try to use strlcpy and snprintf more; ok various

18 files changed, 80 insertions, 73 deletions

diff --git a/lib/libc/gen/auth_subr.c b/lib/libc/gen/auth_subr.c
index 15b1f3a9591..c99233d62c9 100644
--- a/lib/libc/gen/auth_subr.c
+++ b/lib/libc/gen/auth_subr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: auth_subr.c,v 1.9 2002/03/13 21:39:41 millert Exp $	*/
+/*	$OpenBSD: auth_subr.c,v 1.10 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 1995,1996,1997 Berkeley Software Design, Inc.
@@ -981,7 +981,7 @@ _add_rmlist(auth_session_t *as, char *file)
 	}
 	rm->file = (char *)(rm + 1);
 	rm->next = as->rmlist;
-	strcpy(rm->file, file);
+	strlcpy(rm->file, file, i);
 	as->rmlist = rm;
 }
 
diff --git a/lib/libc/gen/authenticate.c b/lib/libc/gen/authenticate.c
index 9aaba58253e..a7903d3c0d0 100644
--- a/lib/libc/gen/authenticate.c
+++ b/lib/libc/gen/authenticate.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: authenticate.c,v 1.9 2002/03/20 17:17:15 mpech Exp $	*/
+/*	$OpenBSD: authenticate.c,v 1.10 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*-
  * Copyright (c) 1997 Berkeley Software Design, Inc. All rights reserved.
@@ -208,7 +208,7 @@ auth_approval(auth_session_t *as, login_cap_t *lc, char *name, char *type)
 			return (0);
 		}
 		if (pwd == NULL && (approve = strchr(name, '.')) != NULL) {
-			strcpy(path, name);
+			strlcpy(path, name, sizeof path);
 			path[approve-name] = '\0';
 			pwd = getpwnam(name);
 		}
@@ -301,7 +301,7 @@ auth_usercheck(char *name, char *style, char *type, char *password)
 
 	if (strlen(name) >= sizeof(namebuf))
 		return (NULL);
-	strcpy(namebuf, name);
+	strlcpy(namebuf, name, sizeof namebuf);
 	name = namebuf;
 
 	/*
@@ -367,7 +367,7 @@ auth_userchallenge(char *name, char *style, char *type, char **challengep)
 
 	if (strlen(name) >= sizeof(namebuf))
 		return (NULL);
-	strcpy(namebuf, name);
+	strlcpy(namebuf, name, sizeof namebuf);
 	name = namebuf;
 
 	/*
diff --git a/lib/libc/gen/basename.c b/lib/libc/gen/basename.c
index 7707cdb52bf..9aa31be2473 100644
--- a/lib/libc/gen/basename.c
+++ b/lib/libc/gen/basename.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: basename.c,v 1.6 2001/06/28 04:27:19 pjanzen Exp $	*/
+/*	$OpenBSD: basename.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -28,7 +28,7 @@
  */
 
 #ifndef lint
-static char rcsid[] = "$OpenBSD: basename.c,v 1.6 2001/06/28 04:27:19 pjanzen Exp $";
+static char rcsid[] = "$OpenBSD: basename.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* not lint */
 
 #include <errno.h>
@@ -45,7 +45,7 @@ basename(path)
 
 	/* Empty or NULL string gets treated as "." */
 	if (path == NULL || *path == '\0') {
-		(void)strcpy(bname, ".");
+		(void)strlcpy(bname, ".", sizeof bname);
 		return(bname);
 	}
 
@@ -56,7 +56,7 @@ basename(path)
 
 	/* All slashes becomes "/" */
 	if (endp == path && *endp == '/') {
-		(void)strcpy(bname, "/");
+		(void)strlcpy(bname, "/", sizeof bname);
 		return(bname);
 	}
 
diff --git a/lib/libc/gen/dirname.c b/lib/libc/gen/dirname.c
index 839c785348c..ade0f97410c 100644
--- a/lib/libc/gen/dirname.c
+++ b/lib/libc/gen/dirname.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: dirname.c,v 1.6 2001/06/28 04:27:19 pjanzen Exp $	*/
+/*	$OpenBSD: dirname.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1997 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -28,7 +28,7 @@
  */
 
 #ifndef lint
-static char rcsid[] = "$OpenBSD: dirname.c,v 1.6 2001/06/28 04:27:19 pjanzen Exp $";
+static char rcsid[] = "$OpenBSD: dirname.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* not lint */
 
