Module Name:    src
Committed By:   snj
Date:           Mon Jun 29 23:43:48 UTC 2009

Modified Files:
        src/games/hack [netbsd-4-0]: extern.h hack.do_name.c hack.eat.c
            hack.end.c hack.fight.c hack.invent.c hack.main.c hack.objnam.c
            hack.options.c hack.pri.c hack.rip.c hack.shk.c hack.topl.c
            hack.unix.c

Log Message:
Pull up following revision(s) (requested by dholland in ticket #1331):
        games/hack/extern.h: revision 1.11
        games/hack/hack.do_name.c: revision 1.9
        games/hack/hack.eat.c: revision 1.8
        games/hack/hack.end.c: revision 1.12 via patch
        games/hack/hack.fight.c: revision 1.10 via patch
        games/hack/hack.invent.c: revision 1.12
        games/hack/hack.main.c: revision 1.12
        games/hack/hack.objnam.c: revision 1.9
        games/hack/hack.options.c: revision 1.9
        games/hack/hack.pri.c: revision 1.11
        games/hack/hack.rip.c: revision 1.10
        games/hack/hack.shk.c: revision 1.10
        games/hack/hack.topl.c: revision 1.10
        games/hack/hack.unix.c: revision 1.12
sprintf -> snprintf, plus some use of strlcpy/strlcat where appropriate
XXX: there's still one sprintf left which will take some hacking to expunge.


To generate a diff of this commit:
cvs rdiff -u -r1.6 -r1.6.26.1 src/games/hack/extern.h \
    src/games/hack/hack.do_name.c src/games/hack/hack.eat.c \
    src/games/hack/hack.objnam.c
cvs rdiff -u -r1.7 -r1.7.14.1 src/games/hack/hack.end.c \
    src/games/hack/hack.fight.c
cvs rdiff -u -r1.10 -r1.10.14.1 src/games/hack/hack.invent.c
cvs rdiff -u -r1.9 -r1.9.26.1 src/games/hack/hack.main.c \
    src/games/hack/hack.unix.c
cvs rdiff -u -r1.7 -r1.7.26.1 src/games/hack/hack.options.c \
    src/games/hack/hack.rip.c src/games/hack/hack.topl.c
cvs rdiff -u -r1.8 -r1.8.26.1 src/games/hack/hack.pri.c
cvs rdiff -u -r1.8 -r1.8.14.1 src/games/hack/hack.shk.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: src/games/hack/extern.h
diff -u src/games/hack/extern.h:1.6 src/games/hack/extern.h:1.6.26.1
--- src/games/hack/extern.h:1.6	Tue Jan 27 20:30:29 2004
+++ src/games/hack/extern.h	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: extern.h,v 1.6 2004/01/27 20:30:29 jsm Exp $	*/
+/*	$NetBSD: extern.h,v 1.6.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*-
  * Copyright (c) 1997 The NetBSD Foundation, Inc.
@@ -363,7 +363,7 @@
 char *typename(int);
 char *xname(struct obj *);
 char *doname(struct obj *);
-void setan(const char *, char *);
+void setan(const char *, char *, size_t);
 char *aobjnam(struct obj *, const char *);
 char *Doname(struct obj *);
 struct obj *readobjnam(char *);
Index: src/games/hack/hack.do_name.c
diff -u src/games/hack/hack.do_name.c:1.6 src/games/hack/hack.do_name.c:1.6.26.1
--- src/games/hack/hack.do_name.c:1.6	Wed Apr  2 18:36:36 2003
+++ src/games/hack/hack.do_name.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.do_name.c,v 1.6 2003/04/02 18:36:36 jsm Exp $	*/
+/*	$NetBSD: hack.do_name.c,v 1.6.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.do_name.c,v 1.6 2003/04/02 18:36:36 jsm Exp $");
+__RCSID("$NetBSD: hack.do_name.c,v 1.6.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <stdlib.h>
@@ -273,7 +273,7 @@
 {
 	static char     buf[BUFSZ];	/* %% */
 	if (mtmp->mnamelth && !vb) {
-		(void) strcpy(buf, NAME(mtmp));
+		(void) strlcpy(buf, NAME(mtmp), sizeof(buf));
 		return (buf);
 	}
 	switch (mtmp->data->mlet) {
@@ -286,23 +286,23 @@
 					(void)
 						strcpy((char *) mtmp->mextra, !rn2(5) ? plname : gn);
 			}
-			(void) sprintf(buf, "%s's ghost", gn);
+			(void) snprintf(buf, sizeof(buf), "%s's ghost", gn);
 		}
 		break;
 	case '@':
 		if (mtmp->isshk) {
-			(void) strcpy(buf, shkname(mtmp));
+			(void) strlcpy(buf, shkname(mtmp), sizeof(buf));
 			break;
 		}
 		/* fall into next case */
 	default:
-		(void) sprintf(buf, "the %s%s",
+		(void) snprintf(buf, sizeof(buf), "the %s%s",
 			       mtmp->minvis ? "invisible " : "",
 			       mtmp->data->mname);
 	}
 	if (vb && mtmp->mnamelth) {
-		(void) strcat(buf, " called ");
-		(void) strcat(buf, NAME(mtmp));
+		(void) strlcat(buf, " called ", sizeof(buf));
+		(void) strlcat(buf, NAME(mtmp), sizeof(buf));
 	}
 	return (buf);
 }
@@ -341,7 +341,7 @@
 
 	if (!strncmp(bp, "the ", 4))
 		bp += 4;
-	(void) sprintf(buf, "the %s %s", adj, bp);
+	(void) snprintf(buf, sizeof(buf), "the %s %s", adj, bp);
 	return (buf);
 }
 
