strings

ok tedu@, art@

17 files changed, 134 insertions, 119 deletions

diff --git a/gnu/lib/libreadline/bind.c b/gnu/lib/libreadline/bind.c
index fc6fe284116..d9947c389df 100644
--- a/gnu/lib/libreadline/bind.c
+++ b/gnu/lib/libreadline/bind.c
@@ -1761,14 +1761,15 @@ rl_invoking_keyseqs_in_map (function, map)
 
 	    for (i = 0; seqs[i]; i++)
 	      {
-		char *keyname = (char *)xmalloc (6 + strlen (seqs[i]));
+		int len = 6 + strlen(seqs[i]);
+		char *keyname = (char *)xmalloc (len);
 
 		if (key == ESC)
-		  sprintf (keyname, "\\e");
+		  snprintf(keyname, len, "\\e");
 		else if (CTRL_CHAR (key))
-		  sprintf (keyname, "\\C-%c", _rl_to_lower (UNCTRL (key)));
+		  snprintf(keyname, len, "\\C-%c", _rl_to_lower (UNCTRL (key)));
 		else if (key == RUBOUT)
-		  sprintf (keyname, "\\C-?");
+		  snprintf(keyname, len, "\\C-?");
 		else if (key == '\\' || key == '"')
 		  {
 		    keyname[0] = '\\';
@@ -1781,7 +1782,7 @@ rl_invoking_keyseqs_in_map (function, map)
 		    keyname[1] = '\0';
 		  }
 		
-		strcat (keyname, seqs[i]);
+		strlcat (keyname, seqs[i], len);
 		free (seqs[i]);
 
 		if (result_index + 2 > result_size)
@@ -1935,9 +1936,10 @@ _rl_macro_dumper_internal (print_readably, map, prefix)
 	  prefix_len = prefix ? strlen (prefix) : 0;
 	  if (key == ESC)
 	    {
-	      keyname = xmalloc (3 + prefix_len);
+	      int len = 3 + prefix_len;
+	      keyname = xmalloc (len);
 	      if (prefix)
-		strcpy (keyname, prefix);
+		strlcpy (keyname, prefix, len);
 	      keyname[prefix_len] = '\\';
 	      keyname[prefix_len + 1] = 'e';
 	      keyname[prefix_len + 2] = '\0';
@@ -1947,9 +1949,8 @@ _rl_macro_dumper_internal (print_readably, map, prefix)
 	      keyname = _rl_get_keyname (key);
 	      if (prefix)
 		{
-		  out = xmalloc (strlen (keyname) + prefix_len + 1);
-		  strcpy (out, prefix);
-		  strcpy (out + prefix_len, keyname);
+		  if (asprintf(&out, "%s%s", prefix, keyname) == -1)
+		    memory_error_and_abort("asprintf");
 		  free (keyname);
 		  keyname = out;
 		}
diff --git a/gnu/lib/libreadline/complete.c b/gnu/lib/libreadline/complete.c
index fb48712a4e0..d5f983b0489 100644
--- a/gnu/lib/libreadline/complete.c
+++ b/gnu/lib/libreadline/complete.c
@@ -459,7 +459,7 @@ print_filename (to_print, full_pathname)
     }
 #else  
   char *s, c, *new_full_pathname;
-  int extension_char, slen, tlen;
+  int extension_char;
 
   for (s = to_print; *s; s++)
     {
@@ -485,16 +485,9 @@ print_filename (to_print, full_pathname)
 	  s = tilde_expand (full_pathname && *full_pathname ? full_pathname : "/");
 	  if (rl_directory_completion_hook)
 	    (*rl_directory_completion_hook) (&s);
-
-	  slen = strlen (s);
-	  tlen = strlen (to_print);
-	  new_full_pathname = xmalloc (slen + tlen + 2);
-	  strcpy (new_full_pathname, s);
-	  new_full_pathname[slen] = '/';
-	  strcpy (new_full_pathname + slen + 1, to_print);
-
+	  if (asprintf(&new_full_pathname, "%s/%s", s, to_print) == -1)
+		  memory_error_and_abort("asprintf");
 	  extension_char = stat_char (new_full_pathname);
-
 	  free (new_full_pathname);
 	  to_print[-1] = c;
 	}
@@ -522,10 +515,11 @@ rl_quote_filename (s, rtype, qcp)
      char *qcp;
 {
   char *r;
+  int len = strlen(s) + 2;
 
