* Port [2532] to 1.2.16 from trunk

 * Converted most of the simple_sprintf() calls to simple_snprintf() 


svn: 3811

src/binary.c

@@ -578,13 +578,13 @@ void conf_to_bin(conf_t *in, bool move, int die)
 
   clear_settings();
   sdprintf("converting conf to bin\n");
-  simple_sprintf(settings.uid, "%d", in->uid);
-  simple_sprintf(settings.watcher, "%d", in->watcher);
-  simple_sprintf(settings.autocron, "%d", in->autocron);
-  simple_sprintf(settings.autouname, "%d", in->autouname);
-  simple_sprintf(settings.portmin, "%d", in->portmin);
-  simple_sprintf(settings.portmax, "%d", in->portmax);
-  simple_sprintf(settings.pscloak, "%d", in->pscloak);
+  simple_snprintf(settings.uid, sizeof(settings.uid), "%d", in->uid);
+  simple_snprintf(settings.watcher, sizeof(settings.watcher), "%d", in->watcher);
+  simple_snprintf(settings.autocron, sizeof(settings.autocron), "%d", in->autocron);
+  simple_snprintf(settings.autouname, sizeof(settings.autouname), "%d", in->autouname);
+  simple_snprintf(settings.portmin, sizeof(settings.portmin), "%d", in->portmin);
+  simple_snprintf(settings.portmax, sizeof(settings.portmax), "%d", in->portmax);
+  simple_snprintf(settings.pscloak, sizeof(settings.pscloak), "%d", in->pscloak);
 
   strlcpy(settings.binname, in->binname, sizeof(settings.binname));
   if (in->username)

src/botcmd.c

@@ -282,7 +282,7 @@ static void bot_bye(int idx, char *par)
 
   bots = bots_in_subtree(findbot(dcc[idx].nick));
   users = users_in_subtree(findbot(dcc[idx].nick));
-  simple_sprintf(s, "%s %s. %s (lost %d bot%s and %d user%s)",
+  simple_snprintf(s, sizeof(s), "%s %s. %s (lost %d bot%s and %d user%s)",
 		 BOT_DISCONNECTED, conf.bot->hub ? dcc[idx].nick : "botnet", par[0] ?
 		 par : "No reason", bots, (bots != 1) ?
 		 "s" : "", users, (users != 1) ? "s" : "");
@@ -312,7 +312,7 @@ static void remote_tell_who(int idx, char *nick, int chan)
       l = strlen(c->dname);
       if (i + l < 1021) {
 	if (i > 10) {
-          simple_sprintf(s, "%s, %s", s, c->dname);
+          simple_snprintf(s, sizeof(s), "%s, %s", s, c->dname);
 	} else {
           strcpy(s, c->dname);
 	  i += (l + 2);
@@ -614,7 +614,7 @@ static void bot_nlinked(int idx, char *par)
   s[0] = 0;
   if (!next[0]) {
     putlog(LOG_BOTS, "*", "Invalid eggnet protocol from %s (zapfing)", dcc[idx].nick);
-    simple_sprintf(s, "Disconnected %s (invalid bot)", dcc[idx].nick);
+    simple_snprintf(s, sizeof(s), "Disconnected %s (invalid bot)", dcc[idx].nick);
     dprintf(idx, "error invalid eggnet protocol for 'nlinked'\n");
   } else if ((in_chain(newbot)) || (!egg_strcasecmp(newbot, conf.bot->nick))) {
     /* Loop! */
@@ -632,7 +632,7 @@ static void bot_nlinked(int idx, char *par)
 
     if (bogus) {
       putlog(LOG_BOTS, "*", "Bogus link notice from %s!  (%s -> %s)", dcc[idx].nick, next, newbot);
-      simple_sprintf(s, "Bogus link notice from: %s Disconnected", dcc[idx].nick);
+      simple_snprintf(s, sizeof(s), "Bogus link notice from: %s Disconnected", dcc[idx].nick);
       dprintf(idx, "error Bogus link notice from (%s -> %s)\n", next, newbot);
     }
   }
@@ -839,7 +839,7 @@ static void bot_thisbot(int idx, char *par)
 
     putlog(LOG_BOTS, "*", "Wrong bot--wanted %s, got %s", dcc[idx].nick, par);
     dprintf(idx, "bye imposter\n");
-    simple_sprintf(s, "Disconnected %s (imposter)", dcc[idx].nick);
+    simple_snprintf(s, sizeof(s), "Disconnected %s (imposter)", dcc[idx].nick);
     chatout("*** %s\n", s);
     botnet_send_unlinked(idx, dcc[idx].nick, s);
     unvia(idx, findbot(dcc[idx].nick));

src/botmsg.c

@@ -63,9 +63,12 @@ static void send_tand_but(int x, char *buf, size_t len)
 void botnet_send_cmdpass(int idx, char *cmd, char *pass)
 {
   if (tands > 0) {
-    char *buf = (char *) my_calloc(1, strlen(cmd) + strlen(pass) + 5 + 1);
+    char *buf = NULL;
+    size_t siz = strlen(cmd) + strlen(pass) + 5 + 1;
 
-    simple_sprintf(buf, "cp %s %s\n", cmd, pass);
+    buf = (char *) my_calloc(1, siz);
+
+    simple_snprintf(buf, siz, "cp %s %s\n", cmd, pass);
     send_tand_but(idx, buf, strlen(buf));
     free(buf);
   }
@@ -81,7 +84,7 @@ int botnet_send_cmd(char * fbot, char * bot, char *fhnd, int fromidx, char * cmd
   } else if (!egg_strcasecmp(bot, conf.bot->nick)) {
     char tmp[24] = "";
 
-    simple_sprintf(tmp, "%i", fromidx);
+    simple_snprintf(tmp, sizeof(tmp), "%i", fromidx);
     gotremotecmd(conf.bot->nick, conf.bot->nick, fhnd, tmp, cmd);
   }
   return 0;
@@ -95,7 +98,7 @@ void botnet_send_cmd_broad(int idx, char * fbot, char *fhnd, int fromidx, char *
   if (idx < 0) {
     char tmp[24] = "";
 
-    simple_sprintf(tmp, "%i", fromidx);
+    simple_snprintf(tmp, sizeof(tmp), "%i", fromidx);
     gotremotecmd("*", conf.bot->nick, fhnd, tmp, cmd);
   }
 }
@@ -256,11 +259,11 @@ void botnet_send_reject(int idx, char *fromp, char *frombot, char *top, char *to
   char to[NOTENAMELEN + 1] = "", from[NOTENAMELEN + 1] = "";
 
   if (tobot) {
-    simple_sprintf(to, "%s@%s", top, tobot);
+    simple_snprintf(to, sizeof(to), "%s@%s", top, tobot);
     top = to;
   }
   if (frombot) {
-    simple_sprintf(from, "%s@%s", fromp, frombot);
+    simple_snprintf(from, sizeof(from), "%s@%s", fromp, frombot);
     fromp = from;
   }
   if (!reason)
@@ -445,7 +448,7 @@ int add_note(char *to, char *from, char *msg, int idx, int echo)
       if (strchr(from, '@')) {
 	strcpy(botf, from);
       } else
-	simple_sprintf(botf, "%s@%s", from, conf.bot->nick);
+	simple_snprintf(botf, sizeof(botf), "%s@%s", from, conf.bot->nick);
     } else
       strcpy(botf, conf.bot->nick);
     i = nextbot(p);
@@ -457,7 +460,7 @@ int add_note(char *to, char *from, char *msg, int idx, int echo)
     if ((idx >= 0) && (echo))
       dprintf(idx, "-> %s@%s: %s\n", x, p, msg);
     if (idx >= 0) {
-      simple_sprintf(ssf, "%d:%s", dcc[idx].sock, botf);
+      simple_snprintf(ssf, sizeof(ssf), "%d:%s", dcc[idx].sock, botf);
       botnet_send_priv(i, ssf, x, p, "%s", msg);
     } else
       botnet_send_priv(i, botf, x, p, "%s", msg);
@@ -498,7 +501,7 @@ int add_note(char *to, char *from, char *msg, int idx, int echo)
 	while ((*msg == '<') || (*msg == '>')) {
 	  p2 = newsplit(&msg);
 	  if (*p2 == '<')
-	    l += simple_sprintf(work + l, "via %s, ", p2 + 1);
+	    l += simple_snprintf(work + l, sizeof(work) - l, "via %s, ", p2 + 1);
 	  else if (*from == '@')
 	    fr = p2 + 1;
 	}

src/botnet.c

@@ -663,9 +663,9 @@ void tell_bottree(int idx)
             color_str = (char *) NULL;
 
           if (bot->share)
-            i = simple_sprintf(s, "%c", bot->share);
+            i = simple_snprintf(s, sizeof(s), "%c", bot->share);
           else
-            i = simple_sprintf(s, "-");
+            i = simple_snprintf(s, sizeof(s), "-");
           i = sprintf(s + 1, "%s%s%s (%s %li)", color_str ? color_str : "",
                                                 bot->bot,
                                                 color_str ? COLOR_END(idx) : "",
@@ -709,9 +709,9 @@ void tell_bottree(int idx)
 
 		bot2 = bot;
                 if (bot->share)
-                  i = simple_sprintf(s, "%c", bot->share);
+                  i = simple_snprintf(s, sizeof(s), "%c", bot->share);
                 else
-                  i = simple_sprintf(s, "-");
+                  i = simple_snprintf(s, sizeof(s), "-");
                 i = sprintf(s + 1, "%s%s%s (%s %li)", color_str ? color_str : "",
                                                       bot->bot,
                                                       color_str ? COLOR_END(idx) : "",
@@ -776,7 +776,7 @@ void dump_links(int z)
       else
         p = bot->uplink->bot;
 
-      l = simple_sprintf(x, "n %s %s %cD0gc %d %d %d %s\n", bot->bot, p, bot->share, bot->localhub, 
+      l = simple_snprintf(x, sizeof(x), "n %s %s %cD0gc %d %d %d %s\n", bot->bot, p, bot->share, bot->localhub, 
                                                         (int) bot->buildts, bot->revision, bot->version ? bot->version : "");
       tputs(dcc[z].sock, x, l);
     }
@@ -894,13 +894,13 @@ int botunlink(int idx, char *nick, char *reason)
 	bots = bots_in_subtree(bot);
 	users = users_in_subtree(bot);
 	if (reason && reason[0]) {
-	  simple_sprintf(s, "%s %s (%s) (lost %d bot%s and %d user%s)",
+	  simple_snprintf(s, sizeof(s), "%s %s (%s) (lost %d bot%s and %d user%s)",
 	  		 BOT_UNLINKEDFROM, dcc[i].nick, reason, bots,
 			 (bots != 1) ? "s" : "", users, (users != 1) ?
 			 "s" : "");
 	  dprintf(i, "bye %s\n", reason);
 	} else {
-	  simple_sprintf(s, "%s %s (lost %d bot%s and %d user%s)",
+	  simple_snprintf(s, sizeof(s), "%s %s (lost %d bot%s and %d user%s)",
 	  		 BOT_UNLINKEDFROM, dcc[i].nick, bots, (bots != 1) ?
 			 "s" : "", users, (users != 1) ? "s" : "");
 	  dprintf(i, "bye No reason\n");
@@ -1627,7 +1627,7 @@ void check_botnet_pings()
 	      bot = findbot(dcc[i].nick);
 	      bots = bots_in_subtree(bot);
 	      users = users_in_subtree(bot);
-	      simple_sprintf(s, "%s %s (%s) (lost %d bot%s and %d user%s)",
+	      simple_snprintf(s, sizeof(s), "%s %s (%s) (lost %d bot%s and %d user%s)",
 	    		   BOT_DISCONNECTED, dcc[i].nick, BOT_BOTNOTLEAFLIKE,
 			   bots, (bots != 1) ? "s" : "", users, (users != 1) ?
 			   "s" : "");
@@ -1651,7 +1651,7 @@ void check_botnet_pings()
         bot = findbot(dcc[i].nick);
         bots = bots_in_subtree(bot);
         users = users_in_subtree(bot);
-        simple_sprintf(s, "%s: %s (lost %d bot%s and %d user%s)", BOT_PINGTIMEOUT,
+        simple_snprintf(s, sizeof(s), "%s: %s (lost %d bot%s and %d user%s)", BOT_PINGTIMEOUT,
   		       dcc[i].nick, bots, (bots != 1) ? "s" : "",
 		       users, (users != 1) ? "s" : "");
         chatout("*** %s\n", s);
@@ -1676,7 +1676,7 @@ void zapfbot(int idx)
   tand_t *bot = findbot(dcc[idx].nick);
   int bots = bots_in_subtree(bot), users = users_in_subtree(bot);
 
