26 files changed, 130 insertions, 94 deletions

diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
index 5d981c6553..58b437bc84 100644
--- a/src/lib/libcrypto/asn1/a_mbstr.c
+++ b/src/lib/libcrypto/asn1/a_mbstr.c
@@ -145,14 +145,14 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
         if((minsize > 0) && (nchar < minsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
-                sprintf(strbuf, "%ld", minsize);
+                snprintf(strbuf, sizeof strbuf, "%ld", minsize);
                 ERR_add_error_data(2, "minsize=", strbuf);
                 return -1;
         }
 
         if((maxsize > 0) && (nchar > maxsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
-                sprintf(strbuf, "%ld", maxsize);
+                snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
                 ERR_add_error_data(2, "maxsize=", strbuf);
                 return -1;
         }
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 0638870ab7..60f36bb958 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -412,8 +412,8 @@ void asn1_add_error(unsigned char *address, int offset)
         {
         char buf1[DECIMAL_SIZE(address)+1],buf2[DECIMAL_SIZE(offset)+1];
 
-        sprintf(buf1,"%lu",(unsigned long)address);
-        sprintf(buf2,"%d",offset);
+        snprintf(buf1,sizeof buf1,"%lu",(unsigned long)address);
+        snprintf(buf2,sizeof buf2,"%d",offset);
         ERR_add_error_data(4,"address=",buf1," offset=",buf2);
         }
 
diff --git a/src/lib/libcrypto/asn1/asn1_par.c b/src/lib/libcrypto/asn1/asn1_par.c
index facfdd27fc..4223c9ae45 100644
--- a/src/lib/libcrypto/asn1/asn1_par.c
+++ b/src/lib/libcrypto/asn1/asn1_par.c
@@ -88,11 +88,11 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
 
         p=str;
         if ((xclass & V_ASN1_PRIVATE) == V_ASN1_PRIVATE)
-                sprintf(str,"priv [ %d ] ",tag);
+                snprintf(str,sizeof str,"priv [ %d ] ",tag);
         else if ((xclass & V_ASN1_CONTEXT_SPECIFIC) == V_ASN1_CONTEXT_SPECIFIC)
-                sprintf(str,"cont [ %d ]",tag);
+                snprintf(str,sizeof str,"cont [ %d ]",tag);
         else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
-                sprintf(str,"appl [ %d ]",tag);
+                snprintf(str,sizeof str,"appl [ %d ]",tag);
         else p = ASN1_tag2str(tag);
 
         if (p2 != NULL)
diff --git a/src/lib/libcrypto/asn1/t_req.c b/src/lib/libcrypto/asn1/t_req.c
index 739f272ecf..eca97e00cb 100644
--- a/src/lib/libcrypto/asn1/t_req.c
+++ b/src/lib/libcrypto/asn1/t_req.c
@@ -116,7 +116,8 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
                 l=0;
                 for (i=0; i<ri->version->length; i++)
                         { l<<=8; l+=ri->version->data[i]; }
-                sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l);
+                snprintf(str,sizeof str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,
+                         l,neg,l);
                 if (BIO_puts(bp,str) <= 0) goto err;
                 }
         if(!(cflag & X509_FLAG_NO_SUBJECT))
@@ -168,13 +169,13 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
         if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
                 {
                 /* may not be */
-                sprintf(str,"%8sAttributes:\n","");
+                snprintf(str,sizeof str,"%8sAttributes:\n","");
                 if (BIO_puts(bp,str) <= 0) goto err;
 
                 sk=x->req_info->attributes;
                 if (sk_X509_ATTRIBUTE_num(sk) == 0)
                         {
-                        sprintf(str,"%12sa0:00\n","");
+                        snprintf(str,sizeof str,"%12sa0:00\n","");
                         if (BIO_puts(bp,str) <= 0) goto err;
                         }
                 else
@@ -190,7 +191,7 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
                                 a=sk_X509_ATTRIBUTE_value(sk,i);
                                 if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
                                                                         continue;
-                                sprintf(str,"%12s","");
+                                snprintf(str,sizeof str,"%12s","");
                                 if (BIO_puts(bp,str) <= 0) goto err;
                                 if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
                                 {
diff --git a/src/lib/libcrypto/bio/bss_conn.c b/src/lib/libcrypto/bio/bss_conn.c
index f91ae4c8c6..81f27dba4c 100644
--- a/src/lib/libcrypto/bio/bss_conn.c
+++ b/src/lib/libcrypto/bio/bss_conn.c
@@ -521,8 +521,8 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                 char buf[16];
                                 char *p = ptr;
 
