == KFAILURE)) {
 	free(buf);
 	return(KFAILURE);
     }
     /* destructive string hacking is more fun.. */
-    strcpy(buf, str);
+    strlcpy(buf, str, len);
 
     if (rlm = index(buf, '@')) {
 	*rlm++ = '\0';
@@ -166,11 +168,15 @@ a_to_an(char *str, AUTH_DAT *ad)
     if (inst = index(buf, '.')) {
 	*inst++ = '\0';
     }
-    strcpy(ad->pname, buf);
-    if(inst) strcpy(ad->pinst, inst);
-    else *ad->pinst = '\0';
-    if (rlm) strcpy(ad->prealm, rlm);
-    else strcpy(ad->prealm, lrealm);
+    strlcpy(ad->pname, buf, sizeof ad->pname);
+    if(inst)
+	strlcpy(ad->pinst, inst, sizeof ad->pinst);
+    else
+	*ad->pinst = '\0';
+    if (rlm)
+	strlcpy(ad->prealm, rlm, sizeof ad->prealm);
+    else
+	strlcpy(ad->prealm, lrealm, sizeof ad->prealm);
     free(buf);
     return(KSUCCESS);
 }
diff --git a/kerberosIV/src/lib/krb/unparse_name.c b/kerberosIV/src/lib/krb/unparse_name.c
index 3ca4f30b45b..079373a8a21 100644
--- a/kerberosIV/src/lib/krb/unparse_name.c
+++ b/kerberosIV/src/lib/krb/unparse_name.c
@@ -54,11 +54,11 @@ krb_unparse_name_r(krb_principal *pr, char *fullname)
 {
     quote_string("'@\\", pr->name, fullname);
     if(pr->instance[0]){
-	strcat(fullname, ".");
+	strlcat(fullname, ".", MAX_K_NAME_SZ);
 	quote_string("@\\", pr->instance, fullname + strlen(fullname));
     }
     if(pr->realm[0]){
-	strcat(fullname, "@");
+	strlcat(fullname, "@", MAX_K_NAME_SZ);
 	quote_string("\\", pr->realm, fullname + strlen(fullname));
     }
     return fullname;
diff --git a/kerberosV/src/appl/kf/kfd.c b/kerberosV/src/appl/kf/kfd.c
index d644c2566a7..dea7c5c3aa1 100644
--- a/kerberosV/src/appl/kf/kfd.c
+++ b/kerberosV/src/appl/kf/kfd.c
@@ -280,10 +280,10 @@ proto (int sock, const char *service)
 		    (char *)(remotename.data),ccname);
 out:
     if (status) {
-	strcpy(ret_string, "no");
+	strlcpy(ret_string, "no", sizeof ret_string);
 	syslog_and_cont("failed");
     } else  {
-	strcpy(ret_string, "ok");
+	strlcpy(ret_string, "ok", sizeof ret_string);
     }
 
     krb5_data_free (&tk_file);
diff --git a/kerberosV/src/include/bits.c b/kerberosV/src/include/bits.c
index ee747c6cebf..06f0b23b93e 100644
--- a/kerberosV/src/include/bits.c
+++ b/kerberosV/src/include/bits.c
@@ -47,8 +47,8 @@ RCSID("$KTH: bits.c,v 1.18 2000/08/27 05:42:46 assar Exp $");
     while(x){ x <<= 1; b++; if(x < zero) pre=""; }		\
     if(b >= len){						\
         int tabs;						\
-	sprintf(tmp, "%sint%d_t" , pre, len);			\
-	sprintf(tmp2, "typedef %s %s;", #TYPE, tmp);		\
+	snprintf(tmp, sizeof tmp, "%sint%d_t" , pre, len);	\
+	snprintf(tmp2, sizeof tmp2, "typedef %s %s;", #TYPE, tmp);	\
 	tabs = 5 - strlen(tmp2) / 8;				\
         fprintf(f, "%s", tmp2);					\
 	while(tabs-- > 0) fprintf(f, "\t");			\
@@ -121,8 +121,7 @@ int main(int argc, char **argv)
     } else {
 	char *p;
 	fn = argv[1];
-	hb = malloc(strlen(fn) + 5);
-	sprintf(hb, "__%s__", fn);
+	asprintf(&hb, "__%s__", fn);
 	for(p = hb; *p; p++){
 	    if(!isalnum((unsigned char)*p))
 		*p = '_';
diff --git a/kerberosV/src/kdc/hpropd.c b/kerberosV/src/kdc/hpropd.c
index bc2d7d98235..3c4c3ae50c3 100644
--- a/kerberosV/src/kdc/hpropd.c
+++ b/kerberosV/src/kdc/hpropd.c
@@ -87,11 +87,11 @@ dump_krb4(krb5_context context, hdb_entry *ent, int fd)
 
