From: Marc Haber <mh+debian-packages@zugschlus.de>
Date: Sun, 25 May 2025 20:59:39 +0200
Subject: replace sprintf with snprintf

Author: Gerlof Langeveld
Forwarded: not-needed
---
 atop.c      |   2 +-
 atopcat.c   |   2 +-
 netlink.c   |   2 +-
 photosyst.c |  15 +++++--
 showlinux.c |   2 +-
 showprocs.c | 108 +++++++++++++++++++++++------------------------
 showsys.c   | 138 ++++++++++++++++++++++++++++++------------------------------
 7 files changed, 138 insertions(+), 131 deletions(-)

diff --git a/atop.c b/atop.c
index ea3865e..0040c61 100644
--- a/atop.c
+++ b/atop.c
@@ -1266,7 +1266,7 @@ twinprepare(void)
 
 	ptrverify(tempname, "Malloc failed for temporary twin name\n");
 
-	sprintf(tempname, "%s/%s", twindir, TWINNAME);
+	snprintf(tempname, strlen(twindir) + sizeof TWINNAME + 1, "%s/%s", twindir, TWINNAME);
 
 	if ( (tempfd = mkstemp(tempname)) == -1)
 	{
diff --git a/atopcat.c b/atopcat.c
index fb014a0..2864011 100644
--- a/atopcat.c
+++ b/atopcat.c
@@ -365,7 +365,7 @@ convepoch(time_t utime)
 
 	tt = localtime(&utime);
 
-	sprintf(datetime, "%04d/%02d/%02d %02d:%02d:%02d",
+	snprintf(datetime, sizeof datetime, "%04d/%02d/%02d %02d:%02d:%02d",
                 tt->tm_year+1900, tt->tm_mon+1, tt->tm_mday,
 		tt->tm_hour, tt->tm_min, tt->tm_sec);
 
diff --git a/netlink.c b/netlink.c
index eb3a7ca..7991267 100644
--- a/netlink.c
+++ b/netlink.c
@@ -78,7 +78,7 @@ netlink_open(void)
 	** determine maximum number of CPU's for this system
 	** and specify mask to register all cpu's
 	*/
-	sprintf(cpudef, "0-%d", getnumcpu() -1);
+	snprintf(cpudef, sizeof cpudef, "0-%d", getnumcpu() -1);
 
 	/*
 	** indicate to listen for processes from all CPU's
diff --git a/photosyst.c b/photosyst.c
index 860e41d..2f862fd 100644
--- a/photosyst.c
+++ b/photosyst.c
@@ -913,8 +913,11 @@ photosyst(struct sstat *si)
 				ptrverify(lhugepagetot,
 					"Malloc failed for huge page total");
 
-				sprintf(lhugepagetot, "%s/%s/nr_hugepages",
-							HUGEPAGEDIR, dentry->d_name);
+				snprintf(lhugepagetot,
+						sizeof HUGEPAGEDIR + 1 +
+				                strlen(dentry->d_name) + 1 +
+						sizeof "nr_hugepages" + 1,
+						"%s/%s/nr_hugepages", HUGEPAGEDIR, dentry->d_name);
 
 
 				lhugepagefree = malloc(sizeof HUGEPAGEDIR + 1 +
@@ -924,8 +927,10 @@ photosyst(struct sstat *si)
 				ptrverify(lhugepagefree,
 					"Malloc failed for huge page free");
 
-				sprintf(lhugepagefree, "%s/%s/free_hugepages",
-							HUGEPAGEDIR, dentry->d_name);
+				snprintf(lhugepagefree, sizeof HUGEPAGEDIR + 1 + 
+				                        strlen(dentry->d_name) + 1 +
+                                                        sizeof "free_hugepages" + 1,
+						"%s/%s/free_hugepages", HUGEPAGEDIR, dentry->d_name);
 
 				break;
 			}
@@ -1065,9 +1070,11 @@ photosyst(struct sstat *si)
 					else if ( strcmp("HugePages_Free:", nam) == EQ)
 						si->memnuma.numa[j].freehp = cnts[1];
 				}
+
 				fclose(fp);
 			}
 		}
+
 		closedir(dirp);
 	}
 
diff --git a/showlinux.c b/showlinux.c
index 5226eb7..3bdf804 100644
--- a/showlinux.c
+++ b/showlinux.c
@@ -704,7 +704,7 @@ init_proc_prints(count_t numcpu)
 
 			ptrverify(p, "Malloc failed for formatted header\n");
 
-			sprintf(p, "%*s", pidwidth, idprocpdefs[i]->head);
+			snprintf(p, pidwidth+1, "%*s", pidwidth, idprocpdefs[i]->head);
 			idprocpdefs[i]->head = p;
 		}
 	}
diff --git a/showprocs.c b/showprocs.c
index 7d56732..b8e5db9 100644
--- a/showprocs.c
+++ b/showprocs.c
@@ -418,12 +418,12 @@ showprochead(detail_printpair* elemptr, int curlist, int totlist,
 
                 if (screen)
                 {
-                        col += sprintf(buf+col, "%*s%s%*s",
+                        col += snprintf(buf+col, bufsz-col, "%*s%s%*s",
 				widen, autoindic, chead, colspacings[n], "");
                 }
                 else
                 {
-                        col += sprintf(buf+col, "%s%s ", autoindic, chead);
+                        col += snprintf(buf+col, bufsz-col, "%s%s ", autoindic, chead);
                 }
                               