-                                sprintf(buf,"%d.%d.%d.%d",
-                                        p[0],p[1],p[2],p[3]);
+                                snprintf(buf,sizeof buf,"%d.%d.%d.%d",
+                                         p[0],p[1],p[2],p[3]);
                                 if (data->param_hostname != NULL)
                                         OPENSSL_free(data->param_hostname);
                                 data->param_hostname=BUF_strdup(buf);
@@ -532,7 +532,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                 {
                                 char buf[16];
 
-                                sprintf(buf,"%d",*(int *)ptr);
+                                snprintf(buf,sizeof buf,"%d",*(int *)ptr);
                                 if (data->param_port != NULL)
                                         OPENSSL_free(data->param_port);
                                 data->param_port=BUF_strdup(buf);
diff --git a/src/lib/libcrypto/bn/bn_lib.c b/src/lib/libcrypto/bn/bn_lib.c
index 8abe095af2..ce2ae78419 100644
--- a/src/lib/libcrypto/bn/bn_lib.c
+++ b/src/lib/libcrypto/bn/bn_lib.c
@@ -145,10 +145,10 @@ char *BN_options(void)
                 {
                 init++;
 #ifdef BN_LLONG
-                sprintf(data,"bn(%d,%d)",(int)sizeof(BN_ULLONG)*8,
+                snprintf(data,sizeof data,"bn(%d,%d)",(int)sizeof(BN_ULLONG)*8,
                         (int)sizeof(BN_ULONG)*8);
 #else
-                sprintf(data,"bn(%d,%d)",(int)sizeof(BN_ULONG)*8,
+                snprintf(data,sizeof data,"bn(%d,%d)",(int)sizeof(BN_ULONG)*8,
                         (int)sizeof(BN_ULONG)*8);
 #endif
                 }
diff --git a/src/lib/libcrypto/conf/conf_def.c b/src/lib/libcrypto/conf/conf_def.c
index 37925b603d..48ff6f1120 100644
--- a/src/lib/libcrypto/conf/conf_def.c
+++ b/src/lib/libcrypto/conf/conf_def.c
@@ -445,7 +445,7 @@ err:
         if (buff != NULL) BUF_MEM_free(buff);
         if (section != NULL) OPENSSL_free(section);
         if (line != NULL) *line=eline;
-        sprintf(btmp,"%ld",eline);
+        snprintf(btmp,sizeof btmp,"%ld",eline);
         ERR_add_error_data(2,"line ",btmp);
         if ((h != conf->data) && (conf->data != NULL))
                 {
diff --git a/src/lib/libcrypto/conf/conf_mod.c b/src/lib/libcrypto/conf/conf_mod.c
index 8270ae5eb5..5a747e8c84 100644
--- a/src/lib/libcrypto/conf/conf_mod.c
+++ b/src/lib/libcrypto/conf/conf_mod.c
@@ -232,7 +232,7 @@ static int module_run(const CONF *cnf, char *name, char *value,
                         {
                         char rcode[DECIMAL_SIZE(ret)+1];
                         CONFerr(CONF_F_CONF_MODULES_LOAD, CONF_R_MODULE_INITIALIZATION_ERROR);
-                        sprintf(rcode, "%-8d", ret);
+                        snprintf(rcode, sizeof rcode, "%-8d", ret);
                         ERR_add_error_data(6, "module=", name, ", value=", value, ", retcode=", rcode);
                         }
                 }
diff --git a/src/lib/libcrypto/des/ecb_enc.c b/src/lib/libcrypto/des/ecb_enc.c
index 1b70f68806..c828bdd45d 100644
--- a/src/lib/libcrypto/des/ecb_enc.c
+++ b/src/lib/libcrypto/des/ecb_enc.c
@@ -97,7 +97,8 @@ const char *DES_options(void)
                         size="int";
                 else
                         size="long";
-                sprintf(buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,size);
+                snprintf(buf,sizeof buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,
+                         size);
                 init=0;
                 }
         return(buf);
diff --git a/src/lib/libcrypto/lhash/lh_stats.c b/src/lib/libcrypto/lhash/lh_stats.c
index 39ea2885f4..8e6f57c741 100644
--- a/src/lib/libcrypto/lhash/lh_stats.c
+++ b/src/lib/libcrypto/lhash/lh_stats.c
@@ -181,46 +181,60 @@ void lh_stats_bio(const LHASH *lh, BIO *out)
         {
         char buf[128];
 