 #include <errno.h>
@@ -45,7 +45,7 @@ dirname(path)
 
 	/* Empty or NULL string gets treated as "." */
 	if (path == NULL || *path == '\0') {
-		(void)strcpy(bname, ".");
+		(void)strlcpy(bname, ".", sizeof bname);
 		return(bname);
 	}
 
@@ -60,7 +60,7 @@ dirname(path)
 
 	/* Either the dir is "/" or there are no slashes */
 	if (endp == path) {
-		(void)strcpy(bname, *endp == '/' ? "/" : ".");
+		(void)strlcpy(bname, *endp == '/' ? "/" : ".", sizeof bname);
 		return(bname);
 	} else {
 		do {
diff --git a/lib/libc/gen/disklabel.c b/lib/libc/gen/disklabel.c
index f6c8fce726c..b55e7e63c08 100644
--- a/lib/libc/gen/disklabel.c
+++ b/lib/libc/gen/disklabel.c
@@ -32,7 +32,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: disklabel.c,v 1.6 2002/02/16 21:27:22 millert Exp $";
+static char rcsid[] = "$OpenBSD: disklabel.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>
@@ -114,11 +114,11 @@ getdiskbyname(name)
 	getnumdflt(dp->d_trkseek, "ts", 0);
 	getnumdflt(dp->d_bbsize, "bs", BBSIZE);
 	getnumdflt(dp->d_sbsize, "sb", SBSIZE);
-	strcpy(psize, "px");
-	strcpy(pbsize, "bx");
-	strcpy(pfsize, "fx");
-	strcpy(poffset, "ox");
-	strcpy(ptype, "tx");
+	strlcpy(psize, "px", sizeof psize);
+	strlcpy(pbsize, "bx", sizeof pbsize);
+	strlcpy(pfsize, "fx", sizeof pfsize);
+	strlcpy(poffset, "ox", sizeof poffset);
+	strlcpy(ptype, "tx", sizeof ptype);
 	max = 'a' - 1;
 	pp = &dp->d_partitions[0];
 	for (p = 'a'; p < 'a' + MAXPARTITIONS; p++, pp++) {
@@ -146,7 +146,7 @@ getdiskbyname(name)
 		}
 	}
 	dp->d_npartitions = max + 1 - 'a';
-	(void)strcpy(psize, "dx");
+	(void)strlcpy(psize, "dx", sizeof psize);
 	dx = dp->d_drivedata;
 	for (p = '0'; p < '0' + NDDATA; p++, dx++) {
 		psize[1] = p;
diff --git a/lib/libc/gen/getgrent.c b/lib/libc/gen/getgrent.c
index 28c5024b5e8..e977e7a8d52 100644
--- a/lib/libc/gen/getgrent.c
+++ b/lib/libc/gen/getgrent.c
@@ -33,7 +33,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: getgrent.c,v 1.15 2002/02/16 21:27:22 millert Exp $";
+static char rcsid[] = "$OpenBSD: getgrent.c,v 1.16 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/types.h>
@@ -386,16 +386,18 @@ grscan(search, gid, name, p_gr, gs)
 						continue;
 					if (name) {
 						r = yp_match(__ypdomain,
-							     "group.byname",
-							     name, strlen(name),
-							     &data, &datalen);
+						    "group.byname",
+						    name, strlen(name),
+						    &data, &datalen);
 					} else {
 						char buf[20];
-						sprintf(buf, "%u", gid);
+
+						snprintf(buf, sizeof buf,
+						    "%u", gid);
 						r = yp_match(__ypdomain,
-							     "group.bygid",
-							     buf, strlen(buf),
-							     &data, &datalen);
+						    "group.bygid",
+						    buf, strlen(buf),
+						    &data, &datalen);
 					}
 					if (r != 0)
 						continue;
diff --git a/lib/libc/gen/getpwent.c b/lib/libc/gen/getpwent.c
index 0ddc32e44b4..f82e8b5f689 100644
--- a/lib/libc/gen/getpwent.c
+++ b/lib/libc/gen/getpwent.c
@@ -33,7 +33,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: getpwent.c,v 1.24 2002/02/19 19:39:36 millert Exp $";
+static char rcsid[] = "$OpenBSD: getpwent.c,v 1.25 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>
@@ -767,7 +767,7 @@ getpwuid(uid_t uid)
 		int s = -1;
 		const char *host, *user, *dom;
 
