Replace all use of ERR_add_error_data with ERR_asprintf_error_data.

This avoids a lot of ugly gymnastics to do snprintfs before sending the
bag of strings to ERR, and eliminates at least one place in dso_dlfctn.c
where it was being called with the incorrect number of arguments and
using random things off the stack as addresses of strings.
ok krw@, jsing@

74 files changed, 222 insertions, 270 deletions

diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
index b59d84910f..9945ede2ac 100644
--- a/src/lib/libcrypto/asn1/a_mbstr.c
+++ b/src/lib/libcrypto/asn1/a_mbstr.c
@@ -98,7 +98,6 @@ ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
         ASN1_STRING *dest;
         unsigned char *p;
         int nchar;
-        char strbuf[32];
         int (*cpyfunc)(unsigned long, void *) = NULL;
 
         if (len == -1)
@@ -148,15 +147,13 @@ ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
         if ((minsize > 0) && (nchar < minsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_SHORT);
-                snprintf(strbuf, sizeof strbuf, "%ld", minsize);
-                ERR_add_error_data(2, "minsize=", strbuf);
+                ERR_asprintf_error_data("minsize=%ld", minsize);
                 return -1;
         }
 
         if ((maxsize > 0) && (nchar > maxsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_LONG);
-                snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
-                ERR_add_error_data(2, "maxsize=", strbuf);
+                ERR_asprintf_error_data("maxsize=%ld", maxsize);
                 return -1;
         }
 
diff --git a/src/lib/libcrypto/asn1/asn1_gen.c b/src/lib/libcrypto/asn1/asn1_gen.c
index c66bea2ab4..598a322242 100644
--- a/src/lib/libcrypto/asn1/asn1_gen.c
+++ b/src/lib/libcrypto/asn1/asn1_gen.c
@@ -291,7 +291,7 @@ asn1_cb(const char *elem, int len, void *bitstr)
 
         if (utype == -1) {
                 ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKNOWN_TAG);
-                ERR_add_error_data(2, "tag=", elem);
+                ERR_asprintf_error_data("tag=%s", elem);
                 return -1;
         }
 
@@ -370,7 +370,6 @@ asn1_cb(const char *elem, int len, void *bitstr)
 static int
 parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
 {
-        char erch[2];
         long tag_num;
         char *eptr;
 
@@ -410,10 +409,8 @@ parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
                         break;
 
                 default:
-                        erch[0] = *eptr;
-                        erch[1] = 0;
                         ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_MODIFIER);
-                        ERR_add_error_data(2, "Char=", erch);
+                        ERR_asprintf_error_data("Char=%c", *eptr);
                         return 0;
                         break;
 
@@ -777,7 +774,7 @@ asn1_str2type(const char *str, int format, int utype)
         return atmp;
 
 bad_str:
-        ERR_add_error_data(2, "string=", str);
+        ERR_asprintf_error_data("string=%s", str);
 bad_form:
         ASN1_TYPE_free(atmp);
         return NULL;
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 4d4368aefe..c2f0837a1c 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -459,10 +459,7 @@ ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
 void
 asn1_add_error(const unsigned char *address, int offset)
 {
-        char tmp[128];
-        (void) snprintf(tmp, sizeof(tmp), "address=%p offset=%d",
-            address, offset);
-        ERR_add_error_data(1, tmp);
+        ERR_asprintf_error_data("address=%p offset=%d", address, offset);
 }
 
 int
diff --git a/src/lib/libcrypto/asn1/asn_mime.c b/src/lib/libcrypto/asn1/asn_mime.c
index 248ea114e8..b30c366561 100644
--- a/src/lib/libcrypto/asn1/asn_mime.c
+++ b/src/lib/libcrypto/asn1/asn_mime.c
@@ -493,7 +493,7 @@ SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
                     strcmp(hdr->value, "application/pkcs7-signature")) {
                         ASN1err(ASN1_F_SMIME_READ_ASN1,
                             ASN1_R_SIG_INVALID_MIME_TYPE);
-                        ERR_add_error_data(2, "type: ", hdr->value);
+                        ERR_asprintf_error_data("type: %s", hdr->value);
                         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                         sk_BIO_pop_free(parts, BIO_vfree);
                         return NULL;
@@ -520,7 +520,7 @@ SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
         if (strcmp (hdr->value, "application/x-pkcs7-mime") &&
             strcmp (hdr->value, "application/pkcs7-mime")) {
                 ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_INVALID_MIME_TYPE);
-                ERR_add_error_data(2, "type: ", hdr->value);
+                ERR_asprintf_error_data("type: %s", hdr->value);
                 sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 return NULL;
         }
@@ -591,7 +591,7 @@ SMIME_text(BIO *in, BIO *out)
         }
         if (strcmp (hdr->value, "text/plain")) {
                 ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_INVALID_MIME_TYPE);
-                ERR_add_error_data(2, "type: ", hdr->value);
+                ERR_asprintf_error_data("type: %s", hdr->value);
                 sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 return 0;
         }
diff --git a/src/lib/libcrypto/asn1/tasn_dec.c b/src/lib/libcrypto/asn1/tasn_dec.c
index 560b6f3d5f..d86bc4e091 100644
--- a/src/lib/libcrypto/asn1/tasn_dec.c
+++ b/src/lib/libcrypto/asn1/tasn_dec.c
@@ -496,10 +496,10 @@ auxerr:
 err:
         ASN1_item_ex_free(pval, it);
         if (errtt)
-                ERR_add_error_data(4, "Field=", errtt->field_name,
-                    ", Type=", it->sname);
+                ERR_asprintf_error_data("Field=%s, Type=%s", errtt->field_name,
+                    it->sname);
         else
-                ERR_add_error_data(2, "Type=", it->sname);
+                ERR_asprintf_error_data("Type=%s", it->sname);
         return 0;
 }
 
diff --git a/src/lib/libcrypto/bio/b_sock.c b/src/lib/libcrypto/bio/b_sock.c
index 05eb362cc6..ecfaf93b99 100644
--- a/src/lib/libcrypto/bio/b_sock.c
+++ b/src/lib/libcrypto/bio/b_sock.c
@@ -129,7 +129,7 @@ err:
         if (locked)
                 CRYPTO_w_unlock(CRYPTO_LOCK_GETHOSTBYNAME);
         if (err) {
-                ERR_add_error_data(2, "host=", str);
+                ERR_asprintf_error_data("host=%s", str);
                 return 0;
         } else
                 return 1;
@@ -171,7 +171,7 @@ BIO_get_port(const char *str, unsigned short *port_ptr)
                                 *port_ptr = 70;
                         else {
                                 SYSerr(SYS_F_GETSERVBYNAME, errno);
-                                ERR_add_error_data(3, "service='", str, "'");
+                                ERR_asprintf_error_data("service='%s'", str);
                                 return (0);
                         }
                 }
@@ -378,7 +378,7 @@ again:
         s = socket(server.sa.sa_family, SOCK_STREAM, SOCKET_PROTOCOL);
         if (s == -1) {
                 SYSerr(SYS_F_SOCKET, errno);
-                ERR_add_error_data(3, "port='", host, "'");
+                ERR_asprintf_error_data("port='%s'", host);
                 BIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET, BIO_R_UNABLE_TO_CREATE_SOCKET);
                 goto err;
         }
@@ -422,13 +422,13 @@ again:
                 }
 #endif
                 SYSerr(SYS_F_BIND, err_num);
-                ERR_add_error_data(3, "port='", host, "'");
+                ERR_asprintf_error_data("port='%s'", host);
                 BIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET, BIO_R_UNABLE_TO_BIND_SOCKET);
                 goto err;
         }
         if (listen(s, MAX_LISTEN) == -1) {
                 SYSerr(SYS_F_BIND, errno);
-                ERR_add_error_data(3, "port='", host, "'");
+                ERR_asprintf_error_data("port='%s'", host);
                 BIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET, BIO_R_UNABLE_TO_LISTEN_SOCKET);
                 goto err;
         }
diff --git a/src/lib/libcrypto/bio/bss_conn.c b/src/lib/libcrypto/bio/bss_conn.c
index b64d7d7761..d7a8619b38 100644
--- a/src/lib/libcrypto/bio/bss_conn.c
+++ b/src/lib/libcrypto/bio/bss_conn.c
@@ -156,7 +156,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
 
                         if (c->param_port == NULL) {
                                 BIOerr(BIO_F_CONN_STATE, BIO_R_NO_PORT_SPECIFIED);
-                                ERR_add_error_data(2, "host=", c->param_hostname);
+                                ERR_asprintf_error_data("host=%s",
+                                    c->param_hostname);
                                 goto exit_loop;
                         }
                         c->state = BIO_CONN_S_GET_IP;
@@ -193,8 +194,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                         ret = socket(AF_INET, SOCK_STREAM, SOCKET_PROTOCOL);
                         if (ret == -1) {
                                 SYSerr(SYS_F_SOCKET, errno);
-                                ERR_add_error_data(4, "host=",
-                                    c->param_hostname, ":", c->param_port);
+                                ERR_asprintf_error_data("host=%s:%s",
+                                    c->param_hostname, c->param_port);
                                 BIOerr(BIO_F_CONN_STATE,
                                     BIO_R_UNABLE_TO_CREATE_SOCKET);
                                 goto exit_loop;
@@ -208,9 +209,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                                 if (!BIO_socket_nbio(b->num, 1)) {
                                         BIOerr(BIO_F_CONN_STATE,
                                             BIO_R_ERROR_SETTING_NBIO);
-                                        ERR_add_error_data(4, "host=",
-                                            c->param_hostname, ":",
-                                            c->param_port);
+                                        ERR_asprintf_error_data("host=%s:%s",
+                                            c->param_hostname, c->param_port);
                                         goto exit_loop;
                                 }
                         }
@@ -221,8 +221,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                         i = setsockopt(b->num, SOL_SOCKET, SO_KEEPALIVE,(char *)&i, sizeof(i));
                         if (i < 0) {
                                 SYSerr(SYS_F_SOCKET, errno);
-                                ERR_add_error_data(4, "host=",
-                                    c->param_hostname, ":", c->param_port);
+                                ERR_asprintf_error_data("host=%s:%s",
+                                    c->param_hostname, c->param_port);
                                 BIOerr(BIO_F_CONN_STATE, BIO_R_KEEPALIVE);
                                 goto exit_loop;
                         }
@@ -242,9 +242,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                                         b->retry_reason = BIO_RR_CONNECT;
                                 } else {
                                         SYSerr(SYS_F_CONNECT, errno);
-                                        ERR_add_error_data(4, "host=",
-                                            c->param_hostname, ":",
-                                            c->param_port);
+                                        ERR_asprintf_error_data("host=%s:%s",
+                                            c->param_hostname, c->param_port);
                                         BIOerr(BIO_F_CONN_STATE,
                                             BIO_R_CONNECT_ERROR);
                                 }
@@ -258,8 +257,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                         if (i) {
                                 BIO_clear_retry_flags(b);
                                 SYSerr(SYS_F_CONNECT, i);
-                                ERR_add_error_data(4, "host=",
-                                    c->param_hostname, ":", c->param_port);
+                                ERR_asprintf_error_data("host=%s:%s",
+                                    c->param_hostname, c->param_port);
                                 BIOerr(BIO_F_CONN_STATE,
                                     BIO_R_NBIO_CONNECT_ERROR);
                                 ret = 0;
diff --git a/src/lib/libcrypto/bio/bss_file.c b/src/lib/libcrypto/bio/bss_file.c
index acc746260e..6d5444f666 100644
--- a/src/lib/libcrypto/bio/bss_file.c
+++ b/src/lib/libcrypto/bio/bss_file.c
@@ -122,7 +122,7 @@ BIO_new_file(const char *filename, const char *mode)
 