-        sprintf(buf,"num_items             = %lu\n",lh->num_items);
+        snprintf(buf,sizeof buf,"num_items             = %lu\n",lh->num_items);
         BIO_puts(out,buf);
-        sprintf(buf,"num_nodes             = %u\n",lh->num_nodes);
+        snprintf(buf,sizeof buf,"num_nodes             = %u\n",lh->num_nodes);
         BIO_puts(out,buf);
-        sprintf(buf,"num_alloc_nodes       = %u\n",lh->num_alloc_nodes);
+        snprintf(buf,sizeof buf,"num_alloc_nodes       = %u\n",
+                 lh->num_alloc_nodes);
         BIO_puts(out,buf);
-        sprintf(buf,"num_expands           = %lu\n",lh->num_expands);
+        snprintf(buf,sizeof buf,"num_expands           = %lu\n",
+                 lh->num_expands);
         BIO_puts(out,buf);
-        sprintf(buf,"num_expand_reallocs   = %lu\n",lh->num_expand_reallocs);
+        snprintf(buf,sizeof buf,"num_expand_reallocs   = %lu\n",
+                 lh->num_expand_reallocs);
         BIO_puts(out,buf);
-        sprintf(buf,"num_contracts         = %lu\n",lh->num_contracts);
+        snprintf(buf,sizeof buf,"num_contracts         = %lu\n",
+                 lh->num_contracts);
         BIO_puts(out,buf);
-        sprintf(buf,"num_contract_reallocs = %lu\n",lh->num_contract_reallocs);
+        snprintf(buf,sizeof buf,"num_contract_reallocs = %lu\n",
+                 lh->num_contract_reallocs);
         BIO_puts(out,buf);
-        sprintf(buf,"num_hash_calls        = %lu\n",lh->num_hash_calls);
+        snprintf(buf,sizeof buf,"num_hash_calls        = %lu\n",
+                 lh->num_hash_calls);
         BIO_puts(out,buf);
-        sprintf(buf,"num_comp_calls        = %lu\n",lh->num_comp_calls);
+        snprintf(buf,sizeof buf,"num_comp_calls        = %lu\n",
+                 lh->num_comp_calls);
         BIO_puts(out,buf);
-        sprintf(buf,"num_insert            = %lu\n",lh->num_insert);
+        snprintf(buf,sizeof buf,"num_insert            = %lu\n",
+                 lh->num_insert);
         BIO_puts(out,buf);
-        sprintf(buf,"num_replace           = %lu\n",lh->num_replace);
+        snprintf(buf,sizeof buf,"num_replace           = %lu\n",
+                 lh->num_replace);
         BIO_puts(out,buf);
-        sprintf(buf,"num_delete            = %lu\n",lh->num_delete);
+        snprintf(buf,sizeof buf,"num_delete            = %lu\n",
+                 lh->num_delete);
         BIO_puts(out,buf);
-        sprintf(buf,"num_no_delete         = %lu\n",lh->num_no_delete);
+        snprintf(buf,sizeof buf,"num_no_delete         = %lu\n",
+                 lh->num_no_delete);
         BIO_puts(out,buf);
-        sprintf(buf,"num_retrieve          = %lu\n",lh->num_retrieve);
+        snprintf(buf,sizeof buf,"num_retrieve          = %lu\n",
+                 lh->num_retrieve);
         BIO_puts(out,buf);
-        sprintf(buf,"num_retrieve_miss     = %lu\n",lh->num_retrieve_miss);
+        snprintf(buf,sizeof buf,"num_retrieve_miss     = %lu\n",
+                 lh->num_retrieve_miss);
         BIO_puts(out,buf);
-        sprintf(buf,"num_hash_comps        = %lu\n",lh->num_hash_comps);
+        snprintf(buf,sizeof buf,"num_hash_comps        = %lu\n",
+                 lh->num_hash_comps);
         BIO_puts(out,buf);
 #if 0
-        sprintf(buf,"p                     = %u\n",lh->p);
+        snprintf(buf,sizeof buf,"p                     = %u\n",lh->p);
         BIO_puts(out,buf);
-        sprintf(buf,"pmax                  = %u\n",lh->pmax);
+        snprintf(buf,sizeof buf,"pmax                  = %u\n",lh->pmax);
         BIO_puts(out,buf);
-        sprintf(buf,"up_load               = %lu\n",lh->up_load);
+        snprintf(buf,sizeof buf,"up_load               = %lu\n",lh->up_load);
         BIO_puts(out,buf);
-        sprintf(buf,"down_load             = %lu\n",lh->down_load);
+        snprintf(buf,sizeof buf,"down_load             = %lu\n",lh->down_load);
         BIO_puts(out,buf);
 #endif
         }
@@ -235,7 +249,7 @@ void lh_node_stats_bio(const LHASH *lh, BIO *out)
                 {
                 for (n=lh->b[i],num=0; n != NULL; n=n->next)
                         num++;
-                sprintf(buf,"node %6u -> %3u\n",i,num);
+                snprintf(buf,sizeof buf,"node %6u -> %3u\n",i,num);
                 BIO_puts(out,buf);
                 }
         }
@@ -258,12 +272,13 @@ void lh_node_usage_stats_bio(const LHASH *lh, BIO *out)
                         total+=num;
                         }
                 }
-        sprintf(buf,"%lu nodes used out of %u\n",n_used,lh->num_nodes);
+        snprintf(buf,sizeof buf,"%lu nodes used out of %u\n",n_used,
+                 lh->num_nodes);
         BIO_puts(out,buf);
-        sprintf(buf,"%lu items\n",total);
+        snprintf(buf,sizeof buf,"%lu items\n",total);
         BIO_puts(out,buf);
         if (n_used == 0) return;
-        sprintf(buf,"load %d.%02d  actual load %d.%02d\n",
+        snprintf(buf,sizeof buf,"load %d.%02d  actual load %d.%02d\n",
                 (int)(total/lh->num_nodes),
                 (int)((total%lh->num_nodes)*100/lh->num_nodes),
                 (int)(total/n_used),
diff --git a/src/lib/libcrypto/objects/obj_dat.c b/src/lib/libcrypto/objects/obj_dat.c
index ce779dc1b5..202bd168ac 100644
--- a/src/lib/libcrypto/objects/obj_dat.c
+++ b/src/lib/libcrypto/objects/obj_dat.c
@@ -462,7 +462,7 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
                 if (i > 2) i=2;
                 l-=(long)(i*40);
 