-		sprintf(uidbuf, "%u", uid);
+		snprintf(uidbuf, sizeof uidbuf, "%u", uid);
 		for (_pw_keynum=1; _pw_keynum; _pw_keynum++) {
 			bf[0] = _PW_KEYBYNUM;
 			bcopy((char *)&_pw_keynum, bf + 1, sizeof(_pw_keynum));
diff --git a/lib/libc/gen/glob.c b/lib/libc/gen/glob.c
index aa918f41a8a..23ca3d55108 100644
--- a/lib/libc/gen/glob.c
+++ b/lib/libc/gen/glob.c
@@ -38,7 +38,7 @@
 #if 0
 static char sccsid[] = "@(#)glob.c	8.3 (Berkeley) 10/13/93";
 #else
-static char rcsid[] = "$OpenBSD: glob.c,v 1.18 2002/02/17 19:42:22 millert Exp $";
+static char rcsid[] = "$OpenBSD: glob.c,v 1.19 2002/05/24 21:22:37 deraadt Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -812,7 +812,7 @@ g_opendir(str, pglob)
 	char buf[MAXPATHLEN];
 
 	if (!*str)
-		strcpy(buf, ".");
+		strlcpy(buf, ".", sizeof buf);
 	else {
 		if (g_Ctoc(str, buf, sizeof(buf)))
 			return(NULL);
diff --git a/lib/libc/net/ethers.c b/lib/libc/net/ethers.c
index e7781438c1f..858ac5b3f37 100644
--- a/lib/libc/net/ethers.c
+++ b/lib/libc/net/ethers.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ethers.c,v 1.13 2002/02/16 21:27:23 millert Exp $	*/
+/*	$OpenBSD: ethers.c,v 1.14 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
@@ -34,7 +34,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: ethers.c,v 1.13 2002/02/16 21:27:23 millert Exp $";
+static char rcsid[] = "$OpenBSD: ethers.c,v 1.14 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/types.h>
@@ -72,7 +72,7 @@ ether_ntoa(e)
 		return (NULL);
 	}
 
-	(void)sprintf(a, "%02x:%02x:%02x:%02x:%02x:%02x",
+	(void)snprintf(a, sizeof a, "%02x:%02x:%02x:%02x:%02x:%02x",
 	    e->ether_addr_octet[0], e->ether_addr_octet[1],
 	    e->ether_addr_octet[2], e->ether_addr_octet[3],
 	    e->ether_addr_octet[4], e->ether_addr_octet[5]);
@@ -138,7 +138,7 @@ ether_ntohost(hostname, e)
 	}
 
 #ifdef YP
-	sprintf(trybuf, "%x:%x:%x:%x:%x:%x", 
+	snprintf(trybuf, sizeof trybuf, "%x:%x:%x:%x:%x:%x", 
 	    e->ether_addr_octet[0], e->ether_addr_octet[1],
 	    e->ether_addr_octet[2], e->ether_addr_octet[3],
 	    e->ether_addr_octet[4], e->ether_addr_octet[5]);
diff --git a/lib/libc/net/inet_neta.c b/lib/libc/net/inet_neta.c
index ffcddd8d912..881a328ab02 100644
--- a/lib/libc/net/inet_neta.c
+++ b/lib/libc/net/inet_neta.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet_neta.c,v 1.2 1997/04/05 21:13:12 millert Exp $	*/
+/*	$OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*
  * Copyright (c) 1996 by Internet Software Consortium.
@@ -19,9 +19,9 @@
 
 #if defined(LIBC_SCCS) && !defined(lint)
 #if 0
-static const char rcsid[] = "$Id: inet_neta.c,v 1.2 1997/04/05 21:13:12 millert Exp $";
+static const char rcsid[] = "$Id: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
 #else
-static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.2 1997/04/05 21:13:12 millert Exp $";
+static const char rcsid[] = "$OpenBSD: inet_neta.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
 #endif
 #endif
 