-  simple_sprintf(s, "%s: %s (lost %d bot%s and %d user%s)", BOT_BOTDROPPED,
+  simple_snprintf(s, sizeof(s), "%s: %s (lost %d bot%s and %d user%s)", BOT_BOTDROPPED,
   		 dcc[idx].nick, bots, (bots != 1) ? "s" : "", users,
 		 (users != 1) ? "s" : "");
   chatout("*** %s\n", s);
@@ -1723,7 +1723,7 @@ void lower_bot_linked(int idx)
 {
   char tmp[6] = "";
 
-  simple_sprintf(tmp, "rl %d", get_role(dcc[idx].nick));
+  simple_snprintf(tmp, sizeof(tmp), "rl %d", get_role(dcc[idx].nick));
   putbot(dcc[idx].nick, tmp);
 }
 

src/chanprog.c

@@ -262,10 +262,10 @@ void tell_verbose_uptime(int idx)
     else
       strcpy(s1, "log dump mode");
   }
-  simple_sprintf(outbuf,  "Online for %s", s);
+  simple_snprintf(outbuf, sizeof(outbuf), "Online for %s", s);
   if (restart_time) {
     tell_time(restart_time, s);
-    simple_sprintf(outbuf, "%s (%s %s)", outbuf, restart_was_update ? "updated" : "restarted", s);
+    simple_snprintf(outbuf, sizeof(outbuf), "%s (%s %s)", outbuf, restart_was_update ? "updated" : "restarted", s);
   }
 
 #if HAVE_GETRUSAGE
@@ -283,7 +283,7 @@ void tell_verbose_uptime(int idx)
   sprintf(s2, "CPU %02d:%02d (load avg %3.1f%%)", (int) hr, (int) min,
   100.0 * ((float) cl / (float) (now - online_since)));
 # else
-  simple_sprintf(s2, "CPU ???");
+  simple_snprintf(s2, sizeof(s2), "CPU ???");
 # endif
 #endif /* HAVE_GETRUSAGE */
   dprintf(idx, "%s  (%s)  %s  cache hit %4.1f%%\n",
@@ -499,7 +499,7 @@ void load_internal_users()
               hosts = q;
             }
             
-            simple_sprintf(x, "-telnet!%s", hosts);
+            simple_snprintf(x, sizeof(x), "-telnet!%s", hosts);
 	    set_user(&USERENTRY_HOSTS, u, x);
 	    hosts = ln;
 	  }

src/cmds.c

@@ -425,6 +425,7 @@ static void cmd_addline(int idx, char *par)
 
   struct list_type *q = (struct list_type *) get_user(&USERENTRY_HOSTS, u);
   char *hostbuf = NULL, *outbuf = NULL;
+  size_t siz = 0;
   
   hostbuf = (char *) my_calloc(1, 1);
   for (; q; q = q->next) {
@@ -432,8 +433,10 @@ static void cmd_addline(int idx, char *par)
     strcat(hostbuf, q->extra);
     strcat(hostbuf, " ");
   }
-  outbuf = (char *) my_calloc(1, strlen(hostbuf) + strlen(u->handle) + 20);
-  simple_sprintf(outbuf, "Addline: +user %s %s", u->handle, hostbuf);
+  siz = strlen(hostbuf) + strlen(u->handle) + 19 + 1;
+
+  outbuf = (char *) my_calloc(1, siz);
+  simple_snprintf(outbuf, siz, "Addline: +user %s %s", u->handle, hostbuf);
   dumplots(idx, "", outbuf);
   free(hostbuf);
   free(outbuf);
@@ -613,7 +616,7 @@ static void cmd_help(int idx, char *par)
 
   build_flags(flg, &fr, NULL);
   if (!par[0]) {
-    simple_sprintf(match, "*");
+    simple_snprintf(match, sizeof(match), "*");
   } else {
     if (!strchr(par, '*') && !strchr(par, '?'))
       nowild++;
@@ -657,12 +660,12 @@ static void cmd_help(int idx, char *par)
           if (first) {
             dprintf(idx, "%s\n", buf[0] ? buf : "");
             dprintf(idx, "# DCC (%s)\n", flag);
-            simple_sprintf(buf, "  ");
+            simple_snprintf(buf, sizeof(buf), "  ");
           }
           if (end && !first) {
             dprintf(idx, "%s\n", buf[0] ? buf : "");
             /* we dumped the buf to dprintf, now start a new one... */
-            simple_sprintf(buf, "  ");
+            simple_snprintf(buf, sizeof(buf), "  ");
           }
           sprintf(buf, "%s%-14.14s", buf[0] ? buf : "", cmdlist[n].name);
           first = 0;
@@ -720,7 +723,7 @@ static void cmd_who(int idx, char *par)
       else {
 	char s[40] = "";
 
-	simple_sprintf(s, "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
+	simple_snprintf(s, sizeof(s), "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
 	botnet_send_who(i, s, par, dcc[idx].u.chat->channel);
       }
     }
@@ -1999,7 +2002,7 @@ static void cmd_link(int idx, char *par)
       dprintf(idx, "No such bot online.\n");
       return;
     }
-    simple_sprintf(x, "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
+    simple_snprintf(x, sizeof(x), "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
     botnet_send_link(i, x, s, par);
   }
 }
@@ -2027,7 +2030,7 @@ static void cmd_unlink(int idx, char *par)
   else {
     char x[40] = "";
 
-    simple_sprintf(x, "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
+    simple_snprintf(x, sizeof(x), "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
     botnet_send_unlink(i, x, lastbot(bot), bot, par);
   }
 }
@@ -2052,7 +2055,7 @@ static void cmd_save(int idx, char *par)
   int i = 0;
 
   putlog(LOG_CMDS, "*", "#%s# save", dcc[idx].nick);
-  simple_sprintf(buf, "Saving user file...");
+  simple_snprintf(buf, sizeof(buf), "Saving user file...");
   i = write_userfile(-1);
   if (i == 0)
     strcat(buf, "success.");
@@ -2097,7 +2100,7 @@ static void cmd_trace(int idx, char *par)
   char x[NOTENAMELEN + 11] = "", y[11] = "";
 
   putlog(LOG_CMDS, "*", "#%s# trace %s", dcc[idx].nick, par);
-  simple_sprintf(x, "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
+  simple_snprintf(x, sizeof(x), "%d:%s@%s", dcc[idx].sock, dcc[idx].nick, conf.bot->nick);
 
   time_t tm;
   egg_timeval_t tv;
@@ -3270,11 +3273,11 @@ static void cmd_pls_ignore(int idx, char *par)
   /* Fix missing ! or @ BEFORE continuing */
   if (!strchr(who, '!')) {
     if (!strchr(who, '@'))
-      simple_sprintf(s, "%s!*@*", who);
+      simple_snprintf(s, sizeof(s), "%s!*@*", who);
     else
-      simple_sprintf(s, "*!%s", who);
+      simple_snprintf(s, sizeof(s), "*!%s", who);
   } else if (!strchr(who, '@'))
-    simple_sprintf(s, "%s@*", who);
+    simple_snprintf(s, sizeof(s), "%s@*", who);
   else
     strcpy(s, who);
 
@@ -3748,7 +3751,7 @@ static void cmd_botserver(int idx, char * par) {
 
 static void rcmd_cursrv(char * fbot, char * fhand, char * fidx) {
   if (!conf.bot->hub) {
-    char tmp[2048] = "";
+    char tmp[512] = "";
 
     if (server_online) {
       if (floodless)
@@ -3756,7 +3759,7 @@ static void rcmd_cursrv(char * fbot, char * fhand, char * fidx) {
       else
         sprintf(tmp, "Currently: %-40s Lag: %ds", cursrvname, server_lag);
     } else
-      simple_sprintf(tmp, "Currently: none");
+      simple_snprintf(tmp, sizeof(tmp), "Currently: none");
 
     botnet_send_cmdreply(conf.bot->nick, fbot, fhand, fidx, tmp);
   }
@@ -3799,17 +3802,17 @@ static void cmd_botversion(int idx, char * par) {
 }
 
 static void rcmd_ver(char * fbot, char * fhand, char * fidx) {
-  char tmp[2048] = "";
+  char tmp[301] = "";
   struct utsname un;
 
-  simple_sprintf(tmp, "%s ", version);
+  simple_snprintf(tmp, sizeof(tmp), "%s ", version);
   if (uname(&un) < 0) {
     strcat(tmp, "(unknown OS)");
   } else {
     if (updated) {
-      simple_sprintf(tmp + strlen(tmp), "%s %s (%s) - UPDATED", un.sysname, un.release, un.machine);
+      simple_snprintf(tmp, sizeof(tmp), "%s %s %s (%s) - UPDATED", tmp, un.sysname, un.release, un.machine);
     } else
-      simple_sprintf(tmp + strlen(tmp), "%s %s (%s)", un.sysname, un.release, un.machine);
+      simple_snprintf(tmp, sizeof(tmp), "%s %s %s (%s)", tmp, un.sysname, un.release, un.machine);
   }
   botnet_send_cmdreply(conf.bot->nick, fbot, fhand, fidx, tmp);
 }
@@ -3840,14 +3843,14 @@ static void cmd_botnick(int idx, char * par) {
 
 static void rcmd_curnick(char * fbot, char * fhand, char * fidx) {
   if (!conf.bot->hub) {
-    char tmp[1024] = "";
+    char tmp[301] = "";
 
     if (server_online)
       sprintf(tmp, "Currently: %-20s ", botname);
     if (strncmp(botname, origbotname, strlen(botname)))
-      simple_sprintf(tmp, "%sWant: %s", tmp, origbotname);
+      simple_snprintf(tmp, sizeof(tmp), "%sWant: %s", tmp, origbotname);
     if (!server_online)
-      simple_sprintf(tmp, "%s(not online)", tmp);
+      simple_snprintf(tmp, sizeof(tmp), "%s(not online)", tmp);
     botnet_send_cmdreply(conf.bot->nick, fbot, fhand, fidx, tmp);
   }
 }
@@ -4156,15 +4159,15 @@ static void rcmd_exec(char * frombot, char * fromhand, char * fromidx, char * pa
       crontab_create(i);
     }
     if (!scmd[0]) {
-      char s[200] = "";
+      char s[31] = "";
       int i = crontab_exists();
 
       if (!i)
-        simple_sprintf(s, "No crontab");
+        simple_snprintf(s, sizeof(s), "No crontab");
       else if (i == 1)
-        simple_sprintf(s, "Crontabbed");
+        simple_snprintf(s, sizeof(s), "Crontabbed");
       else
-        simple_sprintf(s, "Error checking crontab status");
+        simple_snprintf(s, sizeof(s), "Error checking crontab status");
       botnet_send_cmdreply(conf.bot->nick, frombot, fromhand, fromidx, s);
     }
 #endif /* !CYGWIN_HACKS */
@@ -4299,10 +4302,11 @@ void gotremotereply (char *frombot, char *tohand, char *toidx, char *ln) {
 
   if ((idx >= 0) && (idx < dcc_total) && (dcc[idx].type == &DCC_CHAT) && (!strcmp(dcc[idx].nick, tohand))) {
     char *buf = NULL;
-    
-    buf = (char *) my_calloc(1, strlen(frombot) + 2 + 1);
+    size_t siz = strlen(frombot) + 2 + 1;
+
+    buf = (char *) my_calloc(1, siz);
 
-    simple_sprintf(buf, "(%s)", frombot);
+    simple_snprintf(buf, sizeof(buf), "(%s)", frombot);
     dprintf(idx, "%-13s %s\n", buf, ln);
     free(buf);
   }
@@ -4380,22 +4384,22 @@ static char *btos(unsigned long  bytes)
   char unit[10] = "";
   float xbytes;
 
