Use strlcpy() / strlcat() throughout.

22 files changed, 115 insertions, 99 deletions

diff --git a/lib/libcurses/tinfo/access.c b/lib/libcurses/tinfo/access.c
index 7a2bc501c50..a4a184e699c 100644
--- a/lib/libcurses/tinfo/access.c
+++ b/lib/libcurses/tinfo/access.c
@@ -57,14 +57,14 @@ _nc_access(const char *path, int mode)
 	if ((mode & W_OK) != 0
 	    && errno == ENOENT
 	    && strlen(path) < PATH_MAX) {
-	    char head[PATH_MAX];
-	    char *leaf = _nc_basename(strcpy(head, path));
+	    char *leaf, head[PATH_MAX];
 
-	    if (leaf == 0)
+	    strlcpy(head, path, sizeof(head));
+	    if ((leaf = _nc_basename(head)) == 0)
 		leaf = head;
 	    *leaf = '\0';
 	    if (head == leaf)
-		(void) strcpy(head, ".");
+		(void) strlcpy(head, ".", sizeof(head));
 
 	    return access(head, R_OK | W_OK | X_OK);
 	}
diff --git a/lib/libcurses/tinfo/alloc_entry.c b/lib/libcurses/tinfo/alloc_entry.c
index 8429ab5fbbc..b0bab761de8 100644
--- a/lib/libcurses/tinfo/alloc_entry.c
+++ b/lib/libcurses/tinfo/alloc_entry.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: alloc_entry.c,v 1.4 2001/01/22 18:01:50 millert Exp $	*/
+/*	$OpenBSD: alloc_entry.c,v 1.5 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
@@ -109,10 +109,10 @@ _nc_save_str(const char *const string)
 /* save a copy of string in the string buffer */
 {
     size_t old_next_free = next_free;
-    size_t len = strlen(string) + 1;
+    size_t len;
 
-    if (next_free + len < MAX_STRTAB) {
-	strcpy(&stringbuf[next_free], string);
+    len = strlcpy(stringbuf + next_free, string, sizeof(stringbuf) - next_free);
+    if (++len < sizeof(stringbuf) - next_free) {
 	DEBUG(7, ("Saved string %s", _nc_visbuf(string)));
 	DEBUG(7, ("at location %d", (int) next_free));
 	next_free += len;
@@ -183,17 +183,21 @@ _nc_wrap_entry(ENTRY * const ep, bool copy_strings)
 #if NCURSES_XNAMES
     if (!copy_strings) {
 	if ((n = NUM_EXT_NAMES(tp)) != 0) {
-	    unsigned length = 0;
+	    size_t copied, length, strtabsize = 0;
 	    for (i = 0; i < n; i++) {
-		length += strlen(tp->ext_Names[i]) + 1;
+		strtabsize += strlen(tp->ext_Names[i]) + 1;
 		offsets[i] = tp->ext_Names[i] - stringbuf;
 	    }
-	    if ((tp->ext_str_table = typeMalloc(char, length)) == 0)
+	    if ((tp->ext_str_table = typeMalloc(char, strtabsize)) == 0)
 		  _nc_err_abort("Out of memory");
 	    for (i = 0, length = 0; i < n; i++) {
 		tp->ext_Names[i] = tp->ext_str_table + length;
-		strcpy(tp->ext_Names[i], stringbuf + offsets[i]);
-		length += strlen(tp->ext_Names[i]) + 1;
+		copied = strlcpy(tp->ext_Names[i], stringbuf + offsets[i],
+		    strtabsize) + 1;
+		if (copied > strtabsize)
+		    _nc_err_abort("Buffer overflow");
+		length += copied;
+		strtabsize -= copied;
 	    }
 	}
     }
diff --git a/lib/libcurses/tinfo/captoinfo.c b/lib/libcurses/tinfo/captoinfo.c
index 6688647771c..4b9323e8a7f 100644
--- a/lib/libcurses/tinfo/captoinfo.c
+++ b/lib/libcurses/tinfo/captoinfo.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: captoinfo.c,v 1.10 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: captoinfo.c,v 1.11 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -128,14 +128,16 @@ save_string(char *d, const char *const s)
 {
     size_t have = (d - my_string);
     size_t need = have + strlen(s) + 2;
+    size_t copied;
     if (need > my_length) {
 	my_string = (char *) realloc(my_string, my_length = (need + need));
 	if (my_string == 0)
 	    _nc_err_abort("Out of memory");
 	d = my_string + have;
     }
-    (void) strcpy(d, s);
-    return d + strlen(d);
+    if ((copied = strlcpy(d, s, my_length - have)) >= my_length - have)
+	_nc_err_abort("Buffer overflow");
+    return d + copied;
 }
 
