14 files changed, 98 insertions, 72 deletions

diff --git a/src/lib/libcrypto/asn1/a_gentm.c b/src/lib/libcrypto/asn1/a_gentm.c
index cd09f68b38..48b923de1f 100644
--- a/src/lib/libcrypto/asn1/a_gentm.c
+++ b/src/lib/libcrypto/asn1/a_gentm.c
@@ -208,6 +208,7 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
         char *p;
         struct tm *ts;
         struct tm data;
+        size_t len = 20; 
 
         if (s == NULL)
                 s=M_ASN1_GENERALIZEDTIME_new();
@@ -219,17 +220,17 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
                 return(NULL);
 
         p=(char *)s->data;
-        if ((p == NULL) || (s->length < 16))
+        if ((p == NULL) || (s->length < len))
                 {
-                p=OPENSSL_malloc(20);
+                p=OPENSSL_malloc(len);
                 if (p == NULL) return(NULL);
                 if (s->data != NULL)
                         OPENSSL_free(s->data);
                 s->data=(unsigned char *)p;
                 }
 
-        sprintf(p,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
-                ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
+        snprintf(p,len,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
+                 ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
         s->length=strlen(p);
         s->type=V_ASN1_GENERALIZEDTIME;
 #ifdef CHARSET_EBCDIC_not
diff --git a/src/lib/libcrypto/asn1/a_utctm.c b/src/lib/libcrypto/asn1/a_utctm.c
index dbb4a42c9d..41f6d421bb 100644
--- a/src/lib/libcrypto/asn1/a_utctm.c
+++ b/src/lib/libcrypto/asn1/a_utctm.c
@@ -188,6 +188,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
         char *p;
         struct tm *ts;
         struct tm data;
+        size_t len = 20;
 
         if (s == NULL)
                 s=M_ASN1_UTCTIME_new();
@@ -199,17 +200,17 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
                 return(NULL);
 
         p=(char *)s->data;
-        if ((p == NULL) || (s->length < 14))
+        if ((p == NULL) || (s->length < len))
                 {
-                p=OPENSSL_malloc(20);
+                p=OPENSSL_malloc(len);
                 if (p == NULL) return(NULL);
                 if (s->data != NULL)
                         OPENSSL_free(s->data);
                 s->data=(unsigned char *)p;
                 }
 
-        sprintf(p,"%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
-                ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
+        snprintf(p,len,"%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
+                 ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
         s->length=strlen(p);
         s->type=V_ASN1_UTCTIME;
 #ifdef CHARSET_EBCDIC_not
diff --git a/src/lib/libcrypto/bio/b_sock.c b/src/lib/libcrypto/bio/b_sock.c
index 45bd7c47e8..7632c2d85e 100644
--- a/src/lib/libcrypto/bio/b_sock.c
+++ b/src/lib/libcrypto/bio/b_sock.c
@@ -697,12 +697,12 @@ int BIO_accept(int sock, char **addr)
                         }
                 *addr=p;
                 }
-        sprintf(*addr,"%d.%d.%d.%d:%d",
-                (unsigned char)(l>>24L)&0xff,
-                (unsigned char)(l>>16L)&0xff,
-                (unsigned char)(l>> 8L)&0xff,
-                (unsigned char)(l     )&0xff,
-                port);
+        snprintf(*addr,24,"%d.%d.%d.%d:%d",
+                 (unsigned char)(l>>24L)&0xff,
+                 (unsigned char)(l>>16L)&0xff,
+                 (unsigned char)(l>> 8L)&0xff,
+                 (unsigned char)(l     )&0xff,
+                 port);
 end:
         return(ret);
         }
diff --git a/src/lib/libcrypto/bio/bio_cb.c b/src/lib/libcrypto/bio/bio_cb.c
index 0ffa4d2136..ee9159ebd8 100644
--- a/src/lib/libcrypto/bio/bio_cb.c
+++ b/src/lib/libcrypto/bio/bio_cb.c
@@ -70,55 +70,61 @@ long MS_CALLBACK BIO_debug_callback(BIO *bio, int cmd, const char *argp,
         MS_STATIC char buf[256];
         char *p;
         long r=1;
+        size_t p_maxlen;
 
         if (BIO_CB_RETURN & cmd)
                 r=ret;
 