-  simple_sprintf(unit, "Bytes");
+  simple_snprintf(unit, sizeof(unit), "Bytes");
   xbytes = bytes;
   if (xbytes > 1024.0) {
-    simple_sprintf(unit, "KBytes");
+    simple_snprintf(unit, sizeof(unit), "KBytes");
     xbytes = xbytes / 1024.0;
   }
   if (xbytes > 1024.0) {
-    simple_sprintf(unit, "MBytes");
+    simple_snprintf(unit, sizeof(unit), "MBytes");
     xbytes = xbytes / 1024.0;
   }
   if (xbytes > 1024.0) {
-    simple_sprintf(unit, "GBytes");
+    simple_snprintf(unit, sizeof(unit), "GBytes");
     xbytes = xbytes / 1024.0;
   }
   if (xbytes > 1024.0) {
-    simple_sprintf(unit, "TBytes");
+    simple_snprintf(unit, sizeof(unit), "TBytes");
     xbytes = xbytes / 1024.0;
   }
   if (bytes > 1024)

src/crypt.c

@@ -181,7 +181,7 @@ static char *passkey()
 
   char *tmp = my_calloc(1, 512);
 
-  simple_sprintf(tmp, "%s-%s.%s!%s", settings.salt1, settings.salt2, settings.packname, settings.bdhash);
+  simple_snprintf(tmp, sizeof(tmp), "%s-%s.%s!%s", settings.salt1, settings.salt2, settings.packname, settings.bdhash);
   key = SHA1(tmp);
   free(tmp);
   egg_bzero(tmp, 512);

src/dcc.c

@@ -1338,7 +1338,7 @@ dcc_telnet(int idx, char *buf, int ii)
 
   putlog(LOG_DEBUG, "*", "Telnet connection: %s/%d", s, port);
 
-  simple_sprintf(x, "-telnet!telnet@%s", iptostr(htonl(ip)));
+  simple_snprintf(x, sizeof(x), "-telnet!telnet@%s", iptostr(htonl(ip)));
 
   if (match_ignore(x) || detect_telnet_flood(x)) {
     putlog(LOG_DEBUG, "*", "Ignored telnet connection from: %s", x);
@@ -1387,7 +1387,7 @@ static void dcc_telnet_dns_callback(int id, void *client_data, const char *ip, c
 
   strlcpy(dcc[i].host, hosts ? hosts[0] : ip, UHOSTLEN);
 
-  simple_sprintf(s2, "-telnet!telnet@%s", dcc[i].host);
+  simple_snprintf(s2, sizeof(s2), "-telnet!telnet@%s", dcc[i].host);
 
   if (match_ignore(s2)) {
     putlog(LOG_DEBUG, "*", "Ignored telnet connection from: %s", s2);
@@ -1445,7 +1445,7 @@ static void dcc_telnet_dns_callback(int id, void *client_data, const char *ip, c
   }
   if (s[0]) {
     putlog(LOG_MISC, "*", DCC_IDENTFAIL, dcc[i].host, s);
-    simple_sprintf(s, "telnet@%s", dcc[i].host);
+    simple_snprintf(s, sizeof(s), "telnet@%s", dcc[i].host);
     dcc_telnet_got_ident(i, s);
     return;
   }
@@ -1689,7 +1689,7 @@ dcc_telnet_pass(int idx, int atr)
       link_hash(idx, rand);
 
       for (i = 0; enclink[i].name; i++)
-        simple_sprintf(buf, "%s%d ", buf[0] ? buf : "", enclink[i].type);
+        simple_snprintf(buf, sizeof(buf), "%s%d ", buf[0] ? buf : "", enclink[i].type);
 
       dprintf(-dcc[idx].sock, "neg? %s %s\n", rand, buf);
     } else {
@@ -1822,7 +1822,7 @@ dcc_ident(int idx, char *buf, int len)
   uid[20] = 0;                  /* 20 character ident max */
   for (int i = 0; i < dcc_total; i++)
     if (dcc[i].type && (dcc[i].type == &DCC_IDENTWAIT) && (dcc[i].sock == dcc[idx].uint.ident_sock)) {
-      simple_sprintf(buf1, "%s@%s", uid, dcc[idx].host);
+      simple_snprintf(buf1, sizeof(buf1), "%s@%s", uid, dcc[idx].host);
       dcc_telnet_got_ident(i, buf1);
     }
   dcc[idx].u.other = 0;
@@ -1838,7 +1838,7 @@ eof_dcc_ident(int idx)
   for (int i = 0; i < dcc_total; i++)
     if (dcc[i].type && (dcc[i].type == &DCC_IDENTWAIT) && (dcc[i].sock == dcc[idx].uint.ident_sock)) {
       putlog(LOG_MISC, "*", DCC_EOFIDENT);
-      simple_sprintf(buf, "telnet@%s", dcc[idx].host);
+      simple_snprintf(buf, sizeof(buf), "telnet@%s", dcc[idx].host);
       dcc_telnet_got_ident(i, buf);
     }
   killsock(dcc[idx].sock);

src/dccutil.c

@@ -98,33 +98,33 @@ colorbuf(char *buf, size_t len, int idx)
         switch (c) {
           case 'b':
             if (cflags & CFLGS_BOLD) {
-              simple_sprintf(buf2, "%s", BOLD_END(idx));
+              simple_snprintf(buf2, sizeof(buf2), "%s", BOLD_END(idx));
               cflags &= ~CFLGS_BOLD;
             } else {
               cflags |= CFLGS_BOLD;
-              simple_sprintf(buf2, "%s", BOLD(idx));
+              simple_snprintf(buf2, sizeof(buf2), "%s", BOLD(idx));
             }
             break;
           case 'u':
             if (cflags & CFLGS_UNDERLINE) {
-              simple_sprintf(buf2, "%s", UNDERLINE_END(idx));
+              simple_snprintf(buf2, sizeof(buf2), "%s", UNDERLINE_END(idx));
               cflags &= ~CFLGS_UNDERLINE;
             } else {
-              simple_sprintf(buf2, "%s", UNDERLINE(idx));
+              simple_snprintf(buf2, sizeof(buf2), "%s", UNDERLINE(idx));
               cflags |= CFLGS_UNDERLINE;
             }
             break;
           case 'f':
             if (cflags & CFLGS_FLASH) {
-              simple_sprintf(buf2, "%s", FLASH_END(idx));
+              simple_snprintf(buf2, sizeof(buf2), "%s", FLASH_END(idx));
               cflags &= ~CFLGS_FLASH;
             } else {
-              simple_sprintf(buf2, "%s", FLASH(idx));
+              simple_snprintf(buf2, sizeof(buf2), "%s", FLASH(idx));
               cflags |= CFLGS_FLASH;
             }
             break;
           default:
-            simple_sprintf(buf2, "$%c", c);    /* No identifier, put the '$' back in */
+            simple_snprintf(buf2, sizeof(buf2), "$%c", c);    /* No identifier, put the '$' back in */
             break;
         }
       } else {                    /* These are character replacements */
@@ -133,19 +133,19 @@ colorbuf(char *buf, size_t len, int idx)
             schar++;
             break;
           case ':':
-            simple_sprintf(buf2, "%s%c%s", LIGHTGREY(idx), c, COLOR_END(idx));
+            simple_snprintf(buf2, sizeof(buf2), "%s%c%s", LIGHTGREY(idx), c, COLOR_END(idx));
             break;
           case '@':
-            simple_sprintf(buf2, "%s%c%s", BOLD(idx), c, BOLD_END(idx));
+            simple_snprintf(buf2, sizeof(buf2), "%s%c%s", BOLD(idx), c, BOLD_END(idx));
             break;
           case '>':
           case ')':
           case '<':
           case '(':
-            simple_sprintf(buf2, "%s%c%s", GREEN(idx), c, COLOR_END(idx));
+            simple_snprintf(buf2, sizeof(buf2), "%s%c%s", GREEN(idx), c, COLOR_END(idx));
             break;
           default:
-            simple_sprintf(buf2, "%c", c);
+            simple_snprintf(buf2, sizeof(buf2), "%c", c);
             break;
         }
       }
@@ -158,7 +158,7 @@ colorbuf(char *buf, size_t len, int idx)
           case 'f':
             break;
           default:
-            simple_sprintf(buf2, "$%c", c);    /* No identifier, put the '$' back in */
+            simple_snprintf(buf2, sizeof(buf2), "$%c", c);    /* No identifier, put the '$' back in */
         }
       } else {
         switch (c) {
@@ -166,12 +166,12 @@ colorbuf(char *buf, size_t len, int idx)
             schar++;
             break;
           default:
-            simple_sprintf(buf2, "%c", c);
+            simple_snprintf(buf2, sizeof(buf2), "%c", c);
             break;
         }
       }
     }
-    simple_sprintf(buf3, "%s%s", (buf3 && buf3[0]) ? buf3 : "", (buf2 && buf2[0]) ? buf2 : "");
+    simple_snprintf(buf3, sizeof(buf3), "%s%s", (buf3 && buf3[0]) ? buf3 : "", (buf2 && buf2[0]) ? buf2 : "");
   }
   buf3[strlen(buf3)] = 0;
   strcpy(buf, buf3);

src/flags.c

@@ -654,11 +654,11 @@ void deflag_user(struct userrec *u, int why, char *msg, struct chanset_t *chan)
     which = chan->mop;
     break;
   default:
-    simple_sprintf(tmp, "Reason #%i", why);
+    simple_snprintf(tmp, sizeof(tmp), "Reason #%i", why);
   }
   if (which == P_DEOP) {
     putlog(LOG_WARN, "*",  "Setting %s +d (%s): %s", u->handle, tmp, msg);
-    simple_sprintf(tmp2, "+d: %s (%s)", tmp, msg);
+    simple_snprintf(tmp2, sizeof(tmp2), "+d: %s (%s)", tmp, msg);
     set_user(&USERENTRY_COMMENT, u, tmp2);
 
     get_user_flagrec(u, &fr, chan->dname);
@@ -677,7 +677,7 @@ void deflag_user(struct userrec *u, int why, char *msg, struct chanset_t *chan)
       set_user_flagrec(u, &fr, chan->dname);
   } else if (which == P_KICK) {
     putlog(LOG_WARN, "*",  "Setting %s +dk (%s): %s", u->handle, tmp, msg);
-    simple_sprintf(tmp2, "+dk: %s (%s)", tmp, msg);
+    simple_snprintf(tmp2, sizeof(tmp2), "+dk: %s (%s)", tmp, msg);
     set_user(&USERENTRY_COMMENT, u, tmp2);
 
     get_user_flagrec(u, &fr, chan->dname);
@@ -699,7 +699,7 @@ void deflag_user(struct userrec *u, int why, char *msg, struct chanset_t *chan)
     deluser(u->handle);
   } else {
     putlog(LOG_WARN, "*",  "No user flag effects for %s (%s): %s", u->handle, tmp, msg);
-    simple_sprintf(tmp2, "Warning: %s (%s)", tmp, msg);
+    simple_snprintf(tmp2, sizeof(tmp2), "Warning: %s (%s)", tmp, msg);
     set_user(&USERENTRY_COMMENT, u, tmp2);
   }
 }

src/misc.c

@@ -771,7 +771,7 @@ hard_restart(int idx)
   }
   fatal(idx <= 0x7FF0 ? reason : NULL, 1);
   usleep(2000 * 500);
-  simple_sprintf(buf, "%s -B %s\n", shell_escape(binname), shell_escape(conf.bot->nick));
+  simple_snprintf(buf, sizeof(buf), "%s -B %s\n", shell_escape(binname), shell_escape(conf.bot->nick));
   unlink(conf.bot->pid_file); /* if this fails it is ok, cron will restart the bot, *hopefully* */
   system(buf); /* start new bot. */
   exit(0);
@@ -876,7 +876,7 @@ int updatebin(int idx, char *par, int secs)
     size_t binsize = conffile->len + 7 + 1;
     char *tmpbuf = (char *) my_calloc(1, binsize);
 
-    simple_sprintf(tmpbuf, "%sbin.old.exe", conffile->file);
+    simple_snprintf(tmpbuf, binsize, "%sbin.old.exe", conffile->file);
     tmpbuf[binsize - 1] = 0;
     movefile(binname, tmpbuf);
     free(tmpbuf);
@@ -951,12 +951,12 @@ int goodpass(char *pass, int idx, char *nick)
   if (!pass[0]) 
     return 0;
 
-  char tell[501] = "", last = 0;
+  char tell[201] = "", last = 0;
   int nalpha = 0, lcase = 0, ucase = 0, ocase = 0, tc, repeats = 0, score = 0;
   size_t length = strlen(pass);
 
   if (strchr(BADPASSCHARS, pass[0])) {
-    simple_sprintf(tell, "Passes may not begin with '-'");
+    simple_snprintf(tell, sizeof(tell), "Passes may not begin with '-'");
     goto fail;
   }
 