-                sprintf(tbuf,"%d.%lu",i,l);
+                snprintf(tbuf,sizeof tbuf,"%d.%lu",i,l);
                 i=strlen(tbuf);
                 strncpy(buf,tbuf,buf_len);
                 buf_len-=i;
@@ -473,7 +473,7 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
                 for (; idx<len; idx++) {
                         l|=p[idx]&0x7f;
                         if (!(p[idx] & 0x80)) {
-                                sprintf(tbuf,".%lu",l);
+                                snprintf(tbuf,sizeof tbuf,".%lu",l);
                                 i=strlen(tbuf);
                                 if (buf_len > 0)
                                         strncpy(buf,tbuf,buf_len);
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
index 4f83db8ba2..9d09ae17e8 100644
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ b/src/lib/libcrypto/x509/x509_txt.c
@@ -148,7 +148,7 @@ const char *X509_verify_cert_error_string(long n)
                 return("unhandled critical extension");
 
         default:
-                sprintf(buf,"error number %ld",n);
+                snprintf(buf,sizeof buf,"error number %ld",n);
                 return(buf);
                 }
         }
diff --git a/src/lib/libcrypto/x509v3/v3_alt.c b/src/lib/libcrypto/x509v3/v3_alt.c
index 0e9e7dcb4f..0fae31a3a6 100644
--- a/src/lib/libcrypto/x509v3/v3_alt.c
+++ b/src/lib/libcrypto/x509v3/v3_alt.c
@@ -137,7 +137,8 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
                         X509V3_add_value("IP Address","<invalid>", &ret);
                         break;
                 }
-                sprintf(oline, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
+                snprintf(oline, sizeof oline, "%d.%d.%d.%d", p[0], p[1], p[2],
+                         p[3]);
                 X509V3_add_value("IP Address",oline, &ret);
                 break;
 
diff --git a/src/lib/libssl/src/crypto/asn1/a_mbstr.c b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
index 5d981c6553..58b437bc84 100644
--- a/src/lib/libssl/src/crypto/asn1/a_mbstr.c
+++ b/src/lib/libssl/src/crypto/asn1/a_mbstr.c
@@ -145,14 +145,14 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
         if((minsize > 0) && (nchar < minsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
-                sprintf(strbuf, "%ld", minsize);
+                snprintf(strbuf, sizeof strbuf, "%ld", minsize);
                 ERR_add_error_data(2, "minsize=", strbuf);
                 return -1;
         }
 
         if((maxsize > 0) && (nchar > maxsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
-                sprintf(strbuf, "%ld", maxsize);
+                snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
                 ERR_add_error_data(2, "maxsize=", strbuf);
                 return -1;
         }
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_lib.c b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
index 0638870ab7..60f36bb958 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_lib.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_lib.c
@@ -412,8 +412,8 @@ void asn1_add_error(unsigned char *address, int offset)
         {
         char buf1[DECIMAL_SIZE(address)+1],buf2[DECIMAL_SIZE(offset)+1];
 