         if (file == NULL) {
                 SYSerr(SYS_F_FOPEN, errno);
-                ERR_add_error_data(5, "fopen('", filename, "', '", mode, "')");
+                ERR_asprintf_error_data("fopen('%s', '%s')", filename, mode);
                 if (errno == ENOENT)
                         BIOerr(BIO_F_BIO_NEW_FILE, BIO_R_NO_SUCH_FILE);
                 else
@@ -262,7 +262,7 @@ file_ctrl(BIO *b, int cmd, long num, void *ptr)
                 fp = fopen(ptr, p);
                 if (fp == NULL) {
                         SYSerr(SYS_F_FOPEN, errno);
-                        ERR_add_error_data(5, "fopen('", ptr, "', '", p, "')");
+                        ERR_asprintf_error_data("fopen('%s', '%s')", ptr, p);
                         BIOerr(BIO_F_FILE_CTRL, ERR_R_SYS_LIB);
                         ret = 0;
                         break;
diff --git a/src/lib/libcrypto/cms/cms_smime.c b/src/lib/libcrypto/cms/cms_smime.c
index 8c56e3a852..eed50cd6a3 100644
--- a/src/lib/libcrypto/cms/cms_smime.c
+++ b/src/lib/libcrypto/cms/cms_smime.c
@@ -302,7 +302,7 @@ static int cms_signerinfo_verify_cert(CMS_SignerInfo *si,
                 j = X509_STORE_CTX_get_error(&ctx);
                 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CERT,
                                                 CMS_R_CERTIFICATE_VERIFY_ERROR);
-                ERR_add_error_data(2, "Verify error:",
+                ERR_asprintf_error_data("Verify error:%s",
                                          X509_verify_cert_error_string(j));
                 goto err;
                 }
diff --git a/src/lib/libcrypto/comp/c_zlib.c b/src/lib/libcrypto/comp/c_zlib.c
index aaf89429b6..3a73b3df0b 100644
--- a/src/lib/libcrypto/comp/c_zlib.c
+++ b/src/lib/libcrypto/comp/c_zlib.c
@@ -551,7 +551,7 @@ bio_zlib_read(BIO *b, char *out, int outl)
                         if ((ret != Z_OK) && (ret != Z_STREAM_END)) {
                                 COMPerr(COMP_F_BIO_ZLIB_READ,
                                     COMP_R_ZLIB_INFLATE_ERROR);
-                                ERR_add_error_data(2, "zlib error:",
+                                ERR_asprintf_error_data("zlib error:%s",
                                     zError(ret));
                                 return 0;
                         }
@@ -638,7 +638,7 @@ bio_zlib_write(BIO *b, const char *in, int inl)
                 if (ret != Z_OK) {
                         COMPerr(COMP_F_BIO_ZLIB_WRITE,
                             COMP_R_ZLIB_DEFLATE_ERROR);
-                        ERR_add_error_data(2, "zlib error:", zError(ret));
+                        ERR_asprintf_error_data("zlib error:%s", zError(ret));
                         return 0;
                 }
                 ctx->ocount = ctx->obufsize - zout->avail_out;
@@ -688,7 +688,7 @@ bio_zlib_flush(BIO *b)
                 else if (ret != Z_OK) {
                         COMPerr(COMP_F_BIO_ZLIB_FLUSH,
                             COMP_R_ZLIB_DEFLATE_ERROR);
-                        ERR_add_error_data(2, "zlib error:", zError(ret));
+                        ERR_asprintf_error_data("zlib error:%s", zError(ret));
                         return 0;
                 }
                 ctx->ocount = ctx->obufsize - zout->avail_out;
diff --git a/src/lib/libcrypto/conf/conf_def.c b/src/lib/libcrypto/conf/conf_def.c
index 22fe7a8f60..bc9f139e7e 100644
--- a/src/lib/libcrypto/conf/conf_def.c
+++ b/src/lib/libcrypto/conf/conf_def.c
@@ -218,7 +218,6 @@ def_load_bio(CONF *conf, BIO *in, long *line)
         char *s, *p, *end;
         int again;
         long eline = 0;
-        char btmp[DECIMAL_SIZE(eline) + 1];
         CONF_VALUE *v = NULL, *tv;
         CONF_VALUE *sv = NULL;
         char *section = NULL, *buf;
@@ -428,8 +427,7 @@ err:
                 free(section);
         if (line != NULL)
                 *line = eline;
-        snprintf(btmp, sizeof btmp, "%ld", eline);
-        ERR_add_error_data(2, "line ", btmp);
+        ERR_asprintf_error_data("line %ld", eline);
         if ((h != conf->data) && (conf->data != NULL)) {
                 CONF_free(conf->data);
                 conf->data = NULL;
diff --git a/src/lib/libcrypto/conf/conf_lib.c b/src/lib/libcrypto/conf/conf_lib.c
index 469af6e825..35bdda3d64 100644
--- a/src/lib/libcrypto/conf/conf_lib.c
+++ b/src/lib/libcrypto/conf/conf_lib.c
@@ -329,7 +329,7 @@ NCONF_get_string(const CONF *conf, const char *group, const char *name)
                 return NULL;
         }
         CONFerr(CONF_F_NCONF_GET_STRING, CONF_R_NO_VALUE);
-        ERR_add_error_data(4, "group=", group, " name=", name);
+        ERR_asprintf_error_data("group=%s name=%s", group, name);
         return NULL;
 }
 
diff --git a/src/lib/libcrypto/conf/conf_mod.c b/src/lib/libcrypto/conf/conf_mod.c
index 80266e43d8..b574104791 100644
--- a/src/lib/libcrypto/conf/conf_mod.c
+++ b/src/lib/libcrypto/conf/conf_mod.c
@@ -211,7 +211,7 @@ module_run(const CONF *cnf, char *name, char *value, unsigned long flags)
         if (!md) {
                 if (!(flags & CONF_MFLAGS_SILENT)) {
                         CONFerr(CONF_F_MODULE_RUN, CONF_R_UNKNOWN_MODULE_NAME);
-                        ERR_add_error_data(2, "module=", name);
+                        ERR_asprintf_error_data("module=%s", name);
                 }
                 return -1;
         }
@@ -220,12 +220,11 @@ module_run(const CONF *cnf, char *name, char *value, unsigned long flags)
 
         if (ret <= 0) {
                 if (!(flags & CONF_MFLAGS_SILENT)) {
-                        char rcode[DECIMAL_SIZE(ret) + 1];
                         CONFerr(CONF_F_MODULE_RUN,
                             CONF_R_MODULE_INITIALIZATION_ERROR);
-                        snprintf(rcode, sizeof rcode, "%-8d", ret);
-                        ERR_add_error_data(6, "module=", name, ", value=",
-                            value, ", retcode=", rcode);
+                        ERR_asprintf_error_data
+                            ("module=%s, value=%s, retcode=%-8d",
+                            name, value, ret);
                 }
         }
 
@@ -272,7 +271,7 @@ err:
         if (dso)
                 DSO_free(dso);
         CONFerr(CONF_F_MODULE_LOAD_DSO, errcode);
-        ERR_add_error_data(4, "module=", name, ", path=", path);
+        ERR_asprintf_error_data("module=%s, path=%s", name, path);
         return NULL;
 }
 
diff --git a/src/lib/libcrypto/dso/dso_dlfcn.c b/src/lib/libcrypto/dso/dso_dlfcn.c
index ea4e4935aa..6cf9ab2667 100644
--- a/src/lib/libcrypto/dso/dso_dlfcn.c
+++ b/src/lib/libcrypto/dso/dso_dlfcn.c
@@ -140,7 +140,8 @@ dlfcn_load(DSO *dso)
         ptr = dlopen(filename, flags);
         if (ptr == NULL) {
                 DSOerr(DSO_F_DLFCN_LOAD, DSO_R_LOAD_FAILED);
-                ERR_add_error_data(4, "filename(", filename, "): ", dlerror());
+                ERR_asprintf_error_data("filename(%s): %s", filename,
+                    dlerror());
                 goto err;
         }
         if (!sk_void_push(dso->meth_data, (char *)ptr)) {
@@ -204,7 +205,7 @@ dlfcn_bind_var(DSO *dso, const char *symname)
         sym = dlsym(ptr, symname);
         if (sym == NULL) {
                 DSOerr(DSO_F_DLFCN_BIND_VAR, DSO_R_SYM_FAILURE);
-                ERR_add_error_data(4, "symname(", symname, "): ", dlerror());
+                ERR_asprintf_error_data("symname(%s): %s", symname, dlerror());
                 return (NULL);
         }
         return (sym);
@@ -235,7 +236,7 @@ dlfcn_bind_func(DSO *dso, const char *symname)
         u.dlret = dlsym(ptr, symname);
         if (u.dlret == NULL) {
                 DSOerr(DSO_F_DLFCN_BIND_FUNC, DSO_R_SYM_FAILURE);
-                ERR_add_error_data(4, "symname(", symname, "): ", dlerror());
+                ERR_asprintf_error_data("symname(%s): %s", symname, dlerror());
                 return (NULL);
         }
         return u.sym;
@@ -348,7 +349,7 @@ dlfcn_pathbyaddr(void *addr, char *path, int sz)
                 return len;
         }
 
-        ERR_add_error_data(4, "dlfcn_pathbyaddr(): ", dlerror());
+        ERR_asprintf_error_data("dlfcn_pathbyaddr(): %s", dlerror());
         return -1;
 }
 
diff --git a/src/lib/libcrypto/engine/eng_cnf.c b/src/lib/libcrypto/engine/eng_cnf.c
index 95c4070015..afb704e93b 100644
--- a/src/lib/libcrypto/engine/eng_cnf.c
+++ b/src/lib/libcrypto/engine/eng_cnf.c
@@ -203,9 +203,9 @@ static int int_engine_configure(char *name, char *value, const CONF *cnf)
                 {
                 ENGINEerr(ENGINE_F_INT_ENGINE_CONFIGURE, ENGINE_R_ENGINE_CONFIGURATION_ERROR);
                 if (ecmd)
-                        ERR_add_error_data(6, "section=", ecmd->section, 
-                                                ", name=", ecmd->name,
-                                                ", value=", ecmd->value);
+                        ERR_asprintf_error_data
+                            ("section=%s, name=%s, value=%s",
+                            ecmd->section, ecmd->name, ecmd->value);
                 }
         if (e)
                 ENGINE_free(e);
diff --git a/src/lib/libcrypto/engine/eng_fat.c b/src/lib/libcrypto/engine/eng_fat.c
index 789b8d57e5..e01067566e 100644
--- a/src/lib/libcrypto/engine/eng_fat.c
+++ b/src/lib/libcrypto/engine/eng_fat.c
@@ -141,7 +141,7 @@ int ENGINE_set_default_string(ENGINE *e, const char *def_list)
                 {
                 ENGINEerr(ENGINE_F_ENGINE_SET_DEFAULT_STRING,
                                         ENGINE_R_INVALID_STRING);
-                ERR_add_error_data(2, "str=",def_list);
+                ERR_asprintf_error_data("str=%s",def_list);
                 return 0;
                 }
         return ENGINE_set_default(e, flags);
diff --git a/src/lib/libcrypto/engine/eng_list.c b/src/lib/libcrypto/engine/eng_list.c
index 95c858960b..5528b5478f 100644
--- a/src/lib/libcrypto/engine/eng_list.c
+++ b/src/lib/libcrypto/engine/eng_list.c
@@ -389,7 +389,7 @@ ENGINE *ENGINE_by_id(const char *id)
                 {
                 ENGINEerr(ENGINE_F_ENGINE_BY_ID,
                         ENGINE_R_NO_SUCH_ENGINE);
-                ERR_add_error_data(2, "id=", id);
+                ERR_asprintf_error_data("id=%s", id);
                 }
         return iterator;
 #else
@@ -416,7 +416,7 @@ ENGINE *ENGINE_by_id(const char *id)
 notfound:
         ENGINE_free(iterator);
         ENGINEerr(ENGINE_F_ENGINE_BY_ID,ENGINE_R_NO_SUCH_ENGINE);
-        ERR_add_error_data(2, "id=", id);
+        ERR_asprintf_error_data("id=%s", id);
         return NULL;
         /* EEK! Experimental code ends */
 #endif
diff --git a/src/lib/libcrypto/evp/evp_pbe.c b/src/lib/libcrypto/evp/evp_pbe.c
index 37a926c3fc..37683af76a 100644
--- a/src/lib/libcrypto/evp/evp_pbe.c
+++ b/src/lib/libcrypto/evp/evp_pbe.c
@@ -167,7 +167,7 @@ int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                 EVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_UNKNOWN_PBE_ALGORITHM);
                 if (!pbe_obj) strlcpy (obj_tmp, "NULL", sizeof obj_tmp);
                 else i2t_ASN1_OBJECT(obj_tmp, sizeof obj_tmp, pbe_obj);
-                ERR_add_error_data(2, "TYPE=", obj_tmp);
+                ERR_asprintf_error_data("TYPE=%s", obj_tmp);
                 return 0;
                 }
 