 static inline char *
@@ -599,7 +601,7 @@ save_tc_char(char *bufptr, int c1)
 	bufptr = save_char(bufptr, c1);
     } else {
 	if (c1 == (c1 & 0x1f))	/* iscntrl() returns T on 255 */
-	    (void) strcpy(temp, unctrl((chtype) c1));
+	    (void) strlcpy(temp, unctrl((chtype) c1), sizeof(temp));
 	else
 	    (void) snprintf(temp, sizeof(temp), "\\%03o", c1);
 	bufptr = save_string(bufptr, temp);
diff --git a/lib/libcurses/tinfo/comp_error.c b/lib/libcurses/tinfo/comp_error.c
index 13d427c9379..13259e1efc4 100644
--- a/lib/libcurses/tinfo/comp_error.c
+++ b/lib/libcurses/tinfo/comp_error.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: comp_error.c,v 1.4 2001/01/22 18:05:43 millert Exp $	*/
+/*	$OpenBSD: comp_error.c,v 1.5 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -62,15 +62,16 @@ _nc_set_source(const char *const name)
 NCURSES_EXPORT(void)
 _nc_set_type(const char *const name)
 {
-    termtype[0] = '\0';
     if (name)
-	strncat(termtype, name, sizeof(termtype) - 1);
+	strlcpy(termtype, name, sizeof(termtype));
+    else
+    	termtype[0] = '\0';
 }
 
 NCURSES_EXPORT(void)
 _nc_get_type(char *name)
 {
-    strcpy(name, termtype);
+    strlcpy(name, termtype, MAX_NAME_SIZE + 1);
 }
 
 static inline void
diff --git a/lib/libcurses/tinfo/comp_hash.c b/lib/libcurses/tinfo/comp_hash.c
index 6a21fbbf505..172c3fc946a 100644
--- a/lib/libcurses/tinfo/comp_hash.c
+++ b/lib/libcurses/tinfo/comp_hash.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: comp_hash.c,v 1.5 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: comp_hash.c,v 1.6 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998 Free Software Foundation, Inc.                        *
@@ -309,7 +309,8 @@ int main(int argc, char **argv)
 				 root_name,
 				(long) (hash_table[n] - name_table));
 		} else {
-			strcpy(buffer, "0");
+			buffer[0] = '0';
+			buffer[1] = '\0';
 		}
 		printf("\t%s,\n", buffer);
 	}
diff --git a/lib/libcurses/tinfo/comp_parse.c b/lib/libcurses/tinfo/comp_parse.c
index 7a8992726ac..4c9b83497d3 100644
--- a/lib/libcurses/tinfo/comp_parse.c
+++ b/lib/libcurses/tinfo/comp_parse.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: comp_parse.c,v 1.10 2001/01/22 18:01:51 millert Exp $	*/
+/*	$OpenBSD: comp_parse.c,v 1.11 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -132,9 +132,10 @@ force_bar(char *dst, char *src, size_t siz)
 	size_t len;
 