-        sprintf(buf,"BIO[%08lX]:",(unsigned long)bio);
+        snprintf(buf,sizeof buf,"BIO[%08lX]:",(unsigned long)bio);
         p= &(buf[14]);
+        p_maxlen = sizeof buf - 14;
         switch (cmd)
                 {
         case BIO_CB_FREE:
-                sprintf(p,"Free - %s\n",bio->method->name);
+                snprintf(p,p_maxlen,"Free - %s\n",bio->method->name);
                 break;
         case BIO_CB_READ:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"read(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        snprintf(p,p_maxlen,"read(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"read(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        snprintf(p,p_maxlen,"read(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_WRITE:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"write(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        snprintf(p,p_maxlen,"write(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"write(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        snprintf(p,p_maxlen,"write(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_PUTS:
-                sprintf(p,"puts() - %s\n",bio->method->name);
+                snprintf(p,p_maxlen,"puts() - %s\n",bio->method->name);
                 break;
         case BIO_CB_GETS:
-                sprintf(p,"gets(%d) - %s\n",argi,bio->method->name);
+                snprintf(p,p_maxlen,"gets(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_CTRL:
-                sprintf(p,"ctrl(%d) - %s\n",argi,bio->method->name);
+                snprintf(p,p_maxlen,"ctrl(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_RETURN|BIO_CB_READ:
-                sprintf(p,"read return %ld\n",ret);
+                snprintf(p,p_maxlen,"read return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_WRITE:
-                sprintf(p,"write return %ld\n",ret);
+                snprintf(p,p_maxlen,"write return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_GETS:
-                sprintf(p,"gets return %ld\n",ret);
+                snprintf(p,p_maxlen,"gets return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_PUTS:
-                sprintf(p,"puts return %ld\n",ret);
+                snprintf(p,p_maxlen,"puts return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_CTRL:
-                sprintf(p,"ctrl return %ld\n",ret);
+                snprintf(p,p_maxlen,"ctrl return %ld\n",ret);
                 break;
         default:
-                sprintf(p,"bio callback - unknown type (%d)\n",cmd);
+                snprintf(p,p_maxlen,"bio callback - unknown type (%d)\n",cmd);
                 break;
                 }
 
diff --git a/src/lib/libcrypto/bn/bn_print.c b/src/lib/libcrypto/bn/bn_print.c
index 5f46b1826c..e3b6aa235b 100644
--- a/src/lib/libcrypto/bn/bn_print.c
+++ b/src/lib/libcrypto/bn/bn_print.c
@@ -119,6 +119,7 @@ char *BN_bn2dec(const BIGNUM *a)
                 }
         if ((t=BN_dup(a)) == NULL) goto err;
 