diff --git a/src/lib/libcrypto/evp/evp_pkey.c b/src/lib/libcrypto/evp/evp_pkey.c
index c760cf1965..94056f0da9 100644
--- a/src/lib/libcrypto/evp/evp_pkey.c
+++ b/src/lib/libcrypto/evp/evp_pkey.c
@@ -83,7 +83,7 @@ EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8)
                 {
                 EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);
                 i2t_ASN1_OBJECT(obj_tmp, 80, algoid);
-                ERR_add_error_data(2, "TYPE=", obj_tmp);
+                ERR_asprintf_error_data("TYPE=%s", obj_tmp);
                 goto error;
                 }
 
diff --git a/src/lib/libcrypto/ocsp/ocsp_ht.c b/src/lib/libcrypto/ocsp/ocsp_ht.c
index 4bb6fce83c..b45eaf6767 100644
--- a/src/lib/libcrypto/ocsp/ocsp_ht.c
+++ b/src/lib/libcrypto/ocsp/ocsp_ht.c
@@ -259,9 +259,9 @@ static int parse_http_line1(char *line)
                 {
                 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR);
                 if(!*q)
-                        ERR_add_error_data(2, "Code=", p);
+                        ERR_asprintf_error_data("Code=%s", p);
                 else
-                        ERR_add_error_data(4, "Code=", p, ",Reason=", q);
+                        ERR_asprintf_error_data("Code=%s,Reason=%s", p, q);
                 return 0;
                 }
 
diff --git a/src/lib/libcrypto/ocsp/ocsp_vfy.c b/src/lib/libcrypto/ocsp/ocsp_vfy.c
index 276718304d..0b181d5abe 100644
--- a/src/lib/libcrypto/ocsp/ocsp_vfy.c
+++ b/src/lib/libcrypto/ocsp/ocsp_vfy.c
@@ -122,9 +122,9 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
                 X509_STORE_CTX_cleanup(&ctx);
                 if (ret <= 0)
                         {
-                        i = X509_STORE_CTX_get_error(&ctx);     
+                        i = X509_STORE_CTX_get_error(&ctx);
                         OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR);
-                        ERR_add_error_data(2, "Verify error:",
+                        ERR_asprintf_error_data("Verify error:%s",
                                         X509_verify_cert_error_string(i));
                         goto end;
                         }
@@ -421,7 +421,7 @@ int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *st
                         {
                         ret = X509_STORE_CTX_get_error(&ctx);   
                         OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR);
-                        ERR_add_error_data(2, "Verify error:",
+                        ERR_asprintf_error_data("Verify error:%s",
                                         X509_verify_cert_error_string(ret));
                         return 0;
                         }
diff --git a/src/lib/libcrypto/pem/pem_lib.c b/src/lib/libcrypto/pem/pem_lib.c
index c670ac2acb..9bc2b27285 100644
--- a/src/lib/libcrypto/pem/pem_lib.c
+++ b/src/lib/libcrypto/pem/pem_lib.c
@@ -289,7 +289,7 @@ PEM_bytes_read_bio(unsigned char **pdata, long *plen, char **pnm,
                 if (!PEM_read_bio(bp, &nm, &header, &data, &len)) {
                         if (ERR_GET_REASON(ERR_peek_error()) ==
                             PEM_R_NO_START_LINE)
-                                ERR_add_error_data(2, "Expecting: ", name);
+                                ERR_asprintf_error_data("Expecting: %s", name);
                         return 0;
                 }
                 if (check_pem(nm, name))
diff --git a/src/lib/libcrypto/pkcs7/bio_ber.c b/src/lib/libcrypto/pkcs7/bio_ber.c
index 04dc5c9b96..d787495a21 100644
--- a/src/lib/libcrypto/pkcs7/bio_ber.c
+++ b/src/lib/libcrypto/pkcs7/bio_ber.c
@@ -155,7 +155,6 @@ static int ber_free(BIO *a)
 
 int bio_ber_get_header(BIO *bio, BIO_BER_CTX *ctx)
         {
-        char buf[64];
         int i,j,n;
         int ret;
         unsigned char *p;
@@ -215,8 +214,7 @@ int bio_ber_get_header(BIO *bio, BIO_BER_CTX *ctx)
         if ((ctx->tag  >= 0) && (ctx->tag != tag))
                 {
                 BIOerr(BIO_F_BIO_BER_GET_HEADER,BIO_R_TAG_MISMATCH);
-                sprintf(buf,"tag=%d, got %d",ctx->tag,tag);
-                ERR_add_error_data(1,buf);
+                ERR_asprintf_error_data("tag=%d, got %d", ctx->tag, tag);
                 return(-1);
                 }
         if (ret & 0x01)
diff --git a/src/lib/libcrypto/pkcs7/pk7_smime.c b/src/lib/libcrypto/pkcs7/pk7_smime.c
index a5104f8d05..6d6bd46b62 100644
--- a/src/lib/libcrypto/pkcs7/pk7_smime.c
+++ b/src/lib/libcrypto/pkcs7/pk7_smime.c
@@ -340,7 +340,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                 X509_STORE_CTX_cleanup(&cert_ctx);
                 if (i <= 0) {
                         PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CERTIFICATE_VERIFY_ERROR);
-                        ERR_add_error_data(2, "Verify error:",
+                        ERR_asprintf_error_data("Verify error:%s",
                                          X509_verify_cert_error_string(j));
                         sk_X509_free(signers);
                         return 0;
diff --git a/src/lib/libcrypto/ts/ts_conf.c b/src/lib/libcrypto/ts/ts_conf.c
index f8cf3b514c..12cce16bc8 100644
--- a/src/lib/libcrypto/ts/ts_conf.c
+++ b/src/lib/libcrypto/ts/ts_conf.c
@@ -239,7 +239,7 @@ err:
         if (!ret) {
                 TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE,
                     TS_R_COULD_NOT_SET_ENGINE);
-                ERR_add_error_data(2, "engine:", name);
+                ERR_asprintf_error_data("engine:%s", name);
         }
         if (e)
                 ENGINE_free(e);
diff --git a/src/lib/libcrypto/ts/ts_rsp_verify.c b/src/lib/libcrypto/ts/ts_rsp_verify.c
index 66e35dab3a..2a4c0c5ef9 100644
--- a/src/lib/libcrypto/ts/ts_rsp_verify.c
+++ b/src/lib/libcrypto/ts/ts_rsp_verify.c
@@ -244,7 +244,7 @@ TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509 *signer,
         if (i <= 0) {
                 int j = X509_STORE_CTX_get_error(&cert_ctx);
                 TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR);
-                ERR_add_error_data(2, "Verify error:",
+                ERR_asprintf_error_data("Verify error:%s",
                     X509_verify_cert_error_string(j));
                 ret = 0;
         } else {
@@ -530,11 +530,11 @@ TS_check_status_info(TS_RESP *response)
 
         /* Making up the error string. */
         TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN);
-        ERR_add_error_data(6,
-            "status code: ", status_text,
-            ", status text: ", embedded_status_text ?
-            embedded_status_text : "unspecified",
-            ", failure codes: ", failure_text);
+        ERR_asprintf_error_data
+            ("status code: %s, status text: %s, failure codes: %s",
+            status_text,
+            embedded_status_text ? embedded_status_text : "unspecified",
+            failure_text);
         free(embedded_status_text);
 