                 elemptr++;
@@ -432,16 +432,16 @@ showprochead(detail_printpair* elemptr, int curlist, int totlist,
 
         if (screen)   // add page number, eat from last header if needed...
         {
-                pagindiclen=sprintf(pagindic,"%d/%d", curlist, totlist);
+                pagindiclen=snprintf(pagindic, sizeof pagindic, "%d/%d", curlist, totlist);
                 align=COLS-col-pagindiclen;    // extra spaces needed
             
                 if (align >= 0)     // align by adding spaces
                 {
-                        sprintf(buf+col, "%*s", align+pagindiclen, pagindic);
+                        snprintf(buf+col, bufsz-col, "%*s", align+pagindiclen, pagindic);
                 }
                 else if (col+align >= 0)
                 {    // align by removing from the right
-                        sprintf(buf+col+align, "%s", pagindic);
+                        snprintf(buf+col+align, bufsz-(col+align), "%s", pagindic);
                 }
         }
 
@@ -572,9 +572,9 @@ procprt_TID_ae(struct tstat *curstat, int avgval, int nsecs)
         static char buf[64];
 
 	if (curstat->gen.isproc)
-        	sprintf(buf, "%*s", procprt_TID.width, "-");
+        	snprintf(buf, sizeof buf, "%*s", procprt_TID.width, "-");
 	else
-        	sprintf(buf, "%*d", procprt_TID.width, curstat->gen.pid);
+        	snprintf(buf, sizeof buf, "%*d", procprt_TID.width, curstat->gen.pid);
         return buf;
 }
 
@@ -586,7 +586,7 @@ procprt_PID_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[64];
 
-        sprintf(buf, "%*d", procprt_PID.width, curstat->gen.tgid);
+        snprintf(buf, sizeof buf, "%*d", procprt_PID.width, curstat->gen.tgid);
         return buf;
 }
 
@@ -596,9 +596,9 @@ procprt_PID_e(struct tstat *curstat, int avgval, int nsecs)
         static char buf[64];
 
         if (curstat->gen.pid == 0)
-        	sprintf(buf, "%*s", procprt_PID.width, "?");
+        	snprintf(buf, sizeof buf, "%*s", procprt_PID.width, "?");
 	else
-        	sprintf(buf, "%*d", procprt_PID.width, curstat->gen.tgid);
+        	snprintf(buf, sizeof buf, "%*d", procprt_PID.width, curstat->gen.tgid);
         return buf;
 }
 
@@ -610,7 +610,7 @@ procprt_PPID_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[64];
 
-        sprintf(buf, "%*d", procprt_PPID.width, curstat->gen.ppid);
+        snprintf(buf, sizeof buf, "%*d", procprt_PPID.width, curstat->gen.ppid);
         return buf;
 }
 
@@ -620,9 +620,9 @@ procprt_PPID_e(struct tstat *curstat, int avgval, int nsecs)
         static char buf[64];
 
 	if (curstat->gen.ppid)
-        	sprintf(buf, "%*d", procprt_PPID.width, curstat->gen.ppid);
+        	snprintf(buf, sizeof buf, "%*d", procprt_PPID.width, curstat->gen.ppid);
 	else
-		sprintf(buf, "%*s", procprt_PPID.width, "-");
+		snprintf(buf, sizeof buf, "%*s", procprt_PPID.width, "-");
         return buf;
 }
 
@@ -634,7 +634,7 @@ procprt_VPID_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[64];
 
-        sprintf(buf, "%*d", procprt_VPID.width, curstat->gen.vpid);
+        snprintf(buf, sizeof buf, "%*d", procprt_VPID.width, curstat->gen.vpid);
         return buf;
 }
 
@@ -643,7 +643,7 @@ procprt_VPID_e(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[64];
 
-	sprintf(buf, "%*s", procprt_VPID.width, "-");
+	snprintf(buf, sizeof buf, "%*s", procprt_VPID.width, "-");
         return buf;
 }
 
@@ -655,7 +655,7 @@ procprt_CTID_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[32];
 
-        sprintf(buf, "%5d", curstat->gen.ctid);
+        snprintf(buf, sizeof buf, "%5d", curstat->gen.ctid);
         return buf;
 }
 
@@ -674,9 +674,9 @@ procprt_CID_a(struct tstat *curstat, int avgval, int nsecs)
         static char buf[64];
 
 	if (curstat->gen.utsname[0])
-        	sprintf(buf, "%-15s", curstat->gen.utsname);
+        	snprintf(buf, sizeof buf, "%-15s", curstat->gen.utsname);
 	else
-        	sprintf(buf, "%-15s", "host-----------");
+        	snprintf(buf, sizeof buf, "%-15s", "host-----------");
 
         return buf;
 }
@@ -687,9 +687,9 @@ procprt_CID_e(struct tstat *curstat, int avgval, int nsecs)
         static char buf[64];
 
 	if (curstat->gen.utsname[0])
-        	sprintf(buf, "%-15s", curstat->gen.utsname);
+        	snprintf(buf, sizeof buf, "%-15s", curstat->gen.utsname);
 	else
-        	sprintf(buf, "%-15s", "?");
+        	snprintf(buf, sizeof buf, "%-15s", "?");
 
         return buf;
 }
@@ -951,7 +951,7 @@ procprt_CMD_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%-14.14s", curstat->gen.name);
+        snprintf(buf, sizeof buf, "%-14.14s", curstat->gen.name);
         return buf;
 }
 