-  r = xmalloc (strlen (s) + 2);
+  r = xmalloc (len);
   *r = *rl_completer_quote_characters;
-  strcpy (r + 1, s);
+  strlcpy (r + 1, s, len - 1);
   if (qcp)
     *qcp = *rl_completer_quote_characters;
   return r;
@@ -820,8 +814,9 @@ compute_lcd_of_matches (match_list, matches, text)
      value of matches[0]. */
   if (low == 0 && text && *text)
     {
-      match_list[0] = xmalloc (strlen (text) + 1);
-      strcpy (match_list[0], text);
+      match_list[0] = strdup(text);
+      if (match_list[0] == NULL)
+	      memory_error_and_abort("strdup");
     }
   else
     {
@@ -1452,11 +1447,12 @@ username_completion_function (text, state)
     }
   else
     {
-      value = xmalloc (2 + strlen (entry->pw_name));
+      int len = 2 + strlen(entry->pw_name);	    
+      value = xmalloc (len);
 
       *value = *text;
 
-      strcpy (value + first_char_loc, entry->pw_name);
+      strlcpy (value + first_char_loc, entry->pw_name, len - first_char_loc);
 
       if (first_char == '~')
 	rl_filename_completion_desired = 1;
@@ -1499,6 +1495,7 @@ filename_completion_function (text, state)
       FREE (users_dirname);
 
       filename = savestring (text);
+      filename_len = strlen(filename);
       if (*text == 0)
 	text = ".";
       dirname = savestring (text);
@@ -1513,14 +1510,15 @@ filename_completion_function (text, state)
 
       if (temp)
 	{
-	  strcpy (filename, ++temp);
+	  strlcpy (filename, ++temp, filename_len);
 	  *temp = '\0';
 	}
 #if defined (__MSDOS__)
       /* searches from current directory on the drive */
       else if (isalpha (dirname[0]) && dirname[1] == ':')
         {
-          strcpy (filename, dirname + 2);
+	  /* XXX DOS strlcpy anyone? */	
+          strlcpy (filename, dirname + 2, filename_len);
           dirname[2] = '\0';
         }
 #endif
@@ -1625,11 +1623,13 @@ filename_completion_function (text, state)
       /* dirname && (strcmp (dirname, ".") != 0) */
       if (dirname && (dirname[0] != '.' || dirname[1]))
 	{
+	  int templen;	
 	  if (rl_complete_with_tilde_expansion && *users_dirname == '~')
 	    {
 	      dirlen = strlen (dirname);
-	      temp = xmalloc (2 + dirlen + D_NAMLEN (entry));
-	      strcpy (temp, dirname);
+	      templen = 2 + dirlen + D_NAMLEN (entry);
+	      temp = xmalloc (templen);
+	      strlcpy (temp, dirname, templen);
 	      /* Canonicalization cuts off any final slash present.  We
 		 may need to add it back. */
 	      if (dirname[dirlen - 1] != '/')
@@ -1641,11 +1641,12 @@ filename_completion_function (text, state)
 	  else
 	    {
 	      dirlen = strlen (users_dirname);
-	      temp = xmalloc (1 + dirlen + D_NAMLEN (entry));
-	      strcpy (temp, users_dirname);
+	      templen = 1 + dirlen + D_NAMLEN (entry);
+	      temp = xmalloc (templen);
+	      strlcpy (temp, users_dirname, templen);
 	    }
 
