Fixed buffer overflow problems, changed sprintf to snprintf don't use this yet, i have a few things that need to be fixed.

AUTHORS

@@ -49,6 +49,9 @@ Math fixes/optimizations:
   Zinx Verituse <zinx@linuxfreak.com>
   Nelson J. Rush <chesterrr@att.net>
 
+Buffer overflow fixes:
+  Nelson J. Rush <chesterrr@att.net>
+
 Documentation:
   Nelson J. Rush <chesterrr@att.net>
   Joseph Carter <knghtbrd@debian.org>

common/gl_mesh.c

@@ -320,13 +320,13 @@ void GL_MakeAliasModelDisplayLists (model_t *m, aliashdr_t *hdr)
 		//
 		// save out the cached version
 		//
-		sprintf (fullpath, "%s/%s", com_gamedir, cache);
+		snprintf(fullpath, sizeof(fullpath), "%s/%s", com_gamedir, cache);
 		f = fopen (fullpath, "wb");
 #ifdef QUAKEWORLD
 		if (!f) {
 			char gldir[MAX_OSPATH];
 
-			sprintf (gldir, "%s/glquake", com_gamedir);
+			snprintf(gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 			Sys_mkdir (gldir);
 			f = fopen (fullpath, "wb");
 		}

common/gl_vidlinux_3dfx.c

@@ -294,9 +294,9 @@ void	VID_SetPalette (unsigned char *palette)
 			d_15to8table[i]=k;
 		}
 #ifdef QUAKEWORLD
-		sprintf(s, "%s/glquake", com_gamedir);
+		snprintf(s, sizeof(s), "%s/glquake", com_gamedir);
  		Sys_mkdir (s);
-		sprintf(s, "%s/glquake/15to8.pal", com_gamedir);
+		snprintf(s, sizeof(s), "%s/glquake/15to8.pal", com_gamedir);
 		if ((f = fopen(s, "wb")) != NULL) {
 			fwrite(d_15to8table, 1<<15, 1, f);
 			fclose(f);
@@ -655,7 +655,7 @@ void VID_Init(unsigned char *palette)
 
 	GL_Init();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf(gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	VID_SetPalette(palette);

common/gl_vidlinuxglx.c

@@ -469,9 +469,9 @@ void	VID_SetPalette (unsigned char *palette)
 			}
 			d_15to8table[i]=k;
 		}
-		sprintf(s, "%s/glquake", com_gamedir);
+		snprintf(s, sizeof(s), "%s/glquake", com_gamedir);
  		Sys_mkdir (s);
-		sprintf(s, "%s/glquake/15to8.pal", com_gamedir);
+		snprintf(s, sizeof(s), "%s/glquake/15to8.pal", com_gamedir);
 		if ((f = fopen(s, "wb")) != NULL) {
 			fwrite(d_15to8table, 1<<15, 1, f);
 			fclose(f);
@@ -689,7 +689,7 @@ void VID_Init(unsigned char *palette)
 
 	GL_Init();
 
-	sprintf (gldir, "%s/OpenGL", com_gamedir);
+	snprintf(gldir, sizeof(gldir), "%s/OpenGL", com_gamedir);
 	Sys_mkdir (gldir);
 
 	VID_SetPalette(palette);

common/gl_vidnt.c

@@ -1182,7 +1182,7 @@ char *VID_GetModeDescription (int mode)
 	}
 	else
 	{
-		sprintf (temp, "Desktop resolution (%dx%d)",
+		snprintf(temp, sizeof(temp), "Desktop resolution (%dx%d)",
 				 modelist[MODE_FULLSCREEN_DEFAULT].width,
 				 modelist[MODE_FULLSCREEN_DEFAULT].height);
 		pinfo = temp;
@@ -1207,11 +1207,11 @@ char *VID_GetExtModeDescription (int mode)
 	{
 		if (!leavecurrentmode)
 		{
-			sprintf(pinfo,"%s fullscreen", pv->modedesc);
+			snprintf(pinfo, sizeof(pinfo),"%s fullscreen", pv->modedesc);
 		}
 		else
 		{
-			sprintf (pinfo, "Desktop resolution (%dx%d)",
+			snprintf(pinfo, sizeof(pinfo), "Desktop resolution (%dx%d)",
 					 modelist[MODE_FULLSCREEN_DEFAULT].width,
 					 modelist[MODE_FULLSCREEN_DEFAULT].height);
 		}
@@ -1219,9 +1219,9 @@ char *VID_GetExtModeDescription (int mode)
 	else
 	{
 		if (modestate == MS_WINDOWED)
-			sprintf(pinfo, "%s windowed", pv->modedesc);
+			snprintf(pinfo, sizeof(pinfo), "%s windowed", pv->modedesc);
 		else
-			sprintf(pinfo, "windowed");
+			snprintf(pinfo, sizeof(pinfo), "windowed");
 	}
 
 	return pinfo;
@@ -1340,7 +1340,7 @@ void VID_InitDIB (HINSTANCE hInstance)
 	if (modelist[0].height < 240)
 		modelist[0].height = 240;
 
-	sprintf (modelist[0].modedesc, "%dx%d",
+	snprintf(modelist[0].modedesc, sizeof(modelist[0].modedesc), "%dx%d",
 			 modelist[0].width, modelist[0].height);
 
 	modelist[0].modenum = MODE_WINDOWED;
@@ -1393,7 +1393,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 				modelist[nummodes].dib = 1;
 				modelist[nummodes].fullscreen = 1;
 				modelist[nummodes].bpp = devmode.dmBitsPerPel;
-				sprintf (modelist[nummodes].modedesc, "%dx%dx%d",
+				snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%dx%dx%d",
 						 devmode.dmPelsWidth, devmode.dmPelsHeight,
 						 devmode.dmBitsPerPel);
 
@@ -1405,7 +1405,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 					{
 						modelist[nummodes].width >>= 1;
 						modelist[nummodes].halfscreen = 1;
-						sprintf (modelist[nummodes].modedesc, "%dx%dx%d",
+						snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%dx%dx%d",
 								 modelist[nummodes].width,
 								 modelist[nummodes].height,
 								 modelist[nummodes].bpp);
@@ -1458,7 +1458,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 				modelist[nummodes].dib = 1;
 				modelist[nummodes].fullscreen = 1;
 				modelist[nummodes].bpp = devmode.dmBitsPerPel;
-				sprintf (modelist[nummodes].modedesc, "%dx%dx%d",
+				snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%dx%dx%d",
 						 devmode.dmPelsWidth, devmode.dmPelsHeight,
 						 devmode.dmBitsPerPel);
 
@@ -1676,7 +1676,7 @@ void	VID_Init (unsigned char *palette)
 					modelist[nummodes].dib = 1;
 					modelist[nummodes].fullscreen = 1;
 					modelist[nummodes].bpp = bpp;
-					sprintf (modelist[nummodes].modedesc, "%dx%dx%d",
+					snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%dx%dx%d",
 							 devmode.dmPelsWidth, devmode.dmPelsHeight,
 							 devmode.dmBitsPerPel);
 
@@ -1808,7 +1808,7 @@ void	VID_Init (unsigned char *palette)
 
 	GL_Init ();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf(gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	vid_realmode = vid_modenum;

common/gl_warp.c

@@ -643,7 +643,7 @@ void R_LoadSkys (void)
 	for (i=0 ; i<6 ; i++)
 	{
 		GL_Bind (SKY_TEX + i);
-		sprintf (name, "gfx/env/bkgtst%s.tga", suf[i]);
+		snprintf(name, sizeof(name), "gfx/env/bkgtst%s.tga", suf[i]);
 		COM_FOpenFile (name, &f);
 		if (!f)
 		{

common/keys.c

@@ -805,7 +805,7 @@ void Key_Event (int key, qboolean down)
 		kb = keybindings[key];
 		if (kb && kb[0] == '+')
 		{
-			sprintf (cmd, "-%s %i\n", kb+1, key);
+			snprintf(cmd, sizeof(cmd), "-%s %i\n", kb+1, key);
 			Cbuf_AddText (cmd);
 		}
 		if (keyshift[key] != key)
@@ -813,7 +813,7 @@ void Key_Event (int key, qboolean down)
 			kb = keybindings[keyshift[key]];
 			if (kb && kb[0] == '+')
 			{
-				sprintf (cmd, "-%s %i\n", kb+1, key);
+				snprintf(cmd, sizeof(cmd), "-%s %i\n", kb+1, key);
 				Cbuf_AddText (cmd);
 			}
 		}
@@ -847,7 +847,7 @@ void Key_Event (int key, qboolean down)
 		{
 			if (kb[0] == '+')
 			{	// button commands add keynum as a parm
-				sprintf (cmd, "%s %i\n", kb, key);
+				snprintf(cmd, sizeof(cmd), "%s %i\n", kb, key);
 				Cbuf_AddText (cmd);
 			}
 			else

common/pr_cmds.c

@@ -1006,9 +1006,9 @@ void PF_ftos (void)
 	v = G_FLOAT(OFS_PARM0);
 	
 	if (v == (int)v)
-		sprintf (pr_string_temp, "%d",(int)v);
+		snprintf(pr_string_temp, sizeof(pr_string_temp), "%d",(int)v);
 	else
-		sprintf (pr_string_temp, "%5.1f",v);
+		snprintf(pr_string_temp, sizeof(pr_string_temp), "%5.1f",v);
 	G_INT(OFS_RETURN) = PR_SetString(pr_string_temp);
 }
 
@@ -1021,7 +1021,7 @@ void PF_fabs (void)
 
 void PF_vtos (void)
 {
-	sprintf (pr_string_temp, "'%5.1f %5.1f %5.1f'", G_VECTOR(OFS_PARM0)[0], G_VECTOR(OFS_PARM0)[1], G_VECTOR(OFS_PARM0)[2]);
+	snprintf(pr_string_temp, sizeof(pr_string_temp), "'%5.1f %5.1f %5.1f'", G_VECTOR(OFS_PARM0)[0], G_VECTOR(OFS_PARM0)[1], G_VECTOR(OFS_PARM0)[2]);
 	G_INT(OFS_RETURN) = PR_SetString(pr_string_temp);
 }
 