+#define BUF_REMAIN (num+3 - (size_t)(p - buf))
         p=buf;
         lp=bn_data;
         if (t->neg) *(p++)='-';
@@ -139,12 +140,12 @@ char *BN_bn2dec(const BIGNUM *a)
                 /* We now have a series of blocks, BN_DEC_NUM chars
                  * in length, where the last one needs truncation.
                  * The blocks need to be reversed in order. */
-                sprintf(p,BN_DEC_FMT1,*lp);
+                snprintf(p,BUF_REMAIN,BN_DEC_FMT1,*lp);
                 while (*p) p++;
                 while (lp != bn_data)
                         {
                         lp--;
-                        sprintf(p,BN_DEC_FMT2,*lp);
+                        snprintf(p,BUF_REMAIN,BN_DEC_FMT2,*lp);
                         while (*p) p++;
                         }
                 }
diff --git a/src/lib/libcrypto/engine/eng_ctrl.c b/src/lib/libcrypto/engine/eng_ctrl.c
index ad3858395b..0d56e69d27 100644
--- a/src/lib/libcrypto/engine/eng_ctrl.c
+++ b/src/lib/libcrypto/engine/eng_ctrl.c
@@ -160,15 +160,19 @@ static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p, void (*f)())
         case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD:
                 return strlen(e->cmd_defns[idx].cmd_name);
         case ENGINE_CTRL_GET_NAME_FROM_CMD:
-                return sprintf(s, "%s", e->cmd_defns[idx].cmd_name);
+                return snprintf(s,strlen(e->cmd_defns[idx].cmd_name) + 1,
+                                "%s", e->cmd_defns[idx].cmd_name);
         case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD:
                 if(e->cmd_defns[idx].cmd_desc)
                         return strlen(e->cmd_defns[idx].cmd_desc);
                 return strlen(int_no_description);
         case ENGINE_CTRL_GET_DESC_FROM_CMD:
                 if(e->cmd_defns[idx].cmd_desc)
-                        return sprintf(s, "%s", e->cmd_defns[idx].cmd_desc);
-                return sprintf(s, "%s", int_no_description);
+                        return snprintf(s,
+                                        strlen(e->cmd_defns[idx].cmd_desc) + 1,
+                                        "%s", e->cmd_defns[idx].cmd_desc);
+                return snprintf(s, strlen(int_no_description) + 1,"%s",
+                                int_no_description);
         case ENGINE_CTRL_GET_CMD_FLAGS:
                 return e->cmd_defns[idx].cmd_flags;
                 }
diff --git a/src/lib/libcrypto/x509/by_dir.c b/src/lib/libcrypto/x509/by_dir.c
index 448bd7e69c..a5c306f1fd 100644
--- a/src/lib/libcrypto/x509/by_dir.c
+++ b/src/lib/libcrypto/x509/by_dir.c
@@ -302,8 +302,8 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                 k=0;
                 for (;;)
                         {
-                        sprintf(b->data,"%s/%08lx.%s%d",ctx->dirs[i],h,
-                                postfix,k);
+                        snprintf(b->data,b->max,"%s/%08lx.%s%d",ctx->dirs[i],h,
+                                 postfix,k);
                         k++;
                         if (stat(b->data,&st) < 0)
                                 break;
diff --git a/src/lib/libssl/src/crypto/asn1/a_gentm.c b/src/lib/libssl/src/crypto/asn1/a_gentm.c
index cd09f68b38..48b923de1f 100644
--- a/src/lib/libssl/src/crypto/asn1/a_gentm.c
+++ b/src/lib/libssl/src/crypto/asn1/a_gentm.c
@@ -208,6 +208,7 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
         char *p;
         struct tm *ts;
         struct tm data;
+        size_t len = 20; 
 
         if (s == NULL)
                 s=M_ASN1_GENERALIZEDTIME_new();
@@ -219,17 +220,17 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
                 return(NULL);
 
         p=(char *)s->data;
-        if ((p == NULL) || (s->length < 16))
+        if ((p == NULL) || (s->length < len))
                 {
-                p=OPENSSL_malloc(20);
+                p=OPENSSL_malloc(len);
                 if (p == NULL) return(NULL);
                 if (s->data != NULL)
                         OPENSSL_free(s->data);
                 s->data=(unsigned char *)p;
                 }
 
-        sprintf(p,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
-                ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
+        snprintf(p,len,"%04d%02d%02d%02d%02d%02dZ",ts->tm_year + 1900,
+                 ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
         s->length=strlen(p);
         s->type=V_ASN1_GENERALIZEDTIME;
 #ifdef CHARSET_EBCDIC_not
diff --git a/src/lib/libssl/src/crypto/asn1/a_utctm.c b/src/lib/libssl/src/crypto/asn1/a_utctm.c
index dbb4a42c9d..41f6d421bb 100644
--- a/src/lib/libssl/src/crypto/asn1/a_utctm.c
+++ b/src/lib/libssl/src/crypto/asn1/a_utctm.c
@@ -188,6 +188,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
         char *p;
         struct tm *ts;
         struct tm data;
+        size_t len = 20;
 
         if (s == NULL)
                 s=M_ASN1_UTCTIME_new();
@@ -199,17 +200,17 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
                 return(NULL);
 
         p=(char *)s->data;
-        if ((p == NULL) || (s->length < 14))
+        if ((p == NULL) || (s->length < len))
                 {
-                p=OPENSSL_malloc(20);
+                p=OPENSSL_malloc(len);
                 if (p == NULL) return(NULL);
                 if (s->data != NULL)
                         OPENSSL_free(s->data);
                 s->data=(unsigned char *)p;
                 }
 