Index: src/games/hack/hack.eat.c
diff -u src/games/hack/hack.eat.c:1.6 src/games/hack/hack.eat.c:1.6.26.1
--- src/games/hack/hack.eat.c:1.6	Wed Apr  2 18:36:36 2003
+++ src/games/hack/hack.eat.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.eat.c,v 1.6 2003/04/02 18:36:36 jsm Exp $	*/
+/*	$NetBSD: hack.eat.c,v 1.6.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.eat.c,v 1.6 2003/04/02 18:36:36 jsm Exp $");
+__RCSID("$NetBSD: hack.eat.c,v 1.6.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include "hack.h"
@@ -330,7 +330,8 @@
 eatx:
 	if (multi < 0 && !nomovemsg) {
 		static char     msgbuf[BUFSZ];
-		(void) sprintf(msgbuf, "You finished eating the %s.",
+		(void) snprintf(msgbuf, sizeof(msgbuf),
+			       "You finished eating the %s.",
 			       ftmp->oc_name);
 		nomovemsg = msgbuf;
 	}
Index: src/games/hack/hack.objnam.c
diff -u src/games/hack/hack.objnam.c:1.6 src/games/hack/hack.objnam.c:1.6.26.1
--- src/games/hack/hack.objnam.c:1.6	Wed Apr  2 18:36:39 2003
+++ src/games/hack/hack.objnam.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.objnam.c,v 1.6 2003/04/02 18:36:39 jsm Exp $	*/
+/*	$NetBSD: hack.objnam.c,v 1.6.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,13 +63,13 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.objnam.c,v 1.6 2003/04/02 18:36:39 jsm Exp $");
+__RCSID("$NetBSD: hack.objnam.c,v 1.6.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <stdlib.h>
 #include "hack.h"
 #include "extern.h"
-#define Sprintf (void) sprintf
+#define Snprintf (void) snprintf
 #define Strcat  (void) strcat
 #define	Strcpy	(void) strcpy
 #define	PREFIX	15
@@ -93,7 +93,7 @@
 	int             a;
 {
 	static char     buf[13];
-	Sprintf(buf, (a < 0) ? "%d" : "+%d", a);
+	Snprintf(buf, sizeof(buf), (a < 0) ? "%d" : "+%d", a);
 	return (buf);
 }
 
@@ -102,6 +102,7 @@
 	int             otyp;
 {
 	static char     buf[BUFSZ];
+	size_t bufpos;
 	struct objclass *ocl = &objects[otyp];
 	const char     *an = ocl->oc_name;
 	const char     *dn = ocl->oc_descr;
@@ -125,26 +126,42 @@
 			Strcpy(buf, an);
 			if (otyp >= TURQUOISE && otyp <= JADE)
 				Strcat(buf, " stone");
-			if (un)
-				Sprintf(eos(buf), " called %s", un);
-			if (dn)
-				Sprintf(eos(buf), " (%s)", dn);
+			if (un) {
+				bufpos = strlen(buf);
+				Snprintf(buf+bufpos, sizeof(buf)-bufpos,
+					" called %s", un);
+			}
+			if (dn) {
+				bufpos = strlen(buf);
+				Snprintf(buf+bufpos, sizeof(buf)-bufpos,
+					" (%s)", dn);
+			}
 		} else {
-			Strcpy(buf, dn ? dn : an);
-			if (ocl->oc_olet == GEM_SYM)
-				Strcat(buf, " gem");
-			if (un)
-				Sprintf(eos(buf), " called %s", un);
+			strlcpy(buf, dn ? dn : an, sizeof(buf));
+			if (ocl->oc_olet == GEM_SYM) {
+				strlcat(buf, " gem", sizeof(buf));
+			}
+			if (un) {
+				bufpos = strlen(buf);
+				Snprintf(buf+bufpos, sizeof(buf)-bufpos,
+					" called %s", un);
+			}
 		}
 		return (buf);
 	}
 	/* here for ring/scroll/potion/wand */
-	if (nn)
-		Sprintf(eos(buf), " of %s", an);
-	if (un)
-		Sprintf(eos(buf), " called %s", un);
-	if (dn)
-		Sprintf(eos(buf), " (%s)", dn);
+	if (nn) {
+		bufpos = strlen(buf);
+		Snprintf(buf+bufpos, sizeof(buf)-bufpos, " of %s", an);
+	}
+	if (un) {
+		bufpos = strlen(buf);
+		Snprintf(buf+bufpos, sizeof(buf)-bufpos, " called %s", un);
+	}
+	if (dn) {
+		bufpos = strlen(buf);
+		Snprintf(buf+bufpos, sizeof(buf)-bufpos, " (%s)", dn);
+	}
 	return (buf);
 }
 