-        sprintf(buf1,"%lu",(unsigned long)address);
-        sprintf(buf2,"%d",offset);
+        snprintf(buf1,sizeof buf1,"%lu",(unsigned long)address);
+        snprintf(buf2,sizeof buf2,"%d",offset);
         ERR_add_error_data(4,"address=",buf1," offset=",buf2);
         }
 
diff --git a/src/lib/libssl/src/crypto/asn1/asn1_par.c b/src/lib/libssl/src/crypto/asn1/asn1_par.c
index facfdd27fc..4223c9ae45 100644
--- a/src/lib/libssl/src/crypto/asn1/asn1_par.c
+++ b/src/lib/libssl/src/crypto/asn1/asn1_par.c
@@ -88,11 +88,11 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
 
         p=str;
         if ((xclass & V_ASN1_PRIVATE) == V_ASN1_PRIVATE)
-                sprintf(str,"priv [ %d ] ",tag);
+                snprintf(str,sizeof str,"priv [ %d ] ",tag);
         else if ((xclass & V_ASN1_CONTEXT_SPECIFIC) == V_ASN1_CONTEXT_SPECIFIC)
-                sprintf(str,"cont [ %d ]",tag);
+                snprintf(str,sizeof str,"cont [ %d ]",tag);
         else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
-                sprintf(str,"appl [ %d ]",tag);
+                snprintf(str,sizeof str,"appl [ %d ]",tag);
         else p = ASN1_tag2str(tag);
 
         if (p2 != NULL)
diff --git a/src/lib/libssl/src/crypto/asn1/t_req.c b/src/lib/libssl/src/crypto/asn1/t_req.c
index 739f272ecf..eca97e00cb 100644
--- a/src/lib/libssl/src/crypto/asn1/t_req.c
+++ b/src/lib/libssl/src/crypto/asn1/t_req.c
@@ -116,7 +116,8 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
                 l=0;
                 for (i=0; i<ri->version->length; i++)
                         { l<<=8; l+=ri->version->data[i]; }
-                sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l);
+                snprintf(str,sizeof str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,
+                         l,neg,l);
                 if (BIO_puts(bp,str) <= 0) goto err;
                 }
         if(!(cflag & X509_FLAG_NO_SUBJECT))
@@ -168,13 +169,13 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
         if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
                 {
                 /* may not be */
-                sprintf(str,"%8sAttributes:\n","");
+                snprintf(str,sizeof str,"%8sAttributes:\n","");
                 if (BIO_puts(bp,str) <= 0) goto err;
 
                 sk=x->req_info->attributes;
                 if (sk_X509_ATTRIBUTE_num(sk) == 0)
                         {
-                        sprintf(str,"%12sa0:00\n","");
+                        snprintf(str,sizeof str,"%12sa0:00\n","");
                         if (BIO_puts(bp,str) <= 0) goto err;
                         }
                 else
@@ -190,7 +191,7 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
                                 a=sk_X509_ATTRIBUTE_value(sk,i);
                                 if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
                                                                         continue;
-                                sprintf(str,"%12s","");
+                                snprintf(str,sizeof str,"%12s","");
                                 if (BIO_puts(bp,str) <= 0) goto err;
                                 if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
                                 {
diff --git a/src/lib/libssl/src/crypto/bio/bss_conn.c b/src/lib/libssl/src/crypto/bio/bss_conn.c
index f91ae4c8c6..81f27dba4c 100644
--- a/src/lib/libssl/src/crypto/bio/bss_conn.c
+++ b/src/lib/libssl/src/crypto/bio/bss_conn.c
@@ -521,8 +521,8 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                 char buf[16];
                                 char *p = ptr;
 