@@ -1818,7 +1818,7 @@ void PF_infokey (void)
 			value = strcpy(ov, NET_BaseAdrToString (svs.clients[e1-1].netchan.remote_address));
 		else if (!strcmp(key, "ping")) {
 			int ping = SV_CalcPing (&svs.clients[e1-1]);
-			sprintf(ov, "%d", ping);
+			snprintf(ov, sizeof(ov), "%d", ping);
 			value = ov;
 		} else
 			value = Info_ValueForKey (svs.clients[e1-1].userinfo, key);

common/pr_edict.c

@@ -318,33 +318,33 @@ char *PR_ValueString (etype_t type, eval_t *val)
 	switch (type)
 	{
 	case ev_string:
-		sprintf (line, "%s", PR_GetString(val->string));
+		snprintf(line, sizeof(line), "%s", PR_GetString(val->string));
 		break;
 	case ev_entity:	
-		sprintf (line, "entity %i", NUM_FOR_EDICT(PROG_TO_EDICT(val->edict)) );
+		snprintf(line, sizeof(line), "entity %i", NUM_FOR_EDICT(PROG_TO_EDICT(val->edict)) );
 		break;
 	case ev_function:
 		f = pr_functions + val->function;
-		sprintf (line, "%s()", PR_GetString(f->s_name));
+		snprintf(line, sizeof(line), "%s()", PR_GetString(f->s_name));
 		break;
 	case ev_field:
 		def = ED_FieldAtOfs ( val->_int );
-		sprintf (line, ".%s", PR_GetString(def->s_name));
+		snprintf(line, sizeof(line), ".%s", PR_GetString(def->s_name));
 		break;
 	case ev_void:
-		sprintf (line, "void");
+		snprintf(line, sizeof(line), "void");
 		break;
 	case ev_float:
-		sprintf (line, "%5.1f", val->_float);
+		snprintf(line, sizeof(line), "%5.1f", val->_float);
 		break;
 	case ev_vector:
-		sprintf (line, "'%5.1f %5.1f %5.1f'", val->vector[0], val->vector[1], val->vector[2]);
+		snprintf(line, sizeof(line), "'%5.1f %5.1f %5.1f'", val->vector[0], val->vector[1], val->vector[2]);
 		break;
 	case ev_pointer:
-		sprintf (line, "pointer");
+		snprintf(line, sizeof(line), "pointer");
 		break;
 	default:
-		sprintf (line, "bad type %i", type);
+		snprintf(line, sizeof(line), "bad type %i", type);
 		break;
 	}
 	
@@ -370,30 +370,30 @@ char *PR_UglyValueString (etype_t type, eval_t *val)
 	switch (type)
 	{
 	case ev_string:
-		sprintf (line, "%s", PR_GetString(val->string));
+		snprintf(line, sizeof(line), "%s", PR_GetString(val->string));
 		break;
 	case ev_entity:	
-		sprintf (line, "%i", NUM_FOR_EDICT(PROG_TO_EDICT(val->edict)));
+		snprintf(line, sizeof(line), "%i", NUM_FOR_EDICT(PROG_TO_EDICT(val->edict)));
 		break;
 	case ev_function:
 		f = pr_functions + val->function;
-		sprintf (line, "%s", PR_GetString(f->s_name));
+		snprintf(line, sizeof(line), "%s", PR_GetString(f->s_name));
 		break;
 	case ev_field:
 		def = ED_FieldAtOfs ( val->_int );
-		sprintf (line, "%s", PR_GetString(def->s_name));
+		snprintf(line, sizeof(line), "%s", PR_GetString(def->s_name));
 		break;
 	case ev_void:
-		sprintf (line, "void");
+		snprintf(line, sizeof(line), "void");
 		break;
 	case ev_float:
-		sprintf (line, "%f", val->_float);
+		snprintf(line, sizeof(line), "%f", val->_float);
 		break;
 	case ev_vector:
-		sprintf (line, "%f %f %f", val->vector[0], val->vector[1], val->vector[2]);
+		snprintf(line, sizeof(line), "%f %f %f", val->vector[0], val->vector[1], val->vector[2]);
 		break;
 	default:
-		sprintf (line, "bad type %i", type);
+		snprintf(line, sizeof(line), "bad type %i", type);
 		break;
 	}
 	
@@ -419,11 +419,11 @@ char *PR_GlobalString (int ofs)
 	val = (void *)&pr_globals[ofs];
 	def = ED_GlobalAtOfs(ofs);
 	if (!def)
-		sprintf (line,"%i(???)", ofs);
+		snprintf(line, sizeof(line),"%i(???)", ofs);
 	else
 	{
 		s = PR_ValueString (def->type, val);
-		sprintf (line,"%i(%s)%s", ofs, PR_GetString(def->s_name), s);
+		snprintf(line, sizeof(line),"%i(%s)%s", ofs, PR_GetString(def->s_name), s);
 	}
 	
 	i = strlen(line);
@@ -442,9 +442,9 @@ char *PR_GlobalStringNoContents (int ofs)
 	
 	def = ED_GlobalAtOfs(ofs);
 	if (!def)
-		sprintf (line,"%i(???)", ofs);
+		snprintf(line, sizeof(line),"%i(???)", ofs);
 	else
-		sprintf (line,"%i(%s)", ofs, PR_GetString(def->s_name));
+		snprintf(line, sizeof(line),"%i(%s)", ofs, PR_GetString(def->s_name));
 	
 	i = strlen(line);
 	for ( ; i<20 ; i++)
@@ -939,7 +939,7 @@ if (anglehack)
 {
 char	temp[32];
 strcpy (temp, com_token);
-sprintf (com_token, "0 %s 0", temp);
+snprintf(com_token, sizeof(com_token), "0 %s 0", temp);
 }
 
 		if (!ED_ParseEpair ((void *)&ent->v, key, com_token))
@@ -1092,7 +1092,7 @@ void PR_LoadProgs (void)
 
 #ifdef QUAKEWORLD
 // add prog crc to the serverinfo
-	sprintf (num, "%i", CRC_Block ((byte *)progs, com_filesize));
+	snprintf(num, sizeof(num), "%i", CRC_Block ((byte *)progs, com_filesize));
 	Info_SetValueForStarKey (svs.info, "*progs", num, MAX_SERVERINFO_STRING);
 #else
 	for (i=0 ; i<com_filesize ; i++)

common/skin.c

@@ -117,12 +117,12 @@ byte	*Skin_Cache (skin_t *skin)
 //
 // load the pic from disk
 //
-	sprintf (name, "skins/%s.pcx", skin->name);
+	snprintf(name, sizeof(name), "skins/%s.pcx", skin->name);
 	raw = COM_LoadTempFile (name);
 	if (!raw)
 	{
 		Con_Printf ("Couldn't load skin %s\n", name);
-		sprintf (name, "skins/%s.pcx", baseskin.string);
+		snprintf(name, sizeof(name), "skins/%s.pcx", baseskin.string);
 		raw = COM_LoadTempFile (name);
 		if (!raw)
 		{

common/sys_linux.c

@@ -221,7 +221,7 @@ void Sys_EditFile(char *filename) {
 			editor = getenv("EDIT");
 		if (!editor)
 			editor = "vi";
-		sprintf(cmd, "xterm -e %s %s", editor, filename);
+		snprintf(cmd, sizeof(cmd), "xterm -e %s %s", editor, filename);
 		system(cmd);
 	}
 }

common/vid_dos.c

@@ -654,7 +654,7 @@ void VID_MenuDraw (void)
 // line cursor
 	if (vid_testingmode)
 	{
-		sprintf (temp, "TESTING %s",
+		snprintf(temp, sizeof(temp), "TESTING %s",
 				modedescs[vid_line].desc);
 		M_Print (13*8, 36 + MAX_COLUMN_SIZE * 8 + 8*4, temp);
 		M_Print (9*8, 36 + MAX_COLUMN_SIZE * 8 + 8*6,
@@ -667,13 +667,13 @@ void VID_MenuDraw (void)
 		M_Print (6*8, 36 + MAX_COLUMN_SIZE * 8 + 8*3,
 				"T to test mode for 5 seconds");
 		ptr = VID_GetModeDescription (vid_modenum);
-		sprintf (temp, "D to make %s the default", ptr);
+		snprintf(temp, sizeof(temp), "D to make %s the default", ptr);
 		M_Print (6*8, 36 + MAX_COLUMN_SIZE * 8 + 8*5, temp);
 		ptr = VID_GetModeDescription ((int)_vid_default_mode.value);
 
 		if (ptr)
 		{
-			sprintf (temp, "Current default is %s", ptr);
+			snprintf(temp, sizeof(temp), "Current default is %s", ptr);
 			M_Print (7*8, 36 + MAX_COLUMN_SIZE * 8 + 8*6, temp);
 		}
 

common/vid_ext.c

@@ -338,13 +338,13 @@ void VID_InitExtra (void)
 			{
 				if (modeinfo.height > 999)
 				{
-					sprintf (&names[nummodes][0], "%4dx%4d", modeinfo.width,
+					snprintf(&names[nummodes][0], sizeof(&names[nummodes][0]), "%4dx%4d", modeinfo.width,
 							 modeinfo.height);
 					names[nummodes][9] = 0;
 				}
 				else
 				{
-					sprintf (&names[nummodes][0], "%4dx%3d", modeinfo.width,
+					snprintf(&names[nummodes][0], sizeof(&names[nummodes][0]), "%4dx%3d", modeinfo.width,
 							 modeinfo.height);
 					names[nummodes][8] = 0;
 				}
@@ -353,13 +353,13 @@ void VID_InitExtra (void)
 			{
 				if (modeinfo.height > 999)
 				{
-					sprintf (&names[nummodes][0], "%3dx%4d", modeinfo.width,
+					snprintf(&names[nummodes][0], sizeof(&names[nummodes][0]), "%3dx%4d", modeinfo.width,
 							 modeinfo.height);
 					names[nummodes][8] = 0;
 				}
 				else
 				{
-					sprintf (&names[nummodes][0], "%3dx%3d", modeinfo.width,
+					snprintf(&names[nummodes][0], sizeof(&names[nummodes][0]), "%3dx%3d", modeinfo.width,
 							 modeinfo.height);
 					names[nummodes][7] = 0;
 				}