-	  strcpy (temp + dirlen, entry->d_name);
+	  strlcat (temp, entry->d_name, templen);
 	}
       else
 	temp = savestring (entry->d_name);
diff --git a/gnu/lib/libreadline/display.c b/gnu/lib/libreadline/display.c
index 4487004a027..c26bdf44c7a 100644
--- a/gnu/lib/libreadline/display.c
+++ b/gnu/lib/libreadline/display.c
@@ -501,7 +501,7 @@ rl_redisplay ()
 	{
 	  if (_rl_output_meta_chars == 0)
 	    {
-	      sprintf (line + out, "\\%o", c);
+	      snprintf (line + out, line_size - out, "\\%o", c);
 
 	      if (lpos + 4 >= screenwidth)
 		{
@@ -1092,8 +1092,8 @@ rl_on_new_line_with_prompt ()
 
   /* Make sure the line structures hold the already-displayed prompt for
      redisplay. */
-  strcpy (visible_line, rl_prompt);
-  strcpy (invisible_line, rl_prompt);
+  strlcpy (visible_line, rl_prompt, line_size);
+  strlcpy (invisible_line, rl_prompt, line_size);
 
   /* If the prompt contains newlines, take the last tail. */
   prompt_last_line = strrchr (rl_prompt, '\n');
@@ -1312,7 +1312,7 @@ rl_message (va_alist)
   format = va_arg (args, char *);
 #endif
 
-  vsprintf (msg_buf, format, args);
+  vsnprintf (msg_buf, sizeof(msg_buf), format, args);
   va_end (args);
 
   rl_display_prompt = msg_buf;
@@ -1324,7 +1324,7 @@ int
 rl_message (format, arg1, arg2)
      char *format;
 {
-  sprintf (msg_buf, format, arg1, arg2);
+  snprintf (msg_buf, sizeof(msg_buf), format, arg1, arg2);
   rl_display_prompt = msg_buf;
   (*rl_redisplay_function) ();
   return 0;
@@ -1395,7 +1395,7 @@ _rl_make_prompt_for_search (pchar)
       len = (rl_prompt && *rl_prompt) ? strlen (rl_prompt) : 0;
       pmt = xmalloc (len + 2);
       if (len)
-	strcpy (pmt, rl_prompt);
+	strlcpy (pmt, rl_prompt, len + 2);
       pmt[len] = pchar;
       pmt[len+1] = '\0';
     }
@@ -1404,7 +1404,7 @@ _rl_make_prompt_for_search (pchar)
       len = *saved_local_prompt ? strlen (saved_local_prompt) : 0;
       pmt = xmalloc (len + 2);
       if (len)
-	strcpy (pmt, saved_local_prompt);
+	strlcpy (pmt, saved_local_prompt, len + 2);
       pmt[len] = pchar;
       pmt[len+1] = '\0';
       local_prompt = savestring (pmt);
diff --git a/gnu/lib/libreadline/histexpand.c b/gnu/lib/libreadline/histexpand.c
index 78da3e585a6..4c42a213c0e 100644
--- a/gnu/lib/libreadline/histexpand.c
+++ b/gnu/lib/libreadline/histexpand.c
@@ -341,7 +341,7 @@ hist_error(s, start, current, errtype)
       int start, current, errtype;
 {
   char *temp, *emsg;
-  int ll, elen;
+  int ll, elen, len;
 
   ll = current - start;
 
@@ -373,11 +373,11 @@ hist_error(s, start, current, errtype)
       break;
     }
 
-  temp = xmalloc (ll + elen + 3);
+  len = ll + elen + 3; 
+  temp = xmalloc (len);
   strncpy (temp, s + start, ll);
-  temp[ll] = ':';
-  temp[ll + 1] = ' ';
-  strcpy (temp + ll + 2, emsg);
+  strlcat (temp, ": ", len);
+  strlcat (temp, emsg, len);
   return (temp);
 }
 