@@ -1056,7 +1056,7 @@ void showhelp(int idx, struct flag_record *flags, char *string)
         }
         flagstr[0] = 0;
         while (*string && *string != '}') {
-          simple_sprintf(tmp, "%c", *string);
+          simple_snprintf(tmp, sizeof(tmp), "%c", *string);
           strcat(flagstr, tmp);
           string++;
         }
@@ -1065,7 +1065,7 @@ void showhelp(int idx, struct flag_record *flags, char *string)
         if (flagrec_ok(&fr, flags)) {
           ok = 1;
           while (*string && *string != '%') {
-            simple_sprintf(tmp, "%c", *string);
+            simple_snprintf(tmp, sizeof(tmp), "%c", *string);
             strcat(helpstr, tmp);
             string++;
           }
@@ -1098,14 +1098,14 @@ void showhelp(int idx, struct flag_record *flags, char *string)
         strcat(helpstr, "%");        
       } else {
         if (ok) {
-          simple_sprintf(tmp, "%c", *string);
+          simple_snprintf(tmp, sizeof(tmp), "%c", *string);
           strcat(helpstr, tmp);
         }
         string++;
       }
     } else {
       if (ok) {
-        simple_sprintf(tmp, "%c", *string);
+        simple_snprintf(tmp, sizeof(tmp), "%c", *string);
         strcat(helpstr, tmp);
       }
       string++;

src/mod/channels.mod/channels.c

@@ -341,7 +341,7 @@ static void rebalance_roles()
         ba = (struct bot_addr *) get_user(&USERENTRY_BOTADDR, dcc[i].user);
         if (ba && (ba->roleid == (hNdx + 1))) {
           ba->roleid = lNdx + 1;
-          simple_sprintf(tmp, "rl %d", lNdx + 1);
+          simple_snprintf(tmp, sizeof(tmp), "rl %d", lNdx + 1);
           putbot(dcc[i].nick, tmp);
         }
       }

src/mod/channels.mod/cmdschan.c

@@ -525,7 +525,7 @@ static void cmd_slowjoin(int idx, char *par)
     dprintf(idx, "Hmmm... Channel didn't get added. Weird *shrug*\n");
     return;
   }
-  simple_sprintf(buf2, "cjoin %s %s", chan->dname, buf);
+  simple_snprintf(buf2, sizeof(buf2), "cjoin %s %s", chan->dname, buf);
   putallbots(buf2);
   if (conf.bot->hub)
     count = 0;
@@ -859,9 +859,9 @@ static void cmd_cycle(int idx, char *par)
     delay = atoi(newsplit(&par));
 
   if (conf.bot->hub) {
-    char buf2[1024] = "";
+    char buf2[201] = "";
 
-    simple_sprintf(buf2, "cycle %s %d", chname, delay); /* this just makes the bot PART */
+    simple_snprintf(buf2, sizeof(buf2), "cycle %s %d", chname, delay); /* this just makes the bot PART */
     putallbots(buf2);
   } else {
     do_chanset(NULL, chan, "+inactive", DO_LOCAL);
@@ -873,7 +873,7 @@ static void cmd_cycle(int idx, char *par)
 
 static void cmd_down(int idx, char *par)
 {
-  char *chname = NULL, buf2[1024] = "";
+  char *chname = NULL, buf2[201] = "";
   struct chanset_t *chan = NULL;
 
   putlog(LOG_CMDS, "*", "#%s# down %s", dcc[idx].nick, par);
@@ -890,7 +890,7 @@ static void cmd_down(int idx, char *par)
     return;
   }
   
-  simple_sprintf(buf2, "down %s", chan->dname);
+  simple_snprintf(buf2, sizeof(buf2), "down %s", chan->dname);
   putallbots(buf2);
   if (!conf.bot->hub) {
     add_mode(chan, '-', 'o', botname);
@@ -912,7 +912,7 @@ static void pls_chan(int idx, char *par, char *bot)
   }
 
   chname = newsplit(&par);
-  simple_sprintf(buf, "cjoin %s %s", chname, bot ? bot : "*");		/* +chan makes all bots join */
+  simple_snprintf(buf, sizeof(buf), "cjoin %s %s", chname, bot ? bot : "*");		/* +chan makes all bots join */
   if (par[0]) {
     strcat(buf, " ");
     strcat(buf, par);
@@ -1000,7 +1000,7 @@ static void mns_chan(int idx, char *par, char *bot)
   }
   chname = newsplit(&par);
 
-  simple_sprintf(buf2, "cpart %s %s", chname, bot ? bot : "*");
+  simple_snprintf(buf2, sizeof(buf2), "cpart %s %s", chname, bot ? bot : "*");
   if (bot)		/* bot will just set it +inactive */
     putbot(bot, buf2);
   else

src/mod/channels.mod/tclchan.c

@@ -865,7 +865,7 @@ int channel_add(char *result, char *newname, char *options)
   int items = 0;
   char buf[3001] = "";
 
-  simple_sprintf(buf, "chanmode { %s } ", glob_chanmode);
+  simple_snprintf(buf, sizeof(buf), "chanmode { %s } ", glob_chanmode);
   strcat(buf, def_chanset);
   strcat(buf, " ");
   strcat(buf, glob_chanset);

src/mod/channels.mod/userchan.c

@@ -313,9 +313,9 @@ bool u_addmask(char type, struct chanset_t *chan, char *who, char *from, char *n
     strcat(host, s);
   }
     if (conf.bot->hub)
-      simple_sprintf(s, "%s!%s@%s", origbotname, botuser, conf.bot->net.host);
+      simple_snprintf(s, sizeof(s), "%s!%s@%s", origbotname, botuser, conf.bot->net.host);
     else
-      simple_sprintf(s, "%s!%s", botname, botuserhost);
+      simple_snprintf(s, sizeof(s), "%s!%s", botname, botuserhost);
   if (s[0] && type == 'b' && wild_match(host, s)) {
     putlog(LOG_MISC, "*", "Wanted to ban myself--deflected.");
     return 0;
@@ -386,7 +386,7 @@ static void display_mask(const char type, int idx, int number, maskrec *mask, st
 
   if (mask->added) {
     daysago(now, mask->added, s);
-    simple_sprintf(dates, "Created %s", s);
+    simple_snprintf(dates, sizeof(dates), "Created %s", s);
     if (mask->added < mask->lastactive) {
       strcat(dates, ", ");
       strcat(dates, "last used");
@@ -402,7 +402,7 @@ static void display_mask(const char type, int idx, int number, maskrec *mask, st
     char s1[41] = "";
 
     days(mask->expire, now, s1);
-    simple_sprintf(s, "(expires %s)", s1);
+    simple_snprintf(s, sizeof(s), "(expires %s)", s1);
   }
   if (mask->flags & MASKREC_STICKY)
     strcat(s, " (sticky)");
@@ -516,9 +516,9 @@ static void tell_masks(const char type, int idx, bool show_inact, char *match, b
 	  s2 = s;
 	  s1 = splitnick(&s2);
 	  if (s1[0])
-	    simple_sprintf(fill, "%s (%s!%s)", ml->mask, s1, s2);
+	    simple_snprintf(fill, sizeof(fill), "%s (%s!%s)", ml->mask, s1, s2);
 	  else
-	    simple_sprintf(fill, "%s (server %s)", ml->mask, s2);
+	    simple_snprintf(fill, sizeof(fill), "%s (server %s)", ml->mask, s2);
 	  if (ml->timer != 0) {
 	    min = (now - ml->timer) / 60;
 	    sec = (now - ml->timer) - (min * 60);
@@ -968,7 +968,7 @@ bool expired_mask(struct chanset_t *chan, char *who)
   if (m->user)
     u = m->user;
   else {
-    simple_sprintf(buf, "%s!%s", m->nick, m->userhost);
+    simple_snprintf(buf, sizeof(buf), "%s!%s", m->nick, m->userhost);
     u = get_user_by_host(buf);
   }
   /* Do not expire masks set by bots. */

src/mod/ctcp.mod/ctcp.c

@@ -52,23 +52,23 @@ void scriptchanged()
   
   switch (cloak_script) {
   case CLOAK_PLAIN:
-    simple_sprintf(ctcpversion, "\002BitchX-%s\002 by panasync - %s %s : \002Keep it to yourself!\002", cloak_bxver, cloak_os, cloak_osver);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), "\002BitchX-%s\002 by panasync - %s %s : \002Keep it to yourself!\002", cloak_bxver, cloak_os, cloak_osver);
     strcpy(ctcpuserinfo, "");
     strcpy(autoaway, "Auto-Away after 10 mins");
     strcpy(kickprefix, "");
     strcpy(bankickprefix, "");
     break;
   case CLOAK_CRACKROCK:
-    simple_sprintf(ctcpversion, "BitchX-%s\002/\002%s %s:(\002c\002)\037rackrock\037/\002b\002X \037[\0373.0.1á9\037]\037 :\002 Keep it to yourself!\002", cloak_bxver, cloak_os, cloak_osver);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), "BitchX-%s\002/\002%s %s:(\002c\002)\037rackrock\037/\002b\002X \037[\0373.0.1á9\037]\037 :\002 Keep it to yourself!\002", cloak_bxver, cloak_os, cloak_osver);
     strcpy(ctcpuserinfo, "crack addict, help me.");
     strcpy(autoaway, "automatically dead");
     strcpy(kickprefix, "\002c\002/\037k\037: ");
     strcpy(bankickprefix, "\002c\002/\037kb\037: ");
     break;
   case CLOAK_NEONAPPLE:
-    simple_sprintf(tmp, "%s %s", cloak_os, cloak_osver);
+    simple_snprintf(tmp, sizeof(tmp), "%s %s", cloak_os, cloak_osver);
     strtolower(tmp);
-    simple_sprintf(ctcpversion, "bitchx-%s\037(\037%s\037):\037 \002n\002eon\037a\037ppl\002e\002\037/\037\002v\0020\037.\03714i : \002d\002ont you wish you had it\037?\037", cloak_bxver, tmp);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), "bitchx-%s\037(\037%s\037):\037 \002n\002eon\037a\037ppl\002e\002\037/\037\002v\0020\037.\03714i : \002d\002ont you wish you had it\037?\037", cloak_bxver, tmp);
     strcpy(ctcpuserinfo, "neon apple");
     strcpy(autoaway, "automatically away after 10 mins \037(\037\002n\002/\037a)\037");
     strcpy(kickprefix, "\037[na\002(\037k\037)\002]\037 ");
@@ -82,28 +82,28 @@ void scriptchanged()
     p[0] = '\037';
     p[2] = '\037';
     p[3] = 0;
-    simple_sprintf(ctcpversion, "\002b\002itchx-%s :tunnel\002vision\002/\0371.2\037", tmp);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), "\002b\002itchx-%s :tunnel\002vision\002/\0371.2\037", tmp);
     strcpy(ctcpuserinfo, "");
     strcpy(autoaway, "auto-gone");
     strcpy(kickprefix, "");
     strcpy(bankickprefix, "");
     break;
   case CLOAK_ARGON:
-    simple_sprintf(ctcpversion, ".\037.(\037argon\002/\0021g\037)\037 \002:\002bitchx-%s", cloak_bxver);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), ".\037.(\037argon\002/\0021g\037)\037 \002:\002bitchx-%s", cloak_bxver);
     strcpy(ctcpuserinfo, "");
     strcpy(autoaway, "\037(\037ar\037)\037 auto-away \037(\03710m\037)\037");
     strcpy(kickprefix, "\037(\037ar\037)\037 ");
     strcpy(bankickprefix, "\037(\037ar\037)\037 ");
     break;
   case CLOAK_EVOLVER:
-    simple_sprintf(ctcpversion, "\037evolver\037(\00202x9\002)\037: bitchx\037(\002%s\002) \037í\037 %s\002/\002%s : eye yam pheerable now!", cloak_bxver, cloak_os, cloak_osver);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), "\037evolver\037(\00202x9\002)\037: bitchx\037(\002%s\002) \037í\037 %s\002/\002%s : eye yam pheerable now!", cloak_bxver, cloak_os, cloak_osver);
     strcpy(ctcpuserinfo, "");
     strcpy(autoaway, "[\037\002i\002dle for \037[\03710 minutes\037]]");
     strcpy(kickprefix, "\037ev\002!\002k\037 ");
     strcpy(bankickprefix, "\037ev\002!\002bk\037 ");
     break;
   case CLOAK_PREVAIL:
-    simple_sprintf(ctcpversion, "%s\037!\037%s bitchx-%s \002-\002 prevail\037[\0370123\037]\037 :down with people", cloak_os, cloak_osver, cloak_bxver);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), "%s\037!\037%s bitchx-%s \002-\002 prevail\037[\0370123\037]\037 :down with people", cloak_os, cloak_osver, cloak_bxver);
     strcpy(ctcpuserinfo, botrealname);
     strcpy(autoaway, "idle 10 minutes \037-\037 gone\037!\037");
     strcpy(kickprefix, "\037[\037pv\037!\037k\037]\037 ");
@@ -114,7 +114,7 @@ void scriptchanged()
     char mircver[5] = "";
    