common/vid_svgalib.c

@@ -1007,7 +1007,7 @@ char *VID_ModeInfo (int modenum)
 
 	if (modenum == 0)
 	{
-		sprintf (modestr, "%d x %d, %d bpp",
+		snprintf(modestr, sizeof(modestr), "%d x %d, %d bpp",
 				 vid.width, vid.height, modes[current_mode].bytesperpixel*8);
 		return (modestr);
 	}

common/vid_win.c

@@ -538,7 +538,7 @@ void VID_InitMGLFull (HINSTANCE hInstance)
 				modelist[curmode].type = MS_FULLSCREEN;
 				modelist[curmode].width = xRes;
 				modelist[curmode].height = yRes;
-				sprintf (modelist[curmode].modedesc, "%dx%d", xRes, yRes);
+				snprintf(modelist[curmode].modedesc, sizeof(modelist[curmode].modedesc), "%dx%d", xRes, yRes);
 
 				if (m[i] == grVGA_320x200x256)
 					modelist[curmode].mode13 = 1;
@@ -560,7 +560,7 @@ void VID_InitMGLFull (HINSTANCE hInstance)
 			modelist[MODE_FULLSCREEN_DEFAULT].stretched = 1;
 			modelist[MODE_FULLSCREEN_DEFAULT].width >>= 1;
 			modelist[MODE_FULLSCREEN_DEFAULT].height >>= 1;
-			sprintf (modelist[MODE_FULLSCREEN_DEFAULT].modedesc, "%dx%d",
+			snprintf(modelist[MODE_FULLSCREEN_DEFAULT].modedesc, sizeof(modelist[MODE_FULLSCREEN_DEFAULT].modedesc), "%dx%d",
 					 modelist[MODE_FULLSCREEN_DEFAULT].width,
 					 modelist[MODE_FULLSCREEN_DEFAULT].height);
 		}
@@ -788,7 +788,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 				modelist[nummodes].dib = 1;
 				modelist[nummodes].fullscreen = 1;
 				modelist[nummodes].bpp = devmode.dmBitsPerPel;
-				sprintf (modelist[nummodes].modedesc, "%ldx%ld",
+				snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%ldx%ld",
 						 devmode.dmPelsWidth, devmode.dmPelsHeight);
 
 			// if the width is more than twice the height, reduce it by half because this
@@ -799,7 +799,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 					{
 						modelist[nummodes].width >>= 1;
 						modelist[nummodes].halfscreen = 1;
-						sprintf (modelist[nummodes].modedesc, "%dx%d",
+						snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%dx%d",
 								 modelist[nummodes].width,
 								 modelist[nummodes].height);
 					}
@@ -867,7 +867,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 					modelist[nummodes].dib = 1;
 					modelist[nummodes].fullscreen = 1;
 					modelist[nummodes].bpp = devmode.dmBitsPerPel;
-					sprintf (modelist[nummodes].modedesc, "%ldx%ld",
+					snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%ldx%ld",
 							 devmode.dmPelsWidth, devmode.dmPelsHeight);
 
 				// if the width is more than twice the height, reduce it by half because this
@@ -878,7 +878,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 						{
 							modelist[nummodes].width >>= 1;
 							modelist[nummodes].halfscreen = 1;
-							sprintf (modelist[nummodes].modedesc, "%dx%d",
+							snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%dx%d",
 									 modelist[nummodes].width,
 									 modelist[nummodes].height);
 						}
@@ -951,7 +951,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 					modelist[nummodes].dib = 1;
 					modelist[nummodes].fullscreen = 1;
 					modelist[nummodes].bpp = devmode.dmBitsPerPel;
-					sprintf (modelist[nummodes].modedesc, "%ldx%ld",
+					snprintf(modelist[nummodes].modedesc, sizeof(modelist[nummodes].modedesc), "%ldx%ld",
 							 devmode.dmPelsWidth, devmode.dmPelsHeight);
 
 			// we only want the lowest-bpp version of each mode
@@ -1023,7 +1023,7 @@ void VID_InitFullDIB (HINSTANCE hInstance)
 			modelist[istretch].width >>= 1;
 			modelist[istretch].height >>= 1;
 			modelist[istretch].stretched = 1;
-			sprintf (modelist[istretch].modedesc, "%dx%d",
+			snprintf(modelist[istretch].modedesc, sizeof(modelist[istretch].modedesc), "%dx%d",
 					 modelist[istretch].width, modelist[istretch].height);
 		}
 	}
@@ -1083,7 +1083,7 @@ void VID_CheckModedescFixup (int mode)
 
 		x = (int)vid_config_x.value;
 		y = (int)vid_config_y.value;
-		sprintf (modelist[mode].modedesc, "%dx%d", x, y);
+		snprintf(modelist[mode].modedesc, sizeof(modelist[mode].modedesc), "%dx%d", x, y);
 		modelist[mode].width = x;
 		modelist[mode].height = y;
 	}
@@ -1161,15 +1161,15 @@ char *VID_GetModeDescription2 (int mode)
 
 	if (modelist[mode].type == MS_FULLSCREEN)
 	{
-		sprintf(pinfo,"%s fullscreen", pv->modedesc);
+		snprintf(pinfo, sizeof(pinfo),"%s fullscreen", pv->modedesc);
 	}
 	else if (modelist[mode].type == MS_FULLDIB)
 	{
-		sprintf(pinfo,"%s fullscreen", pv->modedesc);
+		snprintf(pinfo, sizeof(pinfo),"%s fullscreen", pv->modedesc);
 	}
 	else
 	{
-		sprintf(pinfo, "%s windowed", pv->modedesc);
+		snprintf(pinfo, sizeof(pinfo), "%s windowed", pv->modedesc);
 	}
 
 	return pinfo;
@@ -1191,16 +1191,16 @@ char *VID_GetExtModeDescription (int mode)
 	pv = VID_GetModePtr (mode);
 	if (modelist[mode].type == MS_FULLSCREEN)
 	{
-		sprintf(pinfo,"%s fullscreen %s",pv->modedesc,
+		snprintf(pinfo, sizeof(pinfo),"%s fullscreen %s",pv->modedesc,
 				MGL_modeDriverName(pv->modenum));
 	}
 	else if (modelist[mode].type == MS_FULLDIB)
 	{
-		sprintf(pinfo,"%s fullscreen DIB", pv->modedesc);
+		snprintf(pinfo, sizeof(pinfo),"%s fullscreen DIB", pv->modedesc);
 	}
 	else
 	{
-		sprintf(pinfo, "%s windowed", pv->modedesc);
+		snprintf(pinfo, sizeof(pinfo), "%s windowed", pv->modedesc);
 	}
 
 	return pinfo;
@@ -3245,7 +3245,7 @@ void VID_MenuDraw (void)
 // line cursor
 	if (vid_testingmode)
 	{
-		sprintf (temp, "TESTING %s",
+		snprintf(temp, sizeof(temp), "TESTING %s",
 				modedescs[vid_line].desc);
 		M_Print (13*8, 36 + MODE_AREA_HEIGHT * 8 + 8*4, temp);
 		M_Print (9*8, 36 + MODE_AREA_HEIGHT * 8 + 8*6,
@@ -3261,7 +3261,7 @@ void VID_MenuDraw (void)
 
 		if (ptr)
 		{
-			sprintf (temp, "D to set default: %s", ptr);
+			snprintf(temp, sizeof(temp), "D to set default: %s", ptr);
 			M_Print (2*8, 36 + MODE_AREA_HEIGHT * 8 + 8*5, temp);
 		}
 
@@ -3269,7 +3269,7 @@ void VID_MenuDraw (void)
 
 		if (ptr)
 		{
-			sprintf (temp, "Current default: %s", ptr);
+			snprintf(temp, sizeof(temp), "Current default: %s", ptr);
 			M_Print (3*8, 36 + MODE_AREA_HEIGHT * 8 + 8*6, temp);
 		}
 

qw_client/cl_cam.c

@@ -124,7 +124,7 @@ void Cam_Lock(int playernum)
 {
 	char st[40];
 
-	sprintf(st, "ptrack %i", playernum);
+	snprintf(st, sizeof(st), "ptrack %i", playernum);
 	MSG_WriteByte (&cls.netchan.message, clc_stringcmd);
 	MSG_WriteString (&cls.netchan.message, st);
 	spec_track = playernum;

qw_client/cl_demo.c

@@ -402,7 +402,7 @@ void CL_Record_f (void)
 	if (cls.demorecording)
 		CL_Stop_f();
   
-	sprintf (name, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf(name, sizeof(name), "%s/%s", com_gamedir, Cmd_Argv(1));
 
 //
 // open the demo file
@@ -688,7 +688,7 @@ void CL_ReRecord_f (void)
 	if (cls.demorecording)
 		CL_Stop_f();
   
-	sprintf (name, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf(name, sizeof(name), "%s/%s", com_gamedir, Cmd_Argv(1));
 
 //
 // open the demo file

qw_client/cl_main.c

@@ -238,7 +238,7 @@ void CL_SendConnectPacket (void)
 	//Info_SetValueForStarKey (cls.userinfo, "*ip", NET_AdrToString(adr), MAX_INFO_STRING);
 
 //	Con_Printf ("Connecting to %s...\n", cls.servername);
-	sprintf (data, "%c%c%c%cconnect %i %i %i \"%s\"\n",
+	snprintf(data, sizeof(data), "%c%c%c%cconnect %i %i %i \"%s\"\n",
 		255, 255, 255, 255,	PROTOCOL_VERSION, cls.qport, cls.challenge, cls.userinfo);
 	NET_SendPacket (strlen(data), data, adr);
 }
@@ -285,7 +285,7 @@ void CL_CheckForResend (void)
 	connect_time = realtime+t2-t1;	// for retransmit requests
 
 	Con_Printf ("Connecting to %s...\n", cls.servername);
-	sprintf (data, "%c%c%c%cgetchallenge\n", 255, 255, 255, 255);
+	snprintf(data, sizeof(data), "%c%c%c%cgetchallenge\n", 255, 255, 255, 255);
 	NET_SendPacket (strlen(data), data, adr);
 }
 