@@ -153,12 +170,15 @@
 	struct obj     *obj;
 {
 	static char     bufr[BUFSZ];
+	/* caution: doname() and aobjnam() below "know" these sizes */
 	char           *buf = &(bufr[PREFIX]);	/* leave room for "17 -3 " */
+	size_t          bufmax = sizeof(bufr) - PREFIX;
 	int             nn = objects[obj->otyp].oc_name_known;
 	const char     *an = objects[obj->otyp].oc_name;
 	const char     *dn = objects[obj->otyp].oc_descr;
 	char           *un = objects[obj->otyp].oc_uname;
 	int             pl = (obj->quan != 1);
+
 	if (!obj->dknown && !Blind)
 		obj->dknown = 1;/* %% doesnt belong here */
 	switch (obj->olet) {
@@ -169,10 +189,10 @@
 		break;
 	case TOOL_SYM:
 		if (!nn) {
-			Strcpy(buf, dn);
+			strlcpy(buf, dn, bufmax);
 			break;
 		}
-		Strcpy(buf, an);
+		strlcpy(buf, an, bufmax);
 		break;
 	case FOOD_SYM:
 		if (obj->otyp == DEAD_HOMUNCULUS && pl) {
@@ -197,10 +217,10 @@
 	case ARMOR_SYM:
 	case CHAIN_SYM:
 	case ROCK_SYM:
-		Strcpy(buf, an);
+		strlcpy(buf, an, bufmax);
 		break;
 	case BALL_SYM:
-		Sprintf(buf, "%sheavy iron ball",
+		Snprintf(buf, bufmax, "%sheavy iron ball",
 		  (obj->owt > objects[obj->otyp].oc_weight) ? "very " : "");
 		break;
 	case POTION_SYM:
@@ -214,14 +234,14 @@
 				break;
 			if (un) {
 				Strcat(buf, " called ");
-				Strcat(buf, un);
+				strlcat(buf, un, bufmax);
 			} else {
 				Strcat(buf, " of ");
-				Strcat(buf, an);
+				strlcat(buf, an, bufmax);
 			}
 		} else {
-			Strcpy(buf, dn);
-			Strcat(buf, " potion");
+			strlcpy(buf, dn, bufmax);
+			strlcat(buf, " potion", bufmax);
 		}
 		break;
 	case SCROLL_SYM:
@@ -234,34 +254,34 @@
 			break;
 		if (nn) {
 			Strcat(buf, " of ");
-			Strcat(buf, an);
+			strlcat(buf, an, bufmax);
 		} else if (un) {
 			Strcat(buf, " called ");
-			Strcat(buf, un);
+			strlcat(buf, un, bufmax);
 		} else {
 			Strcat(buf, " labeled ");
-			Strcat(buf, dn);
+			strlcat(buf, dn, bufmax);
 		}
 		break;
 	case WAND_SYM:
 		if (!obj->dknown)
-			Sprintf(buf, "wand");
+			Snprintf(buf, bufmax, "wand");
 		else if (nn)
-			Sprintf(buf, "wand of %s", an);
+			Snprintf(buf, bufmax, "wand of %s", an);
 		else if (un)
-			Sprintf(buf, "wand called %s", un);
+			Snprintf(buf, bufmax, "wand called %s", un);
 		else
-			Sprintf(buf, "%s wand", dn);
+			Snprintf(buf, bufmax, "%s wand", dn);
 		break;
 	case RING_SYM:
 		if (!obj->dknown)
-			Sprintf(buf, "ring");
+			Snprintf(buf, bufmax, "ring");
 		else if (nn)
-			Sprintf(buf, "ring of %s", an);
+			Snprintf(buf, bufmax, "ring of %s", an);
 		else if (un)
-			Sprintf(buf, "ring called %s", un);
+			Snprintf(buf, bufmax, "ring called %s", un);
 		else
-			Sprintf(buf, "%s ring", dn);
+			Snprintf(buf, bufmax, "%s ring", dn);
 		break;
 	case GEM_SYM:
 		if (!obj->dknown) {
@@ -269,15 +289,15 @@
 			break;
 		}
 		if (!nn) {
-			Sprintf(buf, "%s gem", dn);
+			Snprintf(buf, bufmax, "%s gem", dn);
 			break;
 		}
-		Strcpy(buf, an);
+		strlcpy(buf, an, bufmax);
 		if (obj->otyp >= TURQUOISE && obj->otyp <= JADE)
-			Strcat(buf, " stone");
+			strlcat(buf, " stone", bufmax);
 		break;
 	default:
-		Sprintf(buf, "glorkum %c (0%o) %u %d",
+		Snprintf(buf, bufmax, "glorkum %c (0%o) %u %d",
 			obj->olet, obj->olet, obj->otyp, obj->spe);
 	}
 	if (pl) {
@@ -298,17 +318,21 @@
 		}
 		p = eos(buf) - 1;
 		if (*p == 's' || *p == 'z' || *p == 'x' ||
-		    (*p == 'h' && p[-1] == 's'))
-			Strcat(buf, "es");	/* boxes */
-		else if (*p == 'y' && !strchr(vowels, p[-1]))
-			Strcpy(p, "ies");	/* rubies, zruties */
-		else
-			Strcat(buf, "s");
+		    (*p == 'h' && p[-1] == 's')) {
+			/* boxes */
+			strlcat(buf, "es", bufmax);
+		} else if (*p == 'y' && !strchr(vowels, p[-1])) {
+			/* rubies, zruties */
+			*p = '\0';
+			strlcat(buf, "ies", bufmax);
+		} else {
+			strlcat(buf, "s", bufmax);
+		}
 	}
 nopl:
 	if (obj->onamelth) {
-		Strcat(buf, " named ");
-		Strcat(buf, ONAME(obj));
+		strlcat(buf, " named ", bufmax);
+		strlcat(buf, ONAME(obj), bufmax);
 	}
 	return (buf);
 }
@@ -319,8 +343,13 @@
 {
 	char            prefix[PREFIX];
 	char           *bp = xname(obj);
+	size_t          bppos, bpmax;
+
+	/* XXX do this better somehow w/o knowing internals of xname() */
+	bpmax = BUFSZ - PREFIX;
+
 	if (obj->quan != 1)
-		Sprintf(prefix, "%u ", obj->quan);
+		Snprintf(prefix, sizeof(prefix), "%u ", obj->quan);
 	else
 		Strcpy(prefix, "a ");
 	switch (obj->olet) {
@@ -330,33 +359,35 @@
 		break;
 	case ARMOR_SYM:
 		if (obj->owornmask & W_ARMOR)
-			Strcat(bp, " (being worn)");
+			strlcat(bp, " (being worn)", bpmax);
 		/* fall into next case */
 	case WEAPON_SYM:
 		if (obj->known) {
-			Strcat(prefix, sitoa(obj->spe));
-			Strcat(prefix, " ");
+			strlcat(prefix, sitoa(obj->spe), sizeof(prefix));
+			strlcat(prefix, " ", sizeof(prefix));
 		}
 		break;
 	case WAND_SYM:
-		if (obj->known)
-			Sprintf(eos(bp), " (%d)", obj->spe);
+		if (obj->known) {
+			bppos = strlen(bp);
+			Snprintf(bp+bppos, bpmax-bppos, " (%d)", obj->spe);
+		}
 		break;
 	case RING_SYM:
 		if (obj->owornmask & W_RINGR)
-			Strcat(bp, " (on right hand)");
+			strlcat(bp, " (on right hand)", bpmax);
 		if (obj->owornmask & W_RINGL)
-			Strcat(bp, " (on left hand)");
+			strlcat(bp, " (on left hand)", bpmax);
 		if (obj->known && (objects[obj->otyp].bits & SPEC)) {
-			Strcat(prefix, sitoa(obj->spe));
-			Strcat(prefix, " ");
+			strlcat(prefix, sitoa(obj->spe), sizeof(prefix));
+			strlcat(prefix, " ", sizeof(prefix));
 		}
 		break;
 	}
 	if (obj->owornmask & W_WEP)
-		Strcat(bp, " (weapon in hand)");
+		strlcat(bp, " (weapon in hand)", bpmax);
 	if (obj->unpaid)
-		Strcat(bp, " (unpaid)");
+		strlcat(bp, " (unpaid)", bpmax);
 	if (!strcmp(prefix, "a ") && strchr(vowels, *bp))
 		Strcpy(prefix, "an ");
 	bp = strprepend(bp, prefix);
@@ -365,12 +396,12 @@
 