     strcpy(mircver, response(RES_MIRCVER));
-    simple_sprintf(ctcpversion, "mIRC v%s Khaled Mardam-Bey", mircver);
+    simple_snprintf(ctcpversion, sizeof(ctcpversion), "mIRC v%s Khaled Mardam-Bey", mircver);
     if (randint(2) % 2)
       strlcpy(ctcpversion2, response(RES_MIRCSCRIPT), sizeof(ctcpversion2));
     strcpy(ctcpuserinfo, botrealname);
@@ -203,68 +203,68 @@ void scriptchanged()
     }
     switch (randint(16)) {
     case 0:
-      simple_sprintf(ctcpversion, "bitchx\037-\037%s \037/\037 cypress\037.\03701i%s", cloak_bxver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "bitchx\037-\037%s \037/\037 cypress\037.\03701i%s", cloak_bxver, theme);
       break;
     case 1:
-      simple_sprintf(ctcpversion, "cypress\037.\03701i%s \037/\037 bitchx\037-\037%s", theme, cloak_bxver);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "cypress\037.\03701i%s \037/\037 bitchx\037-\037%s", theme, cloak_bxver);
       break;
     case 2:
-      simple_sprintf(tmp, "%s %s", cloak_os, cloak_osver);
+      simple_snprintf(tmp, sizeof(tmp), "%s %s", cloak_os, cloak_osver);
       strtolower(tmp);
-      simple_sprintf(ctcpversion, "cypress\037.\03701i%s %s\037(\037%s\037)\037 bitchx\037-\037%s)", theme, tmp, cloak_host, cloak_bxver);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "cypress\037.\03701i%s %s\037(\037%s\037)\037 bitchx\037-\037%s)", theme, tmp, cloak_host, cloak_bxver);
       break;
     case 3:
-      simple_sprintf(tmp, "%s %s", cloak_os, cloak_osver);
+      simple_snprintf(tmp, sizeof(tmp), "%s %s", cloak_os, cloak_osver);
       strtolower(tmp);
-      simple_sprintf(ctcpversion, "bitchx\037-\037%s %s\037(\037%s\037)\037 cypress\037.\03701i%s", cloak_bxver, tmp, cloak_host, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "bitchx\037-\037%s %s\037(\037%s\037)\037 cypress\037.\03701i%s", cloak_bxver, tmp, cloak_host, theme);
       break;
     case 4:
-      simple_sprintf(ctcpversion, "%s\002/\002%s: BitchX-%s \002[\002cypress\002]\002 v01i%s", cloak_os, cloak_osver, cloak_bxver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "%s\002/\002%s: BitchX-%s \002[\002cypress\002]\002 v01i%s", cloak_os, cloak_osver, cloak_bxver, theme);
       break;
     case 5:
       p = replace(cloak_osver, ".", "\037.\037");
-      simple_sprintf(tmp, "%s %s", cloak_os, p);
+      simple_snprintf(tmp, sizeof(tmp), "%s %s", cloak_os, p);
       strtolower(tmp);
-      simple_sprintf(ctcpversion, "\037.\037.cypress\037.\03701i%s %s\037(\037%s\037)\037 bitchx\037/\037%s",theme, tmp, cloak_host, cloak_bxver);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "\037.\037.cypress\037.\03701i%s %s\037(\037%s\037)\037 bitchx\037/\037%s",theme, tmp, cloak_host, cloak_bxver);
       break;
     case 6:
       p = replace(cloak_osver, ".", "\037.\037");
-      simple_sprintf(tmp, "%s %s", cloak_os, p);
+      simple_snprintf(tmp, sizeof(tmp), "%s %s", cloak_os, p);
       strtolower(tmp);
-      simple_sprintf(ctcpversion, "cypress\002.\00201i%s\037(\037bitchx\002.\002%s\037)\037\002.\002. %s\037(\037%s\037)\037",theme, cloak_bxver, tmp, cloak_host);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "cypress\002.\00201i%s\037(\037bitchx\002.\002%s\037)\037\002.\002. %s\037(\037%s\037)\037",theme, cloak_bxver, tmp, cloak_host);
       break;
     case 7:
       p = replace(cloak_osver, ".", "\037.\037");
-      simple_sprintf(tmp, "%s %s", cloak_os, p);
+      simple_snprintf(tmp, sizeof(tmp), "%s %s", cloak_os, p);
       strtolower(tmp);
-      simple_sprintf(ctcpversion, "\037.\037.cypress\037.\03701i%s - bitchx\037.\037%s\002/\002%s", theme, cloak_bxver, tmp);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "\037.\037.cypress\037.\03701i%s - bitchx\037.\037%s\002/\002%s", theme, cloak_bxver, tmp);
       break;
     case 8:
-      simple_sprintf(ctcpversion, "\002BitchX-%s\002 by panasync \002-\002 %s %s", cloak_bxver, cloak_os, cloak_osver);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "\002BitchX-%s\002 by panasync \002-\002 %s %s", cloak_bxver, cloak_os, cloak_osver);
       break;
     case 9:
-      simple_sprintf(ctcpversion, "\037[\037cypress\002/\00201i\037]\037 - %s \037[\037bx\002/\002%s\037]\037", theme, cloak_bxver);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "\037[\037cypress\002/\00201i\037]\037 - %s \037[\037bx\002/\002%s\037]\037", theme, cloak_bxver);
       break;
     case 10:
-      simple_sprintf(ctcpversion, "\037[\037\002b\002itchx\002.\002%s\037]\037 \002+\002 \037[\037cypress\002.\00201i\037]\037 %s",cloak_bxver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "\037[\037\002b\002itchx\002.\002%s\037]\037 \002+\002 \037[\037cypress\002.\00201i\037]\037 %s",cloak_bxver, theme);
       break;
     case 11:
-      simple_sprintf(ctcpversion, "\037[\037BitchX\002/\002%s\037(\037cypress\002/\00201i\037)]\037 %s", cloak_bxver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "\037[\037BitchX\002/\002%s\037(\037cypress\002/\00201i\037)]\037 %s", cloak_bxver, theme);
       break;
     case 12:
       strtolower(cloak_os);
-      simple_sprintf(ctcpversion, "bitchx\037/\037%s %s %s \037(\037cypress\037/\03701i\037)\037 %s", cloak_bxver, cloak_os, cloak_osver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "bitchx\037/\037%s %s %s \037(\037cypress\037/\03701i\037)\037 %s", cloak_bxver, cloak_os, cloak_osver, theme);
       break;
     case 13:
-      simple_sprintf(ctcpversion, "\037.\037.cypress\037/\03701i\037!\037bitchx\037/\037%s\037.\037.%s", cloak_bxver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "\037.\037.cypress\037/\03701i\037!\037bitchx\037/\037%s\037.\037.%s", cloak_bxver, theme);
       break;
     case 14:
       strtolower(cloak_bxver);
-      simple_sprintf(ctcpversion, "cypress\002\037.\037\002\037.\03701i\002/\002bitchx\037.\037\002\037.\037\002%s%s", cloak_bxver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "cypress\002\037.\037\002\037.\03701i\002/\002bitchx\037.\037\002\037.\037\002%s%s", cloak_bxver, theme);
       break;
     case 15:
       strtolower(cloak_bxver);
-      simple_sprintf(ctcpversion, "cypress\037.\03701i\037/\037bx%s \037(\037%s\037)\037", cloak_bxver, theme);
+      simple_snprintf(ctcpversion, sizeof(ctcpversion), "cypress\037.\03701i\037/\037bx%s \037(\037%s\037)\037", cloak_bxver, theme);
       break;
     }
     strcpy(ctcpuserinfo, "");
@@ -298,47 +298,47 @@ void sendaway()
     break;
   case CLOAK_CRACKROCK:
     if (hrs)
-      simple_sprintf(awtime, "%dh %dm %ds", hrs, min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dh %dm %ds", hrs, min, sec);
     else if (min)
-      simple_sprintf(awtime, "%dm %ds", min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dm %ds", min, sec);
     else
-      simple_sprintf(awtime, "%ds", sec);
+      simple_snprintf(awtime, sizeof(awtime), "%ds", sec);
     dprintf(DP_HELP, "AWAY :%s\002\037[\002%s\002]\037\002\n", autoaway, awtime);
     break;
   case CLOAK_TUNNELVISION:
     if (hrs)
-      simple_sprintf(awtime, "%dh%dm%ds", hrs, min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dh%dm%ds", hrs, min, sec);
     else if (min)
-      simple_sprintf(awtime, "%dm%ds", min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dm%ds", min, sec);
     else
-      simple_sprintf(awtime, "%ds", sec);
+      simple_snprintf(awtime, sizeof(awtime), "%ds", sec);
     dprintf(DP_HELP, "AWAY :%s \037(\037%s\037)\037\n", autoaway, awtime);
     break;
   case CLOAK_ARGON:
     if (hrs)
-      simple_sprintf(awtime, "%dh%dm%ds", hrs, min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dh%dm%ds", hrs, min, sec);
     else if (min)
-      simple_sprintf(awtime, "%dm%ds", min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dm%ds", min, sec);
     else
-      simple_sprintf(awtime, "%ds", sec);
+      simple_snprintf(awtime, sizeof(awtime), "%ds", sec);
     dprintf(DP_HELP, "AWAY :%s .\002.\002\037(\037%s\037)\037\n", autoaway, awtime);
     break;
   case CLOAK_EVOLVER:
     if (hrs)
-      simple_sprintf(awtime, "%dh %dm %ds", hrs, min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dh %dm %ds", hrs, min, sec);
     else if (min)
-      simple_sprintf(awtime, "%dm %ds", min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dm %ds", min, sec);
     else
-      simple_sprintf(awtime, "%ds", sec);
+      simple_snprintf(awtime, sizeof(awtime), "%ds", sec);
     dprintf(DP_HELP, "AWAY :away\037: %s (\037l\002:\002off\037,\037 p\002:\002off\037)\037 \037[\037gone\002:\002%s\037]\037\n", autoaway, awtime);
     break;
   case CLOAK_PREVAIL:
     if (hrs)
-      simple_sprintf(awtime, "%dh%dm%ds", hrs, min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dh%dm%ds", hrs, min, sec);
     else if (min)
-      simple_sprintf(awtime, "%dm%ds", min, sec);
+      simple_snprintf(awtime, sizeof(awtime), "%dm%ds", min, sec);
     else
-      simple_sprintf(awtime, "%ds", sec);
+      simple_snprintf(awtime, sizeof(awtime), "%ds", sec);
     dprintf(DP_HELP, "AWAY :%s %s\n", autoaway, awtime);
     break;
   case CLOAK_CYPRESS:
@@ -602,7 +602,7 @@ static int ctcp_CHAT(char *nick, char *uhost, struct userrec *u, char *object, c
     return BIND_RET_LOG;
 
     if (u_pass_match(u, "-")) {
-      simple_sprintf(ctcp_reply, "%s\001ERROR no password set\001", ctcp_reply);
+      simple_snprintf(ctcp_reply, sizeof(ctcp_reply), "%s\001ERROR no password set\001", ctcp_reply);
       return BIND_RET_BREAK;
     }
 
@@ -613,7 +613,7 @@ static int ctcp_CHAT(char *nick, char *uhost, struct userrec *u, char *object, c
         ix = i;
     }
     if (dcc_total == max_dcc || (ix < 0 && (ix = listen_all(0, 0)) < 0))
-      simple_sprintf(ctcp_reply, "%s\001ERROR no telnet port\001", ctcp_reply);
+      simple_snprintf(ctcp_reply, sizeof(ctcp_reply), "%s\001ERROR no telnet port\001", ctcp_reply);
     else {
       if (listen_time <= 2)
         listen_time++;

src/mod/irc.mod/chan.c

@@ -164,9 +164,9 @@ static char *getchanmode(struct chanset_t *chan)
     s[i++] = 'l';
   s[i] = 0;
   if (chan->channel.key[0])
-    i += simple_sprintf(s + i, " %s", chan->channel.key);
+    i += simple_snprintf(s + i, sizeof(s) - i, " %s", chan->channel.key);
   if (chan->channel.maxmembers != 0)
-    simple_sprintf(s + i, " %d", chan->channel.maxmembers);
+    simple_snprintf(s + i, sizeof(s) - i, " %d", chan->channel.maxmembers);
   return s;
 }
 