     if (ent->max_life) { 
 	asprintf(&p, "%d", krb_time_to_life(0, *ent->max_life));
-	strcat(buf, p);
+	strlcat(buf, p, sizeof(buf));
 	free(p);
     } else 
-	strcat(buf, "255"); 
-    strcat(buf, " ");
+	strlcat(buf, "255", sizeof(buf)); 
+    strlcat(buf, " ", sizeof(buf));
 
     i = 0;
     while (i < ent->keys.len &&
@@ -107,15 +107,15 @@ dump_krb4(krb5_context context, hdb_entry *ent, int fd)
 	asprintf(&p, "%d ", *ent->keys.val[i].mkvno);
     else
 	asprintf(&p, "%d ", 1);
-    strcat(buf, p);
+    strlcat(buf, p, sizeof(buf));
     free(p);
 
     asprintf(&p, "%d ", ent->kvno);
-    strcat(buf, p);
+    strlcat(buf, p, sizeof(buf));
     free(p);
 
     asprintf(&p, "%d ", 0); /* Attributes are always 0*/  
-    strcat(buf, p);
+    strlcat(buf, p, sizeof(buf));
     free(p);
 
     { 
@@ -123,15 +123,15 @@ dump_krb4(krb5_context context, hdb_entry *ent, int fd)
 	kdb_encrypt_key((des_cblock*)key, (des_cblock*)key,
 			&mkey4, msched4, DES_ENCRYPT);
 	asprintf(&p, "%x %x ", (int)htonl(*key), (int)htonl(*(key+1)));
-	strcat(buf, p);
+	strlcat(buf, p, sizeof(buf));
 	free(p);
     }
  
     if (ent->valid_end == NULL)
-	strcat(buf, time2str(60*60*24*365*50)); /* no expiration */
+	strlcat(buf, time2str(60*60*24*365*50), sizeof(buf)); /* no expiration */
     else
-	strcat(buf, time2str(*ent->valid_end));
-    strcat(buf, " ");
+	strlcat(buf, time2str(*ent->valid_end), sizeof(buf));
+    strlcat(buf, " ", sizeof(buf));
 
     if (ent->modified_by == NULL) 
 	modifier = &ent->created_by;
@@ -149,7 +149,7 @@ dump_krb4(krb5_context context, hdb_entry *ent, int fd)
     asprintf(&p, "%s %s %s\n", time2str(modifier->time), 
 	     (strlen(name) != 0) ? name : "*", 
 	     (strlen(instance) != 0) ? instance : "*");
-    strcat(buf, p);
+    strlcat(buf, p, sizeof(buf));
     free(p);
 
     ret = write(fd, buf, strlen(buf));
diff --git a/kerberosV/src/lib/asn1/der_copy.c b/kerberosV/src/lib/asn1/der_copy.c
index b6a61eaeca2..e00c3e89868 100644
--- a/kerberosV/src/lib/asn1/der_copy.c
+++ b/kerberosV/src/lib/asn1/der_copy.c
@@ -38,10 +38,8 @@ RCSID("$KTH: der_copy.c,v 1.8 1999/12/02 17:05:01 joda Exp $");
 int
 copy_general_string (const general_string *from, general_string *to)
 {
-    *to = malloc(strlen(*from) + 1);
-    if(*to == NULL)
+    if ((*to = strdup(*from)) == NULL)
 	return ENOMEM;
-    strcpy(*to, *from);
     return 0;
 }
 