 /* used only in hack.fight.c (thitu) */
 void
-setan(const char *str, char *buf)
+setan(const char *str, char *buf, size_t bufmax)
 {
 	if (strchr(vowels, *str))
-		Sprintf(buf, "an %s", str);
+		Snprintf(buf, bufmax, "an %s", str);
 	else
-		Sprintf(buf, "a %s", str);
+		Snprintf(buf, bufmax, "a %s", str);
 }
 
 char           *
@@ -380,20 +411,25 @@
 {
 	char           *bp = xname(otmp);
 	char            prefix[PREFIX];
+	size_t          bpmax;
+
+	/* XXX do this better somehow w/o knowing internals of xname() */
+	bpmax = BUFSZ - PREFIX;
+
 	if (otmp->quan != 1) {
-		Sprintf(prefix, "%u ", otmp->quan);
+		Snprintf(prefix, sizeof(prefix), "%u ", otmp->quan);
 		bp = strprepend(bp, prefix);
 	}
 	if (verb) {
 		/* verb is given in plural (i.e., without trailing s) */
-		Strcat(bp, " ");
+		strlcat(bp, " ", bpmax);
 		if (otmp->quan != 1)
-			Strcat(bp, verb);
+			strlcat(bp, verb, bpmax);
 		else if (!strcmp(verb, "are"))
-			Strcat(bp, "is");
+			strlcat(bp, "is", bpmax);
 		else {
-			Strcat(bp, verb);
-			Strcat(bp, "s");
+			strlcat(bp, verb, bpmax);
+			strlcat(bp, "s", bpmax);
 		}
 	}
 	return (bp);

Index: src/games/hack/hack.end.c
diff -u src/games/hack/hack.end.c:1.7 src/games/hack/hack.end.c:1.7.14.1
--- src/games/hack/hack.end.c:1.7	Sat May 13 22:45:11 2006
+++ src/games/hack/hack.end.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.end.c,v 1.7 2006/05/13 22:45:11 christos Exp $	*/
+/*	$NetBSD: hack.end.c,v 1.7.14.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.end.c,v 1.7 2006/05/13 22:45:11 christos Exp $");
+__RCSID("$NetBSD: hack.end.c,v 1.7.14.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <signal.h>
@@ -71,7 +71,7 @@
 #include <stdlib.h>
 #include "hack.h"
 #include "extern.h"
-#define	Sprintf	(void) sprintf
+#define	Snprintf	(void) snprintf
 
 xchar           maxdlevel = 1;
 
@@ -131,14 +131,15 @@
 	static char     buf[BUFSZ];
 	pline("You die ...");
 	if (mtmp->data->mlet == ' ') {
-		Sprintf(buf, "the ghost of %s", (char *) mtmp->mextra);
+		Snprintf(buf, sizeof(buf),
+			"the ghost of %s", (char *) mtmp->mextra);
 		killer = buf;
 	} else if (mtmp->mnamelth) {
-		Sprintf(buf, "%s called %s",
+		Snprintf(buf, sizeof(buf), "%s called %s",
 			mtmp->data->mname, NAME(mtmp));
 		killer = buf;
 	} else if (mtmp->minvis) {
-		Sprintf(buf, "invisible %s", mtmp->data->mname);
+		Snprintf(buf, sizeof(buf), "invisible %s", mtmp->data->mname);
 		killer = buf;
 	} else
 		killer = mtmp->data->mname;
@@ -495,84 +496,120 @@
 	puts(linebuf);
 }
 