-                                sprintf(buf,"%d.%d.%d.%d",
-                                        p[0],p[1],p[2],p[3]);
+                                snprintf(buf,sizeof buf,"%d.%d.%d.%d",
+                                         p[0],p[1],p[2],p[3]);
                                 if (data->param_hostname != NULL)
                                         OPENSSL_free(data->param_hostname);
                                 data->param_hostname=BUF_strdup(buf);
@@ -532,7 +532,7 @@ static long conn_ctrl(BIO *b, int cmd, long num, void *ptr)
                                 {
                                 char buf[16];
 
-                                sprintf(buf,"%d",*(int *)ptr);
+                                snprintf(buf,sizeof buf,"%d",*(int *)ptr);
                                 if (data->param_port != NULL)
                                         OPENSSL_free(data->param_port);
                                 data->param_port=BUF_strdup(buf);
diff --git a/src/lib/libssl/src/crypto/bn/bn_lib.c b/src/lib/libssl/src/crypto/bn/bn_lib.c
index 8abe095af2..ce2ae78419 100644
--- a/src/lib/libssl/src/crypto/bn/bn_lib.c
+++ b/src/lib/libssl/src/crypto/bn/bn_lib.c
@@ -145,10 +145,10 @@ char *BN_options(void)
                 {
                 init++;
 #ifdef BN_LLONG
-                sprintf(data,"bn(%d,%d)",(int)sizeof(BN_ULLONG)*8,
+                snprintf(data,sizeof data,"bn(%d,%d)",(int)sizeof(BN_ULLONG)*8,
                         (int)sizeof(BN_ULONG)*8);
 #else
-                sprintf(data,"bn(%d,%d)",(int)sizeof(BN_ULONG)*8,
+                snprintf(data,sizeof data,"bn(%d,%d)",(int)sizeof(BN_ULONG)*8,
                         (int)sizeof(BN_ULONG)*8);
 #endif
                 }
diff --git a/src/lib/libssl/src/crypto/conf/conf_def.c b/src/lib/libssl/src/crypto/conf/conf_def.c
index 37925b603d..48ff6f1120 100644
--- a/src/lib/libssl/src/crypto/conf/conf_def.c
+++ b/src/lib/libssl/src/crypto/conf/conf_def.c
@@ -445,7 +445,7 @@ err:
         if (buff != NULL) BUF_MEM_free(buff);
         if (section != NULL) OPENSSL_free(section);
         if (line != NULL) *line=eline;
-        sprintf(btmp,"%ld",eline);
+        snprintf(btmp,sizeof btmp,"%ld",eline);
         ERR_add_error_data(2,"line ",btmp);
         if ((h != conf->data) && (conf->data != NULL))
                 {
diff --git a/src/lib/libssl/src/crypto/conf/conf_mod.c b/src/lib/libssl/src/crypto/conf/conf_mod.c
index 8270ae5eb5..5a747e8c84 100644
--- a/src/lib/libssl/src/crypto/conf/conf_mod.c
+++ b/src/lib/libssl/src/crypto/conf/conf_mod.c
@@ -232,7 +232,7 @@ static int module_run(const CONF *cnf, char *name, char *value,
                         {
                         char rcode[DECIMAL_SIZE(ret)+1];
                         CONFerr(CONF_F_CONF_MODULES_LOAD, CONF_R_MODULE_INITIALIZATION_ERROR);
-                        sprintf(rcode, "%-8d", ret);
+                        snprintf(rcode, sizeof rcode, "%-8d", ret);
                         ERR_add_error_data(6, "module=", name, ", value=", value, ", retcode=", rcode);
                         }
                 }
diff --git a/src/lib/libssl/src/crypto/des/ecb_enc.c b/src/lib/libssl/src/crypto/des/ecb_enc.c
index 1b70f68806..c828bdd45d 100644
--- a/src/lib/libssl/src/crypto/des/ecb_enc.c
+++ b/src/lib/libssl/src/crypto/des/ecb_enc.c
@@ -97,7 +97,8 @@ const char *DES_options(void)
                         size="int";
                 else
                         size="long";
-                sprintf(buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,size);
+                snprintf(buf,sizeof buf,"des(%s,%s,%s,%s)",ptr,risc,unroll,
+                         size);
                 init=0;
                 }
         return(buf);
diff --git a/src/lib/libssl/src/crypto/lhash/lh_stats.c b/src/lib/libssl/src/crypto/lhash/lh_stats.c
index 39ea2885f4..8e6f57c741 100644
--- a/src/lib/libssl/src/crypto/lhash/lh_stats.c
+++ b/src/lib/libssl/src/crypto/lhash/lh_stats.c
@@ -181,46 +181,60 @@ void lh_stats_bio(const LHASH *lh, BIO *out)
         {
         char buf[128];
 