@@ -565,9 +565,9 @@ void CL_Color_f (void)
 	if (bottom > 13)
 		bottom = 13;
 	
-	sprintf (num, "%i", top);
+	snprintf(num, sizeof(num), "%i", top);
 	Cvar_Set ("topcolor", num);
-	sprintf (num, "%i", bottom);
+	snprintf(num, sizeof(num), "%i", bottom);
 	Cvar_Set ("bottomcolor", num);
 }
 
@@ -755,7 +755,7 @@ void CL_NextDemo (void)
 		}
 	}
 
-	sprintf (str,"playdemo %s\n", cls.demos[cls.demonum]);
+	snprintf(str, sizeof(str),"playdemo %s\n", cls.demos[cls.demonum]);
 	Cbuf_InsertText (str);
 	cls.demonum++;
 }
@@ -1028,7 +1028,7 @@ void CL_Download_f (void)
 		return;
 	}
 
-	sprintf (cls.downloadname, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf(cls.downloadname, sizeof(cls.downloadname), "%s/%s", com_gamedir, Cmd_Argv(1));
 
 	p = cls.downloadname;
 	for (;;) {

qw_client/cl_parse.c

@@ -364,9 +364,9 @@ void CL_ParseDownload (void)
 	if (!cls.download)
 	{
 		if (strncmp(cls.downloadtempname,"skins/",6))
-			sprintf (name, "%s/%s", com_gamedir, cls.downloadtempname);
+			snprintf(name, sizeof(name), "%s/%s", com_gamedir, cls.downloadtempname);
 		else
-			sprintf (name, "qw/%s", cls.downloadtempname);
+			snprintf(name, sizeof(name), "qw/%s", cls.downloadtempname);
 
 		COM_CreatePath (name);
 
@@ -414,11 +414,11 @@ void CL_ParseDownload (void)
 		// rename the temp file to it's final name
 		if (strcmp(cls.downloadtempname, cls.downloadname)) {
 			if (strncmp(cls.downloadtempname,"skins/",6)) {
-				sprintf (oldn, "%s/%s", com_gamedir, cls.downloadtempname);
+				snprintf(oldn, sizeof(oldn), "%s/%s", com_gamedir, cls.downloadtempname);
-				sprintf (newn, "%s/%s", com_gamedir, cls.downloadname);
+				snprintf(newn, sizeof(newn), "%s/%s", com_gamedir, cls.downloadname);
 			} else {
-				sprintf (oldn, "qw/%s", cls.downloadtempname);
+				snprintf(oldn, sizeof(oldn), "qw/%s", cls.downloadtempname);
-				sprintf (newn, "qw/%s", cls.downloadname);
+				snprintf(newn, sizeof(newn), "qw/%s", cls.downloadname);
 			}
 			r = rename (oldn, newn);
 			if (r)
@@ -559,7 +559,7 @@ void CL_ParseServerData (void)
 	//ZOID--run the autoexec.cfg in the gamedir
 	//if it exists
 	if (cflag) {
-		sprintf(fn, "%s/%s", com_gamedir, "config.cfg");
+		snprintf(fn, sizeof(fn), "%s/%s", com_gamedir, "config.cfg");
 		if ((f = fopen(fn, "r")) != NULL) {
 			fclose(f);
 			Cbuf_AddText ("cl_warncmd 0\n");

qw_client/cl_pred.c

@@ -146,7 +146,7 @@ void CL_PredictMove (void)
 		char		text[1024];
 
 		cls.state = ca_active;
-		sprintf (text, "QuakeWorld: %s", cls.servername);
+		snprintf(text, sizeof(text), "QuakeWorld: %s", cls.servername);
 #ifdef _WIN32
 		SetWindowText (mainwindow, text);
 #endif

qw_client/gl_model.c

@@ -906,7 +906,7 @@ void Mod_LoadLeafs (lump_t *l)
 
 	loadmodel->leafs = out;
 	loadmodel->numleafs = count;
-	sprintf(s, "maps/%s.bsp", Info_ValueForKey(cl.serverinfo,"map"));
+	snprintf(s, sizeof(s), "maps/%s.bsp", Info_ValueForKey(cl.serverinfo,"map"));
 	if (!strcmp(s, loadmodel->name))
 		isnotmap = false;
 	for ( i=0 ; i<count ; i++, in++, out++)
@@ -1240,7 +1240,7 @@ void Mod_LoadBrushModel (model_t *mod, void *buffer)
 		{	// duplicate the basic information
 			char	name[10];
 
-			sprintf (name, "*%i", i+1);
+			snprintf(name, sizeof(name), "*%i", i+1);
 			loadmodel = Mod_FindName (name);
 			*loadmodel = *mod;
 			strcpy (loadmodel->name, name);
@@ -1463,7 +1463,7 @@ void *Mod_LoadAllSkins (int numskins, daliasskintype_t *pskintype)
 					Sys_Error ("Player skin too large");
 				memcpy (player_8bit_texels, (byte *)(pskintype + 1), s);
 			}
-			sprintf (name, "%s_%i", loadmodel->name, i);
+			snprintf(name, sizeof(name), "%s_%i", loadmodel->name, i);
 			pheader->gl_texturenum[i][0] =
 			pheader->gl_texturenum[i][1] =
 			pheader->gl_texturenum[i][2] =
@@ -1483,7 +1483,7 @@ void *Mod_LoadAllSkins (int numskins, daliasskintype_t *pskintype)
 			for (j=0 ; j<groupskins ; j++)
 			{
 					Mod_FloodFillSkin( skin, pheader->skinwidth, pheader->skinheight );
-					sprintf (name, "%s_%i_%i", loadmodel->name, i,j);
+					snprintf(name, sizeof(name), "%s_%i_%i", loadmodel->name, i,j);
 					pheader->gl_texturenum[i][j&3] = 
 						GL_LoadTexture (name, pheader->skinwidth, 
 						pheader->skinheight, (byte *)(pskintype), true, false);
@@ -1530,14 +1530,14 @@ void Mod_LoadAliasModel (model_t *mod, void *buffer)
 		for (len = com_filesize, p = buffer; len; len--, p++)
 			CRC_ProcessByte(&crc, *p);
 	
-		sprintf(st, "%d", (int) crc);
+		snprintf(st, sizeof(st), "%d", (int) crc);
 		Info_SetValueForKey (cls.userinfo, 
 			!strcmp(loadmodel->name, "progs/player.mdl") ? pmodel_name : emodel_name,
 			st, MAX_INFO_STRING);
 
 		if (cls.state >= ca_connected) {
 			MSG_WriteByte (&cls.netchan.message, clc_stringcmd);
-			sprintf(st, "setinfo %s %d", 
+			snprintf(st, sizeof(st), "setinfo %s %d", 
 				!strcmp(loadmodel->name, "progs/player.mdl") ? pmodel_name : emodel_name,
 				(int)crc);
 			SZ_Print (&cls.netchan.message, st);
@@ -1727,7 +1727,7 @@ void * Mod_LoadSpriteFrame (void * pin, mspriteframe_t **ppframe, int framenum)
 	pspriteframe->left = origin[0];
 	pspriteframe->right = width + origin[0];
 
-	sprintf (name, "%s_%i", loadmodel->name, framenum);
+	snprintf(name, sizeof(name), "%s_%i", loadmodel->name, framenum);
 	pspriteframe->gl_texturenum = GL_LoadTexture (name, width, height, (byte *)(pinframe + 1), true, true);
 
 	return (void *)((byte *)pinframe + sizeof (dspriteframe_t) + size);

qw_client/gl_ngraph.c

@@ -111,7 +111,7 @@ void R_NetGraph (void)
 	M_DrawTextBox (x, y, NET_TIMINGS/8, NET_GRAPHHEIGHT/8 + 1);
 	y += 8;
 
-	sprintf(st, "%3i%% packet loss", lost);
+	snprintf(st, sizeof(st), "%3i%% packet loss", lost);
 	Draw_String(8, y, st);
 	y += 8;
 	

qw_client/gl_screen.c

@@ -479,7 +479,7 @@ void SCR_DrawFPS (void)
 		lastframetime = t;
 	}
 
-	sprintf(st, "%3d FPS", lastfps);
+	snprintf(st, sizeof(st), "%3d FPS", lastfps);
 	x = vid.width - strlen(st) * 8 - 8;
 	y = vid.height - sb_lines - 8;
 //	Draw_TileClear(x, y, strlen(st) * 8, 8);
@@ -637,7 +637,7 @@ void SCR_ScreenShot_f (void)
 	{ 
 		pcxname[5] = i/10 + '0'; 
 		pcxname[6] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf(checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;  // file doesn't exist
 	} 
@@ -862,7 +862,7 @@ void SCR_RSShot_f (void)
 	{ 
 		pcxname[6] = i/10 + '0'; 
 		pcxname[7] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf(checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

qw_client/gl_vidlinux_x11.c

@@ -500,9 +500,9 @@ void	VID_SetPalette (unsigned char *palette)
 			}
 			d_15to8table[i]=k;
 		}
-		sprintf(s, "%s/glquake", com_gamedir);
+		snprintf(s, sizeof(s), "%s/glquake", com_gamedir);
  		Sys_mkdir (s);
-		sprintf(s, "%s/glquake/15to8.pal", com_gamedir);
+		snprintf(s, sizeof(s), "%s/glquake/15to8.pal", com_gamedir);
 		if ((f = fopen(s, "wb")) != NULL) {
 			fwrite(d_15to8table, 1<<15, 1, f);
 			fclose(f);
@@ -753,7 +753,7 @@ void VID_Init(unsigned char *palette)
 
 	GL_Init();
 
-	sprintf (gldir, "%s/glquake", com_gamedir);
+	snprintf(gldir, sizeof(gldir), "%s/glquake", com_gamedir);
 	Sys_mkdir (gldir);
 