@@ -443,7 +443,7 @@ postproc_subst_rhs ()
 	{
 	  if (j + subst_lhs_len >= new_size)
 	    new = xrealloc (new, (new_size = new_size * 2 + subst_lhs_len));
-	  strcpy (new + j, subst_lhs);
+	  strlcpy (new + j, subst_lhs, new_size - j);
 	  j += subst_lhs_len;
 	}
       else
@@ -754,7 +754,7 @@ history_expand_internal (string, start, end_index_ptr, ret_string, current_line)
   n = strlen (temp);
   if (n >= result_len)
     result = xrealloc (result, n + 2);
-  strcpy (result, temp);
+  strlcpy (result, temp, n + 2);
   free (temp);
 
   *end_index_ptr = i;
@@ -786,7 +786,7 @@ history_expand_internal (string, start, end_index_ptr, ret_string, current_line)
 		  result_len += 128; \
 		result = xrealloc (result, result_len); \
 	      } \
-	    strcpy (result + j - sl, s); \
+	    strlcpy (result + j - sl, s, result_len - j + sl); \
 	  } \
 	while (0)
 
@@ -847,7 +847,7 @@ history_expand (hstring, output)
       string[0] = string[1] = history_expansion_char;
       string[2] = ':';
       string[3] = 's';
-      strcpy (string + 4, hstring);
+      strlcpy (string + 4, hstring, l - 4);
       l += 4;
     }
   else
@@ -966,7 +966,7 @@ history_expand (hstring, output)
 	  if (i == 0 || member (string[i - 1], HISTORY_WORD_DELIMITERS))
 	    {
 	      temp = xmalloc (l - i + 1);
-	      strcpy (temp, string + i);
+	      strlcpy (temp, string + i, l - i + 1);
 	      ADD_STRING (temp);
 	      free (temp);
 	      i = l;
@@ -998,7 +998,7 @@ history_expand (hstring, output)
 	      if (result)
 		{
 		  temp = xmalloc (1 + strlen (result));
-		  strcpy (temp, result);
+		  strlcpy (temp, result, 1 + strlen(result));
 		  ADD_STRING (temp);
 		  free (temp);
 		}
@@ -1192,7 +1192,7 @@ history_arg_extract (first, last, string)
 
       for (i = first, offset = 0; i < last; i++)
 	{
-	  strcpy (result + offset, list[i]);
+	  strlcpy (result + offset, list[i], size + 1 - offset);
 	  offset += strlen (list[i]);
 	  if (i + 1 < last)
 	    {
diff --git a/gnu/lib/libreadline/histfile.c b/gnu/lib/libreadline/histfile.c
index 0b3135d2a6b..ad200d3051b 100644
--- a/gnu/lib/libreadline/histfile.c
+++ b/gnu/lib/libreadline/histfile.c
@@ -88,6 +88,7 @@ history_filename (filename)
 {
   char *return_val, *home;
   int home_len;
+  char dot;
 
   return_val = filename ? savestring (filename) : (char *)NULL;
 
@@ -102,15 +103,13 @@ history_filename (filename)
   }
   home_len = strlen (home);
 
-  return_val = xmalloc (2 + home_len + 8); /* strlen(".history") == 8 */
-  strcpy (return_val, home);
-  return_val[home_len] = '/';
 #if defined (__MSDOS__)
-  strcpy (return_val + home_len + 1, "_history");
+  dot = '_';
 #else
-  strcpy (return_val + home_len + 1, ".history");
+  dot = '.';
 #endif
-
+  if (asprintf(&return_val, "%s/%c%s", home, dot, "history") == -1)
+	  memory_error_and_abort("asprintf");
   return (return_val);
 }
 
@@ -335,7 +334,6 @@ history_do_write (filename, nelements, overwrite)
      Suggested by Peter Ho (peter@robosts.oxford.ac.uk). */
   {
     HIST_ENTRY **the_history;	/* local */
-    register int j;
     int buffer_size;
     char *buffer;
 
@@ -346,12 +344,12 @@ history_do_write (filename, nelements, overwrite)
 