         return 0;
diff --git a/src/lib/libcrypto/ui/ui_lib.c b/src/lib/libcrypto/ui/ui_lib.c
index ee76e5e64d..5335b59c48 100644
--- a/src/lib/libcrypto/ui/ui_lib.c
+++ b/src/lib/libcrypto/ui/ui_lib.c
@@ -827,31 +827,26 @@ UI_set_result(UI *ui, UI_STRING *uis, const char *result)
         switch (uis->type) {
         case UIT_PROMPT:
         case UIT_VERIFY:
-                {
-                        char number1[DECIMAL_SIZE(uis->_.string_data.result_minsize) + 1];
-                        char number2[DECIMAL_SIZE(uis->_.string_data.result_maxsize) + 1];
-
-                        (void) snprintf(number1, sizeof(number1), "%d",
-                            uis->_.string_data.result_minsize);
-                        (void) snprintf(number2, sizeof(number2), "%d",
-                            uis->_.string_data.result_maxsize);
-
-                        if (l < uis->_.string_data.result_minsize) {
-                                ui->flags |= UI_FLAG_REDOABLE;
-                                UIerr(UI_F_UI_SET_RESULT, UI_R_RESULT_TOO_SMALL);
-                                ERR_add_error_data(5, "You must type in ",
-                                    number1, " to ", number2, " characters");
-                                return -1;
-                        }
-                        if (l > uis->_.string_data.result_maxsize) {
-                                ui->flags |= UI_FLAG_REDOABLE;
-                                UIerr(UI_F_UI_SET_RESULT, UI_R_RESULT_TOO_LARGE);
-                                ERR_add_error_data(5, "You must type in ",
-                                    number1, " to ", number2, " characters");
-                                return -1;
-                        }
+                if (l < uis->_.string_data.result_minsize) {
+                        ui->flags |= UI_FLAG_REDOABLE;
+                        UIerr(UI_F_UI_SET_RESULT,
+                            UI_R_RESULT_TOO_SMALL);
+                        ERR_asprintf_error_data
+                            ("You must type in %d to %d characters",
+                                uis->_.string_data.result_minsize,
+                                uis->_.string_data.result_maxsize);
+                        return -1;
+                }
+                if (l > uis->_.string_data.result_maxsize) {
+                        ui->flags |= UI_FLAG_REDOABLE;
+                        UIerr(UI_F_UI_SET_RESULT,
+                            UI_R_RESULT_TOO_LARGE);
+                        ERR_asprintf_error_data
+                            ("You must type in %d to %d characters",
+                                uis->_.string_data.result_minsize,
+                                uis->_.string_data.result_maxsize);
+                        return -1;
                 }
-
                 if (!uis->result_buf) {
                         UIerr(UI_F_UI_SET_RESULT, UI_R_NO_RESULT_BUFFER);
                         return -1;
diff --git a/src/lib/libcrypto/x509/x509_att.c b/src/lib/libcrypto/x509/x509_att.c
index 5699568998..ef922c7c83 100644
--- a/src/lib/libcrypto/x509/x509_att.c
+++ b/src/lib/libcrypto/x509/x509_att.c
@@ -282,7 +282,7 @@ X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr, const char *atrname,
         if (obj == NULL) {
                 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,
                     X509_R_INVALID_FIELD_NAME);
-                ERR_add_error_data(2, "name=", atrname);
+                ERR_asprintf_error_data("name=%s", atrname);
                 return (NULL);
         }
         nattr = X509_ATTRIBUTE_create_by_OBJ(attr, obj, type, bytes, len);
diff --git a/src/lib/libcrypto/x509/x509name.c b/src/lib/libcrypto/x509/x509name.c
index 3d90fd67fe..32fce2debb 100644
--- a/src/lib/libcrypto/x509/x509name.c
+++ b/src/lib/libcrypto/x509/x509name.c
@@ -298,7 +298,7 @@ X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
         if (obj == NULL) {
                 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,
                     X509_R_INVALID_FIELD_NAME);
-                ERR_add_error_data(2, "name=", field);
+                ERR_asprintf_error_data("name=%s", field);
                 return (NULL);
         }
         nentry = X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
diff --git a/src/lib/libcrypto/x509v3/v3_akey.c b/src/lib/libcrypto/x509v3/v3_akey.c
index 6d5c576e23..a5d760d469 100644
--- a/src/lib/libcrypto/x509v3/v3_akey.c
+++ b/src/lib/libcrypto/x509v3/v3_akey.c
@@ -139,7 +139,7 @@ v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
                 } else {
                         X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
                             X509V3_R_UNKNOWN_OPTION);
-                        ERR_add_error_data(2, "name=", cnf->name);
+                        ERR_asprintf_error_data("name=%s", cnf->name);
                         return NULL;
                 }
         }
diff --git a/src/lib/libcrypto/x509v3/v3_alt.c b/src/lib/libcrypto/x509v3/v3_alt.c
index e61ed673c0..61b0c90fad 100644
--- a/src/lib/libcrypto/x509v3/v3_alt.c
+++ b/src/lib/libcrypto/x509v3/v3_alt.c
@@ -479,7 +479,7 @@ a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
                         if (!(obj = OBJ_txt2obj(value, 0))) {
                                 X509V3err(X509V3_F_A2I_GENERAL_NAME,
                                     X509V3_R_BAD_OBJECT);
-                                ERR_add_error_data(2, "value=", value);
+                                ERR_asprintf_error_data("value=%s", value);
                                 goto err;
                         }
                         gen->d.rid = obj;
@@ -494,7 +494,7 @@ a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
                 if (gen->d.ip == NULL) {
                         X509V3err(X509V3_F_A2I_GENERAL_NAME,
                             X509V3_R_BAD_IP_ADDRESS);
-                        ERR_add_error_data(2, "value=", value);
+                        ERR_asprintf_error_data("value=%s", value);
                         goto err;
                 }
                 break;
@@ -572,7 +572,7 @@ v2i_GENERAL_NAME_ex(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
         else {
                 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,
                     X509V3_R_UNSUPPORTED_OPTION);
-                ERR_add_error_data(2, "name=", name);
+                ERR_asprintf_error_data("name=%s", name);
                 return NULL;
         }
 
@@ -620,7 +620,7 @@ do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
         sk = X509V3_get_section(ctx, value);
         if (!sk) {
                 X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
-                ERR_add_error_data(2, "section=", value);
+                ERR_asprintf_error_data("section=%s", value);
                 X509_NAME_free(nm);
                 return 0;
         }
diff --git a/src/lib/libcrypto/x509v3/v3_conf.c b/src/lib/libcrypto/x509v3/v3_conf.c
index daacf8d5df..e22aa50fcd 100644
--- a/src/lib/libcrypto/x509v3/v3_conf.c
+++ b/src/lib/libcrypto/x509v3/v3_conf.c
@@ -94,7 +94,7 @@ X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name, char *value)
         if (!ret) {
                 X509V3err(X509V3_F_X509V3_EXT_NCONF,
                     X509V3_R_ERROR_IN_EXTENSION);
-                ERR_add_error_data(4, "name=", name, ", value=", value);
+                ERR_asprintf_error_data("name=%s, value=%s", name, value);
         }
         return ret;
 }
@@ -142,8 +142,8 @@ do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value)
                 if (sk_CONF_VALUE_num(nval) <= 0) {
                         X509V3err(X509V3_F_DO_EXT_NCONF,
                             X509V3_R_INVALID_EXTENSION_STRING);
-                        ERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid),
-                            ",section=", value);
+                        ERR_asprintf_error_data("name=%s,section=%s",
+                            OBJ_nid2sn(ext_nid), value);
                         return NULL;
                 }
                 ext_struc = method->v2i(method, ctx, nval);
@@ -165,7 +165,7 @@ do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value)
         } else {
                 X509V3err(X509V3_F_DO_EXT_NCONF,
                     X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);
-                ERR_add_error_data(2, "name=", OBJ_nid2sn(ext_nid));
+                ERR_asprintf_error_data("name=%s", OBJ_nid2sn(ext_nid));
                 return NULL;
         }
 
@@ -283,7 +283,7 @@ v3_generic_extension(const char *ext, char *value, int crit, int gen_type,
         if (!(obj = OBJ_txt2obj(ext, 0))) {
                 X509V3err(X509V3_F_V3_GENERIC_EXTENSION,
                     X509V3_R_EXTENSION_NAME_ERROR);
-                ERR_add_error_data(2, "name=", ext);
+                ERR_asprintf_error_data("name=%s", ext);
                 goto err;
         }
 
@@ -295,7 +295,7 @@ v3_generic_extension(const char *ext, char *value, int crit, int gen_type,
         if (ext_der == NULL) {
                 X509V3err(X509V3_F_V3_GENERIC_EXTENSION,
                     X509V3_R_EXTENSION_VALUE_ERROR);
-                ERR_add_error_data(2, "value=", value);
+                ERR_asprintf_error_data("value=%s", value);
                 goto err;
         }
 
diff --git a/src/lib/libcrypto/x509v3/v3_info.c b/src/lib/libcrypto/x509v3/v3_info.c
index 7853e3e23b..9ae1596b1f 100644
--- a/src/lib/libcrypto/x509v3/v3_info.c
+++ b/src/lib/libcrypto/x509v3/v3_info.c
@@ -184,12 +184,10 @@ v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
                 if (!acc->method) {
                         X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
                             X509V3_R_BAD_OBJECT);
-                        ERR_add_error_data(2, "value=", objtmp);
-                        free(objtmp);
+                        ERR_asprintf_error_data("value=%s", objtmp);
                         goto err;
                 }
                 free(objtmp);
-
         }
         return ainfo;
 
diff --git a/src/lib/libcrypto/x509v3/x509v3.h b/src/lib/libcrypto/x509v3/x509v3.h
index b308abe7cd..dda5344b33 100644
--- a/src/lib/libcrypto/x509v3/x509v3.h
+++ b/src/lib/libcrypto/x509v3/x509v3.h
@@ -379,8 +379,9 @@ struct ISSUING_DIST_POINT_st
 /* onlysomereasons present */
 #define IDP_REASONS     0x40
 
-#define X509V3_conf_err(val) ERR_add_error_data(6, "section:", val->section, \
-",name:", val->name, ",value:", val->value);
+#define X509V3_conf_err(val) ERR_asprintf_error_data( \
+                        "section:%s,name:%s,value:%s", val->section, \
+                        val->name, val->value);
 
 #define X509V3_set_ctx_test(ctx) \
                         X509V3_set_ctx(ctx, NULL, NULL, NULL, NULL, CTX_TEST)
diff --git a/src/lib/libssl/d1_pkt.c b/src/lib/libssl/d1_pkt.c
index 7cfada4e6b..c5bdb41b90 100644
--- a/src/lib/libssl/d1_pkt.c
+++ b/src/lib/libssl/d1_pkt.c
@@ -1109,13 +1109,11 @@ start:
 #endif
                 } else if (alert_level == 2) /* fatal */
                 {
-                        char tmp[16];
-
                         s->rwstate = SSL_NOTHING;
                         s->s3->fatal_alert = alert_descr;
                         SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
-                        (void) snprintf(tmp,sizeof tmp,"%d",alert_descr);
-                        ERR_add_error_data(2, "SSL alert number ", tmp);
+                        ERR_asprintf_error_data("SSL alert number %d",
+                            alert_descr);
                         s->shutdown|=SSL_RECEIVED_SHUTDOWN;
                         SSL_CTX_remove_session(s->ctx, s->session);
                         return (0);
diff --git a/src/lib/libssl/s3_pkt.c b/src/lib/libssl/s3_pkt.c
index 68c3f1cb2b..4a8462ecb9 100644
--- a/src/lib/libssl/s3_pkt.c
+++ b/src/lib/libssl/s3_pkt.c
@@ -1169,13 +1169,11 @@ start:
 #endif
                 } else if (alert_level == 2) {
                         /* fatal */
-                        char tmp[16];
-
                         s->rwstate = SSL_NOTHING;
                         s->s3->fatal_alert = alert_descr;
                         SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
-                        (void) snprintf(tmp, sizeof tmp, "%d", alert_descr);
-                        ERR_add_error_data(2, "SSL alert number ", tmp);
+                        ERR_asprintf_error_data("SSL alert number %d",
+                            alert_descr);
                         s->shutdown|=SSL_RECEIVED_SHUTDOWN;
                         SSL_CTX_remove_session(s->ctx, s->session);
                         return (0);
diff --git a/src/lib/libssl/src/crypto/asn1/a_mbstr.c b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
index b59d84910f..9945ede2ac 100644
--- a/src/lib/libssl/src/crypto/asn1/a_mbstr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
@@ -98,7 +98,6 @@ ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
         ASN1_STRING *dest;
         unsigned char *p;
         int nchar;
-        char strbuf[32];
         int (*cpyfunc)(unsigned long, void *) = NULL;
 
         if (len == -1)
@@ -148,15 +147,13 @@ ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
         if ((minsize > 0) && (nchar < minsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_SHORT);
-                snprintf(strbuf, sizeof strbuf, "%ld", minsize);
-                ERR_add_error_data(2, "minsize=", strbuf);
+                ERR_asprintf_error_data("minsize=%ld", minsize);
                 return -1;
         }
 
         if ((maxsize > 0) && (nchar > maxsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_NCOPY, ASN1_R_STRING_TOO_LONG);
-                snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
-                ERR_add_error_data(2, "maxsize=", strbuf);
+                ERR_asprintf_error_data("maxsize=%ld", maxsize);
                 return -1;
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_gen.c b/src/lib/libssl/src/crypto/asn1/asn1_gen.c
index c66bea2ab4..598a322242 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_gen.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_gen.c
@@ -291,7 +291,7 @@ asn1_cb(const char *elem, int len, void *bitstr)
 
         if (utype == -1) {
                 ASN1err(ASN1_F_ASN1_CB, ASN1_R_UNKNOWN_TAG);
-                ERR_add_error_data(2, "tag=", elem);
+                ERR_asprintf_error_data("tag=%s", elem);
                 return -1;
         }
 