 	VID_SetPalette(palette);

qw_client/menu.c

@@ -794,7 +794,7 @@ void M_Keys_Key (int k)
 		}
 		else if (k != '`')
 		{
-			sprintf (cmd, "bind %s \"%s\"\n", Key_KeynumToString (k), bindnames[keys_cursor][0]);			
+			snprintf(cmd, sizeof(cmd), "bind %s \"%s\"\n", Key_KeynumToString (k), bindnames[keys_cursor][0]);			
 			Cbuf_InsertText (cmd);
 		}
 		

qw_client/model.c

@@ -1207,7 +1207,7 @@ void Mod_LoadBrushModel (model_t *mod, void *buffer)
 		{	// duplicate the basic information
 			char	name[10];
 
-			sprintf (name, "*%i", i+1);
+			snprintf(name, sizeof(name), "*%i", i+1);
 			loadmodel = Mod_FindName (name);
 			*loadmodel = *mod;
 			strcpy (loadmodel->name, name);
@@ -1463,14 +1463,14 @@ void Mod_LoadAliasModel (model_t *mod, void *buffer)
 		for (len = com_filesize, p = buffer; len; len--, p++)
 			CRC_ProcessByte(&crc, *p);
 	
-		sprintf(st, "%d", (int) crc);
+		snprintf(st, sizeof(st), "%d", (int) crc);
 		Info_SetValueForKey (cls.userinfo, 
 			!strcmp(loadmodel->name, "progs/player.mdl") ? pmodel_name : emodel_name,
 			st, MAX_INFO_STRING);
 
 		if (cls.state >= ca_connected) {
 			MSG_WriteByte (&cls.netchan.message, clc_stringcmd);
-			sprintf(st, "setinfo %s %d", 
+			snprintf(st, sizeof(st), "setinfo %s %d", 
 				!strcmp(loadmodel->name, "progs/player.mdl") ? pmodel_name : emodel_name,
 				(int)crc);
 			SZ_Print (&cls.netchan.message, st);

qw_client/r_misc.c

@@ -232,7 +232,7 @@ void R_NetGraph (void)
 		i = (cls.netchan.outgoing_sequence-a) & NET_TIMINGSMASK;
 		R_LineGraph (x+w-1-a, y, packet_latency[i]);
 	}
-	sprintf(st, "%3i%% packet loss", lost);
+	snprintf(st, sizeof(st), "%3i%% packet loss", lost);
 	Draw_String(8, y2, st);
 }
 

qw_client/r_part.c

@@ -92,7 +92,7 @@ void R_ReadPointFile_f (void)
 	particle_t	*p;
 	char	name[MAX_OSPATH];
 	
-// FIXME	sprintf (name,"maps/%s.pts", sv.name);
+// FIXME	snprintf(name, sizeof(name),"maps/%s.pts", sv.name);
 
 	COM_FOpenFile (name, &f);
 	if (!f)

qw_client/sbar.c

@@ -486,7 +486,7 @@ void Sbar_SoloScoreboard (void)
 	seconds = cl.time - 60*minutes;
 	tens = seconds / 10;
 	units = seconds - 10*tens;
-	sprintf (str,"Time :%3i:%i%i", minutes, tens, units);
+	snprintf(str, sizeof(str),"Time :%3i:%i%i", minutes, tens, units);
 	Sbar_DrawString (184, 4, str);
 }
 
@@ -546,7 +546,7 @@ void Sbar_DrawInventory (void)
 // ammo counts
 	for (i=0 ; i<4 ; i++)
 	{
-		sprintf (num, "%3i",cl.stats[STAT_SHELLS+i] );
+		snprintf(num, sizeof(num), "%3i",cl.stats[STAT_SHELLS+i] );
 		if (headsup) {
 //			Sbar_DrawSubPic(3, -24, sb_ibar, 3, 0, 42,11);
 			Sbar_DrawSubPic((hudswap) ? 0 : (vid.width-42), -24 - (4-i)*11, sb_ibar, 3+(i*48), 0, 42, 11);
@@ -647,7 +647,7 @@ void Sbar_DrawFrags (void)
 
 	// draw number
 		f = s->frags;
-		sprintf (num, "%3i",f);
+		snprintf(num, sizeof(num), "%3i",f);
 		
 		Sbar_DrawCharacter ( (x+1)*8 , -24, num[0]);
 		Sbar_DrawCharacter ( (x+2)*8 , -24, num[1]);
@@ -806,7 +806,7 @@ void Sbar_Draw (void)
 					Sbar_DrawNormal ();
 
 //					Sbar_DrawString (160-14*8+4,4, "SPECTATOR MODE - TRACK CAMERA");
-				sprintf(st, "Tracking %-.13s, [JUMP] for next",
+				snprintf(st, sizeof(st), "Tracking %-.13s, [JUMP] for next",
 						cl.players[spec_track].name);
 				Sbar_DrawString(0, -8, st);
 			}
@@ -953,7 +953,7 @@ void Sbar_TeamOverlay (void)
 		if (pavg < 0 || pavg > 999)
 			pavg = 999;
 
-		sprintf (num, "%3i/%3i/%3i", plow, pavg, phigh);
+		snprintf(num, sizeof(num), "%3i/%3i/%3i", plow, pavg, phigh);
 		Draw_String ( x, y, num);
 
 	// draw team
@@ -962,11 +962,11 @@ void Sbar_TeamOverlay (void)
 		Draw_String (x + 104, y, team);
 
 	// draw total
-		sprintf (num, "%5i", tm->frags);
+		snprintf(num, sizeof(num), "%5i", tm->frags);
 		Draw_String (x + 104 + 40, y, num);
 		
 	// draw players
-		sprintf (num, "%5i", tm->players);
+		snprintf(num, sizeof(num), "%5i", tm->players);
 		Draw_String (x + 104 + 88, y, num);
 		
 		if (!strncmp(Info_ValueForKey(cl.players[cl.playernum].userinfo,
@@ -1066,12 +1066,12 @@ void Sbar_DeathmatchOverlay (int start)
 		p = s->ping;
 		if (p < 0 || p > 999)
 			p = 999;
-		sprintf (num, "%4i", p);
+		snprintf(num, sizeof(num), "%4i", p);
 		Draw_String ( x, y, num);
 
 		// draw pl
 		p = s->pl;
-		sprintf (num, "%3i", p);
+		snprintf(num, sizeof(num), "%3i", p);
 		if (p > 25)
 			Draw_Alt_String ( x+32, y, num);
 		else
@@ -1096,7 +1096,7 @@ void Sbar_DeathmatchOverlay (int start)
 		else
 			total = realtime - s->entertime;
 		minutes = (int)total/60;
-		sprintf (num, "%4i", minutes);
+		snprintf(num, sizeof(num), "%4i", minutes);
 		Draw_String ( x+64 , y, num);
 
 		// draw background
@@ -1113,7 +1113,7 @@ void Sbar_DeathmatchOverlay (int start)
 
 	// draw number
 		f = s->frags;
-		sprintf (num, "%3i",f);
+		snprintf(num, sizeof(num), "%3i",f);
 		
 		Draw_Character ( x+112 , y, num[0]);
 		Draw_Character ( x+120 , y, num[1]);
@@ -1225,7 +1225,7 @@ void Sbar_MiniDeathmatchOverlay (void)
 
 	// draw number
 		f = s->frags;
-		sprintf (num, "%3i",f);
+		snprintf(num, sizeof(num), "%3i",f);
 		
 		Draw_Character ( x+8 , y, num[0]);
 		Draw_Character ( x+16, y, num[1]);
@@ -1278,7 +1278,7 @@ void Sbar_MiniDeathmatchOverlay (void)
 		Draw_String (x, y, team);
 
 	// draw total
-		sprintf (num, "%5i", tm->frags);
+		snprintf(num, sizeof(num), "%5i", tm->frags);
 		Draw_String (x + 40, y, num);
 		
 		if (!strncmp(Info_ValueForKey(cl.players[cl.playernum].userinfo,

qw_client/screen.c

@@ -472,7 +472,7 @@ void SCR_DrawFPS (void)
 		lastframetime = t;
 	}
 
-	sprintf(st, "%3d FPS", lastfps);
+	snprintf(st, sizeof(st), "%3d FPS", lastfps);
 	x = vid.width - strlen(st) * 8 - 8;
 	y = vid.height - sb_lines - 8;
 //	Draw_TileClear(x, y, strlen(st) * 8, 8);
@@ -671,7 +671,7 @@ void SCR_ScreenShot_f (void)
 	{ 
 		pcxname[5] = i/10 + '0'; 
 		pcxname[6] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf(checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 
@@ -819,7 +819,7 @@ void SCR_RSShot_f (void)
 	{ 
 		pcxname[6] = i/10 + '0'; 
 		pcxname[7] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf(checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

qw_common/common.c

@@ -1309,7 +1309,7 @@ void COM_WriteFile (char *filename, void *data, int len)
 	FILE	*f;
 	char	name[MAX_OSPATH];
 	
-	sprintf (name, "%s/%s", com_gamedir, filename);
+	snprintf(name, sizeof(name), "%s/%s", com_gamedir, filename);
 	
 	f = fopen (name, "wb");
 	if (!f) {
@@ -1430,7 +1430,7 @@ int COM_FOpenFile (char *filename, FILE **file)
 		else
 		{		
 	// check a file in the directory tree
-			sprintf (netpath, "%s/%s",search->filename, filename);
+			snprintf(netpath, sizeof(netpath), "%s/%s",search->filename, filename);
 			
 			findtime = Sys_FileTime (netpath);
 			if (findtime == -1)
@@ -1648,7 +1648,7 @@ void COM_AddGameDirectory (char *dir)
 //
 	for (i=0 ; ; i++)
 	{
-		sprintf (pakfile, "%s/pak%i.pak", dir, i);
+		snprintf(pakfile, sizeof(pakfile), "%s/pak%i.pak", dir, i);
 		pak = COM_LoadPackFile (pakfile);
 		if (!pak)
 			break;
@@ -1709,7 +1709,7 @@ void COM_Gamedir (char *dir)
 	if (!strcmp(dir,"id1") || !strcmp(dir, "qw"))
 		return;
 