-/* so>0: standout line; so=0: ordinary line; so<0: no output, return lth */
+/* so>0: standout line; so=0: ordinary line; so<0: no output, return length */
 int
 outentry(int rank, struct toptenentry *t1, int so)
 {
 	boolean         quit = FALSE, killed = FALSE, starv = FALSE;
 	char            linebuf[BUFSZ];
-	linebuf[0] = 0;
+	size_t pos;
+
+	linebuf[0] = '\0';
+	pos = 0;
+
 	if (rank)
-		Sprintf(eos(linebuf), "%3d", rank);
+		Snprintf(linebuf+pos, sizeof(linebuf)-pos, "%3d", rank);
 	else
-		Sprintf(eos(linebuf), "   ");
-	Sprintf(eos(linebuf), " %6ld %8s", t1->points, t1->name);
+		Snprintf(linebuf+pos, sizeof(linebuf)-pos, "   ");
+	pos = strlen(linebuf);
+
+	Snprintf(linebuf+pos, sizeof(linebuf)-pos, " %6ld %8s",
+		t1->points, t1->name);
+	pos = strlen(linebuf);
+
 	if (t1->plchar == 'X')
-		Sprintf(eos(linebuf), " ");
+		Snprintf(linebuf+pos, sizeof(linebuf)-pos, " ");
 	else
-		Sprintf(eos(linebuf), "-%c ", t1->plchar);
+		Snprintf(linebuf+pos, sizeof(linebuf)-pos, "-%c ", t1->plchar);
+	pos = strlen(linebuf);
+
 	if (!strncmp("escaped", t1->death, 7)) {
 		if (!strcmp(" (with amulet)", t1->death + 7))
-			Sprintf(eos(linebuf), "escaped the dungeon with amulet");
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				"escaped the dungeon with amulet");
 		else
-			Sprintf(eos(linebuf), "escaped the dungeon [max level %d]",
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				"escaped the dungeon [max level %d]",
 				t1->maxlvl);
+		pos = strlen(linebuf);
 	} else {
 		if (!strncmp(t1->death, "quit", 4)) {
 			quit = TRUE;
 			if (t1->maxhp < 3 * t1->hp && t1->maxlvl < 4)
-				Sprintf(eos(linebuf), "cravenly gave up");
+				Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+					"cravenly gave up");
 			else
-				Sprintf(eos(linebuf), "quit");
-		} else if (!strcmp(t1->death, "choked"))
-			Sprintf(eos(linebuf), "choked on %s food",
+				Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+					"quit");
+		} else if (!strcmp(t1->death, "choked")) {
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				"choked on %s food",
 				(t1->sex == 'F') ? "her" : "his");
-		else if (!strncmp(t1->death, "starv", 5))
-			Sprintf(eos(linebuf), "starved to death"), starv = TRUE;
-		else
-			Sprintf(eos(linebuf), "was killed"), killed = TRUE;
-		Sprintf(eos(linebuf), " on%s level %d",
+		} else if (!strncmp(t1->death, "starv", 5)) {
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				"starved to death");
+			starv = TRUE;
+		} else {
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				"was killed");
+			killed = TRUE;
+		}
+		pos = strlen(linebuf);
+
+		Snprintf(linebuf+pos, sizeof(linebuf)-pos, " on%s level %d",
 			(killed || starv) ? "" : " dungeon", t1->level);
+		pos = strlen(linebuf);
+
 		if (t1->maxlvl != t1->level)
-			Sprintf(eos(linebuf), " [max %d]", t1->maxlvl);
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				" [max %d]", t1->maxlvl);
+		pos = strlen(linebuf);
+
 		if (quit && t1->death[4])
-			Sprintf(eos(linebuf), t1->death + 4);
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				 "%s", t1->death + 4);
+		pos = strlen(linebuf);
 	}
-	if (killed)
-		Sprintf(eos(linebuf), " by %s%s",
+	if (killed) {
+		Snprintf(linebuf+pos, sizeof(linebuf)-pos, " by %s%s",
 			(!strncmp(t1->death, "trick", 5) || !strncmp(t1->death, "the ", 4))
 			? "" :
 			strchr(vowels, *t1->death) ? "an " : "a ",
 			t1->death);
-	Sprintf(eos(linebuf), ".");
+		pos = strlen(linebuf);
+	}
+	strlcat(linebuf, ".", sizeof(linebuf));
+	pos = strlen(linebuf);
 	if (t1->maxhp) {
-		char           *bp = eos(linebuf);
 		char            hpbuf[10];
-		int             hppos;
-		Sprintf(hpbuf, (t1->hp > 0) ? itoa(t1->hp) : "-");
+		unsigned        hppos;
+
+		strlcpy(hpbuf, (t1->hp > 0) ? itoa(t1->hp) : "-", sizeof(hpbuf));
 		hppos = COLNO - 7 - strlen(hpbuf);
-		if (bp <= linebuf + hppos) {
-			while (bp < linebuf + hppos)
-				*bp++ = ' ';
-			(void) strcpy(bp, hpbuf);
-			Sprintf(eos(bp), " [%d]", t1->maxhp);
+		if (pos <= hppos) {
+			while (pos < hppos)
+				linebuf[pos++] = ' ';
+			(void) strlcpy(linebuf+pos, hpbuf, sizeof(linebuf)-pos);
+			pos = strlen(linebuf);
+			Snprintf(linebuf+pos, sizeof(linebuf)-pos,
+				" [%d]", t1->maxhp);
+			pos = strlen(linebuf);
 		}
 	}
 	if (so == 0)
 		puts(linebuf);
 	else if (so > 0) {
-		char           *bp = eos(linebuf);
 		if (so >= COLNO)
 			so = COLNO - 1;
-		while (bp < linebuf + so)
-			*bp++ = ' ';
-		*bp = 0;
+		while (pos < (unsigned)so)
+			linebuf[pos++] = ' ';
+		linebuf[pos] = '\0';
 		standoutbeg();
 		fputs(linebuf, stdout);
 		standoutend();
 		(void) putchar('\n');
 	}
-	return (strlen(linebuf));
+	return /*(strlen(linebuf))*/ pos;
 }
 