-        sprintf(p,"%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
-                ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
+        snprintf(p,len,"%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
+                 ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
         s->length=strlen(p);
         s->type=V_ASN1_UTCTIME;
 #ifdef CHARSET_EBCDIC_not
diff --git a/src/lib/libssl/src/crypto/bio/b_sock.c b/src/lib/libssl/src/crypto/bio/b_sock.c
index 45bd7c47e8..7632c2d85e 100644
--- a/src/lib/libssl/src/crypto/bio/b_sock.c
+++ b/src/lib/libssl/src/crypto/bio/b_sock.c
@@ -697,12 +697,12 @@ int BIO_accept(int sock, char **addr)
                         }
                 *addr=p;
                 }
-        sprintf(*addr,"%d.%d.%d.%d:%d",
-                (unsigned char)(l>>24L)&0xff,
-                (unsigned char)(l>>16L)&0xff,
-                (unsigned char)(l>> 8L)&0xff,
-                (unsigned char)(l     )&0xff,
-                port);
+        snprintf(*addr,24,"%d.%d.%d.%d:%d",
+                 (unsigned char)(l>>24L)&0xff,
+                 (unsigned char)(l>>16L)&0xff,
+                 (unsigned char)(l>> 8L)&0xff,
+                 (unsigned char)(l     )&0xff,
+                 port);
 end:
         return(ret);
         }
diff --git a/src/lib/libssl/src/crypto/bio/bio_cb.c b/src/lib/libssl/src/crypto/bio/bio_cb.c
index 0ffa4d2136..ee9159ebd8 100644
--- a/src/lib/libssl/src/crypto/bio/bio_cb.c
+++ b/src/lib/libssl/src/crypto/bio/bio_cb.c
@@ -70,55 +70,61 @@ long MS_CALLBACK BIO_debug_callback(BIO *bio, int cmd, const char *argp,
         MS_STATIC char buf[256];
         char *p;
         long r=1;
+        size_t p_maxlen;
 
         if (BIO_CB_RETURN & cmd)
                 r=ret;
 
-        sprintf(buf,"BIO[%08lX]:",(unsigned long)bio);
+        snprintf(buf,sizeof buf,"BIO[%08lX]:",(unsigned long)bio);
         p= &(buf[14]);
+        p_maxlen = sizeof buf - 14;
         switch (cmd)
                 {
         case BIO_CB_FREE:
-                sprintf(p,"Free - %s\n",bio->method->name);
+                snprintf(p,p_maxlen,"Free - %s\n",bio->method->name);
                 break;
         case BIO_CB_READ:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"read(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        snprintf(p,p_maxlen,"read(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"read(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        snprintf(p,p_maxlen,"read(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_WRITE:
                 if (bio->method->type & BIO_TYPE_DESCRIPTOR)
-                        sprintf(p,"write(%d,%d) - %s fd=%d\n",bio->num,argi,bio->method->name,bio->num);
+                        snprintf(p,p_maxlen,"write(%d,%d) - %s fd=%d\n",
+                                 bio->num,argi,bio->method->name,bio->num);
                 else
-                        sprintf(p,"write(%d,%d) - %s\n",bio->num,argi,bio->method->name);
+                        snprintf(p,p_maxlen,"write(%d,%d) - %s\n",
+                                 bio->num,argi,bio->method->name);
                 break;
         case BIO_CB_PUTS:
-                sprintf(p,"puts() - %s\n",bio->method->name);
+                snprintf(p,p_maxlen,"puts() - %s\n",bio->method->name);
                 break;
         case BIO_CB_GETS:
-                sprintf(p,"gets(%d) - %s\n",argi,bio->method->name);
+                snprintf(p,p_maxlen,"gets(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_CTRL:
-                sprintf(p,"ctrl(%d) - %s\n",argi,bio->method->name);
+                snprintf(p,p_maxlen,"ctrl(%d) - %s\n",argi,bio->method->name);
                 break;
         case BIO_CB_RETURN|BIO_CB_READ:
-                sprintf(p,"read return %ld\n",ret);
+                snprintf(p,p_maxlen,"read return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_WRITE:
-                sprintf(p,"write return %ld\n",ret);
+                snprintf(p,p_maxlen,"write return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_GETS:
-                sprintf(p,"gets return %ld\n",ret);
+                snprintf(p,p_maxlen,"gets return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_PUTS:
-                sprintf(p,"puts return %ld\n",ret);
+                snprintf(p,p_maxlen,"puts return %ld\n",ret);
                 break;
         case BIO_CB_RETURN|BIO_CB_CTRL:
-                sprintf(p,"ctrl return %ld\n",ret);
+                snprintf(p,p_maxlen,"ctrl return %ld\n",ret);
                 break;
         default:
-                sprintf(p,"bio callback - unknown type (%d)\n",cmd);
+                snprintf(p,p_maxlen,"bio callback - unknown type (%d)\n",cmd);
                 break;
                 }
 