 	len = strlcpy(dst, src, siz);
-	if (len >= siz - 2)
-	    len = siz - 2;;
-	(void) strcpy(dst + len, "|");
+	if (len > siz - 2)
+	    len = siz - 2;
+	dst[len++] = '|';
+	dst[len] = '\0';
 	src = dst;
     }
     return src;
diff --git a/lib/libcurses/tinfo/comp_scan.c b/lib/libcurses/tinfo/comp_scan.c
index 1b6607d8f75..a241322f188 100644
--- a/lib/libcurses/tinfo/comp_scan.c
+++ b/lib/libcurses/tinfo/comp_scan.c
@@ -766,7 +766,7 @@ next_char(void)
 		    }
 		} else {
 		    if (used != 0)
-			strcat(result, "\n");
+			strlcat(result, "\n", allocated);
 		}
 		if ((bufptr = bufstart) != 0) {
 		    used = strlen(bufptr);
diff --git a/lib/libcurses/tinfo/doalloc.c b/lib/libcurses/tinfo/doalloc.c
index 14628653065..54659f55888 100644
--- a/lib/libcurses/tinfo/doalloc.c
+++ b/lib/libcurses/tinfo/doalloc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: doalloc.c,v 1.5 2001/01/22 18:01:51 millert Exp $	*/
+/*	$OpenBSD: doalloc.c,v 1.6 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
@@ -64,10 +64,12 @@ NCURSES_EXPORT(char *)
 _nc_strdup(const char *src)
 {
     char *dst;
+    size_t dsize;
     if (src != 0) {
-	dst = typeMalloc(char, strlen(src) + 1);
+	dsize = strlen(src) + 1;
+	dst = typeMalloc(char, dsize);
 	if (dst != 0) {
-	    (void) strcpy(dst, src);
+	    (void) strlcpy(dst, src, dsize);
 	}
     } else {
 	dst = 0;
diff --git a/lib/libcurses/tinfo/lib_print.c b/lib/libcurses/tinfo/lib_print.c
index 0bb6b5a4c6b..9a5b3157e07 100644
--- a/lib/libcurses/tinfo/lib_print.c
+++ b/lib/libcurses/tinfo/lib_print.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_print.c,v 1.3 2001/01/22 18:01:53 millert Exp $	*/
+/*	$OpenBSD: lib_print.c,v 1.4 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
@@ -62,15 +62,16 @@ mcprint(char *data, int len)
 	offsize = strlen(prtr_off);
     }
 
-    if ((mybuf = typeMalloc(char, onsize + len + offsize + 1)) == (char *) 0) {
+    res = onsize + len + offsize + 1;
+    if ((mybuf = typeMalloc(char, res)) == (char *) 0) {
 	errno = ENOMEM;
 	return (ERR);
     }
 
-    (void) strcpy(mybuf, switchon);
+    (void) strlcpy(mybuf, switchon, res);
     memcpy(mybuf + onsize, data, len);
     if (offsize)
-	(void) strcpy(mybuf + onsize + len, prtr_off);
+	(void) strlcpy(mybuf + onsize + len, prtr_off, res - onsize - len);
 
     /*
      * We're relying on the atomicity of UNIX writes here.  The
diff --git a/lib/libcurses/tinfo/lib_termcap.c b/lib/libcurses/tinfo/lib_termcap.c
index 94173a7a576..b307aac5754 100644
--- a/lib/libcurses/tinfo/lib_termcap.c
+++ b/lib/libcurses/tinfo/lib_termcap.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_termcap.c,v 1.8 2001/01/22 18:01:53 millert Exp $	*/
+/*	$OpenBSD: lib_termcap.c,v 1.9 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -187,7 +187,7 @@ tgetstr
 		if (area != 0
 		    && *area != 0
 		    && VALID_STRING(tp->Strings[i])) {
-		    (void) strcpy(*area, tp->Strings[i]);
+		    (void) strlcpy(*area, tp->Strings[i], 1024);
 		    *area += strlen(*area) + 1;
 		}
 		returnPtr(tp->Strings[i]);
diff --git a/lib/libcurses/tinfo/lib_termname.c b/lib/libcurses/tinfo/lib_termname.c
index f063c300fb8..8e744f1ed31 100644
--- a/lib/libcurses/tinfo/lib_termname.c
+++ b/lib/libcurses/tinfo/lib_termname.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_termname.c,v 1.3 2001/01/22 18:01:53 millert Exp $	*/
+/*	$OpenBSD: lib_termname.c,v 1.4 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
@@ -42,8 +42,7 @@ termname(void)
     T(("termname() called"));
 