@@ -370,7 +370,6 @@ asn1_cb(const char *elem, int len, void *bitstr)
 static int
 parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
 {
-        char erch[2];
         long tag_num;
         char *eptr;
 
@@ -410,10 +409,8 @@ parse_tagging(const char *vstart, int vlen, int *ptag, int *pclass)
                         break;
 
                 default:
-                        erch[0] = *eptr;
-                        erch[1] = 0;
                         ASN1err(ASN1_F_PARSE_TAGGING, ASN1_R_INVALID_MODIFIER);
-                        ERR_add_error_data(2, "Char=", erch);
+                        ERR_asprintf_error_data("Char=%c", *eptr);
                         return 0;
                         break;
 
@@ -777,7 +774,7 @@ asn1_str2type(const char *str, int format, int utype)
         return atmp;
 
 bad_str:
-        ERR_add_error_data(2, "string=", str);
+        ERR_asprintf_error_data("string=%s", str);
 bad_form:
         ASN1_TYPE_free(atmp);
         return NULL;
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_lib.c b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
index 4d4368aefe..c2f0837a1c 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
@@ -459,10 +459,7 @@ ASN1_STRING_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
 void
 asn1_add_error(const unsigned char *address, int offset)
 {
-        char tmp[128];
-        (void) snprintf(tmp, sizeof(tmp), "address=%p offset=%d",
-            address, offset);
-        ERR_add_error_data(1, tmp);
+        ERR_asprintf_error_data("address=%p offset=%d", address, offset);
 }
 
 int
diff --git a/src/lib/libssl/src/crypto/asn1/asn_mime.c b/src/lib/libssl/src/crypto/asn1/asn_mime.c
index 248ea114e8..b30c366561 100644
--- a/src/lib/libssl/src/crypto/asn1/asn_mime.c
+++ b/src/lib/libssl/src/crypto/asn1/asn_mime.c
@@ -493,7 +493,7 @@ SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
                     strcmp(hdr->value, "application/pkcs7-signature")) {
                         ASN1err(ASN1_F_SMIME_READ_ASN1,
                             ASN1_R_SIG_INVALID_MIME_TYPE);
-                        ERR_add_error_data(2, "type: ", hdr->value);
+                        ERR_asprintf_error_data("type: %s", hdr->value);
                         sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                         sk_BIO_pop_free(parts, BIO_vfree);
                         return NULL;
@@ -520,7 +520,7 @@ SMIME_read_ASN1(BIO *bio, BIO **bcont, const ASN1_ITEM *it)
         if (strcmp (hdr->value, "application/x-pkcs7-mime") &&
             strcmp (hdr->value, "application/pkcs7-mime")) {
                 ASN1err(ASN1_F_SMIME_READ_ASN1, ASN1_R_INVALID_MIME_TYPE);
-                ERR_add_error_data(2, "type: ", hdr->value);
+                ERR_asprintf_error_data("type: %s", hdr->value);
                 sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 return NULL;
         }
@@ -591,7 +591,7 @@ SMIME_text(BIO *in, BIO *out)
         }
         if (strcmp (hdr->value, "text/plain")) {
                 ASN1err(ASN1_F_SMIME_TEXT, ASN1_R_INVALID_MIME_TYPE);
-                ERR_add_error_data(2, "type: ", hdr->value);
+                ERR_asprintf_error_data("type: %s", hdr->value);
                 sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
                 return 0;
         }
diff --git a/src/lib/libssl/src/crypto/asn1/tasn_dec.c b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
index 560b6f3d5f..d86bc4e091 100644
--- a/src/lib/libssl/src/crypto/asn1/tasn_dec.c
+++ b/src/lib/libssl/src/crypto/asn1/tasn_dec.c
@@ -496,10 +496,10 @@ auxerr:
 err:
         ASN1_item_ex_free(pval, it);
         if (errtt)
-                ERR_add_error_data(4, "Field=", errtt->field_name,
-                    ", Type=", it->sname);
+                ERR_asprintf_error_data("Field=%s, Type=%s", errtt->field_name,
+                    it->sname);
         else
-                ERR_add_error_data(2, "Type=", it->sname);
+                ERR_asprintf_error_data("Type=%s", it->sname);
         return 0;
 }
 
diff --git a/src/lib/libssl/src/crypto/bio/b_sock.c b/src/lib/libssl/src/crypto/bio/b_sock.c
index 05eb362cc6..ecfaf93b99 100644
--- a/src/lib/libssl/src/crypto/bio/b_sock.c
+++ b/src/lib/libssl/src/crypto/bio/b_sock.c
@@ -129,7 +129,7 @@ err:
         if (locked)
                 CRYPTO_w_unlock(CRYPTO_LOCK_GETHOSTBYNAME);
         if (err) {
-                ERR_add_error_data(2, "host=", str);
+                ERR_asprintf_error_data("host=%s", str);
                 return 0;
         } else
                 return 1;
@@ -171,7 +171,7 @@ BIO_get_port(const char *str, unsigned short *port_ptr)
                                 *port_ptr = 70;
                         else {
                                 SYSerr(SYS_F_GETSERVBYNAME, errno);
-                                ERR_add_error_data(3, "service='", str, "'");
+                                ERR_asprintf_error_data("service='%s'", str);
                                 return (0);
                         }
                 }
@@ -378,7 +378,7 @@ again:
         s = socket(server.sa.sa_family, SOCK_STREAM, SOCKET_PROTOCOL);
         if (s == -1) {
                 SYSerr(SYS_F_SOCKET, errno);
-                ERR_add_error_data(3, "port='", host, "'");
+                ERR_asprintf_error_data("port='%s'", host);
                 BIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET, BIO_R_UNABLE_TO_CREATE_SOCKET);
                 goto err;
         }
@@ -422,13 +422,13 @@ again:
                 }
 #endif
                 SYSerr(SYS_F_BIND, err_num);
-                ERR_add_error_data(3, "port='", host, "'");
+                ERR_asprintf_error_data("port='%s'", host);
                 BIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET, BIO_R_UNABLE_TO_BIND_SOCKET);
                 goto err;
         }
         if (listen(s, MAX_LISTEN) == -1) {
                 SYSerr(SYS_F_BIND, errno);
-                ERR_add_error_data(3, "port='", host, "'");
+                ERR_asprintf_error_data("port='%s'", host);
                 BIOerr(BIO_F_BIO_GET_ACCEPT_SOCKET, BIO_R_UNABLE_TO_LISTEN_SOCKET);
                 goto err;
         }
diff --git a/src/lib/libssl/src/crypto/bio/bss_conn.c b/src/lib/libssl/src/crypto/bio/bss_conn.c
index b64d7d7761..d7a8619b38 100644
--- a/src/lib/libssl/src/crypto/bio/bss_conn.c
+++ b/src/lib/libssl/src/crypto/bio/bss_conn.c
@@ -156,7 +156,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
 
                         if (c->param_port == NULL) {
                                 BIOerr(BIO_F_CONN_STATE, BIO_R_NO_PORT_SPECIFIED);
-                                ERR_add_error_data(2, "host=", c->param_hostname);
+                                ERR_asprintf_error_data("host=%s",
+                                    c->param_hostname);
                                 goto exit_loop;
                         }
                         c->state = BIO_CONN_S_GET_IP;
@@ -193,8 +194,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                         ret = socket(AF_INET, SOCK_STREAM, SOCKET_PROTOCOL);
                         if (ret == -1) {
                                 SYSerr(SYS_F_SOCKET, errno);
-                                ERR_add_error_data(4, "host=",
-                                    c->param_hostname, ":", c->param_port);
+                                ERR_asprintf_error_data("host=%s:%s",
+                                    c->param_hostname, c->param_port);
                                 BIOerr(BIO_F_CONN_STATE,
                                     BIO_R_UNABLE_TO_CREATE_SOCKET);
                                 goto exit_loop;
@@ -208,9 +209,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                                 if (!BIO_socket_nbio(b->num, 1)) {
                                         BIOerr(BIO_F_CONN_STATE,
                                             BIO_R_ERROR_SETTING_NBIO);
-                                        ERR_add_error_data(4, "host=",
-                                            c->param_hostname, ":",
-                                            c->param_port);
+                                        ERR_asprintf_error_data("host=%s:%s",
+                                            c->param_hostname, c->param_port);
                                         goto exit_loop;
                                 }
                         }
@@ -221,8 +221,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                         i = setsockopt(b->num, SOL_SOCKET, SO_KEEPALIVE,(char *)&i, sizeof(i));
                         if (i < 0) {
                                 SYSerr(SYS_F_SOCKET, errno);
-                                ERR_add_error_data(4, "host=",
-                                    c->param_hostname, ":", c->param_port);
+                                ERR_asprintf_error_data("host=%s:%s",
+                                    c->param_hostname, c->param_port);
                                 BIOerr(BIO_F_CONN_STATE, BIO_R_KEEPALIVE);
                                 goto exit_loop;
                         }
@@ -242,9 +242,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                                         b->retry_reason = BIO_RR_CONNECT;
                                 } else {
                                         SYSerr(SYS_F_CONNECT, errno);
-                                        ERR_add_error_data(4, "host=",
-                                            c->param_hostname, ":",
-                                            c->param_port);
+                                        ERR_asprintf_error_data("host=%s:%s",
+                                            c->param_hostname, c->param_port);
                                         BIOerr(BIO_F_CONN_STATE,
                                             BIO_R_CONNECT_ERROR);
                                 }
@@ -258,8 +257,8 @@ conn_state(BIO *b, BIO_CONNECT *c)
                         if (i) {
                                 BIO_clear_retry_flags(b);
                                 SYSerr(SYS_F_CONNECT, i);
-                                ERR_add_error_data(4, "host=",
-                                    c->param_hostname, ":", c->param_port);
+                                ERR_asprintf_error_data("host=%s:%s",
+                                    c->param_hostname, c->param_port);
                                 BIOerr(BIO_F_CONN_STATE,
                                     BIO_R_NBIO_CONNECT_ERROR);
                                 ret = 0;
diff --git a/src/lib/libssl/src/crypto/bio/bss_file.c b/src/lib/libssl/src/crypto/bio/bss_file.c
index acc746260e..6d5444f666 100644
--- a/src/lib/libssl/src/crypto/bio/bss_file.c
+++ b/src/lib/libssl/src/crypto/bio/bss_file.c
@@ -122,7 +122,7 @@ BIO_new_file(const char *filename, const char *mode)
 