     /* Allocate the buffer, and fill it. */
     buffer = xmalloc (buffer_size);
+    buffer[0] = '\0';
 
-    for (j = 0, i = history_length - nelements; i < history_length; i++)
+    for (i = history_length - nelements; i < history_length; i++)
       {
-	strcpy (buffer + j, the_history[i]->line);
-	j += strlen (the_history[i]->line);
-	buffer[j++] = '\n';
+	strlcat (buffer, the_history[i]->line, buffer_size);
+	strlcat (buffer, "\n", buffer_size);
       }
 
     write (file, buffer, buffer_size);
diff --git a/gnu/lib/libreadline/histlib.h b/gnu/lib/libreadline/histlib.h
index 88a34d10f1d..e509381791f 100644
--- a/gnu/lib/libreadline/histlib.h
+++ b/gnu/lib/libreadline/histlib.h
@@ -37,12 +37,10 @@ typedef char **CPPFunction ();
 				    : ((a)[0] == (b)[0]) && (strncmp ((a), (b), (n)) == 0))
 #endif
 
-#ifndef savestring
-#  ifndef strcpy
-extern char *strcpy ();
-#  endif
-#define savestring(x) strcpy (xmalloc (1 + strlen (x)), (x))
-#endif
+#if !defined (savestring)
+extern char *xstrdup (char *);
+#define savestring(x) xstrdup(x)
+#endif /* !savestring */
 
 #ifndef whitespace
 #define whitespace(c) (((c) == ' ') || ((c) == '\t'))
diff --git a/gnu/lib/libreadline/isearch.c b/gnu/lib/libreadline/isearch.c
index 952c10ddf8e..be051203335 100644
--- a/gnu/lib/libreadline/isearch.c
+++ b/gnu/lib/libreadline/isearch.c
@@ -93,17 +93,18 @@ rl_display_search (search_string, reverse_p, where)
      int reverse_p, where;
 {
   char *message;
-  int msglen, searchlen;
+  int msglen, searchlen, mlen;
 
   searchlen = (search_string && *search_string) ? strlen (search_string) : 0;
 
-  message = xmalloc (searchlen + 33);
+  mlen = searchlen + 33;
+  message = xmalloc (mlen);
   msglen = 0;
 
 #if defined (NOTDEF)
   if (where != -1)
     {
-      sprintf (message, "[%d]", where + history_base);
+      snprintf (message, mlen, "[%d]", where + history_base);
       msglen = strlen (message);
     }
 #endif /* NOTDEF */
@@ -112,20 +113,17 @@ rl_display_search (search_string, reverse_p, where)
 
   if (reverse_p)
     {
-      strcpy (message + msglen, "reverse-");
-      msglen += 8;
+      strlcat (message, "reverse-", mlen);
     }
 
-  strcpy (message + msglen, "i-search)`");
-  msglen += 10;
+  strlcat (message, "i-search)`", mlen);
 
   if (search_string)
     {
-      strcpy (message + msglen, search_string);
-      msglen += searchlen;
+      strlcat (message, search_string, mlen);
     }
 
-  strcpy (message + msglen, "': ");
+  strlcat (message, "': ", mlen);
 
   rl_message ("%s", message, 0);
   free (message);
@@ -202,8 +200,9 @@ rl_search_history (direction, invoking_key)
   else
     {
       /* Keep track of this so we can free it. */
-      allocated_line = xmalloc (1 + strlen (rl_line_buffer));
-      strcpy (allocated_line, &rl_line_buffer[0]);
+      allocated_line = strdup(rl_line_buffer);
+      if (allocated_line == NULL)
+	      memory_error_and_abort("strdup");
       lines[i] = allocated_line;
     }
 