     if (name != 0) {
-	ret[0] = '\0';
-	(void) strncat(ret, name, sizeof(ret) - 1);
+	(void) strlcpy(ret, name, sizeof(ret));
 	name = ret;
     }
     return name;
diff --git a/lib/libcurses/tinfo/lib_tgoto.c b/lib/libcurses/tinfo/lib_tgoto.c
index b3f9f86ab45..bb7fb9c2670 100644
--- a/lib/libcurses/tinfo/lib_tgoto.c
+++ b/lib/libcurses/tinfo/lib_tgoto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_tgoto.c,v 1.3 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: lib_tgoto.c,v 1.4 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 2000 Free Software Foundation, Inc.                        *
@@ -77,6 +77,7 @@ tgoto_internal(const char *string, int x, int y)
     int param[3];
     size_t used = 0;
     size_t need = 10;
+    size_t copied;
     int *value = param;
     bool need_BC = FALSE;
 
@@ -175,8 +176,11 @@ tgoto_internal(const char *string, int x, int y)
 	string++;
     }
     if (need_BC) {
-	strcpy(result + used, BC);
-	used += strlen(BC);
+	copied = strlcpy(result + used, BC, length - used);
+	if (copied < length - used)
+	    used += copied;
+	else
+	    used += length - used - 1;
     }
     result[used] = '\0';
     return result;
diff --git a/lib/libcurses/tinfo/lib_tputs.c b/lib/libcurses/tinfo/lib_tputs.c
index 046dc70c512..634d0317114 100644
--- a/lib/libcurses/tinfo/lib_tputs.c
+++ b/lib/libcurses/tinfo/lib_tputs.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_tputs.c,v 1.10 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: lib_tputs.c,v 1.11 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -194,7 +194,7 @@ tputs
 
     if (_nc_tracing & TRACE_TPUTS) {
 	if (outc == _nc_outch)
-	    (void) strcpy(addrbuf, "_nc_outch");
+	    (void) strlcpy(addrbuf, "_nc_outch", sizeof(addrbuf));
 	else
 	    (void) snprintf(addrbuf, sizeof(addrbuf), "%p", outc);
 	if (_nc_tputs_trace) {
diff --git a/lib/libcurses/tinfo/read_entry.c b/lib/libcurses/tinfo/read_entry.c
index 8c31ca39dd3..cfd9272d95f 100644
--- a/lib/libcurses/tinfo/read_entry.c
+++ b/lib/libcurses/tinfo/read_entry.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: read_entry.c,v 1.13 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: read_entry.c,v 1.14 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -158,6 +158,7 @@ read_termtype(int fd, TERMTYPE * ptr)
 {
     int name_size, bool_count, num_count, str_count, str_size;
     int i;
+    size_t bsize;
     char buf[MAX_ENTRY_SIZE];
 
     TR(TRACE_DATABASE, ("READ termtype header @%d", tell(fd)));
@@ -202,11 +203,12 @@ read_termtype(int fd, TERMTYPE * ptr)
     /* grab the name (a null-terminate string) */
     read(fd, buf, min(MAX_NAME_SIZE, (unsigned) name_size));
     buf[MAX_NAME_SIZE] = '\0';
-    ptr->term_names = typeCalloc(char, strlen(buf) + 1);
+    bsize = strlen(buf) + 1;
+    ptr->term_names = typeCalloc(char, bsize);
     if (ptr->term_names == NULL) {
 	return (0);
     }
-    (void) strcpy(ptr->term_names, buf);
+    (void) strlcpy(ptr->term_names, buf, bsize);
     if (name_size > MAX_NAME_SIZE)
 	lseek(fd, (off_t) (name_size - MAX_NAME_SIZE), 1);
 
diff --git a/lib/libcurses/tinfo/read_termcap.c b/lib/libcurses/tinfo/read_termcap.c
index 0460854889f..7270233b71d 100644
--- a/lib/libcurses/tinfo/read_termcap.c
+++ b/lib/libcurses/tinfo/read_termcap.c
@@ -157,7 +157,7 @@ _nc_cgetset(const char *ent)
 	return (-1);
     }
     gottoprec = 0;
-    (void) strcpy(toprec, ent);
+    (void) strlcpy(toprec, ent, topreclen + 1);
     return (0);
 }
 