@@ -200,7 +200,7 @@ void priority_do(struct chanset_t * chan, bool opsonly, int action)
     if (!m->user && !m->tried_getuser) {
       char s[256] = "";
 
-      simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+      simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
       m->user = get_user_by_host(s);
       if (!m->user && doresolv(chan) && m->userip[0]) {
         simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userip);
@@ -529,7 +529,7 @@ static bool detect_chan_flood(char *floodnick, char *floodhost, char *from,
 	  (u_match_mask(global_exempts, from) ||
 	   u_match_mask(chan->exempts, from)))
 	return 1;
-      simple_sprintf(h, "*!*@%s", p);
+      simple_snprintf(h, sizeof(h), "*!*@%s", p);
       if (!isbanned(chan, h) && me_op(chan)) {
 	check_exemptlist(chan, from);
 	do_mask(chan, chan->channel.ban, h, 'b');
@@ -548,7 +548,7 @@ static bool detect_chan_flood(char *floodnick, char *floodhost, char *from,
       if (!channel_enforcebans(chan) && me_op(chan)) {
 	  char s[UHOSTLEN];
 	  for (m = chan->channel.member; m && m->nick[0]; m = m->next) {	  
-	    simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+	    simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
 	    if (!chan_sentkick(m) && wild_match(h, s) &&
 		(m->joined >= chan->floodtime[which]) &&
 		!match_my_nick(m->nick) && me_op(chan)) {
@@ -578,7 +578,7 @@ static bool detect_chan_flood(char *floodnick, char *floodhost, char *from,
       if (u) {
         char s[256] = "";
 
-        simple_sprintf(s, "Mass deop on %s by %s", chan->dname, from);
+        simple_snprintf(s, sizeof(s), "Mass deop on %s by %s", chan->dname, from);
         deflag_user(u, DEFLAG_MDOP, s, chan);
       }
       return 1;
@@ -595,7 +595,7 @@ static void do_closed_kick(struct chanset_t *chan, memberlist *m)
 
   char s[UHOSTLEN] = "", *s1 = NULL;
 
-  simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+  simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
 
   if (!(use_exempts &&
         (u_match_mask(global_exempts,s) ||
@@ -634,7 +634,7 @@ static void kick_all(struct chanset_t *chan, char *hostmask, const char *comment
   struct flag_record fr = {FR_GLOBAL | FR_CHAN, 0, 0, 0 };
 
   for (memberlist *m = chan->channel.member; m && m->nick[0]; m = m->next) {
-    simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+    simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
     get_user_flagrec(m->user, &fr, chan->dname, chan);
     if ((wild_match(hostmask, s) || match_cidr(hostmask, s)) && 
         !chan_sentkick(m) &&
@@ -746,8 +746,8 @@ static void enforce_bans(struct chanset_t *chan)
 
   char me[UHOSTLEN] = "", meip[UHOSTLEN] = "";
 
-  simple_sprintf(me, "%s!%s", botname, botuserhost);
-  simple_sprintf(meip, "%s!%s", botname, botuserip);
+  simple_snprintf(me, sizeof(me), "%s!%s", botname, botuserhost);
+  simple_snprintf(meip, sizeof(meip), "%s!%s", botname, botuserip);
 
   /* Go through all bans, kicking the users. */
   for (masklist *b = chan->channel.ban; b && b->mask[0]; b = b->next) {
@@ -864,7 +864,7 @@ void check_this_ban(struct chanset_t *chan, char *banmask, bool sticky)
   char user[UHOSTLEN] = "";
 
   for (memberlist *m = chan->channel.member; m && m->nick[0]; m = m->next) {
-    simple_sprintf(user, "%s!%s", m->nick, m->userhost);
+    simple_snprintf(user, sizeof(user), "%s!%s", m->nick, m->userhost);
     if (wild_match(banmask, user) &&
         !(use_exempts &&
           (u_match_mask(global_exempts, user) ||
@@ -959,9 +959,9 @@ void recheck_channel_modes(struct chanset_t *chan)
     else if ((mns & CHANQUIET) && (cur & CHANQUIET))
       add_mode(chan, '-', 'q', "");
     if ((chan->limit_prot != 0) && (chan->channel.maxmembers == 0)) {
-      char s[50] = "";
+      char s[11] = "";
 
-      simple_sprintf(s, "%d", chan->limit_prot);
+      simple_snprintf(s, sizeof(s), "%d", chan->limit_prot);
       add_mode(chan, '+', 'l', s);
     } else if ((mns & CHANLIMIT) && (chan->channel.maxmembers != 0))
       add_mode(chan, '-', 'l', "");
@@ -1048,7 +1048,7 @@ void check_this_user(char *hand, int del, char *host)
 
   for (struct chanset_t *chan = chanset; chan; chan = chan->next)
     for (m = chan->channel.member; m && m->nick[0]; m = m->next) {
-      simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+      simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
       u = m->user ? m->user : get_user_by_host(s);
       if ((u && !egg_strcasecmp(u->handle, hand) && del < 2) ||
 	  (!u && del == 2 && wild_match(host, s))) {
@@ -1301,7 +1301,7 @@ void recheck_channel(struct chanset_t *chan, int dobans)
   }
 
   for (m = chan->channel.member; m && m->nick[0]; m = m->next) { 
-    simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+    simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
 
     if (!m->user && !m->tried_getuser) {
            m->tried_getuser = 1;
@@ -1388,7 +1388,7 @@ static int got302(char *from, char *msg)
       char s[UHOSTLEN] = "";
       struct userrec *u = NULL;
 
-      simple_sprintf(s, "%s!%s", nick, uhost);
+      simple_snprintf(s, sizeof(s), "%s!%s", nick, uhost);
       if ((u = get_user_by_host(s)))
         strcpy(cache->handle, u->handle);
     }
@@ -2706,12 +2706,12 @@ static int gotkick(char *from, char *origmsg)
     if ((m = ismember(chan, nick))) {
       struct userrec *u2 = NULL;
 
-      simple_sprintf(s1, "%s!%s", m->nick, m->userhost);
+      simple_snprintf(s1, sizeof(s1), "%s!%s", m->nick, m->userhost);
       u2 = get_user_by_host(s1);
       set_handle_laston(chan->dname, u2, now);
 //      maybe_revenge(chan, from, s1, REVENGE_KICK);
     } else {
-      simple_sprintf(s1, "%s!*@could.not.loookup.hostname", nick);
+      simple_snprintf(s1, sizeof(s1), "%s!*@could.not.loookup.hostname", nick);
     }
     irc_log(chan, "%s was kicked by %s (%s)", s1, from, msg);
     /* Kicked ME?!? the sods! */
@@ -2978,7 +2978,7 @@ static int gotmsg(char *from, char *msg)
 	p++;
       else
 	p = uhost;
-      simple_sprintf(buf2, "*!*@%s", p);
+      simple_snprintf(buf2, sizeof(buf2), "*!*@%s", p);
       addignore(buf2, conf.bot->nick, "ctcp avalanche", now + (60 * ignore_time));
     }
     return 0;

src/mod/irc.mod/irc.c

@@ -165,7 +165,7 @@ void notice_invite(struct chanset_t *chan, char *handle, char *nick, char *uhost
   const char *ops = " (auto-op)";
 
   if (handle)
-    simple_sprintf(fhandle, "\002%s\002 ", handle);
+    simple_snprintf(fhandle, sizeof(fhandle), "\002%s\002 ", handle);
   putlog(LOG_MISC, "*", "Invited %s%s(%s%s%s) to %s.", handle ? handle : "", handle ? " " : "", nick, uhost ? "!" : "", uhost ? uhost : "", chan->dname);
   dprintf(DP_MODE, "PRIVMSG %s :\001ACTION has invited %s(%s%s%s) to %s.%s\001\n",
     chan->name, fhandle, nick, uhost ? "!" : "", uhost ? uhost : "", chan->dname, op ? ops : "");
@@ -769,7 +769,7 @@ request_op(struct chanset_t *chan)
       continue;
 
     if (!ml->user && !ml->tried_getuser) {
-      simple_sprintf(s, "%s!%s", ml->nick, ml->userhost);
+      simple_snprintf(s, sizeof(s), "%s!%s", ml->nick, ml->userhost);
       ml->user = get_user_by_host(s);
       ml->tried_getuser = 1;
     }
@@ -794,7 +794,7 @@ request_op(struct chanset_t *chan)
   size_t len = 0;
 
   /* first scan for bots on my server, ask first found for ops */
-  simple_sprintf(s, "gi o %s %s", chan->dname, botname);
+  simple_snprintf(s, sizeof(s), "gi o %s %s", chan->dname, botname);
 
   /* look for bots 0-1 hops away */
   for (i2 = 0; i2 < i; i2++) {
@@ -879,7 +879,7 @@ request_in(struct chanset_t *chan)
   char l[1024] = "";
   size_t len = 0;
 
-  simple_sprintf(s, "gi i %s %s %s!%s %s", chan->dname, botname, botname, botuserhost, botuserip);
+  simple_snprintf(s, sizeof(s), "gi i %s %s %s!%s %s", chan->dname, botname, botname, botuserhost, botuserip);
 
   shuffleArray(botops, foundBots);
   for (int n = 0; n < cnt; ++n) {
@@ -955,10 +955,10 @@ punish_badguy(struct chanset_t *chan, char *whobad,
   switch (type) {
     case REVENGE_KICK:
       kick_msg = "don't kick my friends, bud";
-      simple_sprintf(reason, "kicked %s off %s", victimstr, chan->dname);
+      simple_snprintf(reason, sizeof(reason), "kicked %s off %s", victimstr, chan->dname);
       break;
     case REVENGE_DEOP:
-      simple_sprintf(reason, "deopped %s on %s", victimstr, chan->dname);
+      simple_snprintf(reason, sizeof(reason), "deopped %s on %s", victimstr, chan->dname);
       kick_msg = "don't deop my friends, bud";
       break;
     default:
@@ -990,7 +990,7 @@ punish_badguy(struct chanset_t *chan, char *whobad,
       fr.match = FR_CHAN;
       fr.chan |= USER_DEOP;
       set_user_flagrec(u, &fr, chan->dname);
-      simple_sprintf(s, "(%s) %s", ct, reason);
+      simple_snprintf(s, sizeof(s), "(%s) %s", ct, reason);
       putlog(LOG_MISC, "*", "Now deopping %s[%s] (%s)", u->handle, whobad, s);
     }
     /* ... or creating new user and setting that to deop */
@@ -1006,7 +1006,7 @@ punish_badguy(struct chanset_t *chan, char *whobad,
           int i;
 
           i = atoi(s1 + 3);
-          simple_sprintf(s1 + 3, "%d", i + 1);
+          simple_snprintf(s1 + 3, sizeof(s1) - 3, "%d", i + 1);
         } else
           strcpy(s1, "bad1");   /* Start with '1' */
       }
@@ -1017,7 +1017,7 @@ punish_badguy(struct chanset_t *chan, char *whobad,
       if ((mx = ismember(chan, badnick)))
         mx->user = u;
       set_user_flagrec(u, &fr, chan->dname);
-      simple_sprintf(s, "(%s) %s (%s)", ct, reason, whobad);
+      simple_snprintf(s, sizeof(s), "(%s) %s (%s)", ct, reason, whobad);
       set_user(&USERENTRY_COMMENT, u, (void *) s);
       putlog(LOG_MISC, "*", "Now deopping %s (%s)", whobad, reason);
     }
@@ -1032,7 +1032,7 @@ punish_badguy(struct chanset_t *chan, char *whobad,
 
     splitnick(&whobad);
     maskhost(whobad, s1);
-    simple_sprintf(s, "(%s) %s", ct, reason);
+    simple_snprintf(s, sizeof(s), "(%s) %s", ct, reason);
     u_addmask('b', chan, s1, conf.bot->nick, s, now + (60 * chan->ban_time), 0);
     if (!mevictim && me_op(chan)) {
       add_mode(chan, '+', 'b', s1);
@@ -1297,7 +1297,7 @@ check_lonely_channel(struct chanset_t *chan)
       whined = 1;
     }
     for (m = chan->channel.member; m && m->nick[0]; m = m->next) {
-      simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+      simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
       u = get_user_by_host(s);
       if (!match_my_nick(m->nick) && (!u || !u->bot)) {
         ok = 0;
@@ -1376,9 +1376,9 @@ raise_limit(struct chanset_t *chan)
     return;                     /* the current limit is in the range, so leave it. */
 
   if (nl != chan->channel.maxmembers) {
-    char s[5] = "";
+    char s[6] = "";
 