@@ -961,8 +961,8 @@ procprt_CMD_e(struct tstat *curstat, int avgval, int nsecs)
         static char buf[15]="<";
         char        helpbuf[15];
 
-        sprintf(helpbuf, "<%.12s>",  curstat->gen.name);
-        sprintf(buf,     "%-14.14s", helpbuf);
+        snprintf(helpbuf, sizeof helpbuf, "<%.12s>",  curstat->gen.name);
+        snprintf(buf, sizeof buf,     "%-14.14s", helpbuf);
         return buf;
 }
 
@@ -977,7 +977,7 @@ procprt_RUID_ae(struct tstat *curstat, int avgval, int nsecs)
 
         if ( (pwd = getpwuid(curstat->gen.ruid)) )
         {
-                        sprintf(buf, "%-8.8s", pwd->pw_name);
+                        snprintf(buf, sizeof buf, "%-8.8s", pwd->pw_name);
         } 
         else 
         {
@@ -997,7 +997,7 @@ procprt_EUID_a(struct tstat *curstat, int avgval, int nsecs)
 
         if ( (pwd = getpwuid(curstat->gen.euid)) )
         {
-                        sprintf(buf, "%-8.8s", pwd->pw_name);
+                        snprintf(buf, sizeof buf, "%-8.8s", pwd->pw_name);
         } 
         else 
         {
@@ -1023,7 +1023,7 @@ procprt_SUID_a(struct tstat *curstat, int avgval, int nsecs)
 
         if ( (pwd = getpwuid(curstat->gen.suid)) )
         {
-                        sprintf(buf, "%-8.8s", pwd->pw_name);
+                        snprintf(buf, sizeof buf, "%-8.8s", pwd->pw_name);
         } 
         else 
         {
@@ -1049,7 +1049,7 @@ procprt_FSUID_a(struct tstat *curstat, int avgval, int nsecs)
 
         if ( (pwd = getpwuid(curstat->gen.fsuid)) )
         {
-                        sprintf(buf, "%-8.8s", pwd->pw_name);
+                        snprintf(buf, sizeof buf, "%-8.8s", pwd->pw_name);
         } 
         else 
         {
@@ -1085,7 +1085,7 @@ procprt_RGID_ae(struct tstat *curstat, int avgval, int nsecs)
                         groupname = grname;
         }
 
-        sprintf(buf, "%-8.8s", groupname);
+        snprintf(buf, sizeof buf, "%-8.8s", groupname);
         return buf;
 }
 
@@ -1110,7 +1110,7 @@ procprt_EGID_a(struct tstat *curstat, int avgval, int nsecs)
                         groupname = grname;
         }
 
-        sprintf(buf, "%-8.8s", groupname);
+        snprintf(buf, sizeof buf, "%-8.8s", groupname);
         return buf;
 }
 
@@ -1141,7 +1141,7 @@ procprt_SGID_a(struct tstat *curstat, int avgval, int nsecs)
                         groupname = grname;
         }
 
-        sprintf(buf, "%-8.8s", groupname);
+        snprintf(buf, sizeof buf, "%-8.8s", groupname);
         return buf;
 }
 
@@ -1172,7 +1172,7 @@ procprt_FSGID_a(struct tstat *curstat, int avgval, int nsecs)
                         groupname = grname;
         }
 
-        sprintf(buf, "%-8.8s", groupname);
+        snprintf(buf, sizeof buf, "%-8.8s", groupname);
         return buf;
 }
 
@@ -1260,7 +1260,7 @@ procprt_THR_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%4d", curstat->gen.nthr);
+        snprintf(buf, sizeof buf, "%4d", curstat->gen.nthr);
         return buf;
 }
 
@@ -1278,7 +1278,7 @@ procprt_TRUN_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%4d", curstat->gen.nthrrun);
+        snprintf(buf, sizeof buf, "%4d", curstat->gen.nthrrun);
         return buf;
 }
 
@@ -1296,7 +1296,7 @@ procprt_TSLPI_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%5d", curstat->gen.nthrslpi);
+        snprintf(buf, sizeof buf, "%5d", curstat->gen.nthrslpi);
         return buf;
 }
 
@@ -1314,7 +1314,7 @@ procprt_TSLPU_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%5d", curstat->gen.nthrslpu);
+        snprintf(buf, sizeof buf, "%5d", curstat->gen.nthrslpu);
         return buf;
 }
 
@@ -1332,7 +1332,7 @@ procprt_TIDLE_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%5d", curstat->gen.nthridle);
+        snprintf(buf, sizeof buf, "%5d", curstat->gen.nthridle);
         return buf;
 }
 
@@ -1397,7 +1397,7 @@ procprt_NICE_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%4d", curstat->cpu.nice);
+        snprintf(buf, sizeof buf, "%4d", curstat->cpu.nice);
         return buf;
 }
 
@@ -1415,7 +1415,7 @@ procprt_PRI_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%3d", curstat->cpu.prio);
+        snprintf(buf, sizeof buf, "%3d", curstat->cpu.prio);
         return buf;
 }
 
@@ -1433,7 +1433,7 @@ procprt_RTPR_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%4d", curstat->cpu.rtprio);
+        snprintf(buf, sizeof buf, "%4d", curstat->cpu.rtprio);
         return buf;
 }
 
@@ -1451,7 +1451,7 @@ procprt_CURCPU_a(struct tstat *curstat, int avgval, int nsecs)
 {
         static char buf[15];
 