diff --git a/kerberosV/src/lib/asn1/der_put.c b/kerberosV/src/lib/asn1/der_put.c
index 600e18ecbf2..a6f935d56dd 100644
--- a/kerberosV/src/lib/asn1/der_put.c
+++ b/kerberosV/src/lib/asn1/der_put.c
@@ -303,7 +303,7 @@ time2generalizedtime (time_t t, octet_string *s)
 	 return ENOMEM;
      s->length = 15;
      tm = gmtime (&t);
-     sprintf (s->data, "%04d%02d%02d%02d%02d%02dZ", tm->tm_year + 1900,
+     snprintf (s->data, 16, "%04d%02d%02d%02d%02d%02dZ", tm->tm_year + 1900,
 	      tm->tm_mon + 1, tm->tm_mday, tm->tm_hour, tm->tm_min,
 	      tm->tm_sec);
      return 0;
diff --git a/kerberosV/src/lib/asn1/gen.c b/kerberosV/src/lib/asn1/gen.c
index 9dc5fadf49f..9d7cb07bd20 100644
--- a/kerberosV/src/lib/asn1/gen.c
+++ b/kerberosV/src/lib/asn1/gen.c
@@ -54,8 +54,8 @@ init_generate (const char *filename, const char *base)
 {
     orig_filename = filename;
     if(base)
-	strcpy(headerbase, base);
-    sprintf(header, "%s.h", headerbase);
+	strlcpy(headerbase, base, sizeof(headerbase));
+    snprintf(header, sizeof(header), "%s.h", headerbase);
     headerfile = fopen (header, "w");
     if (headerfile == NULL)
 	err (1, "open %s", header);
diff --git a/kerberosV/src/lib/com_err/com_err.c b/kerberosV/src/lib/com_err/com_err.c
index 5b2c1719279..5e44fc043fe 100644
--- a/kerberosV/src/lib/com_err/com_err.c
+++ b/kerberosV/src/lib/com_err/com_err.c
@@ -55,7 +55,7 @@ error_message (long code)
 	strncpy(msg, p, sizeof(msg) - 1);
 	msg[sizeof(msg) - 1] = 0;
     } else 
-	sprintf(msg, "Unknown error %ld", code);
+	snprintf(msg, sizeof msg, "Unknown error %ld", code);
     return msg;
 }
 
diff --git a/kerberosV/src/lib/com_err/parse.y b/kerberosV/src/lib/com_err/parse.y
index 379569c0884..78b50ff77f5 100644
--- a/kerberosV/src/lib/com_err/parse.y
+++ b/kerberosV/src/lib/com_err/parse.y
@@ -102,9 +102,7 @@ statement	: INDEX NUMBER
 		}
 		| PREFIX STRING
 		{
-		    prefix = realloc(prefix, strlen($2) + 2);
-		    strcpy(prefix, $2);
-		    strcat(prefix, "_");
+		    asprintf(&prefix, "%s_", $2);
 		    free($2);
 		}
 		| PREFIX
diff --git a/kerberosV/src/lib/des/ecb_enc.c b/kerberosV/src/lib/des/ecb_enc.c
index 5fcaf192898..257182c85bc 100644
--- a/kerberosV/src/lib/des/ecb_enc.c
+++ b/kerberosV/src/lib/des/ecb_enc.c
@@ -96,7 +96,7 @@ char *des_options()
 			size="int";
 		else
 			size="long";
-		sprintf(buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,size);
+		snprintf(buf,sizeof buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,size);
 		}
 	return(buf);
 	}
diff --git a/kerberosV/src/lib/kadm5/dump_log.c b/kerberosV/src/lib/kadm5/dump_log.c
index ab1bc4f4f6b..72f7f20e08e 100644
--- a/kerberosV/src/lib/kadm5/dump_log.c
+++ b/kerberosV/src/lib/kadm5/dump_log.c
@@ -124,7 +124,7 @@ print_entry(kadm5_server_context *server_context,
 	}
 	if(mask & KADM5_PRINC_EXPIRE_TIME) {
 	    if(ent.valid_end == NULL) {
-		strcpy(t, "never");
+		strlcpy(t, "never", sizeof(t));
 	    } else {
 		strftime(t, sizeof(t), "%Y-%m-%d %H:%M:%S", 
 			 localtime(ent.valid_end));
@@ -133,7 +133,7 @@ print_entry(kadm5_server_context *server_context,
 	}
 	if(mask & KADM5_PW_EXPIRATION) {
 	    if(ent.pw_end == NULL) {
-		strcpy(t, "never");
+		strlcpy(t, "never", sizeof(t));
 	    } else {
 		strftime(t, sizeof(t), "%Y-%m-%d %H:%M:%S", 
 			 localtime(ent.pw_end));
@@ -149,14 +149,14 @@ print_entry(kadm5_server_context *server_context,
 	}
 	if(mask & KADM5_MAX_LIFE) {
 	    if(ent.max_life == NULL)
-		strcpy(t, "for ever");
+		strlcpy(t, "for ever", sizeof(t));
 	    else
 		unparse_time(*ent.max_life, t, sizeof(t));
 	    printf("    max life = %s\n", t);
 	}
 	if(mask & KADM5_MAX_RLIFE) {
 	    if(ent.max_renew == NULL)
-		strcpy(t, "for ever");
+		strlcpy(t, "for ever", sizeof(t));
 	    else
 		unparse_time(*ent.max_renew, t, sizeof(t));
 	    printf("    max rlife = %s\n", t);
diff --git a/kerberosV/src/lib/krb5/aname_to_localname.c b/kerberosV/src/lib/krb5/aname_to_localname.c
index a21430c10bc..290db36e488 100644
--- a/kerberosV/src/lib/krb5/aname_to_localname.c
+++ b/kerberosV/src/lib/krb5/aname_to_localname.c
@@ -71,6 +71,6 @@ krb5_aname_to_localname (krb5_context context,
     len = strlen (res);
     if (len >= lnsize)
 	return ERANGE;
-    strcpy (lname, res);
+    strlcpy (lname, res, lnsize);
     return 0;
 }
diff --git a/kerberosV/src/lib/krb5/krbhst.c b/kerberosV/src/lib/krb5/krbhst.c
index 7ff69e28c53..4787a4768e5 100644
--- a/kerberosV/src/lib/krb5/krbhst.c
+++ b/kerberosV/src/lib/krb5/krbhst.c
@@ -104,7 +104,10 @@ srv_find_realm(krb5_context context, krb5_krbhst_info ***res, int *count,
     for(num_srv = 0, rr = r->head; rr; rr = rr->next) 
 	if(rr->type == T_SRV) {
 	    krb5_krbhst_info *hi;
-	    hi = calloc(1, sizeof(*hi) + strlen(rr->u.srv->target));
+	    size_t len;
+
+	    len = strlen(rr->u.srv->target);
+	    hi = calloc(1, sizeof(*hi) + len);
 	    if(hi == NULL) {
 		dns_free_data(r);
 		while(--num_srv >= 0)
@@ -122,7 +125,7 @@ srv_find_realm(krb5_context context, krb5_krbhst_info ***res, int *count,
 	    else
 		hi->port = rr->u.srv->port;
 