 char           *
@@ -580,7 +617,7 @@
 	int             a;
 {
 	static char     buf[12];
-	Sprintf(buf, "%d", a);
+	Snprintf(buf, sizeof(buf), "%d", a);
 	return (buf);
 }
 
Index: src/games/hack/hack.fight.c
diff -u src/games/hack/hack.fight.c:1.7 src/games/hack/hack.fight.c:1.7.14.1
--- src/games/hack/hack.fight.c:1.7	Wed Mar 29 01:18:39 2006
+++ src/games/hack/hack.fight.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.fight.c,v 1.7 2006/03/29 01:18:39 jnemeth Exp $	*/
+/*	$NetBSD: hack.fight.c,v 1.7.14.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.fight.c,v 1.7 2006/03/29 01:18:39 jnemeth Exp $");
+__RCSID("$NetBSD: hack.fight.c,v 1.7.14.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include "hack.h"
@@ -101,7 +101,7 @@
 			seemimic(mdef);
 		if (magr->mimic)
 			seemimic(magr);
-		(void) sprintf(buf, "%s %s", Monnam(magr),
+		(void) snprintf(buf, sizeof(buf), "%s %s", Monnam(magr),
 			       hit ? "hits" : "misses");
 		pline("%s %s.", buf, monnam(mdef));
 	} else {
@@ -196,7 +196,8 @@
 	const char           *name;
 {
 	char            buf[BUFSZ];
-	setan(name, buf);
+
+	setan(name, buf, sizeof(buf));
 	if (u.uac + tlev <= rnd(20)) {
 		if (Blind)
 			pline("It misses.");

Index: src/games/hack/hack.invent.c
diff -u src/games/hack/hack.invent.c:1.10 src/games/hack/hack.invent.c:1.10.14.1
--- src/games/hack/hack.invent.c:1.10	Wed Mar 29 01:19:51 2006
+++ src/games/hack/hack.invent.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.invent.c,v 1.10 2006/03/29 01:19:51 jnemeth Exp $	*/
+/*	$NetBSD: hack.invent.c,v 1.10.14.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.invent.c,v 1.10 2006/03/29 01:19:51 jnemeth Exp $");
+__RCSID("$NetBSD: hack.invent.c,v 1.10.14.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <stdlib.h>
@@ -733,7 +733,7 @@
 {
 	static char     li[BUFSZ];
 
-	(void) sprintf(li, "%c - %s.",
+	(void) snprintf(li, sizeof(li), "%c - %s.",
 		       flags.invlet_constant ? obj->invlet : let,
 		       doname(obj));
 	return (li);
@@ -897,7 +897,7 @@
 	if (gold) {
 		char            gbuf[30];
 
-		(void) sprintf(gbuf, "%ld gold piece%s",
+		(void) snprintf(gbuf, sizeof(gbuf), "%ld gold piece%s",
 			       gold->amount, plur(gold->amount));
 		if (!ct++)
 			pline("You %s here %s.", verb, gbuf);

Index: src/games/hack/hack.main.c
diff -u src/games/hack/hack.main.c:1.9 src/games/hack/hack.main.c:1.9.26.1
--- src/games/hack/hack.main.c:1.9	Tue Jan 27 20:30:29 2004
+++ src/games/hack/hack.main.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.main.c,v 1.9 2004/01/27 20:30:29 jsm Exp $	*/
+/*	$NetBSD: hack.main.c,v 1.9.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.main.c,v 1.9 2004/01/27 20:30:29 jsm Exp $");
+__RCSID("$NetBSD: hack.main.c,v 1.9.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <signal.h>
@@ -308,7 +308,7 @@
 	}
 #endif
 	setftty();
-	(void) sprintf(SAVEF, "save/%d%s", getuid(), plname);
+	(void) snprintf(SAVEF, sizeof(SAVEF), "save/%d%s", getuid(), plname);
 	regularize(SAVEF + 5);	/* avoid . or / in name */
 	if ((fd = open(SAVEF, O_RDONLY)) >= 0 &&
 	    (uptodate(fd) || unlink(SAVEF) == 666)) {
Index: src/games/hack/hack.unix.c
diff -u src/games/hack/hack.unix.c:1.9 src/games/hack/hack.unix.c:1.9.26.1
--- src/games/hack/hack.unix.c:1.9	Wed Apr  2 18:36:41 2003
+++ src/games/hack/hack.unix.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.unix.c,v 1.9 2003/04/02 18:36:41 jsm Exp $	*/
+/*	$NetBSD: hack.unix.c,v 1.9.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.unix.c,v 1.9 2003/04/02 18:36:41 jsm Exp $");
+__RCSID("$NetBSD: hack.unix.c,v 1.9.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 /* This file collects some Unix dependencies; hack.pager.c contains some more */
@@ -123,7 +123,7 @@
 	static char     datestr[7];
 	struct tm      *lt = getlt();
 