         if (file == NULL) {
                 SYSerr(SYS_F_FOPEN, errno);
-                ERR_add_error_data(5, "fopen('", filename, "', '", mode, "')");
+                ERR_asprintf_error_data("fopen('%s', '%s')", filename, mode);
                 if (errno == ENOENT)
                         BIOerr(BIO_F_BIO_NEW_FILE, BIO_R_NO_SUCH_FILE);
                 else
@@ -262,7 +262,7 @@ file_ctrl(BIO *b, int cmd, long num, void *ptr)
                 fp = fopen(ptr, p);
                 if (fp == NULL) {
                         SYSerr(SYS_F_FOPEN, errno);
-                        ERR_add_error_data(5, "fopen('", ptr, "', '", p, "')");
+                        ERR_asprintf_error_data("fopen('%s', '%s')", ptr, p);
                         BIOerr(BIO_F_FILE_CTRL, ERR_R_SYS_LIB);
                         ret = 0;
                         break;
diff --git a/src/lib/libssl/src/crypto/cms/cms_smime.c b/src/lib/libssl/src/crypto/cms/cms_smime.c
index 8c56e3a852..eed50cd6a3 100644
--- a/src/lib/libssl/src/crypto/cms/cms_smime.c
+++ b/src/lib/libssl/src/crypto/cms/cms_smime.c
@@ -302,7 +302,7 @@ static int cms_signerinfo_verify_cert(CMS_SignerInfo *si,
                 j = X509_STORE_CTX_get_error(&ctx);
                 CMSerr(CMS_F_CMS_SIGNERINFO_VERIFY_CERT,
                                                 CMS_R_CERTIFICATE_VERIFY_ERROR);
-                ERR_add_error_data(2, "Verify error:",
+                ERR_asprintf_error_data("Verify error:%s",
                                          X509_verify_cert_error_string(j));
                 goto err;
                 }
diff --git a/src/lib/libssl/src/crypto/comp/c_zlib.c b/src/lib/libssl/src/crypto/comp/c_zlib.c
index aaf89429b6..3a73b3df0b 100644
--- a/src/lib/libssl/src/crypto/comp/c_zlib.c
+++ b/src/lib/libssl/src/crypto/comp/c_zlib.c
@@ -551,7 +551,7 @@ bio_zlib_read(BIO *b, char *out, int outl)
                         if ((ret != Z_OK) && (ret != Z_STREAM_END)) {
                                 COMPerr(COMP_F_BIO_ZLIB_READ,
                                     COMP_R_ZLIB_INFLATE_ERROR);
-                                ERR_add_error_data(2, "zlib error:",
+                                ERR_asprintf_error_data("zlib error:%s",
                                     zError(ret));
                                 return 0;
                         }
@@ -638,7 +638,7 @@ bio_zlib_write(BIO *b, const char *in, int inl)
                 if (ret != Z_OK) {
                         COMPerr(COMP_F_BIO_ZLIB_WRITE,
                             COMP_R_ZLIB_DEFLATE_ERROR);
-                        ERR_add_error_data(2, "zlib error:", zError(ret));
+                        ERR_asprintf_error_data("zlib error:%s", zError(ret));
                         return 0;
                 }
                 ctx->ocount = ctx->obufsize - zout->avail_out;
@@ -688,7 +688,7 @@ bio_zlib_flush(BIO *b)
                 else if (ret != Z_OK) {
                         COMPerr(COMP_F_BIO_ZLIB_FLUSH,
                             COMP_R_ZLIB_DEFLATE_ERROR);
-                        ERR_add_error_data(2, "zlib error:", zError(ret));
+                        ERR_asprintf_error_data("zlib error:%s", zError(ret));
                         return 0;
                 }
                 ctx->ocount = ctx->obufsize - zout->avail_out;
diff --git a/src/lib/libssl/src/crypto/conf/conf_def.c b/src/lib/libssl/src/crypto/conf/conf_def.c
index 22fe7a8f60..bc9f139e7e 100644
--- a/src/lib/libssl/src/crypto/conf/conf_def.c
+++ b/src/lib/libssl/src/crypto/conf/conf_def.c
@@ -218,7 +218,6 @@ def_load_bio(CONF *conf, BIO *in, long *line)
         char *s, *p, *end;
         int again;
         long eline = 0;
-        char btmp[DECIMAL_SIZE(eline) + 1];
         CONF_VALUE *v = NULL, *tv;
         CONF_VALUE *sv = NULL;
         char *section = NULL, *buf;
@@ -428,8 +427,7 @@ err:
                 free(section);
         if (line != NULL)
                 *line = eline;
-        snprintf(btmp, sizeof btmp, "%ld", eline);
-        ERR_add_error_data(2, "line ", btmp);
+        ERR_asprintf_error_data("line %ld", eline);
         if ((h != conf->data) && (conf->data != NULL)) {
                 CONF_free(conf->data);
                 conf->data = NULL;
diff --git a/src/lib/libssl/src/crypto/conf/conf_lib.c b/src/lib/libssl/src/crypto/conf/conf_lib.c
index 469af6e825..35bdda3d64 100644
--- a/src/lib/libssl/src/crypto/conf/conf_lib.c
+++ b/src/lib/libssl/src/crypto/conf/conf_lib.c
@@ -329,7 +329,7 @@ NCONF_get_string(const CONF *conf, const char *group, const char *name)
                 return NULL;
         }
         CONFerr(CONF_F_NCONF_GET_STRING, CONF_R_NO_VALUE);
-        ERR_add_error_data(4, "group=", group, " name=", name);
+        ERR_asprintf_error_data("group=%s name=%s", group, name);
         return NULL;
 }
 
diff --git a/src/lib/libssl/src/crypto/conf/conf_mod.c b/src/lib/libssl/src/crypto/conf/conf_mod.c
index 80266e43d8..b574104791 100644
--- a/src/lib/libssl/src/crypto/conf/conf_mod.c
+++ b/src/lib/libssl/src/crypto/conf/conf_mod.c
@@ -211,7 +211,7 @@ module_run(const CONF *cnf, char *name, char *value, unsigned long flags)
         if (!md) {
                 if (!(flags & CONF_MFLAGS_SILENT)) {
                         CONFerr(CONF_F_MODULE_RUN, CONF_R_UNKNOWN_MODULE_NAME);
-                        ERR_add_error_data(2, "module=", name);
+                        ERR_asprintf_error_data("module=%s", name);
                 }
                 return -1;
         }
@@ -220,12 +220,11 @@ module_run(const CONF *cnf, char *name, char *value, unsigned long flags)
 
         if (ret <= 0) {
                 if (!(flags & CONF_MFLAGS_SILENT)) {
-                        char rcode[DECIMAL_SIZE(ret) + 1];
                         CONFerr(CONF_F_MODULE_RUN,
                             CONF_R_MODULE_INITIALIZATION_ERROR);
-                        snprintf(rcode, sizeof rcode, "%-8d", ret);
-                        ERR_add_error_data(6, "module=", name, ", value=",
-                            value, ", retcode=", rcode);
+                        ERR_asprintf_error_data
+                            ("module=%s, value=%s, retcode=%-8d",
+                            name, value, ret);
                 }
         }
 
@@ -272,7 +271,7 @@ err:
         if (dso)
                 DSO_free(dso);
         CONFerr(CONF_F_MODULE_LOAD_DSO, errcode);
-        ERR_add_error_data(4, "module=", name, ", path=", path);
+        ERR_asprintf_error_data("module=%s, path=%s", name, path);
         return NULL;
 }
 
diff --git a/src/lib/libssl/src/crypto/dso/dso_dlfcn.c b/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
index ea4e4935aa..6cf9ab2667 100644
--- a/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
+++ b/src/lib/libssl/src/crypto/dso/dso_dlfcn.c
@@ -140,7 +140,8 @@ dlfcn_load(DSO *dso)
         ptr = dlopen(filename, flags);
         if (ptr == NULL) {
                 DSOerr(DSO_F_DLFCN_LOAD, DSO_R_LOAD_FAILED);
-                ERR_add_error_data(4, "filename(", filename, "): ", dlerror());
+                ERR_asprintf_error_data("filename(%s): %s", filename,
+                    dlerror());
                 goto err;
         }
         if (!sk_void_push(dso->meth_data, (char *)ptr)) {
@@ -204,7 +205,7 @@ dlfcn_bind_var(DSO *dso, const char *symname)
         sym = dlsym(ptr, symname);
         if (sym == NULL) {
                 DSOerr(DSO_F_DLFCN_BIND_VAR, DSO_R_SYM_FAILURE);
-                ERR_add_error_data(4, "symname(", symname, "): ", dlerror());
+                ERR_asprintf_error_data("symname(%s): %s", symname, dlerror());
                 return (NULL);
         }
         return (sym);
@@ -235,7 +236,7 @@ dlfcn_bind_func(DSO *dso, const char *symname)
         u.dlret = dlsym(ptr, symname);
         if (u.dlret == NULL) {
                 DSOerr(DSO_F_DLFCN_BIND_FUNC, DSO_R_SYM_FAILURE);
-                ERR_add_error_data(4, "symname(", symname, "): ", dlerror());
+                ERR_asprintf_error_data("symname(%s): %s", symname, dlerror());
                 return (NULL);
         }
         return u.sym;
@@ -348,7 +349,7 @@ dlfcn_pathbyaddr(void *addr, char *path, int sz)
                 return len;
         }
 
-        ERR_add_error_data(4, "dlfcn_pathbyaddr(): ", dlerror());
+        ERR_asprintf_error_data("dlfcn_pathbyaddr(): %s", dlerror());
         return -1;
 }
 
diff --git a/src/lib/libssl/src/crypto/engine/eng_cnf.c b/src/lib/libssl/src/crypto/engine/eng_cnf.c
index 95c4070015..afb704e93b 100644
--- a/src/lib/libssl/src/crypto/engine/eng_cnf.c
+++ b/src/lib/libssl/src/crypto/engine/eng_cnf.c
@@ -203,9 +203,9 @@ static int int_engine_configure(char *name, char *value, const CONF *cnf)
                 {
                 ENGINEerr(ENGINE_F_INT_ENGINE_CONFIGURE, ENGINE_R_ENGINE_CONFIGURATION_ERROR);
                 if (ecmd)
-                        ERR_add_error_data(6, "section=", ecmd->section, 
-                                                ", name=", ecmd->name,
-                                                ", value=", ecmd->value);
+                        ERR_asprintf_error_data
+                            ("section=%s, name=%s, value=%s",
+                            ecmd->section, ecmd->name, ecmd->value);
                 }
         if (e)
                 ENGINE_free(e);
diff --git a/src/lib/libssl/src/crypto/engine/eng_fat.c b/src/lib/libssl/src/crypto/engine/eng_fat.c
index 789b8d57e5..e01067566e 100644
--- a/src/lib/libssl/src/crypto/engine/eng_fat.c
+++ b/src/lib/libssl/src/crypto/engine/eng_fat.c
@@ -141,7 +141,7 @@ int ENGINE_set_default_string(ENGINE *e, const char *def_list)
                 {
                 ENGINEerr(ENGINE_F_ENGINE_SET_DEFAULT_STRING,
                                         ENGINE_R_INVALID_STRING);
-                ERR_add_error_data(2, "str=",def_list);
+                ERR_asprintf_error_data("str=%s",def_list);
                 return 0;
                 }
         return ENGINE_set_default(e, flags);
diff --git a/src/lib/libssl/src/crypto/engine/eng_list.c b/src/lib/libssl/src/crypto/engine/eng_list.c
index 95c858960b..5528b5478f 100644
--- a/src/lib/libssl/src/crypto/engine/eng_list.c
+++ b/src/lib/libssl/src/crypto/engine/eng_list.c
@@ -389,7 +389,7 @@ ENGINE *ENGINE_by_id(const char *id)
                 {
                 ENGINEerr(ENGINE_F_ENGINE_BY_ID,
                         ENGINE_R_NO_SUCH_ENGINE);
-                ERR_add_error_data(2, "id=", id);
+                ERR_asprintf_error_data("id=%s", id);
                 }
         return iterator;
 #else
@@ -416,7 +416,7 @@ ENGINE *ENGINE_by_id(const char *id)
 notfound:
         ENGINE_free(iterator);
         ENGINEerr(ENGINE_F_ENGINE_BY_ID,ENGINE_R_NO_SUCH_ENGINE);
-        ERR_add_error_data(2, "id=", id);
+        ERR_asprintf_error_data("id=%s", id);
         return NULL;
         /* EEK! Experimental code ends */
 #endif
diff --git a/src/lib/libssl/src/crypto/evp/evp_pbe.c b/src/lib/libssl/src/crypto/evp/evp_pbe.c
index 37a926c3fc..37683af76a 100644
--- a/src/lib/libssl/src/crypto/evp/evp_pbe.c
+++ b/src/lib/libssl/src/crypto/evp/evp_pbe.c
@@ -167,7 +167,7 @@ int EVP_PBE_CipherInit(ASN1_OBJECT *pbe_obj, const char *pass, int passlen,
                 EVPerr(EVP_F_EVP_PBE_CIPHERINIT,EVP_R_UNKNOWN_PBE_ALGORITHM);
                 if (!pbe_obj) strlcpy (obj_tmp, "NULL", sizeof obj_tmp);
                 else i2t_ASN1_OBJECT(obj_tmp, sizeof obj_tmp, pbe_obj);
-                ERR_add_error_data(2, "TYPE=", obj_tmp);
+                ERR_asprintf_error_data("TYPE=%s", obj_tmp);
                 return 0;
                 }
 