@@ -297,7 +296,7 @@ rl_search_history (direction, invoking_key)
 	  break;
 
 	case CTRL ('G'):
-	  strcpy (rl_line_buffer, lines[orig_line]);
+	  strlcpy (rl_line_buffer, lines[orig_line], rl_line_buffer_len);
 	  rl_point = orig_point;
 	  rl_end = strlen (rl_line_buffer);
 	  rl_restore_prompt();
@@ -402,7 +401,7 @@ rl_search_history (direction, invoking_key)
 	  if (line_len >= rl_line_buffer_len)
 	    rl_extend_line_buffer (line_len);
 
-	  strcpy (rl_line_buffer, lines[i]);
+	  strlcpy (rl_line_buffer, lines[i], rl_line_buffer_len);
 	  rl_point = line_index;
 	  rl_end = line_len;
 	  last_found_line = i;
@@ -416,7 +415,7 @@ rl_search_history (direction, invoking_key)
      not found.  We use this to determine where to place rl_point. */
 
   /* First put back the original state. */
-  strcpy (rl_line_buffer, lines[orig_line]);
+  strlcpy (rl_line_buffer, lines[orig_line], rl_line_buffer_len);
 
   rl_restore_prompt ();
 
diff --git a/gnu/lib/libreadline/kill.c b/gnu/lib/libreadline/kill.c
index c3241bdadd0..b30dd707627 100644
--- a/gnu/lib/libreadline/kill.c
+++ b/gnu/lib/libreadline/kill.c
@@ -128,18 +128,20 @@ _rl_copy_to_kill_ring (text, append)
   /* If the last command was a kill, prepend or append. */
   if (_rl_last_command_was_kill && rl_editing_mode != vi_mode)
     {
+      int len;
       old = rl_kill_ring[slot];
-      new = xmalloc (1 + strlen (old) + strlen (text));
+      len = 1 + strlen (old) + strlen (text);
+      new = xmalloc (len);
 
       if (append)
 	{
-	  strcpy (new, old);
-	  strcat (new, text);
+	  strlcpy (new, old, len);
+	  strlcat (new, text, len);
 	}
       else
 	{
-	  strcpy (new, text);
-	  strcat (new, old);
+	  strlcpy (new, text, len);
+	  strlcat (new, old, len);
 	}
       free (old);
       free (text);
diff --git a/gnu/lib/libreadline/readline.c b/gnu/lib/libreadline/readline.c
index 2c6aef68f48..5ccc001748a 100644
--- a/gnu/lib/libreadline/readline.c
+++ b/gnu/lib/libreadline/readline.c
@@ -341,7 +341,7 @@ readline_internal_teardown (eof)
       entry = replace_history_entry (where_history (), the_line, (histdata_t)NULL);
       _rl_free_history_entry (entry);
 
-      strcpy (the_line, temp);
+      strlcpy (the_line, temp, rl_line_buffer_len);
       free (temp);
     }
 
@@ -1865,7 +1865,7 @@ maybe_unsave_line ()
       if (line_len >= rl_line_buffer_len)
 	rl_extend_line_buffer (line_len);
 
-      strcpy (the_line, saved_line_for_history->line);
+      strlcpy (the_line, saved_line_for_history->line, rl_line_buffer_len);
       rl_undo_list = (UNDO_LIST *)saved_line_for_history->data;
       _rl_free_history_entry (saved_line_for_history);
       saved_line_for_history = (HIST_ENTRY *)NULL;
@@ -1948,7 +1948,7 @@ rl_get_next_history (count, key)
       if (line_len >= rl_line_buffer_len)
 	rl_extend_line_buffer (line_len);
 
-      strcpy (the_line, temp->line);
+      strlcpy (the_line, temp->line, rl_line_buffer_len);
       rl_undo_list = (UNDO_LIST *)temp->data;
       rl_end = rl_point = strlen (the_line);
 #if defined (VI_MODE)
@@ -2005,7 +2005,7 @@ rl_get_previous_history (count, key)
       if (line_len >= rl_line_buffer_len)
 	rl_extend_line_buffer (line_len);
 