@@ -73,7 +73,7 @@ inet_neta(src, dst, size)
 	if (dst == odst) {
 		if (size < sizeof "0.0.0.0")
 			goto emsgsize;
-		strcpy(dst, "0.0.0.0");
+		strlcpy(dst, "0.0.0.0", size);
 	}
 	return (odst);
 
diff --git a/lib/libc/net/inet_ntop.c b/lib/libc/net/inet_ntop.c
index 00b8f6b22e6..212c0396b27 100644
--- a/lib/libc/net/inet_ntop.c
+++ b/lib/libc/net/inet_ntop.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: inet_ntop.c,v 1.2 2002/02/16 21:27:23 millert Exp $	*/
+/*	$OpenBSD: inet_ntop.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /* Copyright (c) 1996 by Internet Software Consortium.
  *
@@ -20,7 +20,7 @@
 #if 0
 static char rcsid[] = "$From: inet_ntop.c,v 8.7 1996/08/05 08:41:18 vixie Exp $";
 #else
-static char rcsid[] = "$OpenBSD: inet_ntop.c,v 1.2 2002/02/16 21:27:23 millert Exp $";
+static char rcsid[] = "$OpenBSD: inet_ntop.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -89,11 +89,11 @@ inet_ntop4(src, dst, size)
 	static const char fmt[] = "%u.%u.%u.%u";
 	char tmp[sizeof "255.255.255.255"];
 
-	if (sprintf(tmp, fmt, src[0], src[1], src[2], src[3]) > size) {
+	if (snprintf(tmp, size, fmt, src[0], src[1], src[2], src[3]) >= size) {
 		errno = ENOSPC;
 		return (NULL);
 	}
-	strcpy(dst, tmp);
+	strlcpy(dst, tmp, size);
 	return (dst);
 }
 
@@ -189,6 +189,6 @@ inet_ntop6(src, dst, size)
 		errno = ENOSPC;
 		return (NULL);
 	}
-	strcpy(dst, tmp);
+	strlcpy(dst, tmp, size);
 	return (dst);
 }
diff --git a/lib/libc/net/ipx_ntoa.c b/lib/libc/net/ipx_ntoa.c
index 1dcfe7181b8..598c94d5995 100644
--- a/lib/libc/net/ipx_ntoa.c
+++ b/lib/libc/net/ipx_ntoa.c
@@ -32,7 +32,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: ipx_ntoa.c,v 1.2 1996/08/19 08:29:20 tholo Exp $";
+static char rcsid[] = "$OpenBSD: ipx_ntoa.c,v 1.3 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>
@@ -45,7 +45,7 @@ ipx_ntoa(addr)
 {
 	static char obuf[] = "xxxx.xx:xx:xx:xx:xx:xx.uuuuu";
 
-	sprintf(obuf, "%8xH.%02x:%02x:%02x:%02x:%02x:%02x.%u",
+	snprintf(obuf, sizeof obuf, "%8xH.%02x:%02x:%02x:%02x:%02x:%02x.%u",
 		ntohl(addr.ipx_net.l_net),
 		addr.ipx_host.c_host[0],
 		addr.ipx_host.c_host[1],
diff --git a/lib/libc/net/ns_ntoa.c b/lib/libc/net/ns_ntoa.c
index 130ccd388bf..3c82bc3cee8 100644
--- a/lib/libc/net/ns_ntoa.c
+++ b/lib/libc/net/ns_ntoa.c
@@ -32,7 +32,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char rcsid[] = "$OpenBSD: ns_ntoa.c,v 1.8 2002/02/16 21:27:23 millert Exp $";
+static char rcsid[] = "$OpenBSD: ns_ntoa.c,v 1.9 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>
@@ -54,7 +54,7 @@ ns_ntoa(addr)
 	u_char *uplim = up + 6;
 
 	net.net_e = addr.x_net;
-	sprintf(obuf, "%x", ntohl(net.long_e));
+	snprintf(obuf, sizeof obuf, "%x", ntohl(net.long_e));
 	cp = spectHex(obuf);
 	cp2 = cp + 1;
 	while (*up==0 && up < uplim) up++;
diff --git a/lib/libc/net/rcmd.c b/lib/libc/net/rcmd.c
index d6814676f4e..be68c599d8c 100644
--- a/lib/libc/net/rcmd.c
+++ b/lib/libc/net/rcmd.c
@@ -34,7 +34,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: rcmd.c,v 1.42 2002/05/22 04:31:14 deraadt Exp $";
+static char *rcsid = "$OpenBSD: rcmd.c,v 1.43 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>
@@ -407,8 +407,7 @@ again:
 		first = 0;
 		if ((pwd = getpwnam(luser)) == NULL)
 			return (-1);
-		(void)strcpy(pbuf, pwd->pw_dir);
-		(void)strcat(pbuf, "/.rhosts");
+		snprintf(pbuf, sizeof pbuf, "%s/.rhosts", pwd->pw_dir);
 