diff --git a/src/lib/libssl/src/crypto/evp/evp_pkey.c b/src/lib/libssl/src/crypto/evp/evp_pkey.c
index c760cf1965..94056f0da9 100644
--- a/src/lib/libssl/src/crypto/evp/evp_pkey.c
+++ b/src/lib/libssl/src/crypto/evp/evp_pkey.c
@@ -83,7 +83,7 @@ EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8)
                 {
                 EVPerr(EVP_F_EVP_PKCS82PKEY, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM);
                 i2t_ASN1_OBJECT(obj_tmp, 80, algoid);
-                ERR_add_error_data(2, "TYPE=", obj_tmp);
+                ERR_asprintf_error_data("TYPE=%s", obj_tmp);
                 goto error;
                 }
 
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c b/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
index 4bb6fce83c..b45eaf6767 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_ht.c
@@ -259,9 +259,9 @@ static int parse_http_line1(char *line)
                 {
                 OCSPerr(OCSP_F_PARSE_HTTP_LINE1, OCSP_R_SERVER_RESPONSE_ERROR);
                 if(!*q)
-                        ERR_add_error_data(2, "Code=", p);
+                        ERR_asprintf_error_data("Code=%s", p);
                 else
-                        ERR_add_error_data(4, "Code=", p, ",Reason=", q);
+                        ERR_asprintf_error_data("Code=%s,Reason=%s", p, q);
                 return 0;
                 }
 
diff --git a/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c b/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
index 276718304d..0b181d5abe 100644
--- a/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
+++ b/src/lib/libssl/src/crypto/ocsp/ocsp_vfy.c
@@ -122,9 +122,9 @@ int OCSP_basic_verify(OCSP_BASICRESP *bs, STACK_OF(X509) *certs,
                 X509_STORE_CTX_cleanup(&ctx);
                 if (ret <= 0)
                         {
-                        i = X509_STORE_CTX_get_error(&ctx);     
+                        i = X509_STORE_CTX_get_error(&ctx);
                         OCSPerr(OCSP_F_OCSP_BASIC_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR);
-                        ERR_add_error_data(2, "Verify error:",
+                        ERR_asprintf_error_data("Verify error:%s",
                                         X509_verify_cert_error_string(i));
                         goto end;
                         }
@@ -421,7 +421,7 @@ int OCSP_request_verify(OCSP_REQUEST *req, STACK_OF(X509) *certs, X509_STORE *st
                         {
                         ret = X509_STORE_CTX_get_error(&ctx);   
                         OCSPerr(OCSP_F_OCSP_REQUEST_VERIFY,OCSP_R_CERTIFICATE_VERIFY_ERROR);
-                        ERR_add_error_data(2, "Verify error:",
+                        ERR_asprintf_error_data("Verify error:%s",
                                         X509_verify_cert_error_string(ret));
                         return 0;
                         }
diff --git a/src/lib/libssl/src/crypto/pem/pem_lib.c b/src/lib/libssl/src/crypto/pem/pem_lib.c
index c670ac2acb..9bc2b27285 100644
--- a/src/lib/libssl/src/crypto/pem/pem_lib.c
+++ b/src/lib/libssl/src/crypto/pem/pem_lib.c
@@ -289,7 +289,7 @@ PEM_bytes_read_bio(unsigned char **pdata, long *plen, char **pnm,
                 if (!PEM_read_bio(bp, &nm, &header, &data, &len)) {
                         if (ERR_GET_REASON(ERR_peek_error()) ==
                             PEM_R_NO_START_LINE)
-                                ERR_add_error_data(2, "Expecting: ", name);
+                                ERR_asprintf_error_data("Expecting: %s", name);
                         return 0;
                 }
                 if (check_pem(nm, name))
diff --git a/src/lib/libssl/src/crypto/pkcs7/bio_ber.c b/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
index 04dc5c9b96..d787495a21 100644
--- a/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
+++ b/src/lib/libssl/src/crypto/pkcs7/bio_ber.c
@@ -155,7 +155,6 @@ static int ber_free(BIO *a)
 
 int bio_ber_get_header(BIO *bio, BIO_BER_CTX *ctx)
         {
-        char buf[64];
         int i,j,n;
         int ret;
         unsigned char *p;
@@ -215,8 +214,7 @@ int bio_ber_get_header(BIO *bio, BIO_BER_CTX *ctx)
         if ((ctx->tag  >= 0) && (ctx->tag != tag))
                 {
                 BIOerr(BIO_F_BIO_BER_GET_HEADER,BIO_R_TAG_MISMATCH);
-                sprintf(buf,"tag=%d, got %d",ctx->tag,tag);
-                ERR_add_error_data(1,buf);
+                ERR_asprintf_error_data("tag=%d, got %d", ctx->tag, tag);
                 return(-1);
                 }
         if (ret & 0x01)
diff --git a/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c b/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
index a5104f8d05..6d6bd46b62 100644
--- a/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
+++ b/src/lib/libssl/src/crypto/pkcs7/pk7_smime.c
@@ -340,7 +340,7 @@ int PKCS7_verify(PKCS7 *p7, STACK_OF(X509) *certs, X509_STORE *store,
                 X509_STORE_CTX_cleanup(&cert_ctx);
                 if (i <= 0) {
                         PKCS7err(PKCS7_F_PKCS7_VERIFY,PKCS7_R_CERTIFICATE_VERIFY_ERROR);
-                        ERR_add_error_data(2, "Verify error:",
+                        ERR_asprintf_error_data("Verify error:%s",
                                          X509_verify_cert_error_string(j));
                         sk_X509_free(signers);
                         return 0;
diff --git a/src/lib/libssl/src/crypto/ts/ts_conf.c b/src/lib/libssl/src/crypto/ts/ts_conf.c
index f8cf3b514c..12cce16bc8 100644
--- a/src/lib/libssl/src/crypto/ts/ts_conf.c
+++ b/src/lib/libssl/src/crypto/ts/ts_conf.c
@@ -239,7 +239,7 @@ err:
         if (!ret) {
                 TSerr(TS_F_TS_CONF_SET_DEFAULT_ENGINE,
                     TS_R_COULD_NOT_SET_ENGINE);
-                ERR_add_error_data(2, "engine:", name);
+                ERR_asprintf_error_data("engine:%s", name);
         }
         if (e)
                 ENGINE_free(e);
diff --git a/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c b/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c
index 66e35dab3a..2a4c0c5ef9 100644
--- a/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c
+++ b/src/lib/libssl/src/crypto/ts/ts_rsp_verify.c
@@ -244,7 +244,7 @@ TS_verify_cert(X509_STORE *store, STACK_OF(X509) *untrusted, X509 *signer,
         if (i <= 0) {
                 int j = X509_STORE_CTX_get_error(&cert_ctx);
                 TSerr(TS_F_TS_VERIFY_CERT, TS_R_CERTIFICATE_VERIFY_ERROR);
-                ERR_add_error_data(2, "Verify error:",
+                ERR_asprintf_error_data("Verify error:%s",
                     X509_verify_cert_error_string(j));
                 ret = 0;
         } else {
@@ -530,11 +530,11 @@ TS_check_status_info(TS_RESP *response)
 
         /* Making up the error string. */
         TSerr(TS_F_TS_CHECK_STATUS_INFO, TS_R_NO_TIME_STAMP_TOKEN);
-        ERR_add_error_data(6,
-            "status code: ", status_text,
-            ", status text: ", embedded_status_text ?
-            embedded_status_text : "unspecified",
-            ", failure codes: ", failure_text);
+        ERR_asprintf_error_data
+            ("status code: %s, status text: %s, failure codes: %s",
+            status_text,
+            embedded_status_text ? embedded_status_text : "unspecified",
+            failure_text);
         free(embedded_status_text);
 