-	sprintf (com_gamedir, "%s/%s", com_basedir, dir);
+	snprintf(com_gamedir, sizeof(com_gamedir), "%s/%s", com_basedir, dir);
 
 	//
 	// add the directory to the search path
@@ -1724,7 +1724,7 @@ void COM_Gamedir (char *dir)
 	//
 	for (i=0 ; ; i++)
 	{
-		sprintf (pakfile, "%s/pak%i.pak", com_gamedir, i);
+		snprintf(pakfile, sizeof(pakfile), "%s/pak%i.pak", com_gamedir, i);
 		pak = COM_LoadPackFile (pakfile);
 		if (!pak)
 			break;
@@ -1957,7 +1957,7 @@ void Info_SetValueForStarKey (char *s, char *key, char *value, int maxsize)
 	if (!value || !strlen(value))
 		return;
 
-	sprintf (new, "\\%s\\%s", key, value);
+	snprintf(new, sizeof(new), "\\%s\\%s", key, value);
 
 	if ((int)(strlen(new) + strlen(s)) > maxsize)
 	{

qw_common/console.c

@@ -619,7 +619,7 @@ void Con_DrawConsole (int lines)
 		dlbar[i++] = '\x82';
 		dlbar[i] = 0;
 
-		sprintf(dlbar + strlen(dlbar), " %02d%%", cls.downloadpercent);
+		snprintf(dlbar + strlen(dlbar), sizeof(dlbar + strlen(dlbar)), " %02d%%", cls.downloadpercent);
 
 		// draw it
 		y = con_vislines-22 + 8;

qw_common/cvar.c

@@ -160,7 +160,7 @@ void Cvar_SetValue (char *var_name, float value)
 {
 	char	val[32];
 	
-	sprintf (val, "%f",value);
+	snprintf(val, sizeof(val), "%f",value);
 	Cvar_Set (var_name, val);
 }
 

qw_common/net_udp.c

@@ -112,7 +112,7 @@ char	*NET_AdrToString (netadr_t a)
 {
 	static	char	s[64];
 	
-	sprintf (s, "%i.%i.%i.%i:%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3], ntohs(a.port));
+	snprintf(s, sizeof(s), "%i.%i.%i.%i:%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3], ntohs(a.port));
 
 	return s;
 }
@@ -121,7 +121,7 @@ char	*NET_BaseAdrToString (netadr_t a)
 {
 	static	char	s[64];
 	
-	sprintf (s, "%i.%i.%i.%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3]);
+	snprintf(s, sizeof(s), "%i.%i.%i.%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3]);
 
 	return s;
 }

qw_server/model.c

@@ -1126,7 +1126,7 @@ void Mod_LoadBrushModel (model_t *mod, void *buffer)
 		{	// duplicate the basic information
 			char	name[10];
 
-			sprintf (name, "*%i", i+1);
+			snprintf(name, sizeof(name), "*%i", i+1);
 			loadmodel = Mod_FindName (name);
 			*loadmodel = *mod;
 			strcpy (loadmodel->name, name);

qw_server/sv_ccmds.c

@@ -104,7 +104,7 @@ void SV_Logfile_f (void)
 		return;
 	}
 
-	sprintf (name, "%s/qconsole.log", com_gamedir);
+	snprintf(name, sizeof(name), "%s/qconsole.log", com_gamedir);
 	Con_Printf ("Logging text to %s.\n", name);
 	sv_logfile = fopen (name, "w");
 	if (!sv_logfile)
@@ -133,7 +133,7 @@ void SV_Fraglogfile_f (void)
 	// find an unused name
 	for (i=0 ; i<1000 ; i++)
 	{
-		sprintf (name, "%s/frag_%i.log", com_gamedir, i);
+		snprintf(name, sizeof(name), "%s/frag_%i.log", com_gamedir, i);
 		sv_fraglogfile = fopen (name, "r");
 		if (!sv_fraglogfile)
 		{	// can't read it, so create this one
@@ -321,7 +321,7 @@ void SV_Map_f (void)
 #endif
 
 	// check to make sure the level exists
-	sprintf (expanded, "maps/%s.bsp", level);
+	snprintf(expanded, sizeof(expanded), "maps/%s.bsp", level);
 	COM_FOpenFile (expanded, &f);
 	if (!f)
 	{
@@ -724,7 +724,7 @@ void SV_Floodprotmsg_f (void)
 		Con_Printf("Usage: floodprotmsg \"<message>\"\n");
 		return;
 	}
-	sprintf(fp_msg, "%s", Cmd_Argv(1));
+	snprintf(fp_msg, sizeof(fp_msg), "%s", Cmd_Argv(1));
 }
   
 /*
@@ -788,9 +788,9 @@ void SV_Snap (int uid)
 		return;
 	}
 
-	sprintf(pcxname, "%d-00.pcx", uid);
+	snprintf(pcxname, sizeof(pcxname), "%d-00.pcx", uid);
 
-	sprintf(checkname, "%s/snap", gamedirfile);
+	snprintf(checkname, sizeof(checkname), "%s/snap", gamedirfile);
 	Sys_mkdir(gamedirfile);
 	Sys_mkdir(checkname);
 		
@@ -798,7 +798,7 @@ void SV_Snap (int uid)
 	{ 
 		pcxname[strlen(pcxname) - 6] = i/10 + '0'; 
 		pcxname[strlen(pcxname) - 5] = i%10 + '0'; 
-		sprintf (checkname, "%s/snap/%s", gamedirfile, pcxname);
+		snprintf(checkname, sizeof(checkname), "%s/snap/%s", gamedirfile, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

qw_server/sv_init.c

@@ -337,7 +337,7 @@ void SV_SpawnServer (char *server)
 	sv.time = 1.0;
 	
 	strcpy (sv.name, server);
-	sprintf (sv.modelname,"maps/%s.bsp", server);
+	snprintf(sv.modelname, sizeof(sv.modelname),"maps/%s.bsp", server);
 	sv.worldmodel = Mod_ForName (sv.modelname, true);
 	SV_CalcPHS ();
 

qw_server/sv_main.c

@@ -425,7 +425,7 @@ void SVC_Log (void)
 
 	Con_DPrintf ("sending log %i to %s\n", svs.logsequence-1, NET_AdrToString(net_from));
 
-	sprintf (data, "stdlog %i\n", svs.logsequence-1);
+	snprintf(data, sizeof(data), "stdlog %i\n", svs.logsequence-1);
 	strcat (data, (char *)svs.log_buf[((svs.logsequence-1)&1)]);
 
 	NET_SendPacket (strlen(data)+1, data, net_from);
@@ -1001,7 +1001,7 @@ void SV_WriteIP_f (void)
 	byte	b[4];
 	int		i;
 
-	sprintf (name, "%s/listip.cfg", com_gamedir);
+	snprintf(name, sizeof(name), "%s/listip.cfg", com_gamedir);
 
 	Con_Printf ("Writing %s.\n", name);
 
@@ -1364,7 +1364,7 @@ void SV_InitLocal (void)
 	Cmd_AddCommand ("writeip", SV_WriteIP_f);
 
 	for (i=0 ; i<MAX_MODELS ; i++)
-		sprintf (localmodels[i], "*%i", i);
+		snprintf(localmodels[i], sizeof(localmodels[i]), "*%i", i);
 
 	Info_SetValueForStarKey (svs.info, "*version", VERSION, MAX_SERVERINFO_STRING);
 
@@ -1414,7 +1414,7 @@ void Master_Heartbeat (void)
 			active++;
 
 	svs.heartbeat_sequence++;
-	sprintf (string, "%c\n%i\n%i\n", S2M_HEARTBEAT,
+	snprintf(string, sizeof(string), "%c\n%i\n%i\n", S2M_HEARTBEAT,
 		svs.heartbeat_sequence, active);
 
 
@@ -1439,7 +1439,7 @@ void Master_Shutdown (void)
 	char		string[2048];
 	int			i;
 
-	sprintf (string, "%c\n", S2M_SHUTDOWN);
+	snprintf(string, sizeof(string), "%c\n", S2M_SHUTDOWN);
 
 	// send to group master
 	for (i=0 ; i<MAX_MASTERS ; i++)
@@ -1522,7 +1522,7 @@ void SV_ExtractFromUserinfo (client_t *cl)
 					p = val + 4;
 			}
 
-			sprintf(newname, "(%d)%-.40s", dupc++, p);
+			snprintf(newname, sizeof(newname), "(%d)%-.40s", dupc++, p);
 			Info_SetValueForKey (cl->userinfo, "name", newname, MAX_INFO_STRING);
 			val = Info_ValueForKey (cl->userinfo, "name");
 		} else

qw_server/sv_user.c

@@ -736,11 +736,11 @@ void SV_Say (qboolean team)
 	}
 
 	if (host_client->spectator && (!sv_spectalk.value || team))
-		sprintf (text, "[SPEC] %s: ", host_client->name);
+		snprintf(text, sizeof(text), "[SPEC] %s: ", host_client->name);
 	else if (team)
-		sprintf (text, "(%s): ", host_client->name);
+		snprintf(text, sizeof(text), "(%s): ", host_client->name);
 	else {
-		sprintf (text, "%s: ", host_client->name);
+		snprintf(text, sizeof(text), "%s: ", host_client->name);
 	}
 
 	if (fp_messages) {
@@ -924,9 +924,9 @@ void SV_Pause_f (void)
 	}
 
 	if (sv.paused)
-		sprintf (st, "%s paused the game\n", host_client->name);
+		snprintf(st, sizeof(st), "%s paused the game\n", host_client->name);
 	else
-		sprintf (st, "%s unpaused the game\n", host_client->name);
+		snprintf(st, sizeof(st), "%s unpaused the game\n", host_client->name);
 
 	SV_TogglePause(st);
 }

uquake/cl_demo.c

@@ -230,7 +230,7 @@ void CL_Record_f (void)
 	else
 		track = -1;	
 
-	sprintf (name, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf(name, sizeof(name), "%s/%s", com_gamedir, Cmd_Argv(1));
 	
 //
 // start the map up

uquake/cl_main.c

@@ -193,7 +193,7 @@ Con_DPrintf ("CL_SignonReply: %i\n", cls.signon);
 		MSG_WriteString (&cls.message, va("color %i %i\n", ((int)cl_color.value)>>4, ((int)cl_color.value)&15));
 	