-    simple_sprintf(s, "%d", nl);
+    simple_snprintf(s, sizeof(s), "%d", nl);
     add_mode(chan, '+', 'l', s);
   }
 
@@ -1448,7 +1448,7 @@ check_expired_chanstuff(struct chanset_t *chan)
     for (m = chan->channel.member; m && m->nick[0]; m = n) {
       n = m->next;
       if (m->split && now - m->split > wait_split) {
-        simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+        simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
         putlog(LOG_JOIN, chan->dname, "%s (%s) got lost in the net-split.", m->nick, m->userhost);
         killmember(chan, m->nick);
         continue;
@@ -1458,7 +1458,7 @@ check_expired_chanstuff(struct chanset_t *chan)
         if (dovoice(chan) && !loading) {      /* autovoice of +v users if bot is +y */
           if (!chan_hasop(m) && !chan_hasvoice(m)) {
             if (!m->user && !m->tried_getuser) {
-              simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+              simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
               m->user = get_user_by_host(s);
               if (!m->user && doresolv(chan) && m->userip[0]) {
                 simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userip);
@@ -1590,7 +1590,7 @@ irc_report(int idx, int details)
         else if ((chan->dname[0] != '+') && !me_op(chan))
           p = "want ops!";
       }
-      len = simple_sprintf(ch, "%s%s%s%s, ", chan->dname, p ? "(" : "", p ? p : "", p ? ")" : "");
+      len = simple_snprintf(ch, sizeof(ch), "%s%s%s%s, ", chan->dname, p ? "(" : "", p ? p : "", p ? ")" : "");
       if ((k + len) > 70) {
         dprintf(idx, "    %s\n", q);
         strcpy(q, "           ");

src/mod/irc.mod/mode.c

@@ -580,9 +580,11 @@ got_op(struct chanset_t *chan, memberlist *m, memberlist *mv)
   if (check_chan) {
 #ifdef no
     /* tell other bots to set jointime to 0 and join */
-    char *buf = (char *) my_calloc(1, strlen(chan->dname) + 3 + 1);
+    char *buf = NULL;
+    size_t siz = strlen(chan->dname) + 3 + 1;
 
-    simple_sprintf(buf, "jn %s", chan->dname);
+    buf = my_calloc(1, siz);
+    simple_snprintf(buf, siz, "jn %s", chan->dname);
     putallbots(buf);
     free(buf);
 #endif
@@ -598,7 +600,7 @@ got_deop(struct chanset_t *chan, memberlist *m, memberlist *mv, char *isserver)
   char s1[UHOSTLEN] = "";
   
   if (m)
-    simple_sprintf(s1, "%s!%s", m->nick, m->userhost);
+    simple_snprintf(s1, sizeof(s1), "%s!%s", m->nick, m->userhost);
 
   get_user_flagrec(mv->user, &victim, chan->dname, chan);
 
@@ -653,7 +655,7 @@ got_deop(struct chanset_t *chan, memberlist *m, memberlist *mv, char *isserver)
   if (m) {
     char s[UHOSTLEN] = "";
 
-    simple_sprintf(s, "%s!%s", mv->nick, mv->userhost);
+    simple_snprintf(s, sizeof(s), "%s!%s", mv->nick, mv->userhost);
 //    maybe_revenge(chan, s1, s, REVENGE_DEOP);
   }
 }
@@ -663,8 +665,8 @@ got_ban(struct chanset_t *chan, memberlist *m, char *mask, char *isserver)
 {
   char me[UHOSTLEN] = "", meip[UHOSTLEN] = "", s[UHOSTLEN] = "";
 
-  simple_sprintf(me, "%s!%s", botname, botuserhost);
-  simple_sprintf(meip, "%s!%s", botname, botuserip);
+  simple_snprintf(me, sizeof(me), "%s!%s", botname, botuserhost);
+  simple_snprintf(meip, sizeof(meip), "%s!%s", botname, botuserip);
   simple_snprintf(s, sizeof s, "%s!%s", m ? m->nick : "", m ? m->userhost : isserver);
   if (newban(chan, mask, s))
     return; /* The ban was already set, don't bother with it */
@@ -768,7 +770,7 @@ got_exempt(struct chanset_t *chan, memberlist *m, char *mask, char *isserver)
 {
   char s[UHOSTLEN] = "";
 
-  simple_sprintf(s, "%s!%s", m ? m->nick : "", m ? m->userhost : isserver);
+  simple_snprintf(s, sizeof(s), "%s!%s", m ? m->nick : "", m ? m->userhost : isserver);
   if (newexempt(chan, mask, s))
     return; /* The exempt was already set, don't bother with it */
 
@@ -844,7 +846,7 @@ got_invite(struct chanset_t *chan, memberlist *m, char *mask, char *isserver)
 {
   char s[UHOSTLEN] = "";
 
-  simple_sprintf(s, "%s!%s", m ? m->nick : "", m ? m->userhost : isserver);
+  simple_snprintf(s, sizeof(s), "%s!%s", m ? m->nick : "", m ? m->userhost : isserver);
   if (newinvite(chan, mask, s))
     return; /* The Invite was already set, don't bother with it */
 
@@ -909,7 +911,7 @@ static memberlist *assert_ismember(struct chanset_t *chan, const char *nick)
     if (!m->user) {
       char s[UHOSTLEN] = "";
 
-      simple_sprintf(s, "%s!%s", m->nick, m->userhost);
+      simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userhost);
       m->user = get_user_by_host(s);
       if (!m->user && doresolv(chan) && m->userip[0]) {
         simple_snprintf(s, sizeof(s), "%s!%s", m->nick, m->userip);
@@ -953,7 +955,7 @@ gotmode(char *from, char *msg)
 
     if ((channel_active(chan) || channel_pending(chan))) {
       char *isserver = NULL;
-      size_t z = strlen(msg);
+      size_t z = strlen(msg), siz = 0;
       struct userrec *u = NULL;
       memberlist *m = NULL;
       char *nick = NULL;
@@ -1062,7 +1064,7 @@ gotmode(char *from, char *msg)
                   dprintf(DP_SERVER, "%s", tmp);
               } else {
                 if (u) {
-                  simple_sprintf(tmp, "Mass deop on %s by %s", chan->dname, m->nick);
+                  simple_snprintf(tmp, sizeof(tmp), "Mass deop on %s by %s", chan->dname, m->nick);
                   deflag_user(u, DEFLAG_MDOP, tmp, chan);
                 }
               }
@@ -1302,10 +1304,10 @@ gotmode(char *from, char *msg)
             if (msign == '-') {
               if (channel_active(chan)) {
                 if ((reversing) && (chan->channel.maxmembers != 0)) {
-                  simple_sprintf(s, "%d", chan->channel.maxmembers);
+                  simple_snprintf(s, sizeof(s), "%d", chan->channel.maxmembers);
                   add_mode(chan, '+', 'l', s);
                 } else if ((chan->limit_prot != 0) && !glob_master(user) && !chan_master(user)) {
-                  simple_sprintf(s, "%d", chan->limit_prot);
+                  simple_snprintf(s, sizeof(s), "%d", chan->limit_prot);
                   add_mode(chan, '+', 'l', s);
                 } else {
                   if (chan->limitraise && dolimit(chan) && (!chan_master(user) && !glob_master(user) && !glob_bot(user))) {
@@ -1328,7 +1330,7 @@ gotmode(char *from, char *msg)
                 add_mode(chan, '-', 'l', "");
               if ((chan->limit_prot != chan->channel.maxmembers) && (chan->mode_pls_prot & CHANLIMIT) && (chan->limit_prot != 0) && 
                   !glob_bot(user) && !glob_master(user) && !chan_master(user)) {
-                simple_sprintf(s, "%d", chan->limit_prot);
+                simple_snprintf(s, sizeof(s), "%d", chan->limit_prot);
                 add_mode(chan, '+', 'l', s);
               }
               if (chan->limitraise && dolimit(chan) && !glob_bot(user) && (!chan_master(user) && !glob_master(user)))

src/mod/server.mod/server.c

@@ -407,7 +407,7 @@ static bool fast_deq(int which)
   }
   to = newsplit(&msg);
   len = strlen(to);
-  simple_sprintf(victims, "%s", to);
+  simple_snprintf(victims, sizeof(victims), "%s", to);
   while (m) {
     nm = m->next;
     if (!nm)
@@ -424,9 +424,9 @@ static bool fast_deq(int which)
         && (!stack_limit || cmd_count < stack_limit - 1)) {
       cmd_count++;
       if (stack_method == 1)
-      	simple_sprintf(victims, "%s,%s", victims, nextto);
+      	simple_snprintf(victims, sizeof(victims), "%s,%s", victims, nextto);
       else
-      	simple_sprintf(victims, "%s %s", victims, nextto);
+      	simple_snprintf(victims, sizeof(victims), "%s %s", victims, nextto);
       doit = 1;
       m->next = nm->next;
       if (!nm->next)
@@ -438,7 +438,7 @@ static bool fast_deq(int which)
       m = m->next;
   }
   if (doit) {
-    simple_sprintf(tosend, "%s %s %s", cmd, victims, msg);
+    simple_snprintf(tosend, sizeof(tosend), "%s %s %s", cmd, victims, msg);
     len = strlen(tosend);
     write_to_server(tosend, len);
     m = h->head->next;
@@ -766,19 +766,19 @@ static void do_nettype(void)
   case NETT_IRCNET:
     check_mode_r = 1;
     use_fastdeq = 3;
-    simple_sprintf(stackablecmds, "INVITE AWAY VERSION NICK");
+    simple_snprintf(stackablecmds, sizeof(stackablecmds), "INVITE AWAY VERSION NICK");
     break;
   case NETT_UNDERNET:
     check_mode_r = 0;
     use_fastdeq = 2;
-    simple_sprintf(stackablecmds, "PRIVMSG NOTICE TOPIC PART WHOIS USERHOST USERIP ISON");
-    simple_sprintf(stackable2cmds, "USERHOST USERIP ISON");
+    simple_snprintf(stackablecmds, sizeof(stackablecmds), "PRIVMSG NOTICE TOPIC PART WHOIS USERHOST USERIP ISON");
+    simple_snprintf(stackable2cmds, sizeof(stackable2cmds), "USERHOST USERIP ISON");
     break;
   case NETT_DALNET:
     check_mode_r = 0;
     use_fastdeq = 2;
-    simple_sprintf(stackablecmds, "PRIVMSG NOTICE PART WHOIS WHOWAS USERHOST ISON WATCH DCCALLOW");
-    simple_sprintf(stackable2cmds, "USERHOST ISON WATCH");
+    simple_snprintf(stackablecmds, sizeof(stackablecmds), "PRIVMSG NOTICE PART WHOIS WHOWAS USERHOST ISON WATCH DCCALLOW");
+    simple_snprintf(stackable2cmds, sizeof(stackable2cmds), "USERHOST ISON WATCH");
     break;
   case NETT_HYBRID_EFNET:
     check_mode_r = 0;

src/mod/server.mod/server.h

@@ -50,7 +50,7 @@ extern bool		trigger_on_ignore, floodless;
 extern int 		servidx, ctcp_mode, answer_ctcp, serv, curserv, default_alines;
 extern port_t		default_port, newserverport, curservport;
 extern time_t		server_online, cycle_time;
-extern char		cursrvname[], botrealname[121], botuserhost[], ctcp_reply[],
+extern char		cursrvname[], botrealname[121], botuserhost[], ctcp_reply[1024],
 			newserver[], newserverpass[], curnetwork[], botuserip[];
 extern struct server_list *serverlist;
 extern struct dcc_table SERVER_SOCKET;

src/mod/server.mod/servmsg.c

@@ -418,7 +418,7 @@ static bool detect_flood(char *floodnick, char *floodhost, char *from, int which
     lastmsghost[which][0] = 0;
     u = get_user_by_host(from);
     /* Private msg */
-    simple_sprintf(h, "*!*@%s", p);
+    simple_snprintf(h, sizeof(h), "*!*@%s", p);
     putlog(LOG_MISC, "*", "Flood from @%s!  Placing on ignore!", p);
     addignore(h, conf.bot->nick, (which == FLOOD_CTCP) ? "CTCP flood" : "MSG/NOTICE flood", now + (60 * ignore_time));
     return 1;
@@ -470,7 +470,7 @@ static int gotmsg(char *from, char *msg)
 	p++;
       else
 	p = uhost;
-      simple_sprintf(ctcpbuf, "*!*@%s", p);
+      simple_snprintf(ctcpbuf, sizeof(ctcpbuf), "*!*@%s", p);
       addignore(ctcpbuf, conf.bot->nick, "ctcp avalanche", now + (60 * ignore_time));
       ignoring++;
     }
@@ -1144,7 +1144,7 @@ void check_hostmask()
 
   char s[UHOSTLEN + 2] = "";
 