         return 0;
diff --git a/src/lib/libssl/src/crypto/ui/ui_lib.c b/src/lib/libssl/src/crypto/ui/ui_lib.c
index ee76e5e64d..5335b59c48 100644
--- a/src/lib/libssl/src/crypto/ui/ui_lib.c
+++ b/src/lib/libssl/src/crypto/ui/ui_lib.c
@@ -827,31 +827,26 @@ UI_set_result(UI *ui, UI_STRING *uis, const char *result)
         switch (uis->type) {
         case UIT_PROMPT:
         case UIT_VERIFY:
-                {
-                        char number1[DECIMAL_SIZE(uis->_.string_data.result_minsize) + 1];
-                        char number2[DECIMAL_SIZE(uis->_.string_data.result_maxsize) + 1];
-
-                        (void) snprintf(number1, sizeof(number1), "%d",
-                            uis->_.string_data.result_minsize);
-                        (void) snprintf(number2, sizeof(number2), "%d",
-                            uis->_.string_data.result_maxsize);
-
-                        if (l < uis->_.string_data.result_minsize) {
-                                ui->flags |= UI_FLAG_REDOABLE;
-                                UIerr(UI_F_UI_SET_RESULT, UI_R_RESULT_TOO_SMALL);
-                                ERR_add_error_data(5, "You must type in ",
-                                    number1, " to ", number2, " characters");
-                                return -1;
-                        }
-                        if (l > uis->_.string_data.result_maxsize) {
-                                ui->flags |= UI_FLAG_REDOABLE;
-                                UIerr(UI_F_UI_SET_RESULT, UI_R_RESULT_TOO_LARGE);
-                                ERR_add_error_data(5, "You must type in ",
-                                    number1, " to ", number2, " characters");
-                                return -1;
-                        }
+                if (l < uis->_.string_data.result_minsize) {
+                        ui->flags |= UI_FLAG_REDOABLE;
+                        UIerr(UI_F_UI_SET_RESULT,
+                            UI_R_RESULT_TOO_SMALL);
+                        ERR_asprintf_error_data
+                            ("You must type in %d to %d characters",
+                                uis->_.string_data.result_minsize,
+                                uis->_.string_data.result_maxsize);
+                        return -1;
+                }
+                if (l > uis->_.string_data.result_maxsize) {
+                        ui->flags |= UI_FLAG_REDOABLE;
+                        UIerr(UI_F_UI_SET_RESULT,
+                            UI_R_RESULT_TOO_LARGE);
+                        ERR_asprintf_error_data
+                            ("You must type in %d to %d characters",
+                                uis->_.string_data.result_minsize,
+                                uis->_.string_data.result_maxsize);
+                        return -1;
                 }
-
                 if (!uis->result_buf) {
                         UIerr(UI_F_UI_SET_RESULT, UI_R_NO_RESULT_BUFFER);
                         return -1;
diff --git a/src/lib/libssl/src/crypto/x509/x509_att.c b/src/lib/libssl/src/crypto/x509/x509_att.c
index 5699568998..ef922c7c83 100644
--- a/src/lib/libssl/src/crypto/x509/x509_att.c
+++ b/src/lib/libssl/src/crypto/x509/x509_att.c
@@ -282,7 +282,7 @@ X509_ATTRIBUTE_create_by_txt(X509_ATTRIBUTE **attr, const char *atrname,
         if (obj == NULL) {
                 X509err(X509_F_X509_ATTRIBUTE_CREATE_BY_TXT,
                     X509_R_INVALID_FIELD_NAME);
-                ERR_add_error_data(2, "name=", atrname);
+                ERR_asprintf_error_data("name=%s", atrname);
                 return (NULL);
         }
         nattr = X509_ATTRIBUTE_create_by_OBJ(attr, obj, type, bytes, len);
diff --git a/src/lib/libssl/src/crypto/x509/x509name.c b/src/lib/libssl/src/crypto/x509/x509name.c
index 3d90fd67fe..32fce2debb 100644
--- a/src/lib/libssl/src/crypto/x509/x509name.c
+++ b/src/lib/libssl/src/crypto/x509/x509name.c
@@ -298,7 +298,7 @@ X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
         if (obj == NULL) {
                 X509err(X509_F_X509_NAME_ENTRY_CREATE_BY_TXT,
                     X509_R_INVALID_FIELD_NAME);
-                ERR_add_error_data(2, "name=", field);
+                ERR_asprintf_error_data("name=%s", field);
                 return (NULL);
         }
         nentry = X509_NAME_ENTRY_create_by_OBJ(ne, obj, type, bytes, len);
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_akey.c b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
index 6d5c576e23..a5d760d469 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_akey.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_akey.c
@@ -139,7 +139,7 @@ v2i_AUTHORITY_KEYID(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
                 } else {
                         X509V3err(X509V3_F_V2I_AUTHORITY_KEYID,
                             X509V3_R_UNKNOWN_OPTION);
-                        ERR_add_error_data(2, "name=", cnf->name);
+                        ERR_asprintf_error_data("name=%s", cnf->name);
                         return NULL;
                 }
         }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_alt.c b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
index e61ed673c0..61b0c90fad 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_alt.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
@@ -479,7 +479,7 @@ a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
                         if (!(obj = OBJ_txt2obj(value, 0))) {
                                 X509V3err(X509V3_F_A2I_GENERAL_NAME,
                                     X509V3_R_BAD_OBJECT);
-                                ERR_add_error_data(2, "value=", value);
+                                ERR_asprintf_error_data("value=%s", value);
                                 goto err;
                         }
                         gen->d.rid = obj;
@@ -494,7 +494,7 @@ a2i_GENERAL_NAME(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
                 if (gen->d.ip == NULL) {
                         X509V3err(X509V3_F_A2I_GENERAL_NAME,
                             X509V3_R_BAD_IP_ADDRESS);
-                        ERR_add_error_data(2, "value=", value);
+                        ERR_asprintf_error_data("value=%s", value);
                         goto err;
                 }
                 break;
@@ -572,7 +572,7 @@ v2i_GENERAL_NAME_ex(GENERAL_NAME *out, const X509V3_EXT_METHOD *method,
         else {
                 X509V3err(X509V3_F_V2I_GENERAL_NAME_EX,
                     X509V3_R_UNSUPPORTED_OPTION);
-                ERR_add_error_data(2, "name=", name);
+                ERR_asprintf_error_data("name=%s", name);
                 return NULL;
         }
 
@@ -620,7 +620,7 @@ do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
         sk = X509V3_get_section(ctx, value);
         if (!sk) {
                 X509V3err(X509V3_F_DO_DIRNAME, X509V3_R_SECTION_NOT_FOUND);
-                ERR_add_error_data(2, "section=", value);
+                ERR_asprintf_error_data("section=%s", value);
                 X509_NAME_free(nm);
                 return 0;
         }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_conf.c b/src/lib/libssl/src/crypto/x509v3/v3_conf.c
index daacf8d5df..e22aa50fcd 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_conf.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_conf.c
@@ -94,7 +94,7 @@ X509V3_EXT_nconf(CONF *conf, X509V3_CTX *ctx, char *name, char *value)
         if (!ret) {
                 X509V3err(X509V3_F_X509V3_EXT_NCONF,
                     X509V3_R_ERROR_IN_EXTENSION);
-                ERR_add_error_data(4, "name=", name, ", value=", value);
+                ERR_asprintf_error_data("name=%s, value=%s", name, value);
         }
         return ret;
 }
@@ -142,8 +142,8 @@ do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value)
                 if (sk_CONF_VALUE_num(nval) <= 0) {
                         X509V3err(X509V3_F_DO_EXT_NCONF,
                             X509V3_R_INVALID_EXTENSION_STRING);
-                        ERR_add_error_data(4, "name=", OBJ_nid2sn(ext_nid),
-                            ",section=", value);
+                        ERR_asprintf_error_data("name=%s,section=%s",
+                            OBJ_nid2sn(ext_nid), value);
                         return NULL;
                 }
                 ext_struc = method->v2i(method, ctx, nval);
@@ -165,7 +165,7 @@ do_ext_nconf(CONF *conf, X509V3_CTX *ctx, int ext_nid, int crit, char *value)
         } else {
                 X509V3err(X509V3_F_DO_EXT_NCONF,
                     X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED);
-                ERR_add_error_data(2, "name=", OBJ_nid2sn(ext_nid));
+                ERR_asprintf_error_data("name=%s", OBJ_nid2sn(ext_nid));
                 return NULL;
         }
 
@@ -283,7 +283,7 @@ v3_generic_extension(const char *ext, char *value, int crit, int gen_type,
         if (!(obj = OBJ_txt2obj(ext, 0))) {
                 X509V3err(X509V3_F_V3_GENERIC_EXTENSION,
                     X509V3_R_EXTENSION_NAME_ERROR);
-                ERR_add_error_data(2, "name=", ext);
+                ERR_asprintf_error_data("name=%s", ext);
                 goto err;
         }
 
@@ -295,7 +295,7 @@ v3_generic_extension(const char *ext, char *value, int crit, int gen_type,
         if (ext_der == NULL) {
                 X509V3err(X509V3_F_V3_GENERIC_EXTENSION,
                     X509V3_R_EXTENSION_VALUE_ERROR);
-                ERR_add_error_data(2, "value=", value);
+                ERR_asprintf_error_data("value=%s", value);
                 goto err;
         }
 
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_info.c b/src/lib/libssl/src/crypto/x509v3/v3_info.c
index 7853e3e23b..9ae1596b1f 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_info.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_info.c
@@ -184,12 +184,10 @@ v2i_AUTHORITY_INFO_ACCESS(X509V3_EXT_METHOD *method, X509V3_CTX *ctx,
                 if (!acc->method) {
                         X509V3err(X509V3_F_V2I_AUTHORITY_INFO_ACCESS,
                             X509V3_R_BAD_OBJECT);
-                        ERR_add_error_data(2, "value=", objtmp);
-                        free(objtmp);
+                        ERR_asprintf_error_data("value=%s", objtmp);
                         goto err;
                 }
                 free(objtmp);
-
         }
         return ainfo;
 
diff --git a/src/lib/libssl/src/crypto/x509v3/x509v3.h b/src/lib/libssl/src/crypto/x509v3/x509v3.h
index b308abe7cd..dda5344b33 100644
--- a/src/lib/libssl/src/crypto/x509v3/x509v3.h
+++ b/src/lib/libssl/src/crypto/x509v3/x509v3.h
@@ -379,8 +379,9 @@ struct ISSUING_DIST_POINT_st
 /* onlysomereasons present */
 #define IDP_REASONS     0x40
 
-#define X509V3_conf_err(val) ERR_add_error_data(6, "section:", val->section, \
-",name:", val->name, ",value:", val->value);
+#define X509V3_conf_err(val) ERR_asprintf_error_data( \
+                        "section:%s,name:%s,value:%s", val->section, \
+                        val->name, val->value);
 
 #define X509V3_set_ctx_test(ctx) \
                         X509V3_set_ctx(ctx, NULL, NULL, NULL, NULL, CTX_TEST)
diff --git a/src/lib/libssl/src/ssl/d1_pkt.c b/src/lib/libssl/src/ssl/d1_pkt.c
index 7cfada4e6b..c5bdb41b90 100644
--- a/src/lib/libssl/src/ssl/d1_pkt.c
+++ b/src/lib/libssl/src/ssl/d1_pkt.c
@@ -1109,13 +1109,11 @@ start:
 #endif
                 } else if (alert_level == 2) /* fatal */
                 {
-                        char tmp[16];
-
                         s->rwstate = SSL_NOTHING;
                         s->s3->fatal_alert = alert_descr;
                         SSLerr(SSL_F_DTLS1_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
-                        (void) snprintf(tmp,sizeof tmp,"%d",alert_descr);
-                        ERR_add_error_data(2, "SSL alert number ", tmp);
+                        ERR_asprintf_error_data("SSL alert number %d",
+                            alert_descr);
                         s->shutdown|=SSL_RECEIVED_SHUTDOWN;
                         SSL_CTX_remove_session(s->ctx, s->session);
                         return (0);
diff --git a/src/lib/libssl/src/ssl/s3_pkt.c b/src/lib/libssl/src/ssl/s3_pkt.c
index 68c3f1cb2b..4a8462ecb9 100644
--- a/src/lib/libssl/src/ssl/s3_pkt.c
+++ b/src/lib/libssl/src/ssl/s3_pkt.c
@@ -1169,13 +1169,11 @@ start:
 #endif
                 } else if (alert_level == 2) {
                         /* fatal */
-                        char tmp[16];
-
                         s->rwstate = SSL_NOTHING;
                         s->s3->fatal_alert = alert_descr;
                         SSLerr(SSL_F_SSL3_READ_BYTES, SSL_AD_REASON_OFFSET + alert_descr);
-                        (void) snprintf(tmp, sizeof tmp, "%d", alert_descr);
-                        ERR_add_error_data(2, "SSL alert number ", tmp);
+                        ERR_asprintf_error_data("SSL alert number %d",
+                            alert_descr);
                         s->shutdown|=SSL_RECEIVED_SHUTDOWN;
                         SSL_CTX_remove_session(s->ctx, s->session);
                         return (0);
diff --git a/src/lib/libssl/src/ssl/ssl_cert.c b/src/lib/libssl/src/ssl/ssl_cert.c
index b493585c58..1b9944cf92 100644
--- a/src/lib/libssl/src/ssl/ssl_cert.c
+++ b/src/lib/libssl/src/ssl/ssl_cert.c
@@ -783,7 +783,7 @@ SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
         }
         if (!ret) {
                 SYSerr(SYS_F_OPENDIR, errno);
-                ERR_add_error_data(3, "opendir ('", dir, "')");
+                ERR_asprintf_error_data("opendir ('%s')", dir);
                 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,
                     ERR_R_SYS_LIB);
         }
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index b493585c58..1b9944cf92 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -783,7 +783,7 @@ SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stack,
         }
         if (!ret) {
                 SYSerr(SYS_F_OPENDIR, errno);
-                ERR_add_error_data(3, "opendir ('", dir, "')");
+                ERR_asprintf_error_data("opendir ('%s')", dir);
                 SSLerr(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK,
                     ERR_R_SYS_LIB);
         }