@@ -290,7 +290,7 @@ _nc_getent(
 	    errno = ENOMEM;
 	    return (TC_SYS_ERR);
 	}
-	(void) strcpy(record, toprec);
+	(void) strlcpy(record, toprec, topreclen + BFRAG);
 	rp = record + topreclen + 1;
 	r_end = rp + BFRAG;
 	current = in_array;
@@ -1017,7 +1017,7 @@ _nc_read_termcap_entry
 	if (use_terminfo_vars() && (h = getenv("HOME")) != NULL && *h != '\0'
 	    && (strlen(h) + sizeof(PRIVATE_CAP)) < PATH_MAX) {
 	    /* user's .termcap, if any, should override it */
-	    (void) strcpy(envhome, h);
+	    (void) strlcpy(envhome, h, sizeof(envhome));
 	    (void) snprintf(pathbuf, sizeof(pathbuf), PRIVATE_CAP, envhome);
 	    ADD_TC(pathbuf, filecount);
 	}
diff --git a/lib/libcurses/tinfo/strings.c b/lib/libcurses/tinfo/strings.c
index 4e3fcf1ea53..fd5d7f314b8 100644
--- a/lib/libcurses/tinfo/strings.c
+++ b/lib/libcurses/tinfo/strings.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: strings.c,v 1.2 2001/01/22 18:01:57 millert Exp $	*/
+/*	$OpenBSD: strings.c,v 1.3 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 2000 Free Software Foundation, Inc.                        *
@@ -113,7 +113,7 @@ _nc_safe_strcat(string_desc * dst, const char *src)
 
 	if (len < dst->s_size) {
 	    if (dst->s_tail != 0) {
-		strcpy(dst->s_tail, src);
+		strlcpy(dst->s_tail, src, dst->s_size);
 		dst->s_tail += len;
 	    }
 	    dst->s_size -= len;
@@ -134,7 +134,7 @@ _nc_safe_strcpy(string_desc * dst, const char *src)
 
 	if (len < dst->s_size) {
 	    if (dst->s_head != 0) {
-		strcpy(dst->s_head, src);
+		strlcpy(dst->s_head, src, dst->s_size);
 		dst->s_tail = dst->s_head + len;
 	    }
 	    dst->s_size -= len;
diff --git a/lib/libcurses/tinfo/write_entry.c b/lib/libcurses/tinfo/write_entry.c
index 97be60e8abe..9aff48b5ef0 100644
--- a/lib/libcurses/tinfo/write_entry.c
+++ b/lib/libcurses/tinfo/write_entry.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: write_entry.c,v 1.11 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: write_entry.c,v 1.12 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -90,9 +90,8 @@ make_directory(const char *path)
     const char *destination = _nc_tic_dir(0);
 
     if (path == destination || *path == '/') {
-	if (strlen(path) + 1 > sizeof(fullpath))
+	if (strlcpy(fullpath, path, sizeof(fullpath)) >= sizeof(fullpath))
 	    return (-1);
-	(void) strcpy(fullpath, path);
     } else {
 	if (strlen(destination) + strlen(path) + 2 > sizeof(fullpath))
 	    return (-1);
@@ -224,7 +223,7 @@ _nc_write_entry(TERMTYPE * const tp)
 	start_time = 0;
     }
 