 		MSG_WriteByte (&cls.message, clc_stringcmd);
-		sprintf (str, "spawn %s", cls.spawnparms);
+		snprintf(str, sizeof(str), "spawn %s", cls.spawnparms);
 		MSG_WriteString (&cls.message, str);
 		break;
 		
@@ -236,7 +236,7 @@ void CL_NextDemo (void)
 		}
 	}
 
-	sprintf (str,"playdemo %s\n", cls.demos[cls.demonum]);
+	snprintf(str, sizeof(str),"playdemo %s\n", cls.demos[cls.demonum]);
 	Cbuf_InsertText (str);
 	cls.demonum++;
 }

uquake/common.c

@@ -1204,7 +1204,7 @@ void COM_WriteFile (char *filename, void *data, int len)
 	int             handle;
 	char    name[MAX_OSPATH];
 	
-	sprintf (name, "%s/%s", com_gamedir, filename);
+	snprintf(name, sizeof(name), "%s/%s", com_gamedir, filename);
 
 	handle = Sys_FileOpenWrite (name);
 	if (handle == -1)
@@ -1336,7 +1336,7 @@ int COM_FindFile (char *filename, int *handle, FILE **file)
 		else
 		{               
 	// check a file in the directory tree
-			sprintf (netpath, "%s/%s",search->filename, filename);
+			snprintf(netpath, sizeof(netpath), "%s/%s",search->filename, filename);
 			
 			findtime = Sys_FileTime (netpath);
 			if (findtime == -1)
@@ -1349,11 +1349,11 @@ int COM_FindFile (char *filename, int *handle, FILE **file)
 			{	
 #if defined(_WIN32)
 				if ((strlen(netpath) < 2) || (netpath[1] != ':'))
-					sprintf (cachepath,"%s%s", com_cachedir, netpath);
+					snprintf(cachepath, sizeof(cachepath),"%s%s", com_cachedir, netpath);
 				else
-					sprintf (cachepath,"%s%s", com_cachedir, netpath+2);
+					snprintf(cachepath, sizeof(cachepath),"%s%s", com_cachedir, netpath+2);
 #else
-				sprintf (cachepath,"%s%s", com_cachedir, netpath);
+				snprintf(cachepath, sizeof(cachepath),"%s%s", com_cachedir, netpath);
 #endif
 
 				cachetime = Sys_FileTime (cachepath);
@@ -1623,7 +1623,7 @@ void COM_AddGameDirectory (char *dir)
 //
 	for (i=0 ; ; i++)
 	{
-		sprintf (pakfile, "%s/pak%i.pak", dir, i);
+		snprintf(pakfile, sizeof(pakfile), "%s/pak%i.pak", dir, i);
 		pak = COM_LoadPackFile (pakfile);
 		if (!pak)
 			break;

uquake/console.c

@@ -221,7 +221,7 @@ void Con_Init (void)
 	{
 		if (strlen (com_gamedir) < (MAXGAMEDIRLEN - strlen (t2)))
 		{
-			sprintf (temp, "%s%s", com_gamedir, t2);
+			snprintf(temp, sizeof(temp), "%s%s", com_gamedir, t2);
 			unlink (temp);
 		}
 	}

uquake/cvar.c

@@ -136,7 +136,7 @@ void Cvar_SetValue (char *var_name, float value)
 {
 	char	val[32];
 	
-	sprintf (val, "%f",value);
+	snprintf(val, sizeof(val), "%f",value);
 	Cvar_Set (var_name, val);
 }
 

uquake/gl_model.c

@@ -1214,7 +1214,7 @@ void Mod_LoadBrushModel (model_t *mod, void *buffer)
 		{	// duplicate the basic information
 			char	name[10];
 
-			sprintf (name, "*%i", i+1);
+			snprintf(name, sizeof(name), "*%i", i+1);
 			loadmodel = Mod_FindName (name);
 			*loadmodel = *mod;
 			strcpy (loadmodel->name, name);
@@ -1437,7 +1437,7 @@ void *Mod_LoadAllSkins (int numskins, daliasskintype_t *pskintype)
 				pheader->texels[i] = texels - (byte *)pheader;
 				memcpy (texels, (byte *)(pskintype + 1), s);
 	//		}
-			sprintf (name, "%s_%i", loadmodel->name, i);
+			snprintf(name, sizeof(name), "%s_%i", loadmodel->name, i);
 			pheader->gl_texturenum[i][0] =
 			pheader->gl_texturenum[i][1] =
 			pheader->gl_texturenum[i][2] =
@@ -1462,7 +1462,7 @@ void *Mod_LoadAllSkins (int numskins, daliasskintype_t *pskintype)
 						pheader->texels[i] = texels - (byte *)pheader;
 						memcpy (texels, (byte *)(pskintype), s);
 					}
-					sprintf (name, "%s_%i_%i", loadmodel->name, i,j);
+					snprintf(name, sizeof(name), "%s_%i_%i", loadmodel->name, i,j);
 					pheader->gl_texturenum[i][j&3] = 
 						GL_LoadTexture (name, pheader->skinwidth, 
 						pheader->skinheight, (byte *)(pskintype), true, false);
@@ -1680,7 +1680,7 @@ void * Mod_LoadSpriteFrame (void * pin, mspriteframe_t **ppframe, int framenum)
 	pspriteframe->left = origin[0];
 	pspriteframe->right = width + origin[0];
 
-	sprintf (name, "%s_%i", loadmodel->name, framenum);
+	snprintf(name, sizeof(name), "%s_%i", loadmodel->name, framenum);
 	pspriteframe->gl_texturenum = GL_LoadTexture (name, width, height, (byte *)(pinframe + 1), true, true);
 
 	return (void *)((byte *)pinframe + sizeof (dspriteframe_t) + size);

uquake/gl_screen.c

@@ -603,7 +603,7 @@ void SCR_ScreenShot_f (void)
 	{ 
 		pcxname[5] = i/10 + '0'; 
 		pcxname[6] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf(checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

uquake/host_cmd.c

@@ -447,7 +447,7 @@ void Host_SavegameComment (char *text)
 	for (i=0 ; i<SAVEGAME_COMMENT_LENGTH ; i++)
 		text[i] = ' ';
 	memcpy (text, cl.levelname, strlen(cl.levelname));
-	sprintf (kills,"kills:%3i/%3i", cl.stats[STAT_MONSTERS], cl.stats[STAT_TOTALMONSTERS]);
+	snprintf(kills, sizeof(kills),"kills:%3i/%3i", cl.stats[STAT_MONSTERS], cl.stats[STAT_TOTALMONSTERS]);
 	memcpy (text+22, kills, strlen(kills));
 // convert space to _ to make stdio happy
 	for (i=0 ; i<SAVEGAME_COMMENT_LENGTH ; i++)
@@ -511,7 +511,7 @@ void Host_Savegame_f (void)
 		}
 	}
 
-	sprintf (name, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf(name, sizeof(name), "%s/%s", com_gamedir, Cmd_Argv(1));
 	COM_DefaultExtension (name, ".sav");
 	
 	Con_Printf ("Saving game to %s...\n", name);
@@ -582,7 +582,7 @@ void Host_Loadgame_f (void)
 
 	cls.demonum = -1;		// stop demo loop in case this fails
 
-	sprintf (name, "%s/%s", com_gamedir, Cmd_Argv(1));
+	snprintf(name, sizeof(name), "%s/%s", com_gamedir, Cmd_Argv(1));
 	COM_DefaultExtension (name, ".sav");
 	
 // we can't call SCR_BeginLoadingPlaque, because too much stack space has
@@ -715,7 +715,7 @@ void SaveGamestate()
 	char	comment[SAVEGAME_COMMENT_LENGTH+1];
 	edict_t	*ent;
 
-	sprintf (name, "%s/%s.gip", com_gamedir, sv.name);
+	snprintf(name, sizeof(name), "%s/%s.gip", com_gamedir, sv.name);
 	
 	Con_Printf ("Saving game to %s...\n", name);
 	f = fopen (name, "w");
@@ -771,7 +771,7 @@ int LoadGamestate(char *level, char *startspot)
 	int		version;
 //	float	spawn_parms[NUM_SPAWN_PARMS];
 
-	sprintf (name, "%s/%s.gip", com_gamedir, level);
+	snprintf(name, sizeof(name), "%s/%s.gip", com_gamedir, level);
 	
 	Con_Printf ("Loading game from %s...\n", name);
 	f = fopen (name, "r");
@@ -991,9 +991,9 @@ void Host_Say(qboolean teamonly)
 
 // turn on color set 1
 	if (!fromServer)
-		sprintf (text, "%c%s: ", 1, save->name);
+		snprintf(text, sizeof(text), "%c%s: ", 1, save->name);
 	else
-		sprintf (text, "%c<%s> ", 1, hostname.string);
+		snprintf(text, sizeof(text), "%c<%s> ", 1, hostname.string);
 
 	j = sizeof(text) - 2 - Q_strlen(text);  // -2 for /n and null terminator
 	if (Q_strlen(p) > j)

uquake/menu.c

@@ -460,7 +460,7 @@ void M_ScanSaves (void)
 	{
 		strcpy (m_filenames[i], "--- UNUSED SLOT ---");
 		loadable[i] = false;
-		sprintf (name, "%s/s%i.sav", com_gamedir, i);
+		snprintf(name, sizeof(name), "%s/s%i.sav", com_gamedir, i);
 		f = fopen (name, "r");
 		if (!f)
 			continue;
@@ -1497,7 +1497,7 @@ void M_Keys_Key (int k)
 		}
 		else if (k != '`')
 		{
-			sprintf (cmd, "bind \"%s\" \"%s\"\n", Key_KeynumToString (k), bindnames[keys_cursor][0]);
+			snprintf(cmd, sizeof(cmd), "bind \"%s\" \"%s\"\n", Key_KeynumToString (k), bindnames[keys_cursor][0]);
 			Cbuf_InsertText (cmd);
 		}
 