-        sprintf(buf, "%5d", curstat->cpu.curcpu);
+        snprintf(buf, sizeof buf, "%5d", curstat->cpu.curcpu);
         return buf;
 }
 
@@ -1520,7 +1520,7 @@ procprt_EXC_e(struct tstat *curstat, int avgval, int nsecs)
         static char buf[4];
 
 
-        sprintf(buf, "%3d", 
+        snprintf(buf, sizeof buf, "%3d", 
                  curstat->gen.excode & 0xff ?
                           curstat->gen.excode & 0x7f : 
                           (curstat->gen.excode>>8) & 0xff);
@@ -1569,9 +1569,9 @@ procprt_COMMAND_LINE_ae(struct tstat *curstat, int avgval, int nsecs)
         int 	curoffset  = startoffset <= cmdlen ? startoffset : cmdlen;
 
         if (screen) 
-                sprintf(buf, "%-*.*s", curwidth, curwidth, pline+curoffset);
+                snprintf(buf, sizeof buf, "%-*.*s", curwidth, curwidth, pline+curoffset);
         else
-                sprintf(buf, "%.*s", CMDLEN, pline+curoffset);
+                snprintf(buf, sizeof buf, "%.*s", CMDLEN, pline+curoffset);
 
         return buf;
 }
@@ -2063,7 +2063,7 @@ format_bandw(char *buf, count_t kbps)
                 c = 'T';
         }
 
-        sprintf(buf, "%4lld %cbps", kbps%100000, c);
+        snprintf(buf, bufsize, "%4lld %cbps", kbps%100000, c);
 }
 /***************************************************************/
 char *
@@ -2356,7 +2356,7 @@ showcgrouphead(detail_printpair *elemptr, int curlist, int totlist, char showord
                 }
                 else
                 {
-                        col += sprintf(buf+col, "%s%s ", "", chead);
+                        col += snprintf(buf+col, sizeof buf-col,"%s%s ", "", chead);
                 }
                               
                 elemptr++;
@@ -2365,7 +2365,7 @@ showcgrouphead(detail_printpair *elemptr, int curlist, int totlist, char showord
 
         if (screen)   // add page number, eat from last header if needed...
         {
-                pagindiclen = sprintf(pagindic,"%d/%d", curlist, totlist);
+                pagindiclen = snprintf(pagindic, sizeof pagindic, "%d/%d", curlist, totlist);
 		move(curline, COLS-pagindiclen);
                 printg("%s", pagindic);
         }
@@ -2492,7 +2492,7 @@ cgroup_CGROUP_PATH(struct cgchainer *cgchain, struct tstat *tstat,
 		switch (cgrdepth)
 		{
 		   case 0:
-			sprintf(buf, "%-*s", cgroupprt_CGROUP_PATH.width, "/");
+			snprintf(buf, sizeof buf, "%-*s", cgroupprt_CGROUP_PATH.width, "/");
 			break;
 
 		   default:
@@ -2529,13 +2529,13 @@ cgroup_CGROUP_PATH(struct cgchainer *cgchain, struct tstat *tstat,
 				addch(' ');
 			}
 
-   			sprintf(buf, " %-*.*s", maxnamelen, maxnamelen,
+   			snprintf(buf, sizeof buf, " %-*.*s", maxnamelen, maxnamelen,
 						cgrname+curoffset);
 		}
 	}
         else
 	{
-                sprintf(buf, "%*s%-*.*s", cgrdepth*2, "",
+                snprintf(buf, sizeof buf, "%*s%-*.*s", cgrdepth*2, "",
 				cgroupprt_CGROUP_PATH.width - cgrdepth*2,
 				cgroupprt_CGROUP_PATH.width - cgrdepth*2,
 				cgrname);
@@ -2959,9 +2959,9 @@ cgroup_CGRPID(struct cgchainer *cgchain, struct tstat *tstat,
         static char buf[64];
 
 	if (tstat)	// process info?
-        	sprintf(buf, "%*d", cgroupprt_CGRPID.width, tstat->gen.pid);
+        	snprintf(buf, sizeof buf, "%*d", cgroupprt_CGRPID.width, tstat->gen.pid);
 	else		// only cgroup info
-        	sprintf(buf, "%*s", cgroupprt_CGRPID.width, " ");
+        	snprintf(buf, sizeof buf, "%*s", cgroupprt_CGRPID.width, " ");
 
         return buf;
 }
@@ -2977,18 +2977,18 @@ cgroup_CGRCMD(struct cgchainer *cgchain, struct tstat *tstat,
 
 	if (tstat)	// process info?
 	{
-        	sprintf(buf, "%-14.14s", tstat->gen.name);
+        	snprintf(buf, sizeof buf, "%-14.14s", tstat->gen.name);
 	}
 	else		// cgroup info
 	{
 		if (cgroupdepth == 8 && cgchain->cstat->gen.depth == 0)
 		{
-			sprintf(buf, "[suppressed]");
+			snprintf(buf, sizeof buf, "[suppressed]");
 			*color = FGCOLORBORDER;
 		}
 		else
 		{
-        		sprintf(buf, "%-14.14s", " ");
+        		snprintf(buf, sizeof buf, "%-14.14s", " ");
 		}
 	}
 
diff --git a/showsys.c b/showsys.c
index 0c40198..1d0c837 100644
--- a/showsys.c
+++ b/showsys.c
@@ -445,7 +445,7 @@ sysprt_CPUSYS(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "sys  %6.0f%%", perc);
+        snprintf(buf, sizeof buf, "sys  %6.0f%%", perc);
         return buf;
 }
 