-	(void) sprintf(datestr, "%02d%02d%02d",
+	(void) snprintf(datestr, sizeof(datestr), "%02d%02d%02d",
 		       lt->tm_year % 100, lt->tm_mon + 1, lt->tm_mday);
 	return (datestr);
 }

Index: src/games/hack/hack.options.c
diff -u src/games/hack/hack.options.c:1.7 src/games/hack/hack.options.c:1.7.26.1
--- src/games/hack/hack.options.c:1.7	Thu Jan  1 16:02:51 2004
+++ src/games/hack/hack.options.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.options.c,v 1.7 2004/01/01 16:02:51 jsm Exp $	*/
+/*	$NetBSD: hack.options.c,v 1.7.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.options.c,v 1.7 2004/01/01 16:02:51 jsm Exp $");
+__RCSID("$NetBSD: hack.options.c,v 1.7.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <stdlib.h>
@@ -239,7 +239,8 @@
 int
 doset()
 {
-	char            buf[BUFSZ];
+	char buf[BUFSZ];
+	size_t pos;
 
 	pline("What options do you want to set? ");
 	getlin(buf);
@@ -247,22 +248,24 @@
 		(void) strcpy(buf, "HACKOPTIONS=");
 		(void) strcat(buf, flags.female ? "female," : "male,");
 		if (flags.standout)
-			(void) strcat(buf, "standout,");
+			(void) strlcat(buf, "standout,", sizeof(buf));
 		if (flags.nonull)
-			(void) strcat(buf, "nonull,");
+			(void) strlcat(buf, "nonull,", sizeof(buf));
 		if (flags.nonews)
-			(void) strcat(buf, "nonews,");
+			(void) strlcat(buf, "nonews,", sizeof(buf));
 		if (flags.time)
-			(void) strcat(buf, "time,");
+			(void) strlcat(buf, "time,", sizeof(buf));
 		if (flags.notombstone)
-			(void) strcat(buf, "notombstone,");
+			(void) strlcat(buf, "notombstone,", sizeof(buf));
 		if (flags.no_rest_on_space)
-			(void) strcat(buf, "!rest_on_space,");
+			(void) strlcat(buf, "!rest_on_space,", sizeof(buf));
 		if (flags.end_top != 5 || flags.end_around != 4 || flags.end_own) {
-			(void) sprintf(eos(buf), "endgame: %u topscores/%u around me",
+			pos = strlen(buf);
+			(void) snprintf(buf+pos, sizeof(buf)-pos,
+				       "endgame: %u topscores/%u around me",
 				       flags.end_top, flags.end_around);
 			if (flags.end_own)
-				(void) strcat(buf, "/own scores");
+				(void) strlcat(buf, "/own scores", sizeof(buf));
 		} else {
 			char           *eop = eos(buf);
 			if (*--eop == ',')
Index: src/games/hack/hack.rip.c
diff -u src/games/hack/hack.rip.c:1.7 src/games/hack/hack.rip.c:1.7.26.1
--- src/games/hack/hack.rip.c:1.7	Wed Apr  2 18:36:39 2003
+++ src/games/hack/hack.rip.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.rip.c,v 1.7 2003/04/02 18:36:39 jsm Exp $	*/
+/*	$NetBSD: hack.rip.c,v 1.7.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.rip.c,v 1.7 2003/04/02 18:36:39 jsm Exp $");
+__RCSID("$NetBSD: hack.rip.c,v 1.7.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include "hack.h"
@@ -94,9 +94,9 @@
 	(void) strcpy(buf, plname);
 	buf[16] = 0;
 	center(6, buf);
-	(void) sprintf(buf, "%ld AU", u.ugold);
+	(void) snprintf(buf, sizeof(buf), "%ld AU", u.ugold);
 	center(7, buf);
-	(void) sprintf(buf, "killed by%s",
+	(void) snprintf(buf, sizeof(buf), "killed by%s",
 		       !strncmp(killer, "the ", 4) ? "" :
 		       !strcmp(killer, "starvation") ? "" :
 		       strchr(vowels, *killer) ? " an" : " a");
@@ -118,7 +118,7 @@
 		center(9, buf);
 		center(10, buf + i1);
 	}
-	(void) sprintf(buf, "%4d", getyear());
+	(void) snprintf(buf, sizeof(buf), "%4d", getyear());
 	center(11, buf);
 	puts(ripbot);
 	getret();
Index: src/games/hack/hack.topl.c
diff -u src/games/hack/hack.topl.c:1.7 src/games/hack/hack.topl.c:1.7.26.1
--- src/games/hack/hack.topl.c:1.7	Wed Apr  2 18:36:41 2003
+++ src/games/hack/hack.topl.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.topl.c,v 1.7 2003/04/02 18:36:41 jsm Exp $	*/
+/*	$NetBSD: hack.topl.c,v 1.7.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.topl.c,v 1.7 2003/04/02 18:36:41 jsm Exp $");
+__RCSID("$NetBSD: hack.topl.c,v 1.7.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <stdlib.h>
@@ -221,9 +221,9 @@
 	if (!line || !*line)
 		return;
 	if (!strchr(line, '%'))
-		(void) strcpy(pbuf, line);
+		(void) strlcpy(pbuf, line, sizeof(pbuf));
 	else
-		(void) vsprintf(pbuf, line, ap);
+		(void) vsnprintf(pbuf, sizeof(pbuf), line, ap);
 	if (flags.toplin == 1 && !strcmp(pbuf, toplines))
 		return;
 	nscr();			/* %% */