-	    strcpy(hi->hostname, rr->u.srv->target);
+	    strlcpy(hi->hostname, rr->u.srv->target, len);
 	}
 
     *count = num_srv;
diff --git a/kerberosV/src/lib/krb5/transited.c b/kerberosV/src/lib/krb5/transited.c
index a8554323fc7..aae48a946c4 100644
--- a/kerberosV/src/lib/krb5/transited.c
+++ b/kerberosV/src/lib/krb5/transited.c
@@ -175,19 +175,21 @@ expand_realms(krb5_context context,
 		return ENOMEM;
 	    }
 	    r->realm = tmp;
-	    strcat(r->realm, prev_realm);
+	    strlcat(r->realm, prev_realm, 
+		    strlen(r->realm) + strlen(prev_realm) + 1);
 	}else if(r->leading_slash && !r->leading_space && prev_realm){
 	    /* yet another exception: if you use x500-names, the
                leading realm doesn't have to be "quoted" with a space */
+	    size_t len = strlen(r->realm) + strlen(prev_realm) + 1;
 	    char *tmp;
-	    tmp = malloc(strlen(r->realm) + strlen(prev_realm) + 1);
+	    tmp = malloc(len);
 	    if(tmp == NULL){
 		free_realms(realms);
 		krb5_set_error_string (context, "malloc: out of memory");
 		return ENOMEM;
 	    }
-	    strcpy(tmp, prev_realm);
-	    strcat(tmp, r->realm);
+	    strlcpy(tmp, prev_realm, len);
+	    strlcat(tmp, r->realm, len);
 	    free(r->realm);
 	    r->realm = tmp;
 	}
@@ -369,10 +371,10 @@ krb5_domain_x500_encode(char **realms, int num_realms, krb5_data *encoding)
     *s = '\0';
     for(i = 0; i < num_realms; i++){
 	if(i && i < num_realms - 1)
-	    strcat(s, ",");
+	    strlcat(s, ",", len+1);
 	if(realms[i][0] == '/')
-	    strcat(s, " ");
-	strcat(s, realms[i]);
+	    strlcat(s, " ", len+1);
+	strlcat(s, realms[i], len+1);
     }
     encoding->data = s;
     encoding->length = strlen(s);
diff --git a/kerberosV/src/lib/krb5/warn.c b/kerberosV/src/lib/krb5/warn.c
index fe79d967020..df270f0928f 100644
--- a/kerberosV/src/lib/krb5/warn.c
+++ b/kerberosV/src/lib/krb5/warn.c
@@ -52,9 +52,9 @@ _warnerr(krb5_context context, int do_errtext,
     args[0] = args[1] = NULL;
     arg = args;
     if(fmt){
-	strcat(xfmt, "%s");
+	strlcat(xfmt, "%s", sizeof(xfmt));
 	if(do_errtext)
-	    strcat(xfmt, ": ");
+	    strlcat(xfmt, ": ", sizeof(xfmt));
 	vasprintf(&msg, fmt, ap);
 	if(msg == NULL)
 	    return ENOMEM;
@@ -63,7 +63,7 @@ _warnerr(krb5_context context, int do_errtext,
     if(context && do_errtext){
 	const char *err_msg;
 