@@ -461,7 +461,7 @@ sysprt_CPUUSER(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "user %6.0f%%", perc);
+        snprintf(buf, sizeof buf, "user %6.0f%%", perc);
         return buf;
 }
 
@@ -477,7 +477,7 @@ sysprt_CPUIRQ(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "irq  %6.0f%%", perc);
+        snprintf(buf, sizeof buf, "irq  %6.0f%%", perc);
         return buf;
 }
 
@@ -487,7 +487,7 @@ static char *
 sysprt_CPUIDLE(struct sstat *sstat, extraparam *as, int badness, int *color) 
 {
         static char buf[15];
-        sprintf(buf, "idle %6.0f%%", 
+        snprintf(buf, sizeof buf, "idle %6.0f%%", 
                 (sstat->cpu.all.itime * 100.0) / as->percputot);
         return buf;
 }
@@ -498,7 +498,7 @@ static char *
 sysprt_CPUWAIT(struct sstat *sstat, extraparam *as, int badness, int *color) 
 {
         static char buf[15];
-        sprintf(buf, "wait %6.0f%%", 
+        snprintf(buf, sizeof buf, "wait %6.0f%%", 
                 (sstat->cpu.all.wtime * 100.0) / as->percputot);
         return buf;
 }
@@ -515,7 +515,7 @@ sysprt_CPUISYS(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "sys  %6.0f%%", perc);
+        snprintf(buf, sizeof buf, "sys  %6.0f%%", perc);
         return buf;
 }
 
@@ -532,7 +532,7 @@ sysprt_CPUIUSER(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "user %6.0f%%", perc);
+        snprintf(buf, sizeof buf, "user %6.0f%%", perc);
         return buf;
 }
 
@@ -549,7 +549,7 @@ sysprt_CPUIIRQ(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "irq  %6.0f%%", perc);
+        snprintf(buf, sizeof buf, "irq  %6.0f%%", perc);
         return buf;
 }
 
@@ -559,7 +559,7 @@ static char *
 sysprt_CPUIIDLE(struct sstat *sstat, extraparam *as, int badness, int *color) 
 {
         static char buf[15];
-        sprintf(buf, "idle %6.0f%%", 
+        snprintf(buf, sizeof buf, "idle %6.0f%%", 
                 (sstat->cpu.cpu[as->index].itime * 100.0) / as->percputot);
         return buf;
 }
@@ -570,7 +570,7 @@ static char *
 sysprt_CPUIWAIT(struct sstat *sstat, extraparam *as, int badness, int *color) 
 {
         static char buf[15];
-        sprintf(buf, "cpu%03d w%3.0f%%", 
+        snprintf(buf, sizeof buf, "cpu%03d w%3.0f%%", 
 		 sstat->cpu.cpu[as->index].cpunr,
                 (sstat->cpu.cpu[as->index].wtime * 100.0) / as->percputot);
         return buf;
@@ -638,12 +638,12 @@ dofmt_cpuscale(char *buf, count_t maxfreq, count_t cnt, count_t ticks)
 		int     perc = maxfreq ? 100 * curfreq / maxfreq : 0;
 
 		strcpy(buf, "avgscal ");
-		sprintf(buf+7, "%4d%%", perc);
+		snprintf(buf+7, 6, "%4d%%", perc);
         } 
         else if (maxfreq)   // max frequency is known so % can be calculated
         {
 		strcpy(buf, "curscal ");
-		sprintf(buf+7, "%4lld%%", 100 * cnt / maxfreq);
+		snprintf(buf+7, 6, "%4lld%%", 100 * cnt / maxfreq);
         }
 	else	// nothing is known: suppress
 	{
@@ -764,7 +764,7 @@ sysprt_CPUSTEAL(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "steal %5.0f%%", perc);
+        snprintf(buf, sizeof buf, "steal %5.0f%%", perc);
         return buf;
 }
 
@@ -780,7 +780,7 @@ sysprt_CPUISTEAL(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "steal %5.0f%%", perc);
+        snprintf(buf, sizeof buf, "steal %5.0f%%", perc);
         return buf;
 }
 
@@ -795,7 +795,7 @@ sysprt_CPUGUEST(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "guest %5.0f%%", perc);
+        snprintf(buf, sizeof buf, "guest %5.0f%%", perc);
         return buf;
 }
 
@@ -810,7 +810,7 @@ sysprt_CPUIGUEST(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-        sprintf(buf, "guest %5.0f%%", perc);
+        snprintf(buf, sizeof buf, "guest %5.0f%%", perc);
         return buf;
 }
 