Index: src/games/hack/hack.pri.c
diff -u src/games/hack/hack.pri.c:1.8 src/games/hack/hack.pri.c:1.8.26.1
--- src/games/hack/hack.pri.c:1.8	Wed Apr  2 18:36:39 2003
+++ src/games/hack/hack.pri.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.pri.c,v 1.8 2003/04/02 18:36:39 jsm Exp $	*/
+/*	$NetBSD: hack.pri.c,v 1.8.26.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.pri.c,v 1.8 2003/04/02 18:36:39 jsm Exp $");
+__RCSID("$NetBSD: hack.pri.c,v 1.8.26.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include "hack.h"
@@ -731,33 +731,47 @@
 {
 	char           *ob = oldbot, *nb = newbot;
 	int             i;
+	size_t pos;
+
 	if (flags.botlx)
 		*ob = 0;
 	flags.botl = flags.botlx = 0;
 #ifdef GOLD_ON_BOTL
-	(void) sprintf(newbot,
+	(void) snprintf(newbot, sizeof(newbot),
 		       "Level %-2d  Gold %-5lu  Hp %3d(%d)  Ac %-2d  Str ",
 		       dlevel, u.ugold, u.uhp, u.uhpmax, u.uac);
 #else
-	(void) sprintf(newbot,
+	(void) snprintf(newbot, sizeof(newbot),
 		       "Level %-2d   Hp %3d(%d)   Ac %-2d   Str ",
 		       dlevel, u.uhp, u.uhpmax, u.uac);
 #endif	/* GOLD_ON_BOTL */
 	if (u.ustr > 18) {
 		if (u.ustr > 117)
-			(void) strcat(newbot, "18/**");
-		else
-			(void) sprintf(eos(newbot), "18/%02d", u.ustr - 18);
-	} else
-		(void) sprintf(eos(newbot), "%-2d   ", u.ustr);
+			(void) strlcat(newbot, "18/**", sizeof(newbot));
+		else {
+			pos = strlen(newbot);
+			(void) snprintf(newbot+pos, sizeof(newbot)-pos,
+					"18/%02d", u.ustr - 18);
+		}
+	} else {
+		pos = strlen(newbot);
+		(void) snprintf(newbot+pos, sizeof(newbot)-pos,
+				"%-2d   ", u.ustr);
+	}
+	pos = strlen(newbot);
 #ifdef EXP_ON_BOTL
-	(void) sprintf(eos(newbot), "  Exp %2d/%-5lu ", u.ulevel, u.uexp);
+	(void) snprintf(newbot+pos, sizeof(newbot)-pos,
+			"  Exp %2d/%-5lu ", u.ulevel, u.uexp);
 #else
-	(void) sprintf(eos(newbot), "   Exp %2u  ", u.ulevel);
+	(void) snprintf(newbot+pos, sizeof(newbot)-pos,
+			"   Exp %2u  ", u.ulevel);
 #endif	/* EXP_ON_BOTL */
-	(void) strcat(newbot, hu_stat[u.uhs]);
-	if (flags.time)
-		(void) sprintf(eos(newbot), "  %ld", moves);
+	(void) strlcat(newbot, hu_stat[u.uhs], sizeof(newbot));
+	if (flags.time) {
+		pos = strlen(newbot);
+		(void) snprintf(newbot+pos, sizeof(newbot)-pos,
+				"  %ld", moves);
+	}
 	if (strlen(newbot) >= COLNO) {
 		char           *bp0, *bp1;
 		bp0 = bp1 = newbot;

Index: src/games/hack/hack.shk.c
diff -u src/games/hack/hack.shk.c:1.8 src/games/hack/hack.shk.c:1.8.14.1
--- src/games/hack/hack.shk.c:1.8	Thu Mar 30 01:32:27 2006
+++ src/games/hack/hack.shk.c	Mon Jun 29 23:43:48 2009
@@ -1,4 +1,4 @@
-/*	$NetBSD: hack.shk.c,v 1.8 2006/03/30 01:32:27 jnemeth Exp $	*/
+/*	$NetBSD: hack.shk.c,v 1.8.14.1 2009/06/29 23:43:48 snj Exp $	*/
 
 /*
  * Copyright (c) 1985, Stichting Centrum voor Wiskunde en Informatica,
@@ -63,7 +63,7 @@
 
 #include <sys/cdefs.h>
 #ifndef lint
-__RCSID("$NetBSD: hack.shk.c,v 1.8 2006/03/30 01:32:27 jnemeth Exp $");
+__RCSID("$NetBSD: hack.shk.c,v 1.8.14.1 2009/06/29 23:43:48 snj Exp $");
 #endif				/* not lint */
 
 #include <stdlib.h>
@@ -838,17 +838,19 @@
 			thisused = bp->price * uquan;
 			totused += thisused;
 			obj->quan = uquan;	/* cheat doname */
-			(void) sprintf(buf, "x -  %s", doname(obj));
+			(void) snprintf(buf, sizeof(buf),
+					"x -  %s", doname(obj));
 			obj->quan = oquan;	/* restore value */
 			for (cnt = 0; buf[cnt]; cnt++);
 			while (cnt < 50)
 				buf[cnt++] = ' ';
-			(void) sprintf(&buf[cnt], " %5ld zorkmids", thisused);
+			(void) snprintf(buf+cnt, sizeof(buf)-cnt,
+					" %5ld zorkmids", thisused);
 			if (page_line(buf))
 				goto quit;
 		}
 	}
-	(void) sprintf(buf, "Total:%50ld zorkmids", totused);
+	(void) snprintf(buf, sizeof(buf), "Total:%50ld zorkmids", totused);
 	if (page_line("") || page_line(buf))
 		goto quit;
 	set_pager(1);

Reply via email to