-        sprintf(buf,"num_items             = %lu\n",lh->num_items);
+        snprintf(buf,sizeof buf,"num_items             = %lu\n",lh->num_items);
         BIO_puts(out,buf);
-        sprintf(buf,"num_nodes             = %u\n",lh->num_nodes);
+        snprintf(buf,sizeof buf,"num_nodes             = %u\n",lh->num_nodes);
         BIO_puts(out,buf);
-        sprintf(buf,"num_alloc_nodes       = %u\n",lh->num_alloc_nodes);
+        snprintf(buf,sizeof buf,"num_alloc_nodes       = %u\n",
+                 lh->num_alloc_nodes);
         BIO_puts(out,buf);
-        sprintf(buf,"num_expands           = %lu\n",lh->num_expands);
+        snprintf(buf,sizeof buf,"num_expands           = %lu\n",
+                 lh->num_expands);
         BIO_puts(out,buf);
-        sprintf(buf,"num_expand_reallocs   = %lu\n",lh->num_expand_reallocs);
+        snprintf(buf,sizeof buf,"num_expand_reallocs   = %lu\n",
+                 lh->num_expand_reallocs);
         BIO_puts(out,buf);
-        sprintf(buf,"num_contracts         = %lu\n",lh->num_contracts);
+        snprintf(buf,sizeof buf,"num_contracts         = %lu\n",
+                 lh->num_contracts);
         BIO_puts(out,buf);
-        sprintf(buf,"num_contract_reallocs = %lu\n",lh->num_contract_reallocs);
+        snprintf(buf,sizeof buf,"num_contract_reallocs = %lu\n",
+                 lh->num_contract_reallocs);
         BIO_puts(out,buf);
-        sprintf(buf,"num_hash_calls        = %lu\n",lh->num_hash_calls);
+        snprintf(buf,sizeof buf,"num_hash_calls        = %lu\n",
+                 lh->num_hash_calls);
         BIO_puts(out,buf);
-        sprintf(buf,"num_comp_calls        = %lu\n",lh->num_comp_calls);
+        snprintf(buf,sizeof buf,"num_comp_calls        = %lu\n",
+                 lh->num_comp_calls);
         BIO_puts(out,buf);
-        sprintf(buf,"num_insert            = %lu\n",lh->num_insert);
+        snprintf(buf,sizeof buf,"num_insert            = %lu\n",
+                 lh->num_insert);
         BIO_puts(out,buf);
-        sprintf(buf,"num_replace           = %lu\n",lh->num_replace);
+        snprintf(buf,sizeof buf,"num_replace           = %lu\n",
+                 lh->num_replace);
         BIO_puts(out,buf);
-        sprintf(buf,"num_delete            = %lu\n",lh->num_delete);
+        snprintf(buf,sizeof buf,"num_delete            = %lu\n",
+                 lh->num_delete);
         BIO_puts(out,buf);
-        sprintf(buf,"num_no_delete         = %lu\n",lh->num_no_delete);
+        snprintf(buf,sizeof buf,"num_no_delete         = %lu\n",
+                 lh->num_no_delete);
         BIO_puts(out,buf);
-        sprintf(buf,"num_retrieve          = %lu\n",lh->num_retrieve);
+        snprintf(buf,sizeof buf,"num_retrieve          = %lu\n",
+                 lh->num_retrieve);
         BIO_puts(out,buf);
-        sprintf(buf,"num_retrieve_miss     = %lu\n",lh->num_retrieve_miss);
+        snprintf(buf,sizeof buf,"num_retrieve_miss     = %lu\n",
+                 lh->num_retrieve_miss);
         BIO_puts(out,buf);
-        sprintf(buf,"num_hash_comps        = %lu\n",lh->num_hash_comps);
+        snprintf(buf,sizeof buf,"num_hash_comps        = %lu\n",
+                 lh->num_hash_comps);
         BIO_puts(out,buf);
 #if 0
-        sprintf(buf,"p                     = %u\n",lh->p);
+        snprintf(buf,sizeof buf,"p                     = %u\n",lh->p);
         BIO_puts(out,buf);
-        sprintf(buf,"pmax                  = %u\n",lh->pmax);
+        snprintf(buf,sizeof buf,"pmax                  = %u\n",lh->pmax);
         BIO_puts(out,buf);
-        sprintf(buf,"up_load               = %lu\n",lh->up_load);
+        snprintf(buf,sizeof buf,"up_load               = %lu\n",lh->up_load);
         BIO_puts(out,buf);
-        sprintf(buf,"down_load             = %lu\n",lh->down_load);
+        snprintf(buf,sizeof buf,"down_load             = %lu\n",lh->down_load);
         BIO_puts(out,buf);
 #endif
         }
@@ -235,7 +249,7 @@ void lh_node_stats_bio(const LHASH *lh, BIO *out)
                 {
                 for (n=lh->b[i],num=0; n != NULL; n=n->next)
                         num++;
-                sprintf(buf,"node %6u -> %3u\n",i,num);
+                snprintf(buf,sizeof buf,"node %6u -> %3u\n",i,num);
                 BIO_puts(out,buf);
                 }
         }
@@ -258,12 +272,13 @@ void lh_node_usage_stats_bio(const LHASH *lh, BIO *out)
                         total+=num;
                         }
                 }
-        sprintf(buf,"%lu nodes used out of %u\n",n_used,lh->num_nodes);
+        snprintf(buf,sizeof buf,"%lu nodes used out of %u\n",n_used,
+                 lh->num_nodes);
         BIO_puts(out,buf);
-        sprintf(buf,"%lu items\n",total);
+        snprintf(buf,sizeof buf,"%lu items\n",total);
         BIO_puts(out,buf);
         if (n_used == 0) return;
-        sprintf(buf,"load %d.%02d  actual load %d.%02d\n",
+        snprintf(buf,sizeof buf,"load %d.%02d  actual load %d.%02d\n",
                 (int)(total/lh->num_nodes),
                 (int)((total%lh->num_nodes)*100/lh->num_nodes),
                 (int)(total/n_used),
diff --git a/src/lib/libssl/src/crypto/objects/obj_dat.c b/src/lib/libssl/src/crypto/objects/obj_dat.c
index ce779dc1b5..202bd168ac 100644
--- a/src/lib/libssl/src/crypto/objects/obj_dat.c
+++ b/src/lib/libssl/src/crypto/objects/obj_dat.c
@@ -462,7 +462,7 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
                 if (i > 2) i=2;
                 l-=(long)(i*40);
 