-	strcat(xfmt, "%s");
+	strlcat(xfmt, "%s", sizeof(xfmt));
 
 	err_str = krb5_get_error_string(context);
 	if (err_str != NULL) {
diff --git a/kerberosV/src/lib/otp/otp_challenge.c b/kerberosV/src/lib/otp/otp_challenge.c
index 791fac494a6..99a998207e4 100644
--- a/kerberosV/src/lib/otp/otp_challenge.c
+++ b/kerberosV/src/lib/otp/otp_challenge.c
@@ -51,7 +51,7 @@ otp_challenge (OtpContext *ctx, char *user, char *str, size_t len)
     ctx->err = "Out of memory";
     return -1;
   }
-  strcpy(ctx->user, user);
+  strlcpy(ctx->user, user, strlen(user)+1);
   dbm = otp_db_open ();
   if (dbm == NULL) {
     ctx->err = "Cannot open database";
diff --git a/kerberosV/src/lib/otp/otp_db.c b/kerberosV/src/lib/otp/otp_db.c
index 58b4eb2756f..0021ec5fcd0 100644
--- a/kerberosV/src/lib/otp/otp_db.c
+++ b/kerberosV/src/lib/otp/otp_db.c
@@ -195,7 +195,7 @@ otp_put (void *v, OtpContext *ctx)
 
   if (rem < len)
       return -1;
-  strcpy (p, ctx->alg->name);
+  strlcpy (p, ctx->alg->name, rem);
   p += len;
   rem -= len;
 