-    (void) strcpy(name_list, tp->term_names);
+    (void) strlcpy(name_list, tp->term_names, sizeof(name_list));
     DEBUG(7, ("Name list = '%s'", name_list));
 
     first_name = name_list;
@@ -310,9 +309,8 @@ _nc_write_entry(TERMTYPE * const tp)
 	{
 	    int code;
 #if USE_SYMLINKS
-	    strcpy(symlinkname, "../");
-	    strncat(symlinkname, filename, sizeof(symlinkname) - 4);
-	    symlinkname[sizeof(symlinkname) - 1] = '\0';
+	    strlcpy(symlinkname, "../", sizeof(symlinkname));
+	    strlcat(symlinkname, filename, sizeof(symlinkname));
 #endif /* USE_SYMLINKS */
 #if HAVE_REMOVE
 	    code = remove(linkname);
diff --git a/lib/libcurses/trace/lib_traceatr.c b/lib/libcurses/trace/lib_traceatr.c
index 57c2ad5fc76..e1b813bc3d9 100644
--- a/lib/libcurses/trace/lib_traceatr.c
+++ b/lib/libcurses/trace/lib_traceatr.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_traceatr.c,v 1.4 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: lib_traceatr.c,v 1.5 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
@@ -89,13 +89,14 @@ _traceattr2(int bufnum, attr_t newmode)
     unsigned save_nc_tracing = _nc_tracing;
     _nc_tracing = 0;
 
-    strcpy(tmp++, "{");
+    *tmp++ = '{';
+    *tmp = '\0';
 
     for (n = 0; n < SIZEOF(names); n++) {
 	if ((newmode & names[n].val) != 0) {
 	    if (buf[1] != '\0')
-		strcat(tmp, "|");
-	    strcat(tmp, names[n].name);
+		strlcat(tmp, "|", BUFSIZ - (tmp - buf));
+	    strlcat(tmp, names[n].name, BUFSIZ - (tmp - buf));
 	    tmp += strlen(tmp);
 
 	    if (names[n].val == A_COLOR) {
@@ -116,12 +117,13 @@ _traceattr2(int bufnum, attr_t newmode)
     }
     if (AttrOf(newmode) == A_NORMAL) {
 	if (buf[1] != '\0')
-	    strcat(tmp, "|");
-	strcat(tmp, "A_NORMAL");
+	    strlcat(tmp, "|", BUFSIZ - (tmp - buf));
+	strlcat(tmp, "A_NORMAL", BUFSIZ - (tmp - buf));
     }
 
     _nc_tracing = save_nc_tracing;
-    return (strcat(buf, "}"));
+    strlcat(buf, "}", BUFSIZ);
+    return (buf);
 }
 
 NCURSES_EXPORT(char *)
@@ -144,7 +146,8 @@ _tracechtype2(int bufnum, chtype ch)
     char *buf = _nc_trace_buf(bufnum, BUFSIZ);
     char *found = 0;
 
-    strcpy(buf, "{");
+    buf[0] = '{';
+    buf[1] = '\0';
     if (ch & A_ALTCHARSET) {
 	char *cp;
 	static const struct {
@@ -201,7 +204,7 @@ _tracechtype2(int bufnum, chtype ch)
 	    ch = TextOf(*found);
 	    for (sp = names; sp->val; sp++)
 		if (sp->val == ch) {
-		    (void) strcat(buf, sp->name);
+		    (void) strlcat(buf, sp->name, BUFSIZ);
 		    ch &= ~A_ALTCHARSET;
 		    break;
 		}
@@ -209,13 +212,13 @@ _tracechtype2(int bufnum, chtype ch)
     }
 
     if (found == 0)
-	(void) strcat(buf, _tracechar(TextOf(ch)));
+	(void) strlcat(buf, _tracechar(TextOf(ch)), BUFSIZ);
 
     if (AttrOf(ch) != A_NORMAL)
 	(void) snprintf(buf + strlen(buf), BUFSIZ - strlen(buf), " | %s",
 		_traceattr2(bufnum + 20, AttrOf(ch)));
 