@@ -825,17 +825,17 @@ sysprt_CPUIPC(struct sstat *sstat, extraparam *as, int badness, int *color)
 	switch (sstat->cpu.all.cycle)
 	{
 	   case 0:
-        	sprintf(buf, "ipc notavail");
+        	snprintf(buf, sizeof buf, "ipc notavail");
 		break;
 
 	   case 1:
 		*color = FGCOLORINFO;
-        	sprintf(buf, "ipc  initial");
+        	snprintf(buf, sizeof buf, "ipc  initial");
 		break;
 
 	   default:
 		ipc = sstat->cpu.all.instr * 100 / sstat->cpu.all.cycle / 100.0;
-        	sprintf(buf, "ipc %8.2f", ipc);
+        	snprintf(buf, sizeof buf, "ipc %8.2f", ipc);
 	}
 
         return buf;
@@ -858,12 +858,12 @@ sysprt_CPUIIPC(struct sstat *sstat, extraparam *as, int badness, int *color)
 	switch (sstat->cpu.all.cycle)
 	{
 	   case 0:
-        	sprintf(buf, "ipc notavail");
+        	snprintf(buf, sizeof buf, "ipc notavail");
 		break;
 
 	   case 1:
 		*color = FGCOLORINFO;
-        	sprintf(buf, "ipc  initial");
+        	snprintf(buf, sizeof buf, "ipc  initial");
 		break;
 
 	   default:
@@ -871,7 +871,7 @@ sysprt_CPUIIPC(struct sstat *sstat, extraparam *as, int badness, int *color)
 			ipc = sstat->cpu.cpu[as->index].instr * 100 /
 				sstat->cpu.cpu[as->index].cycle / 100.0;
 
-        	sprintf(buf, "ipc %8.2f", ipc);
+        	snprintf(buf, sizeof buf, "ipc %8.2f", ipc);
 	}
 
         return buf;
@@ -887,12 +887,12 @@ sysprt_CPUCYCLE(struct sstat *sstat, extraparam *as, int badness, int *color)
 	switch (sstat->cpu.all.cycle)
 	{
 	   case 0:
-        	sprintf(buf+5, "missing");
+        	snprintf(buf+5, sizeof buf-5, "missing");
 		break;
 
 	   case 1:
 		*color = FGCOLORINFO;
-        	sprintf(buf+5, "initial");
+        	snprintf(buf+5, sizeof buf-5, "initial");
 		break;
 
 	   default:
@@ -913,12 +913,12 @@ sysprt_CPUICYCLE(struct sstat *sstat, extraparam *as, int badness, int *color)
 	switch (sstat->cpu.all.cycle)
 	{
 	   case 0:
-        	sprintf(buf+5, "missing");
+        	snprintf(buf+5, sizeof buf-5, "missing");
 		break;
 
 	   case 1:
 		*color = FGCOLORINFO;
-        	sprintf(buf+5, "initial");
+        	snprintf(buf+5, sizeof buf-5, "initial");
 		break;
 
 	   default:
@@ -938,15 +938,15 @@ sysprt_CPLAVG1(struct sstat *sstat, extraparam *notused, int badness, int *color
 
         if (sstat->cpu.lavg1 > 999999.0)
         {
-                sprintf(buf+5, ">999999");
+                snprintf(buf+5, sizeof buf-5, ">999999");
         }
         else if (sstat->cpu.lavg1 > 999.0)
         {
-                sprintf(buf+5, "%7.0f", sstat->cpu.lavg1);
+                snprintf(buf+5, sizeof buf-5, "%7.0f", sstat->cpu.lavg1);
         }
         else
         {
-                sprintf(buf+5, "%7.2f", sstat->cpu.lavg1);
+                snprintf(buf+5, sizeof buf-5, "%7.2f", sstat->cpu.lavg1);
         }
         return buf;
 }
@@ -960,15 +960,15 @@ sysprt_CPLAVG5(struct sstat *sstat, extraparam *notused, int badness, int *color
 
         if (sstat->cpu.lavg5 > 999999.0)
         {
-                sprintf(buf+5, ">999999");
+                snprintf(buf+5, sizeof buf-5, ">999999");
         }
         else if (sstat->cpu.lavg5 > 999.0)
         {
-                sprintf(buf+5, "%7.0f", sstat->cpu.lavg5);
+                snprintf(buf+5, sizeof buf-5, "%7.0f", sstat->cpu.lavg5);
         }
         else
         {
-                sprintf(buf+5, "%7.2f", sstat->cpu.lavg5);
+                snprintf(buf+5, sizeof buf-5, "%7.2f", sstat->cpu.lavg5);
         }
         return buf;
 }
@@ -985,15 +985,15 @@ sysprt_CPLAVG15(struct sstat *sstat, extraparam *notused, int badness, int *colo
 
         if (sstat->cpu.lavg15 > 99999.0)
         {
-                sprintf(buf+6, ">99999");
+                snprintf(buf+6, sizeof buf-6, ">99999");
         }
         else if (sstat->cpu.lavg15 > 999.0)
         {
-                sprintf(buf+6, "%6.0f", sstat->cpu.lavg15);
+                snprintf(buf+6, sizeof buf-6, "%6.0f", sstat->cpu.lavg15);
         }
         else
         {
-                sprintf(buf+6, "%6.2f", sstat->cpu.lavg15);
+                snprintf(buf+6, sizeof buf-6, "%6.2f", sstat->cpu.lavg15);
         }
         return buf;
 }
@@ -1056,7 +1056,7 @@ sysprt_GPUBUS(struct sstat *sstat, extraparam *as, int badness, int *color)
 	else
 		pn = sstat->gpu.gpu[as->index].busid;
 
-        sprintf(buf, "%9.9s %2d", pn, sstat->gpu.gpu[as->index].gpunr);
+        snprintf(buf, sizeof buf, "%9.9s %2d", pn, sstat->gpu.gpu[as->index].gpunr);
         return buf;
 }
 
@@ -1074,7 +1074,7 @@ sysprt_GPUTYPE(struct sstat *sstat, extraparam *as, int badness, int *color)
 	else
 		pn = sstat->gpu.gpu[as->index].type;
 