@@ -220,7 +220,7 @@ otp_put (void *v, OtpContext *ctx)
   len = strlen(ctx->seed) + 1;
   if (rem < len)
       return -1;
-  strcpy (p, ctx->seed);
+  strlcpy (p, ctx->seed, rem);
   p += len;
   rem -= len;
   dat.dptr  = buf;
diff --git a/kerberosV/src/lib/otp/otp_md.c b/kerberosV/src/lib/otp/otp_md.c
index 525834dae40..bbc14b69c20 100644
--- a/kerberosV/src/lib/otp/otp_md.c
+++ b/kerberosV/src/lib/otp/otp_md.c
@@ -87,9 +87,9 @@ otp_md_init (OtpKey key,
   p = malloc (len + 1);
   if (p == NULL)
     return -1;
-  strcpy (p, seed);
+  strlcpy (p, seed, len+1);
   strlwr (p);
-  strcat (p, pwd);
+  strlcat (p, pwd, len+1);
   (*init)(arg);
   (*update)(arg, p, len);
   (*final)(res, arg);
diff --git a/kerberosV/src/lib/roken/getcap.c b/kerberosV/src/lib/roken/getcap.c
index 75979452ef7..86f0e61a933 100644
--- a/kerberosV/src/lib/roken/getcap.c
+++ b/kerberosV/src/lib/roken/getcap.c
@@ -251,11 +251,12 @@ getent(char **cap, size_t *len, char **db_array, int fd,
      * Check if we have a top record from cgetset().
      */
     if (depth == 0 && toprec != NULL && cgetmatch(toprec, name) == 0) {
-	if ((record = malloc (topreclen + BFRAG)) == NULL) {
+	size_t len = topreclen + BFRAG;
+	if ((record = malloc (len)) == NULL) {
 	    errno = ENOMEM;
 	    return (-2);
 	}
-	(void)strcpy(record, toprec);	/* XXX: strcpy is safe */
+	(void)strlcpy(record, toprec, len);
 	db_p = db_array;
 	rp = record + topreclen + 1;
 	r_end = rp + BFRAG;
diff --git a/kerberosV/src/lib/roken/print_version.c b/kerberosV/src/lib/roken/print_version.c
index cfe69a295ce..d46ab992ba2 100644
--- a/kerberosV/src/lib/roken/print_version.c
+++ b/kerberosV/src/lib/roken/print_version.c
@@ -69,8 +69,8 @@ print_version(const char *progname)
 	msg[0] = '\0';
 	for(i = 0; i < num_args; i++) {
 	    if(i > 0)
-		strcat(msg, ", ");
-	    strcat(msg, arg[i]);
+		strlcat(msg, ", ", len+1);
+	    strlcat(msg, arg[i], len+1);
 	}
     }
     fprintf(stderr, "%s (%s)\n", progname, msg);
diff --git a/kerberosV/src/lib/roken/resolve.c b/kerberosV/src/lib/roken/resolve.c
index 77ce5f5503d..229ddd6ca17 100644
--- a/kerberosV/src/lib/roken/resolve.c
+++ b/kerberosV/src/lib/roken/resolve.c
@@ -209,7 +209,7 @@ parse_reply(unsigned char *data, int len)
 		return NULL;
 	    }
 	    (*rr)->u.mx->preference = (p[0] << 8) | p[1];
-	    strcpy((*rr)->u.mx->domain, host);
+	    strlcpy((*rr)->u.mx->domain, host, strlen(host));
 	    break;
 	}
 	case T_SRV:{
@@ -228,7 +228,7 @@ parse_reply(unsigned char *data, int len)
 	    (*rr)->u.srv->priority = (p[0] << 8) | p[1];
 	    (*rr)->u.srv->weight = (p[2] << 8) | p[3];
 	    (*rr)->u.srv->port = (p[4] << 8) | p[5];
-	    strcpy((*rr)->u.srv->target, host);
+	    strlcpy((*rr)->u.srv->target, host, strlen(host));
 	    break;
 	}
 	case T_TXT:{
@@ -286,7 +286,7 @@ parse_reply(unsigned char *data, int len)
 	    (*rr)->u.sig->sig_len        = sig_len;
 	    memcpy ((*rr)->u.sig->sig_data, p + 18 + status, sig_len);
 	    (*rr)->u.sig->signer         = &(*rr)->u.sig->sig_data[sig_len];
-	    strcpy((*rr)->u.sig->signer, host);
+	    strlcpy((*rr)->u.sig->signer, host, strlen(host));
 	    break;
 	}
 
diff --git a/kerberosV/src/lib/sl/ss.c b/kerberosV/src/lib/sl/ss.c
index f7f8d259d8c..4f2918a20f5 100644
--- a/kerberosV/src/lib/sl/ss.c
+++ b/kerberosV/src/lib/sl/ss.c
@@ -137,12 +137,13 @@ ss_execute_line (int index, const char *line)
 int
 ss_listen (int index)
 {
-    char *prompt = malloc(strlen(subsystems[index].name) + 3);
+    size_t len = strlen(subsystems[index].name) + 3;
+    char *prompt = malloc(len);
     if (prompt == NULL)
 	return ENOMEM;
 
-    strcpy(prompt, subsystems[index].name);
-    strcat(prompt, ": ");
+    strlcpy(prompt, subsystems[index].name, len);
+    strlcat(prompt, ": ", len);
     sl_loop(subsystems[index].table, prompt);
     free(prompt);
     return 0;
diff --git a/kerberosV/src/lib/vers/print_version.c b/kerberosV/src/lib/vers/print_version.c
index 21b047820a7..e40cb9e138f 100644
--- a/kerberosV/src/lib/vers/print_version.c
+++ b/kerberosV/src/lib/vers/print_version.c
@@ -69,8 +69,8 @@ print_version(const char *progname)
 	msg[0] = '\0';
 	for(i = 0; i < num_args; i++) {
 	    if(i > 0)
-		strcat(msg, ", ");
-	    strcat(msg, arg[i]);
+		strlcat(msg, ", ", len+1);
+	    strlcat(msg, arg[i], len+1);
 	}
     }
     fprintf(stderr, "%s (%s)\n", progname, msg);