 		/*
 		 * Change effective uid while opening .rhosts.  If root and
diff --git a/lib/libc/net/res_debug.c b/lib/libc/net/res_debug.c
index 54be69cef74..75d70e86b6f 100644
--- a/lib/libc/net/res_debug.c
+++ b/lib/libc/net/res_debug.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: res_debug.c,v 1.11 2001/06/11 10:05:59 itojun Exp $	*/
+/*	$OpenBSD: res_debug.c,v 1.12 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*
  * ++Copyright++ 1985, 1990, 1993
@@ -82,7 +82,7 @@
 static char sccsid[] = "@(#)res_debug.c	8.1 (Berkeley) 6/4/93";
 static char rcsid[] = "$From: res_debug.c,v 8.19 1996/11/26 10:11:23 vixie Exp $";
 #else
-static char rcsid[] = "$OpenBSD: res_debug.c,v 1.11 2001/06/11 10:05:59 itojun Exp $";
+static char rcsid[] = "$OpenBSD: res_debug.c,v 1.12 2002/05/24 21:22:37 deraadt Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -159,7 +159,9 @@ dewks(wks)
 	case 161: return "snmp";
 	case 162: return "snmp-trap";
 	case 170: return "print-srv";
-	default: (void) sprintf(nbuf, "%d", wks); return (nbuf);
+	default:
+		(void) snprintf(nbuf, sizeof nbuf, "%d", wks);
+		return (nbuf);
 	}
 }
 
@@ -183,7 +185,9 @@ deproto(protonum)
 	case 12: return "pup";
 	case 16: return "chaos";
 	case 17: return "udp";
-	default: (void) sprintf(nbuf, "%d", protonum); return (nbuf);
+	default:
+		(void) snprintf(nbuf, sizeof nbuf, "%d", protonum);
+		return (nbuf);
 	}
 }
 
@@ -436,7 +440,7 @@ __p_fqnname(cp, msg, msglen, name, namelen)
 
 	if ((n = dn_expand(msg, cp + msglen, cp, name, namelen)) < 0)
 		return (NULL);
-	newlen = strlen (name);
+	newlen = strlen(name);
 	if (newlen == 0 || name[newlen - 1] != '.') {
 		if (newlen+1 >= namelen)	/* Lack space for final dot */
 			return (NULL);
@@ -958,7 +962,7 @@ __sym_ntos(syms, number, success)
 		}
 	}
 
-	sprintf (unname, "%d", number);
+	snprintf(unname, sizeof unname, "%d", number);
 	if (success)
 		*success = 0;
 	return (unname);
@@ -980,7 +984,7 @@ __sym_ntop(syms, number, success)
 			return (syms->humanname);
 		}
 	}
-	sprintf(unname, "%d", number);
+	snprintf(unname, sizeof unname, "%d", number);
 	if (success)
 		*success = 0;
 	return (unname);
@@ -1030,8 +1034,9 @@ __p_option(option)
 	case RES_INSECURE2:	return "insecure2";
 	case RES_USE_INET6:	return "inet6";
 	case RES_USE_EDNS0:	return "edns0";
-	default:		sprintf(nbuf, "?0x%lx?", (u_long)option);
-				return (nbuf);
+	default:
+		snprintf(nbuf, sizeof nbuf, "?0x%lx?", (u_long)option);
+		return (nbuf);
 	}
 }
 
@@ -1047,7 +1052,7 @@ p_time(value)
 	register char *p;
 
 	if (value == 0) {
-		strcpy(nbuf, "0 secs");
+		strlcpy(nbuf, "0 secs", sizeof nbuf);
 		return (nbuf);
 	}
 
@@ -1109,7 +1114,7 @@ precsize_ntoa(prec)
 
 	val = mantissa * poweroften[exponent];
 
-	(void) sprintf(retbuf, "%ld.%.2ld", val/100, val%100);
+	(void) snprintf(retbuf, sizeof retbuf, "%ld.%.2ld", val/100, val%100);
 	return (retbuf);
 }
 
