4 files changed, 12 insertions, 11 deletions

diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
index 5d981c6553..58b437bc84 100644
--- a/src/lib/libcrypto/asn1/a_mbstr.c
+++ b/src/lib/libcrypto/asn1/a_mbstr.c
@@ -145,14 +145,14 @@ int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
 
         if((minsize > 0) && (nchar < minsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
-                sprintf(strbuf, "%ld", minsize);
+                snprintf(strbuf, sizeof strbuf, "%ld", minsize);
                 ERR_add_error_data(2, "minsize=", strbuf);
                 return -1;
         }
 
         if((maxsize > 0) && (nchar > maxsize)) {
                 ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
-                sprintf(strbuf, "%ld", maxsize);
+                snprintf(strbuf, sizeof strbuf, "%ld", maxsize);
                 ERR_add_error_data(2, "maxsize=", strbuf);
                 return -1;
         }
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 0638870ab7..60f36bb958 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -412,8 +412,8 @@ void asn1_add_error(unsigned char *address, int offset)
         {
         char buf1[DECIMAL_SIZE(address)+1],buf2[DECIMAL_SIZE(offset)+1];
 
-        sprintf(buf1,"%lu",(unsigned long)address);
-        sprintf(buf2,"%d",offset);
+        snprintf(buf1,sizeof buf1,"%lu",(unsigned long)address);
+        snprintf(buf2,sizeof buf2,"%d",offset);
         ERR_add_error_data(4,"address=",buf1," offset=",buf2);
         }
 
diff --git a/src/lib/libcrypto/asn1/asn1_par.c b/src/lib/libcrypto/asn1/asn1_par.c
index facfdd27fc..4223c9ae45 100644
--- a/src/lib/libcrypto/asn1/asn1_par.c
+++ b/src/lib/libcrypto/asn1/asn1_par.c
@@ -88,11 +88,11 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
 
         p=str;
         if ((xclass & V_ASN1_PRIVATE) == V_ASN1_PRIVATE)
-                sprintf(str,"priv [ %d ] ",tag);
+                snprintf(str,sizeof str,"priv [ %d ] ",tag);
         else if ((xclass & V_ASN1_CONTEXT_SPECIFIC) == V_ASN1_CONTEXT_SPECIFIC)
-                sprintf(str,"cont [ %d ]",tag);
+                snprintf(str,sizeof str,"cont [ %d ]",tag);
         else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
-                sprintf(str,"appl [ %d ]",tag);
+                snprintf(str,sizeof str,"appl [ %d ]",tag);
         else p = ASN1_tag2str(tag);
 
         if (p2 != NULL)
diff --git a/src/lib/libcrypto/asn1/t_req.c b/src/lib/libcrypto/asn1/t_req.c
index 739f272ecf..eca97e00cb 100644
--- a/src/lib/libcrypto/asn1/t_req.c
+++ b/src/lib/libcrypto/asn1/t_req.c
@@ -116,7 +116,8 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
                 l=0;
                 for (i=0; i<ri->version->length; i++)
                         { l<<=8; l+=ri->version->data[i]; }
-                sprintf(str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,l,neg,l);
+                snprintf(str,sizeof str,"%8sVersion: %s%lu (%s0x%lx)\n","",neg,
+                         l,neg,l);
                 if (BIO_puts(bp,str) <= 0) goto err;
                 }
         if(!(cflag & X509_FLAG_NO_SUBJECT))
@@ -168,13 +169,13 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
         if(!(cflag & X509_FLAG_NO_ATTRIBUTES))
                 {
                 /* may not be */
-                sprintf(str,"%8sAttributes:\n","");
+                snprintf(str,sizeof str,"%8sAttributes:\n","");
                 if (BIO_puts(bp,str) <= 0) goto err;
 
                 sk=x->req_info->attributes;
                 if (sk_X509_ATTRIBUTE_num(sk) == 0)
                         {
-                        sprintf(str,"%12sa0:00\n","");
+                        snprintf(str,sizeof str,"%12sa0:00\n","");
                         if (BIO_puts(bp,str) <= 0) goto err;
                         }
                 else
@@ -190,7 +191,7 @@ int X509_REQ_print_ex(BIO *bp, X509_REQ *x, unsigned long nmflags, unsigned long
                                 a=sk_X509_ATTRIBUTE_value(sk,i);
                                 if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
                                                                         continue;
-                                sprintf(str,"%12s","");
+                                snprintf(str,sizeof str,"%12s","");
                                 if (BIO_puts(bp,str) <= 0) goto err;
                                 if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
                                 {