4 files changed, 13 insertions, 12 deletions

diff --git a/expr.c b/expr.c
index 96fd956..195e0f3 100644
--- a/expr.c
+++ b/expr.c
@@ -767,7 +767,7 @@ ExprResolveString(ExprDef * expr,
             new = (char *) uAlloc(len);
             if (new)
             {
-                sprintf(new, "%s%s", leftRtrn.str, rightRtrn.str);
+                snprintf(new, len, "%s%s", leftRtrn.str, rightRtrn.str);
                 val_rtrn->str = new;
                 return True;
             }
diff --git a/geometry.c b/geometry.c
index 7f65c3a..cfd1f51 100644
--- a/geometry.c
+++ b/geometry.c
@@ -258,9 +258,9 @@ ddText(Display * dpy, DoodadInfo * di)
     }
     if (di->section)
     {
-        sprintf(buf, "%s in section %s",
-                XkbAtomText(dpy, di->name, XkbMessage), scText(dpy,
-                                                               di->section));
+        snprintf(buf, sizeof(buf), "%s in section %s",
+                 XkbAtomText(dpy, di->name, XkbMessage),
+                 scText(dpy, di->section));
         return buf;
     }
     return XkbAtomText(dpy, di->name, XkbMessage);
@@ -3297,8 +3297,8 @@ FontFromParts(Atom fontTok,
     rtrn = uCalloc(totalSize, 1);
     if (rtrn)
     {
-        sprintf(rtrn, FONT_TEMPLATE, font, weight, slant, setWidth, variant,
-                size, encoding);
+        snprintf(rtrn, totalSize, FONT_TEMPLATE, font, weight, slant,
+                 setWidth, variant, size, encoding);
     }
     return rtrn;
 }
diff --git a/listing.c b/listing.c
index 11de88a..c7f5ef8 100644
--- a/listing.c
+++ b/listing.c
@@ -302,18 +302,19 @@ AddDirectory(char *head, char *ptrn, char *rest, char *map)
     {
         char *tmp, *filename;
         struct stat sbuf;
+        size_t tmpsize;
 
         filename = FileName(file);
         if (!filename || filename[0] == '.')
             continue;
         if (ptrn && (!XkbNameMatchesPattern(filename, ptrn)))
             continue;
-        tmp =
-            (char *) uAlloc((head ? strlen(head) : 0) + strlen(filename) + 2);
+        tmpsize = (head ? strlen(head) : 0) + strlen(filename) + 2;
+        tmp = uAlloc(tmpsize);
         if (!tmp)
             continue;
-        sprintf(tmp, "%s%s%s", (head ? head : ""), (head ? "/" : ""),
-                filename);
+        snprintf(tmp, tmpsize, "%s%s%s",
+                 (head ? head : ""), (head ? "/" : ""), filename);
         if (stat(tmp, &sbuf) < 0)
         {
             uFree(tmp);
diff --git a/xkbcomp.c b/xkbcomp.c
index a4ee359..956e79c 100644
--- a/xkbcomp.c
+++ b/xkbcomp.c
@@ -745,7 +745,7 @@ parseArgs(int argc, char *argv[])
             ACTION("Exiting\n");
             exit(1);
         }
-        sprintf(outputFile, "stdin.%s", fileTypeExt[outputFormat]);
+        snprintf(outputFile, len, "stdin.%s", fileTypeExt[outputFormat]);
     }
     else if ((outputFile == NULL) && (inputFile != NULL))
     {
@@ -773,7 +773,7 @@ parseArgs(int argc, char *argv[])
         }
         ext = strrchr(base, '.');
         if (ext == NULL)
-            sprintf(outputFile, "%s.%s", base, fileTypeExt[outputFormat]);
+            snprintf(outputFile, len, "%s.%s", base, fileTypeExt[outputFormat]);
         else
         {
             strcpy(outputFile, base);