-    strcat(buf, "}");
+    strlcat(buf, "}", BUFSIZ);
     return (buf);
 }
 
diff --git a/lib/libcurses/trace/lib_tracebits.c b/lib/libcurses/trace/lib_tracebits.c
index 3d7fb492884..b1ad17da12c 100644
--- a/lib/libcurses/trace/lib_tracebits.c
+++ b/lib/libcurses/trace/lib_tracebits.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_tracebits.c,v 1.8 2001/01/22 18:01:58 millert Exp $	*/
+/*	$OpenBSD: lib_tracebits.c,v 1.9 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -66,21 +66,21 @@ typedef struct {
 } BITNAMES;
 
 static void
-lookup_bits(char *buf, const BITNAMES * table, const char *label, unsigned int val)
+lookup_bits(char *buf, size_t bufsize, const BITNAMES * table, const char *label, unsigned int val)
 {
     const BITNAMES *sp;
 
-    (void) strcat(buf, label);
-    (void) strcat(buf, ": {");
+    (void) strlcat(buf, label, bufsize);
+    (void) strlcat(buf, ": {", bufsize);
     for (sp = table; sp->name; sp++)
 	if (sp->val != 0
 	    && (val & sp->val) == sp->val) {
-	    (void) strcat(buf, sp->name);
-	    (void) strcat(buf, ", ");
+	    (void) strlcat(buf, sp->name, bufsize);
+	    (void) strlcat(buf, ", ", bufsize);
 	}
     if (buf[strlen(buf) - 2] == ',')
 	buf[strlen(buf) - 2] = '\0';
-    (void) strcat(buf, "} ");
+    (void) strlcat(buf, "} ", bufsize);
 }
 
 NCURSES_EXPORT(char *)
@@ -88,6 +88,7 @@ _nc_tracebits(void)
 /* describe the state of the terminal control bits exactly */
 {
     char *buf;
+    size_t bufsize;
 
 #ifdef TERMIOS
     static const BITNAMES iflags[] =
@@ -138,21 +139,18 @@ _nc_tracebits(void)
 #define ALLLOCAL	(ECHO|ECHONL|ICANON|ISIG|NOFLSH|TOSTOP|IEXTEN)
     };
 
-    buf = _nc_trace_buf(0,
-			8 + sizeof(iflags) +
-			8 + sizeof(oflags) +
-			8 + sizeof(cflags) +
-			8 + sizeof(lflags) +
-			8);
+    bufsize = 8 + sizeof(iflags) + 8 + sizeof(oflags) + 8 + sizeof(cflags) +
+	      8 + sizeof(lflags) + 8;
+    buf = _nc_trace_buf(0, bufsize);
 
     if (cur_term->Nttyb.c_iflag & ALLIN)
-	lookup_bits(buf, iflags, "iflags", cur_term->Nttyb.c_iflag);
+	lookup_bits(buf, bufsize, iflags, "iflags", cur_term->Nttyb.c_iflag);
 
     if (cur_term->Nttyb.c_oflag & ALLOUT)
-	lookup_bits(buf, oflags, "oflags", cur_term->Nttyb.c_oflag);
+	lookup_bits(buf, bufsize, oflags, "oflags", cur_term->Nttyb.c_oflag);
 
     if (cur_term->Nttyb.c_cflag & ALLCTRL)
-	lookup_bits(buf, cflags, "cflags", cur_term->Nttyb.c_cflag);
+	lookup_bits(buf, bufsize, cflags, "cflags", cur_term->Nttyb.c_cflag);
 
 #if defined(CS5) && defined(CS8)
     {
@@ -189,12 +187,12 @@ _nc_tracebits(void)
 		}
 	    }
 	}
-	strcat(buf, result);
+	strlcat(buf, result, bufsize);
     }
 #endif
 
     if (cur_term->Nttyb.c_lflag & ALLLOCAL)
-	lookup_bits(buf, lflags, "lflags", cur_term->Nttyb.c_lflag);
+	lookup_bits(buf, bufsize, lflags, "lflags", cur_term->Nttyb.c_lflag);
 