@@ -1513,7 +1518,7 @@ __p_secstodate (secs)
 	time = gmtime(&clock);
 	time->tm_year += 1900;
 	time->tm_mon += 1;
-	sprintf(output, "%04d%02d%02d%02d%02d%02d",
+	snprintf(output, sizeof output, "%04d%02d%02d%02d%02d%02d",
 		time->tm_year, time->tm_mon, time->tm_mday,
 		time->tm_hour, time->tm_min, time->tm_sec);
 	return (output);
diff --git a/lib/libc/net/res_query.c b/lib/libc/net/res_query.c
index 24c07491a9a..53837815c38 100644
--- a/lib/libc/net/res_query.c
+++ b/lib/libc/net/res_query.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: res_query.c,v 1.17 2002/02/16 21:27:23 millert Exp $	*/
+/*	$OpenBSD: res_query.c,v 1.18 2002/05/24 21:22:37 deraadt Exp $	*/
 
 /*
  * ++Copyright++ 1988, 1993
@@ -60,7 +60,7 @@
 static char sccsid[] = "@(#)res_query.c	8.1 (Berkeley) 6/4/93";
 static char rcsid[] = "$From: res_query.c,v 8.9 1996/09/22 00:13:28 vixie Exp $";
 #else
-static char rcsid[] = "$OpenBSD: res_query.c,v 1.17 2002/02/16 21:27:23 millert Exp $";
+static char rcsid[] = "$OpenBSD: res_query.c,v 1.18 2002/05/24 21:22:37 deraadt Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -351,7 +351,8 @@ res_querydomain(name, domain, class, type, answer, anslen)
 		} else
 			longname = name;
 	} else
-		sprintf(nbuf, "%.*s.%.*s", MAXDNAME, name, MAXDNAME, domain);
+		snprintf(nbuf, sizeof nbuf, "%.*s.%.*s",
+		    MAXDNAME, name, MAXDNAME, domain);
 
 	return (res_query(longname, class, type, answer, anslen));
 }
diff --git a/lib/libc/regex/regerror.c b/lib/libc/regex/regerror.c
index da328c41f25..976a7d6bc4e 100644
--- a/lib/libc/regex/regerror.c
+++ b/lib/libc/regex/regerror.c
@@ -41,7 +41,7 @@
 #if 0
 static char sccsid[] = "@(#)regerror.c	8.4 (Berkeley) 3/20/94";
 #else
-static char rcsid[] = "$OpenBSD: regerror.c,v 1.7 2002/02/16 21:27:24 millert Exp $";
+static char rcsid[] = "$OpenBSD: regerror.c,v 1.8 2002/05/24 21:22:37 deraadt Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -139,7 +139,7 @@ size_t errbuf_size;
 		if (errcode&REG_ITOA) {
 			if (r->code != 0) {
 				assert(strlen(r->name) < sizeof(convbuf));
-				(void) strcpy(convbuf, r->name);
+				(void) strlcpy(convbuf, r->name, sizeof convbuf);
 			} else
 				(void)sprintf(convbuf, "REG_0x%x", target);
 			s = convbuf;
diff --git a/lib/libc/stdlib/realpath.c b/lib/libc/stdlib/realpath.c
index 061f1a7ef12..d01b19e0f2e 100644
--- a/lib/libc/stdlib/realpath.c
+++ b/lib/libc/stdlib/realpath.c
@@ -35,7 +35,7 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: realpath.c,v 1.6 2002/01/12 16:24:35 millert Exp $";
+static char *rcsid = "$OpenBSD: realpath.c,v 1.7 2002/05/24 21:22:37 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <sys/param.h>
@@ -66,7 +66,7 @@ realpath(path, resolved)
 
 	/* Save the starting point. */
 	if ((fd = open(".", O_RDONLY)) < 0) {
-		(void)strcpy(resolved, ".");
+		(void)strlcpy(resolved, ".", MAXPATHLEN);
 		return (NULL);
 	}
 
@@ -125,7 +125,7 @@ loop:
 	 * Save the last component name and get the full pathname of
 	 * the current directory.
 	 */
-	(void)strcpy(wbuf, p);
+	(void)strlcpy(wbuf, p, sizeof wbuf);
 	if (getcwd(resolved, MAXPATHLEN) == 0)
 		goto err1;