-        sprintf(buf, "%12.12s", pn);
+        snprintf(buf, sizeof buf, "%12.12s", pn);
         return buf;
 }
 
@@ -1099,7 +1099,7 @@ sysprt_GPUMEMPERC(struct sstat *sstat, extraparam *as, int badness, int *color)
 
 	if (perc == -1)
 	{
-        	sprintf(buf+8, " N/A");
+        	snprintf(buf+8, sizeof buf-8, " N/A");
 	}
 	else
 	{
@@ -1127,7 +1127,7 @@ sysprt_GPUGPUPERC(struct sstat *sstat, extraparam *as, int badness, int *color)
 
 	if (perc == -1)		// metric not available?
 	{
-        	sprintf(buf+8, " N/A");
+        	snprintf(buf+8, sizeof buf-8, " N/A");
 	}
 	else
 	{
@@ -1835,7 +1835,7 @@ sysprt_NUMANR(struct sstat *sstat, extraparam *as, int badness, int *color)
 {
 	static char buf[16];
 	*color = -1;
-	sprintf(buf, "numanode%04d", sstat->memnuma.numa[as->index].numanr);
+	snprintf(buf, sizeof buf, "numanode%04d", sstat->memnuma.numa[as->index].numanr);
 	return buf;
 }
 
@@ -1915,7 +1915,7 @@ sysprt_NUMAFRAG(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "frag %6.0f%%", perc);
+	snprintf(buf, sizeof buf, "frag %6.0f%%", perc);
 	return buf;
 }
 
@@ -1971,7 +1971,7 @@ sysprt_NUMACPUSYS(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "sys  %6.0f%%", perc);
+	snprintf(buf, sizeof buf, "sys  %6.0f%%", perc);
 	return buf;
 }
 
@@ -1986,7 +1986,7 @@ sysprt_NUMACPUUSER(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "user %6.0f%%", perc);
+	snprintf(buf, sizeof buf, "user %6.0f%%", perc);
 	return buf;
 }
 
@@ -2001,7 +2001,7 @@ sysprt_NUMACPUNICE(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "nice %6.0f%%", perc);
+	snprintf(buf, sizeof buf, "nice %6.0f%%", perc);
 	return buf;
 }
 
@@ -2016,7 +2016,7 @@ sysprt_NUMACPUIRQ(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "irq  %6.0f%%", perc);
+	snprintf(buf, sizeof buf, "irq  %6.0f%%", perc);
 	return buf;
 }
 
@@ -2031,7 +2031,7 @@ sysprt_NUMACPUSOFTIRQ(struct sstat *sstat, extraparam *as, int badness, int *col
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "sirq %6.0f%%", perc);
+	snprintf(buf, sizeof buf, "sirq %6.0f%%", perc);
 	return buf;
 }
 
@@ -2042,7 +2042,7 @@ sysprt_NUMACPUIDLE(struct sstat *sstat, extraparam *as, int badness, int *color)
 {
 	static char buf[15];
 
-	sprintf(buf, "idle %6.0f%%",
+	snprintf(buf, sizeof buf, "idle %6.0f%%",
 		(sstat->cpunuma.numa[as->index].itime * 100.0) / as->percputot);
 	return buf;
 }
@@ -2054,7 +2054,7 @@ sysprt_NUMACPUWAIT(struct sstat *sstat, extraparam *as, int badness, int *color)
 {
 	static char buf[15];
 
-	sprintf(buf, "nod%03d w%3.0f%%",
+	snprintf(buf, sizeof buf, "nod%03d w%3.0f%%",
 		sstat->cpunuma.numa[as->index].numanr,
 		(sstat->cpunuma.numa[as->index].wtime * 100.0) / as->percputot);
 	return buf;
@@ -2072,7 +2072,7 @@ sysprt_NUMACPUSTEAL(struct sstat *sstat, extraparam *as, int badness, int *color
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "steal %5.0f%%", perc);
+	snprintf(buf, sizeof buf, "steal %5.0f%%", perc);
 	return buf;
 }
 
@@ -2088,7 +2088,7 @@ sysprt_NUMACPUGUEST(struct sstat *sstat, extraparam *as, int badness, int *color
 	if (perc > 1.0)
 		*color = -1;
 
-	sprintf(buf, "guest %5.0f%%", perc);
+	snprintf(buf, sizeof buf, "guest %5.0f%%", perc);
 	return buf;
 }
 
@@ -2122,7 +2122,7 @@ sysprt_NUMLLC(struct sstat *sstat, extraparam *as, int badness, int *color)
 	static char buf[16];
 
 	*color = -1;
-	sprintf(buf, "LLC%02d %5.0f%%", sstat->llc.perllc[as->index].id, sstat->llc.perllc[as->index].occupancy * 100);
+	snprintf(buf, sizeof buf, "LLC%02d %5.0f%%", sstat->llc.perllc[as->index].id, sstat->llc.perllc[as->index].occupancy * 100);
 	return buf;
 }
 
@@ -2278,7 +2278,7 @@ sysprt_CONTNAME(struct sstat *sstat, extraparam *as, int badness, int *color)
 
 	*color = -1;
 
-        sprintf(buf+5, "%7lu", sstat->cfs.cont[as->index].ctid);
+        snprintf(buf+5, sizeof buf-5, "%7lu", sstat->cfs.cont[as->index].ctid);
         return buf;
 }
 