-      strcpy (the_line, temp->line);
+      strlcpy (the_line, temp->line, rl_line_buffer_len);
       rl_undo_list = (UNDO_LIST *)temp->data;
       rl_end = rl_point = line_len;
 
diff --git a/gnu/lib/libreadline/rldefs.h b/gnu/lib/libreadline/rldefs.h
index e504d9b1c30..35bdafccc23 100644
--- a/gnu/lib/libreadline/rldefs.h
+++ b/gnu/lib/libreadline/rldefs.h
@@ -93,10 +93,11 @@ extern int _rl_stricmp (), _rl_strnicmp ();
 #  define KEYMAP_TO_FUNCTION(data)	(Function *)(data)
 #endif
 
-#ifndef savestring
 extern char *xmalloc ();
-#define savestring(x) strcpy (xmalloc (1 + strlen (x)), (x))
-#endif
+#if !defined (savestring)
+extern char *xstrdup (char *);
+#define savestring(x) xstrdup(x)
+#endif /* !savestring */
 
 /* Possible values for _rl_bell_preference. */
 #define NO_BELL 0
diff --git a/gnu/lib/libreadline/savestring.c b/gnu/lib/libreadline/savestring.c
index 0916ab8b0a4..679adeb86e1 100644
--- a/gnu/lib/libreadline/savestring.c
+++ b/gnu/lib/libreadline/savestring.c
@@ -22,14 +22,25 @@
 
 #include <string.h>
 
-extern char *strcpy ();
-extern char *xmalloc ();
+extern char * xmalloc();
+extern void memory_error_and_abort(char *);
 
 /* Backwards compatibility, now that savestring has been removed from
    all `public' readline header files. */
+
+char *
+xstrdup(char *s) 
+{
+	char * cp;
+	cp = strdup(s);
+	if (cp == NULL)
+		memory_error_and_abort("savestring");
+	return(cp);
+}
+
 char *
 savestring (s)
      char *s;
 {
-  return ((char *)strcpy (xmalloc (1 + (int)strlen (s)), (s)));
+	return(xstrdup(s));
 }
diff --git a/gnu/lib/libreadline/search.c b/gnu/lib/libreadline/search.c
index 112f8072866..8a6d42b12a3 100644
--- a/gnu/lib/libreadline/search.c
+++ b/gnu/lib/libreadline/search.c
@@ -78,7 +78,7 @@ make_history_line_current (entry)
   line_len = strlen (entry->line);
   if (line_len >= rl_line_buffer_len)
     rl_extend_line_buffer (line_len);
-  strcpy (rl_line_buffer, entry->line);
+  strlcpy (rl_line_buffer, entry->line, rl_line_buffer_len);
 
   rl_undo_list = (UNDO_LIST *)entry->data;
   rl_end = line_len;
diff --git a/gnu/lib/libreadline/shell.c b/gnu/lib/libreadline/shell.c
index 3daef69b4c2..a51e45482b3 100644
--- a/gnu/lib/libreadline/shell.c
+++ b/gnu/lib/libreadline/shell.c
@@ -102,19 +102,20 @@ set_lines_and_columns (lines, cols)
   char *b;
 
 #if defined (HAVE_PUTENV)
-  b = xmalloc (24);
-  sprintf (b, "LINES=%d", lines);
+  if (asprintf (&b, "LINES=%d", lines) == -1)
+	  memory_error_and_abort("asprintf");
   putenv (b);
   b = xmalloc (24);
-  sprintf (b, "COLUMNS=%d", cols);
+  if (asprintf (&b, "COLUMNS=%d", cols) == -1)
+	  memory_error_and_abort("asprintf");
   putenv (b);
 #else /* !HAVE_PUTENV */
 #  if defined (HAVE_SETENV)
-  b = xmalloc (8);
-  sprintf (b, "%d", lines);
+  if (asprintf(&b, "%d", lines) == -1)
+	  memory_error_and_abort("asprintf");
   setenv ("LINES", b, 1);
-  b = xmalloc (8);
-  sprintf (b, "%d", cols);
+  if (asprintf (&b, "%d", cols) == -1)
+	  memory_error_and_abort("asprintf");
   setenv ("COLUMNS", b, 1);
 #  endif /* HAVE_SETENV */
 #endif /* !HAVE_PUTENV */
diff --git a/gnu/lib/libreadline/tilde.c b/gnu/lib/libreadline/tilde.c
index 009c6992396..c82291be6ae 100644
--- a/gnu/lib/libreadline/tilde.c
+++ b/gnu/lib/libreadline/tilde.c
@@ -63,11 +63,9 @@ extern struct passwd *getpwuid (), *getpwnam ();
 #endif /* !HAVE_GETPW_DECLS */
 