 #else
     /* reference: ttcompat(4M) on SunOS 4.1 */
@@ -234,7 +232,7 @@ _nc_tracebits(void)
 			8 + sizeof(cflags));
 
     if (cur_term->Nttyb.sg_flags & ALLCTRL) {
-	lookup_bits(buf, cflags, "cflags", cur_term->Nttyb.sg_flags);
+	lookup_bits(buf, bufsize, cflags, "cflags", cur_term->Nttyb.sg_flags);
     }
 #endif
     return (buf);
diff --git a/lib/libcurses/trace/lib_tracemse.c b/lib/libcurses/trace/lib_tracemse.c
index fe0555eb07f..3346d87e224 100644
--- a/lib/libcurses/trace/lib_tracemse.c
+++ b/lib/libcurses/trace/lib_tracemse.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_tracemse.c,v 1.3 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: lib_tracemse.c,v 1.4 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
@@ -51,7 +51,7 @@ _tracemouse(MEVENT const *ep)
     (void) snprintf(buf, sizeof(buf), "id %2d  at (%2d, %2d, %2d) state %4lx = {",
 		    ep->id, ep->x, ep->y, ep->z, ep->bstate);
 
-#define SHOW(m, s) if ((ep->bstate & m)==m) {strcat(buf,s); strcat(buf, ", ");}
+#define SHOW(m, s) if ((ep->bstate & m)==m) {strlcat(buf,s,sizeof(buf)); strlcat(buf, ", ",sizeof(buf));}
     SHOW(BUTTON1_RELEASED, "release-1")
 	SHOW(BUTTON1_PRESSED, "press-1")
 	SHOW(BUTTON1_CLICKED, "click-1")
@@ -85,7 +85,7 @@ _tracemouse(MEVENT const *ep)
 
 	if (buf[strlen(buf) - 1] == ' ')
 	buf[strlen(buf) - 2] = '\0';
-    (void) strcat(buf, "}");
+    (void) strlcat(buf, "}", sizeof(buf));
     return (buf);
 }
 
diff --git a/lib/libcurses/tty/hardscroll.c b/lib/libcurses/tty/hardscroll.c
index 92dc08ebe6d..2633ce851e9 100644
--- a/lib/libcurses/tty/hardscroll.c
+++ b/lib/libcurses/tty/hardscroll.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hardscroll.c,v 1.5 2003/03/17 19:16:59 millert Exp $	*/
+/*	$OpenBSD: hardscroll.c,v 1.6 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,2000 Free Software Foundation, Inc.                   *
@@ -271,7 +271,7 @@ _nc_linedump(void)
     if (have < want)
 	buf = typeMalloc(char, have = want);
 
-    (void) strcpy(buf, "virt");
+    (void) strlcpy(buf, "virt", have);
     for (n = 0; n < screen_lines; n++)
 	(void) snprintf(buf + strlen(buf), have - strlen(buf), " %02d",
 	    		OLDNUM(n));
diff --git a/lib/libcurses/tty/lib_mvcur.c b/lib/libcurses/tty/lib_mvcur.c
index 45b0a2b7178..8e7db26334a 100644
--- a/lib/libcurses/tty/lib_mvcur.c
+++ b/lib/libcurses/tty/lib_mvcur.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: lib_mvcur.c,v 1.10 2001/01/22 18:02:00 millert Exp $	*/
+/*	$OpenBSD: lib_mvcur.c,v 1.11 2003/03/18 16:55:54 millert Exp $	*/
 
 /****************************************************************************
  * Copyright (c) 1998,1999,2000 Free Software Foundation, Inc.              *
@@ -964,7 +964,7 @@ roll(int n)
 int
 main(int argc GCC_UNUSED, char *argv[]GCC_UNUSED)
 {
-    (void) strcpy(tname, termname());
+    (void) strlcpy(tname, termname(), sizeof(tname));
     load_term();
     _nc_setupscreen(lines, columns, stdout);
     baudrate();
@@ -1029,7 +1029,7 @@ main(int argc GCC_UNUSED, char *argv[]GCC_UNUSED)
 							     before.tv_sec)
 			   * 1000000));
 	} else if (buf[0] == 'r') {
-	    (void) strcpy(tname, termname());
+	    (void) strlcpy(tname, termname(), sizeof(tname));
 	    load_term();
 	} else if (sscanf(buf, "l %s", tname) == 1) {
 	    load_term();