@@ -2313,10 +2313,10 @@ sysprt_CONTCPU(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (sstat->cfs.cont[as->index].uptime)
 	{
 		perc = used * 100.0 / sstat->cfs.cont[as->index].uptime;
-        	sprintf(buf, "cpubusy %3.0f%%", perc);
+        	snprintf(buf, sizeof buf, "cpubusy %3.0f%%", perc);
 	}
 	else
-        	sprintf(buf, "cpubusy   ?%%");
+        	snprintf(buf, sizeof buf, "cpubusy   ?%%");
 
         return buf;
 }
@@ -2351,7 +2351,7 @@ sysprt_DSKNAME(struct sstat *sstat, extraparam *as, int badness, int *color)
 	else
 		pn = as->perdsk[as->index].name;
 
-        sprintf(buf, "%12.12s", pn);
+        snprintf(buf, sizeof buf, "%12.12s", pn);
         return buf;
 }
 
@@ -2368,9 +2368,9 @@ sysprt_DSKBUSY(struct sstat *sstat, extraparam *as, int badness, int *color)
 	perc = as->perdsk[as->index].io_ms * 100.0 / as->mstot;
 
 	if (perc >= 0.0 && perc < 1000000.0)
-        	sprintf(buf+5, "%6.0lf%%", perc);
+        	snprintf(buf+5, sizeof buf-5, "%6.0lf%%", perc);
 	else
-        	sprintf(buf+5, "%6.0lf%%", 999999.0);
+        	snprintf(buf+5, sizeof buf-5, "%6.0lf%%", 999999.0);
 
         return buf;
 }
@@ -2517,7 +2517,7 @@ sysprt_DSKAVQUEUE(struct sstat *sstat, extraparam *as, int badness, int *color)
         static char	buf[16]="avq  ";
 	struct perdsk 	*dp = &(as->perdsk[as->index]);
 
-	sprintf(buf+4, "%8.2f", dp->io_ms > 0 ?
+	snprintf(buf+4, sizeof buf-4, "%8.2f", dp->io_ms > 0 ?
                                 (double)dp->avque / dp->io_ms : 0.0);
         return buf;
 }
@@ -2536,31 +2536,31 @@ sysprt_DSKAVIO(struct sstat *sstat, extraparam *as, int badness, int *color)
 	if (avioms >= 9995.0)
 	{
 		val2valstr((unsigned long long)avioms / 1000, buf+5, 5, 0, 0);
-		sprintf(buf+10, " s");
+		snprintf(buf+10, sizeof buf-10, " s");
 	}
 	else if (avioms >= 99.95)
 	{
-		sprintf(buf+5, "%4.0lf ms", avioms);
+		snprintf(buf+5, sizeof buf-5, "%4.0lf ms", avioms);
 	}
 	else if (avioms >= 9.995)
 	{
-		sprintf(buf+5, "%4.1lf ms", avioms);
+		snprintf(buf+5, sizeof buf-5, "%4.1lf ms", avioms);
 	}
 	else if (avioms >= 0.09995)
 	{
-		sprintf(buf+5, "%4.2lf ms", avioms);
+		snprintf(buf+5, sizeof buf-5, "%4.2lf ms", avioms);
 	}
 	else if (avioms >= 0.01)
 	{
-		sprintf(buf+5, "%4.1lf µs", avioms * 1000.0);
+		snprintf(buf+5, sizeof buf-5, "%4.1lf µs", avioms * 1000.0);
 	}
 	else if (avioms >= 0.0001)
 	{
-		sprintf(buf+5, "%4.2lf µs", avioms * 1000.0);
+		snprintf(buf+5, sizeof buf-5, "%4.2lf µs", avioms * 1000.0);
 	}
 	else
 	{
-		sprintf(buf+5, "%4.1lf ns", avioms * 1000000.0);
+		snprintf(buf+5, sizeof buf-5, "%4.1lf ns", avioms * 1000000.0);
 	}
 
         return buf;
@@ -3183,7 +3183,7 @@ sysprt_NFMSERVER(struct sstat *sstat, extraparam *as, int badness, int *color)
 	else
 		strcpy(mntdev, "?");
 
-	sprintf(buf+4, "%8.8s", mntdev);
+	snprintf(buf+4, sizeof buf-4, "%8.8s", mntdev);
         return buf;
 }
 
@@ -3208,7 +3208,7 @@ sysprt_NFMPATH(struct sstat *sstat, extraparam *as, int badness, int *color)
         if (len > 12)
 		ps = ps + len - 12;
 
-	sprintf(buf, "%12.12s", ps);
+	snprintf(buf, sizeof buf, "%12.12s", ps);
         return buf;
 }
 
@@ -3458,7 +3458,7 @@ sysprt_NFSNRBYTES(struct sstat *sstat, extraparam *as, int badness, int *color)
 {
         static char	buf[32]="MBcr/s ";
 
-        sprintf(buf+7, "%5.1lf",
+        snprintf(buf+7, sizeof buf-7, "%5.1lf",
 		sstat->nfs.server.nrbytes / 1024.0 / 1024.0 / as->nsecs);
 
         return buf;
@@ -3471,7 +3471,7 @@ sysprt_NFSNWBYTES(struct sstat *sstat, extraparam *as, int badness, int *color)
 {
         static char	buf[32]="MBcw/s ";
 
-        sprintf(buf+7, "%5.1lf",
+        snprintf(buf+7, sizeof buf-7, "%5.1lf",
 		sstat->nfs.server.nwbytes / 1024.0 / 1024.0 / as->nsecs);
 
         return buf;