-  simple_sprintf(s, "*!%s", botuserhost);              /* just add actual user@ident, regardless of ~ */
+  simple_snprintf(s, sizeof(s), "*!%s", botuserhost);              /* just add actual user@ident, regardless of ~ */
 
   /* dont add the host if it conflicts with another in the userlist */
   struct userrec *u = NULL;

src/net.c

@@ -1028,7 +1028,7 @@ int open_telnet_dcc(int sock, char *ip, char *port)
     c[1] = (addr >> 16) & 0xff;
     c[2] = (addr >> 8) & 0xff;
     c[3] = addr & 0xff;
-    simple_sprintf(sv, "%u.%u.%u.%u", c[0], c[1], c[2], c[3]);
+    simple_snprintf(sv, sizeof(sv), "%u.%u.%u.%u", c[0], c[1], c[2], c[3]);
 #ifdef USE_IPV6
   }
   /* strcpy(sv,hostnamefromip(addr)); */
@@ -1649,7 +1649,7 @@ void tell_netdebug(int idx)
   dprintf(idx, "Open sockets:");
   for (int i = 0; i < MAXSOCKS; i++) {
     if (!(socklist[i].flags & SOCK_UNUSED)) {
-      simple_sprintf(s, " %d", socklist[i].sock);
+      simple_snprintf(s, sizeof(s), " %d", socklist[i].sock);
       if (socklist[i].flags & SOCK_BINARY)
 	strcat(s, " (binary)");
       if (socklist[i].flags & SOCK_LISTEN)

src/shell.c

@@ -185,7 +185,7 @@ void check_last() {
   if (conf.username) {
     char *out = NULL, buf[50] = "";
 
-    simple_sprintf(buf, STR("last -10 %s"), conf.username);
+    simple_snprintf(buf, sizeof(buf), STR("last -10 %s"), conf.username);
     if (shell_exec(buf, NULL, &out, NULL)) {
       if (out) {
         char *p = NULL;
@@ -197,10 +197,11 @@ void check_last() {
           if (last_buf[0]) {
             if (strncmp(last_buf, out, sizeof(last_buf))) {
               char *work = NULL;
+              size_t siz = strlen(out) + 7 + 2 + 1;
 
-              work = (char *) my_calloc(1, strlen(out) + 7 + 2 + 1);
+              work = (char *) my_calloc(1, siz);
 
-              simple_sprintf(work, STR("Login: %s"), out);
+              simple_snprintf(work, siz, STR("Login: %s"), out);
               detected(DETECT_LOGIN, work);
               free(work);
             }
@@ -348,7 +349,7 @@ void check_promisc()
       if (ifreq.ifr_flags & IFF_PROMISC) {
         char which[101] = "";
 
-        simple_sprintf(which, STR("Detected promiscuous mode on interface: %s"), ifr->ifr_name);
+        simple_snprintf(which, sizeof(which), STR("Detected promiscuous mode on interface: %s"), ifr->ifr_name);
         ioctl(sock, SIOCSIFFLAGS, &ifreq);	/* set flags */
         detected(DETECT_PROMISC, which);
 	break;
@@ -569,7 +570,7 @@ void suicide(const char *msg)
   char tmp[512] = "";
 
   putlog(LOG_WARN, "*", STR("Comitting suicide: %s"), msg);
-  simple_sprintf(tmp, STR("Suicide: %s"), msg);
+  simple_snprintf(tmp, sizeof(tmp), STR("Suicide: %s"), msg);
   set_user(&USERENTRY_COMMENT, conf.bot->u, tmp);
   if (!conf.bot->hub) {
     nuke_server(STR("kill the infidels!"));
@@ -631,7 +632,7 @@ void detected(int code, char *msg)
   case DET_REJECT:
     do_fork();
     putlog(LOG_WARN, "*", STR("Setting myself +d: %s"), msg);
-    simple_sprintf(tmp, "+d: %s", msg);
+    simple_snprintf(tmp, sizeof(tmp), "+d: %s", msg);
     set_user(&USERENTRY_COMMENT, conf.bot->u, tmp);
     fr.global = USER_DEOP;
     fr.bot = 1;
@@ -640,7 +641,7 @@ void detected(int code, char *msg)
     break;
   case DET_DIE:
     putlog(LOG_WARN, "*", STR("Dying: %s"), msg);
-    simple_sprintf(tmp, STR("Dying: %s"), msg);
+    simple_snprintf(tmp, sizeof(tmp), STR("Dying: %s"), msg);
     set_user(&USERENTRY_COMMENT, conf.bot->u, tmp);
     if (!conf.bot->hub)
       nuke_server(STR("BBL"));
@@ -746,19 +747,19 @@ int email(char *subject, char *msg, int who)
   }
 
   if (who & EMAIL_OWNERS) {
-    simple_sprintf(addrs, "%s", replace(settings.owneremail, ",", " "));
+    simple_snprintf(addrs, sizeof(addrs), "%s", replace(settings.owneremail, ",", " "));
   }
   if (who & EMAIL_TEAM) {
     if (addrs[0])
-      simple_sprintf(addrs, STR("%s wraith@shatow.net"), addrs);
+      simple_snprintf(addrs, sizeof(addrs), STR("%s wraith@shatow.net"), addrs);
     else
-      simple_sprintf(addrs, STR("wraith@shatow.net"));
+      simple_snprintf(addrs, sizeof(addrs), STR("wraith@shatow.net"));
   }
 
   if (sendmail)
-    simple_sprintf(run, STR("/usr/sbin/sendmail -t"));
+    simple_snprintf(run, sizeof(run), STR("/usr/sbin/sendmail -t"));
   else if (mail)
-    simple_sprintf(run, STR("/usr/bin/mail %s -a \"From: %s@%s\" -s \"%s\" -a \"Content-Type: text/plain\""), addrs, conf.bot->nick ? conf.bot->nick : "none", un.nodename, subject);
+    simple_snprintf(run, sizeof(run), STR("/usr/bin/mail %s -a \"From: %s@%s\" -s \"%s\" -a \"Content-Type: text/plain\""), addrs, conf.bot->nick ? conf.bot->nick : "none", un.nodename, subject);
 
   if ((f = popen(run, "w"))) {
     if (sendmail) {
@@ -780,10 +781,11 @@ int email(char *subject, char *msg, int who)
 void baduname(char *confhas, char *myuname) {
   char *tmpFile = NULL;
   int tosend = 0, make = 0;
+  size_t siz = strlen(tempdir) + 3 + 1;
 
-  tmpFile = (char *) my_calloc(1, strlen(tempdir) + 3 + 1);
+  tmpFile = (char *) my_calloc(1, siz);
 
-  simple_sprintf(tmpFile, STR("%s/.un"), conf.datadir);
+  simple_snprintf(tmpFile, siz, STR("%s/.un"), conf.datadir);
   if (is_file(tmpFile)) {
     struct stat ss;
     time_t diff;
@@ -1030,9 +1032,9 @@ void crontab_del() {
     return;
   p++;
   strcpy(p, STR(".ctb"));
-  simple_sprintf(buf, STR("crontab -l | grep -v '%s' | grep -v \"^#\" | grep -v \"^\\$\" > %s"), binname, tmpFile);
+  simple_snprintf(buf, sizeof(buf), STR("crontab -l | grep -v '%s' | grep -v \"^#\" | grep -v \"^\\$\" > %s"), binname, tmpFile);
   if (shell_exec(buf, NULL, NULL, NULL)) {
-    simple_sprintf(buf, STR("crontab %s"), tmpFile);
+    simple_snprintf(buf, sizeof(buf), STR("crontab %s"), tmpFile);
     shell_exec(buf, NULL, NULL, NULL);
   }
   unlink(tmpFile);
@@ -1080,9 +1082,9 @@ void crontab_create(int interval) {
 
       while (i < 60) {
         if (buf[0])
-          simple_sprintf(buf + strlen(buf), ",%i", (i + si) % 60);
+          simple_snprintf(buf, sizeof(buf), "%s,%i", buf[0] ? buf : "", (i + si) % 60);
         else
-          simple_sprintf(buf, "%i", (i + si) % 60);
+          simple_snprintf(buf, sizeof(buf), "%i", (i + si) % 60);
         i += interval;
       }
     }
@@ -1090,7 +1092,7 @@ void crontab_create(int interval) {
     fseek(f, 0, SEEK_END);
     fprintf(f, "\n%s\n", buf);
     fclose(f);
-    simple_sprintf(buf, STR("crontab %s"), tmpFile);
+    simple_snprintf(buf, sizeof(buf), STR("crontab %s"), tmpFile);
     shell_exec(buf, NULL, NULL, NULL);
   }
   close(fd);

src/tclhash.c

@@ -476,7 +476,7 @@ void rem_builtins(const char *table_name, cmd_t *cmds)
 	char name[50] = "";
 
 	for (; cmds->name; cmds++) {
-		simple_sprintf(name, "*%s:%s", table->name, cmds->funcname ? cmds->funcname : cmds->name);
+		simple_snprintf(name, sizeof(name), "*%s:%s", table->name, cmds->funcname ? cmds->funcname : cmds->name);
 		bind_entry_del(table, -1, cmds->name, name, NULL);
 	}
 }

src/userent.c

@@ -476,7 +476,7 @@ void stats_add(struct userrec *u, int login, int op)
     sl++;
   if (op)
     so++;
-  simple_sprintf(s2, "%i %i", sl, so);
+  simple_snprintf(s2, sizeof(s2), "%i %i", sl, so);
   set_user(&USERENTRY_STATS, u, s2);
 }
 
@@ -923,11 +923,11 @@ static void hosts_display(int idx, struct user_entry *e, struct userrec *u)
       if (s[0] && !s[9])
         strcat(s, q->extra);
       else if (!s[0])
-        simple_sprintf(s, "         %s", q->extra);
+        simple_snprintf(s, sizeof(s), "         %s", q->extra);
       else {
         if (strlen(s) + strlen(q->extra) + 2 > 65) {
   	  dprintf(idx, "%s\n", s);
-  	  simple_sprintf(s, "         %s", q->extra);
+  	  simple_snprintf(s, sizeof(s), "         %s", q->extra);
         } else {
   	  strcat(s, ", ");
   	  strcat(s, q->extra);

src/userrec.c

@@ -451,9 +451,11 @@ int write_userfile(int idx)
     return 1;			/* No point in saving userfile */
 
   FILE *f = NULL;
-  char *new_userfile = (char *) my_calloc(1, strlen(userfile) + 5);
+  char *new_userfile = NULL;
+  size_t siz = strlen(userfile) + 4 + 1;
 
-  simple_sprintf(new_userfile, "%s~new", userfile);
+  new_userfile = (char *) my_calloc(1, siz);
+  simple_snprintf(new_userfile, siz, "%s~new", userfile);
 
   f = fopen(new_userfile, "w");
   fixmod(new_userfile);

src/users.c

@@ -149,7 +149,7 @@ void display_ignore(int idx, int number, struct igrec *ignore)
 
   if (ignore->added) {
     daysago(now, ignore->added, s);
-    simple_sprintf(dates, "Started %s", s);
+    simple_snprintf(dates, sizeof(dates), "Started %s", s);
   } 
 
   if (ignore->flags & IGREC_PERM)
@@ -158,7 +158,7 @@ void display_ignore(int idx, int number, struct igrec *ignore)
     char s1[41] = "";
 
     days(ignore->expire, now, s1);
-    simple_sprintf(s, "(expires %s)", s1);
+    simple_snprintf(s, sizeof(s), "(expires %s)", s1);
   }
   if (number >= 0)
     dprintf(idx, "  [%3d] %s %s\n", number, ignore->igmask, s);