 #if !defined (savestring)
-#  ifndef strcpy
-extern char *strcpy ();
-#  endif
-#define savestring(x) strcpy (xmalloc (1 + strlen (x)), (x))
-#endif /* !savestring */
+extern char *xstrdup (char *);
+#define savestring(x) xstrdup(x)
+#endif /* !savestring  */
 
 #if !defined (NULL)
 #  if defined (__STDC__)
@@ -244,7 +242,8 @@ tilde_expand (string)
 	  if ((result_index + len + 1) > result_size)
 	    result = xrealloc (result, 1 + (result_size += (len + 20)));
 
-	  strcpy (result + result_index, expansion);
+	  strlcpy (result + result_index, expansion,
+		   result_size - result_index);
 	  result_index += len;
 	}
       free (expansion);
@@ -293,8 +292,8 @@ glue_prefix_and_suffix (prefix, suffix, suffind)
   slen = strlen (suffix + suffind);
   ret = xmalloc (plen + slen + 1);
   if (plen)
-    strcpy (ret, prefix);
-  strcpy (ret + plen, suffix + suffind);
+    strlcpy (ret, prefix, plen + slen + 1);
+  strlcat (ret, suffix + suffind, plen + slen + 1);
   return ret;
 }
 
@@ -396,7 +395,7 @@ main (argc, argv)
       fflush (stdout);
 
       if (!gets (line))
-	strcpy (line, "done");
+	strlcpy (line, "done", sizeof(line));
 
       if ((strcmp (line, "done") == 0) ||
 	  (strcmp (line, "quit") == 0) ||
diff --git a/gnu/lib/libreadline/util.c b/gnu/lib/libreadline/util.c
index be9e0a9869a..e96a401dfd3 100644
--- a/gnu/lib/libreadline/util.c
+++ b/gnu/lib/libreadline/util.c
@@ -347,5 +347,9 @@ char *
 _rl_savestring (s)
      char *s;
 {
-  return ((char *)strcpy (xmalloc (1 + (int)strlen (s)), (s)));
+	char *cp;
+	cp = strdup(s);
+	if (cp == NULL)
+		memory_error_and_abort ("savestring");
+	return(cp);
 }
diff --git a/gnu/lib/libreadline/xmalloc.c b/gnu/lib/libreadline/xmalloc.c
index c0d06403a3c..0393c29f2ff 100644
--- a/gnu/lib/libreadline/xmalloc.c
+++ b/gnu/lib/libreadline/xmalloc.c
@@ -40,7 +40,7 @@
 /*								    */
 /* **************************************************************** */
 
-static void
+void
 memory_error_and_abort (fname)
      char *fname;
 {
diff --git a/gnu/lib/libreadline/xmalloc.h b/gnu/lib/libreadline/xmalloc.h
index bdf251b070a..898d3906f09 100644
--- a/gnu/lib/libreadline/xmalloc.h
+++ b/gnu/lib/libreadline/xmalloc.h
@@ -42,5 +42,5 @@
 extern char *xmalloc __P((int));
 extern char *xrealloc __P((void *, int));
 extern void xfree __P((void *));
-
+extern void memory_error_and_abort __P((char *));
 #endif /* _XMALLOC_H_ */