diff --git a/src/lib/libssl/src/crypto/bn/bn_print.c b/src/lib/libssl/src/crypto/bn/bn_print.c
index 5f46b1826c..e3b6aa235b 100644
--- a/src/lib/libssl/src/crypto/bn/bn_print.c
+++ b/src/lib/libssl/src/crypto/bn/bn_print.c
@@ -119,6 +119,7 @@ char *BN_bn2dec(const BIGNUM *a)
                 }
         if ((t=BN_dup(a)) == NULL) goto err;
 
+#define BUF_REMAIN (num+3 - (size_t)(p - buf))
         p=buf;
         lp=bn_data;
         if (t->neg) *(p++)='-';
@@ -139,12 +140,12 @@ char *BN_bn2dec(const BIGNUM *a)
                 /* We now have a series of blocks, BN_DEC_NUM chars
                  * in length, where the last one needs truncation.
                  * The blocks need to be reversed in order. */
-                sprintf(p,BN_DEC_FMT1,*lp);
+                snprintf(p,BUF_REMAIN,BN_DEC_FMT1,*lp);
                 while (*p) p++;
                 while (lp != bn_data)
                         {
                         lp--;
-                        sprintf(p,BN_DEC_FMT2,*lp);
+                        snprintf(p,BUF_REMAIN,BN_DEC_FMT2,*lp);
                         while (*p) p++;
                         }
                 }
diff --git a/src/lib/libssl/src/crypto/engine/eng_ctrl.c b/src/lib/libssl/src/crypto/engine/eng_ctrl.c
index ad3858395b..0d56e69d27 100644
--- a/src/lib/libssl/src/crypto/engine/eng_ctrl.c
+++ b/src/lib/libssl/src/crypto/engine/eng_ctrl.c
@@ -160,15 +160,19 @@ static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p, void (*f)())
         case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD:
                 return strlen(e->cmd_defns[idx].cmd_name);
         case ENGINE_CTRL_GET_NAME_FROM_CMD:
-                return sprintf(s, "%s", e->cmd_defns[idx].cmd_name);
+                return snprintf(s,strlen(e->cmd_defns[idx].cmd_name) + 1,
+                                "%s", e->cmd_defns[idx].cmd_name);
         case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD:
                 if(e->cmd_defns[idx].cmd_desc)
                         return strlen(e->cmd_defns[idx].cmd_desc);
                 return strlen(int_no_description);
         case ENGINE_CTRL_GET_DESC_FROM_CMD:
                 if(e->cmd_defns[idx].cmd_desc)
-                        return sprintf(s, "%s", e->cmd_defns[idx].cmd_desc);
-                return sprintf(s, "%s", int_no_description);
+                        return snprintf(s,
+                                        strlen(e->cmd_defns[idx].cmd_desc) + 1,
+                                        "%s", e->cmd_defns[idx].cmd_desc);
+                return snprintf(s, strlen(int_no_description) + 1,"%s",
+                                int_no_description);
         case ENGINE_CTRL_GET_CMD_FLAGS:
                 return e->cmd_defns[idx].cmd_flags;
                 }
diff --git a/src/lib/libssl/src/crypto/x509/by_dir.c b/src/lib/libssl/src/crypto/x509/by_dir.c
index 448bd7e69c..a5c306f1fd 100644
--- a/src/lib/libssl/src/crypto/x509/by_dir.c
+++ b/src/lib/libssl/src/crypto/x509/by_dir.c
@@ -302,8 +302,8 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
                 k=0;
                 for (;;)
                         {
-                        sprintf(b->data,"%s/%08lx.%s%d",ctx->dirs[i],h,
-                                postfix,k);
+                        snprintf(b->data,b->max,"%s/%08lx.%s%d",ctx->dirs[i],h,
+                                 postfix,k);
                         k++;
                         if (stat(b->data,&st) < 0)
                                 break;