-                sprintf(tbuf,"%d.%lu",i,l);
+                snprintf(tbuf,sizeof tbuf,"%d.%lu",i,l);
                 i=strlen(tbuf);
                 strncpy(buf,tbuf,buf_len);
                 buf_len-=i;
@@ -473,7 +473,7 @@ int OBJ_obj2txt(char *buf, int buf_len, const ASN1_OBJECT *a, int no_name)
                 for (; idx<len; idx++) {
                         l|=p[idx]&0x7f;
                         if (!(p[idx] & 0x80)) {
-                                sprintf(tbuf,".%lu",l);
+                                snprintf(tbuf,sizeof tbuf,".%lu",l);
                                 i=strlen(tbuf);
                                 if (buf_len > 0)
                                         strncpy(buf,tbuf,buf_len);
diff --git a/src/lib/libssl/src/crypto/x509/x509_txt.c b/src/lib/libssl/src/crypto/x509/x509_txt.c
index 4f83db8ba2..9d09ae17e8 100644
--- a/src/lib/libssl/src/crypto/x509/x509_txt.c
+++ b/src/lib/libssl/src/crypto/x509/x509_txt.c
@@ -148,7 +148,7 @@ const char *X509_verify_cert_error_string(long n)
                 return("unhandled critical extension");
 
         default:
-                sprintf(buf,"error number %ld",n);
+                snprintf(buf,sizeof buf,"error number %ld",n);
                 return(buf);
                 }
         }
diff --git a/src/lib/libssl/src/crypto/x509v3/v3_alt.c b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
index 0e9e7dcb4f..0fae31a3a6 100644
--- a/src/lib/libssl/src/crypto/x509v3/v3_alt.c
+++ b/src/lib/libssl/src/crypto/x509v3/v3_alt.c
@@ -137,7 +137,8 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(X509V3_EXT_METHOD *method,
                         X509V3_add_value("IP Address","<invalid>", &ret);
                         break;
                 }
-                sprintf(oline, "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
+                snprintf(oline, sizeof oline, "%d.%d.%d.%d", p[0], p[1], p[2],
+                         p[3]);
                 X509V3_add_value("IP Address",oline, &ret);
                 break;