@@ -2262,7 +2262,7 @@ void M_Menu_LanConfig_f (void)
 	if (StartingGame && lanConfig_cursor == 2)
 		lanConfig_cursor = 1;
 	lanConfig_port = DEFAULTnet_hostport;
-	sprintf(lanConfig_portname, "%u", lanConfig_port);
+	snprintf(lanConfig_portname, sizeof(lanConfig_portname), "%u", lanConfig_port);
 
 	m_return_onerror = false;
 	m_return_reason[0] = 0;
@@ -2439,7 +2439,7 @@ void M_LanConfig_Key (int key)
 		l = lanConfig_port;
 	else
 		lanConfig_port = l;
-	sprintf(lanConfig_portname, "%u", lanConfig_port);
+	snprintf(lanConfig_portname, sizeof(lanConfig_portname), "%u", lanConfig_port);
 }
 
 //=============================================================================
@@ -3009,9 +3009,9 @@ void M_ServerList_Draw (void)
 	for (n = 0; n < hostCacheCount; n++)
 	{
 		if (hostcache[n].maxusers)
-			sprintf(string, "%-15.15s %-15.15s %2u/%2u\n", hostcache[n].name, hostcache[n].map, hostcache[n].users, hostcache[n].maxusers);
+			snprintf(string, sizeof(string), "%-15.15s %-15.15s %2u/%2u\n", hostcache[n].name, hostcache[n].map, hostcache[n].users, hostcache[n].maxusers);
 		else
-			sprintf(string, "%-15.15s %-15.15s\n", hostcache[n].name, hostcache[n].map);
+			snprintf(string, sizeof(string), "%-15.15s %-15.15s\n", hostcache[n].name, hostcache[n].map);
 		M_Print (16, 32 + 8*n, string);
 	}
 	M_DrawCharacter (0, 32 + slist_cursor*8, 12+((int)(realtime*4)&1));

uquake/model.c

@@ -1210,7 +1210,7 @@ void Mod_LoadBrushModel (model_t *mod, void *buffer)
 		{	// duplicate the basic information
 			char	name[10];
 
-			sprintf (name, "*%i", i+1);
+			snprintf(name, sizeof(name), "*%i", i+1);
 			loadmodel = Mod_FindName (name);
 			*loadmodel = *mod;
 			strcpy (loadmodel->name, name);

uquake/mplpc.c

@@ -996,6 +996,6 @@ char *inet_ntoa (struct in_addr in)
 {
 	static char buf [32];
 
-	sprintf(buf, "%u.%u.%u.%u", in.S_un.S_un_b.s_b1, in.S_un.S_un_b.s_b2, in.S_un.S_un_b.s_b3, in.S_un.S_un_b.s_b4);
+	snprintf(buf, sizeof(buf), "%u.%u.%u.%u", in.S_un.S_un_b.s_b1, in.S_un.S_un_b.s_b2, in.S_un.S_un_b.s_b3, in.S_un.S_un_b.s_b4);
 	return buf;
 }

uquake/net_bw.c

@@ -621,7 +621,7 @@ char *BW_AddrToString (struct qsockaddr *addr)
 {
 	static char buffer[22];
 
-	sprintf(buffer, "%d.%d.%d.%d:%d",
+	snprintf(buffer, sizeof(buffer), "%d.%d.%d.%d:%d",
 		((struct sockaddr_in *)addr)->sin_addr.s_net,
 		((struct sockaddr_in *)addr)->sin_addr.s_host,
 		((struct sockaddr_in *)addr)->sin_addr.s_lh,

uquake/net_comx.c

@@ -781,7 +781,7 @@ int TTY_Connect(int handle, char *host)
 		key_count = -2;
 
 		Con_Printf ("Dialing...\n");
-		sprintf(dialstring, "AT D%c %s\r", p->dialType, host);
+		snprintf(dialstring, sizeof(dialstring), "AT D%c %s\r", p->dialType, host);
 		Modem_Command (p, dialstring);
 		start = Sys_DoubleTime();
 		while(1)
@@ -1154,7 +1154,7 @@ int TTY_Init(void)
 		handleToPort[n] = p;
 		p->portNumber = n;
 		p->dialType = 'T';
-		sprintf(p->name, "com%u", n+1);
+		snprintf(p->name, sizeof(p->name), "com%u", n+1);
 		Cmd_AddCommand (p->name, Com_f);
 		ResetComPortConfig (p);
 	}

uquake/net_dgrm.c

@@ -92,7 +92,7 @@ char *StrAddr (struct qsockaddr *addr)
 	int n;
 
 	for (n = 0; n < 16; n++)
-		sprintf (buf + n * 2, "%02x", *p++);
+		snprintf(buf + n * 2, sizeof(buf), "%02x", *p++);
 	return buf;
 }
 #endif

uquake/net_ipx.c

@@ -577,7 +577,7 @@ char *IPX_AddrToString (struct qsockaddr *addr)
 {
 	static char buf[28];
 
-	sprintf(buf, "%02x%02x%02x%02x:%02x%02x%02x%02x%02x%02x:%u",
+	snprintf(buf, sizeof(buf), "%02x%02x%02x%02x:%02x%02x%02x%02x%02x%02x:%u",
 		((struct sockaddr_ipx *)addr)->sipx_addr.network[0],
 		((struct sockaddr_ipx *)addr)->sipx_addr.network[1],
 		((struct sockaddr_ipx *)addr)->sipx_addr.network[2],
@@ -659,12 +659,12 @@ int IPX_GetAddrFromName (char *name, struct qsockaddr *addr)
 
 	if (n == 12)
 	{
-		sprintf(buf, "00000000:%s:%u", name, net_hostport);
+		snprintf(buf, sizeof(buf), "00000000:%s:%u", name, net_hostport);
 		return IPX_StringToAddr (buf, addr);
 	}
 	if (n == 21)
 	{
-		sprintf(buf, "%s:%u", name, net_hostport);
+		snprintf(buf, sizeof(buf), "%s:%u", name, net_hostport);
 		return IPX_StringToAddr (buf, addr);
 	}
 	if (n > 21 && n <= 27)

uquake/net_mp.c

@@ -337,7 +337,7 @@ char *MPATH_AddrToString (struct qsockaddr *addr)
 	int haddr;
 
 	haddr = ntohl(((struct sockaddr_in *)addr)->sin_addr.s_addr);
-	sprintf(buffer, "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff, (haddr >> 16) & 0xff, (haddr >> 8) & 0xff, haddr & 0xff, ntohs(((struct sockaddr_in *)addr)->sin_port));
+	snprintf(buffer, sizeof(buffer), "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff, (haddr >> 16) & 0xff, (haddr >> 8) & 0xff, haddr & 0xff, ntohs(((struct sockaddr_in *)addr)->sin_port));
 	return buffer;
 }
 

uquake/net_ser.c

@@ -749,7 +749,7 @@ void Serial_SearchForHosts (qboolean xmit)
 	if (TTY_IsModem(p->tty))
 		return;
 
-	sprintf(hostcache[hostCacheCount].name, "COM%u", n+1);
+	snprintf(hostcache[hostCacheCount].name, sizeof(hostcache[hostCacheCount].name), "COM%u", n+1);
 	Q_strcpy(hostcache[hostCacheCount].map, "");
 	hostcache[hostCacheCount].users = 0;
 	hostcache[hostCacheCount].maxusers = 0;
@@ -933,7 +933,7 @@ static qsocket_t *_Serial_CheckNewConnections (SerialLine *p)
 	p->connected = true;
 	p->connecting = false;
 	p->sock->lastMessageTime = net_time;
-	sprintf(p->sock->address, "COM%u", (int)((p - serialLine) + 1));
+	snprintf(p->sock->address, sizeof(p->sock->address), "COM%u", (int)((p - serialLine) + 1));
 
 	return p->sock;
 }

uquake/net_udp.c

@@ -325,7 +325,7 @@ char *UDP_AddrToString (struct qsockaddr *addr)
 	int haddr;
 
 	haddr = ntohl(((struct sockaddr_in *)addr)->sin_addr.s_addr);
-	sprintf(buffer, "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff, (haddr >> 16) & 0xff, (haddr >> 8) & 0xff, haddr & 0xff, ntohs(((struct sockaddr_in *)addr)->sin_port));
+	snprintf(buffer, sizeof(buffer), "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff, (haddr >> 16) & 0xff, (haddr >> 8) & 0xff, haddr & 0xff, ntohs(((struct sockaddr_in *)addr)->sin_port));
 	return buffer;
 }
 

uquake/net_wins.c

@@ -110,7 +110,7 @@ void WINS_GetLocalAddress()
 	myAddr = *(int *)local->h_addr_list[0];
 
 	addr = ntohl(myAddr);
-	sprintf(my_tcpip_address, "%d.%d.%d.%d", (addr >> 24) & 0xff, (addr >> 16) & 0xff, (addr >> 8) & 0xff, addr & 0xff);
+	snprintf(my_tcpip_address, sizeof(my_tcpip_address), "%d.%d.%d.%d", (addr >> 24) & 0xff, (addr >> 16) & 0xff, (addr >> 8) & 0xff, addr & 0xff);
 }
 
 
@@ -469,7 +469,7 @@ char *WINS_AddrToString (struct qsockaddr *addr)
 	int haddr;
 
 	haddr = ntohl(((struct sockaddr_in *)addr)->sin_addr.s_addr);
-	sprintf(buffer, "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff, (haddr >> 16) & 0xff, (haddr >> 8) & 0xff, haddr & 0xff, ntohs(((struct sockaddr_in *)addr)->sin_port));
+	snprintf(buffer, sizeof(buffer), "%d.%d.%d.%d:%d", (haddr >> 24) & 0xff, (haddr >> 16) & 0xff, (haddr >> 8) & 0xff, haddr & 0xff, ntohs(((struct sockaddr_in *)addr)->sin_port));
 	return buffer;
 }
 

uquake/net_wipx.c

@@ -294,7 +294,7 @@ char *WIPX_AddrToString (struct qsockaddr *addr)
 {
 	static char buf[28];
 
-	sprintf(buf, "%02x%02x%02x%02x:%02x%02x%02x%02x%02x%02x:%u",
+	snprintf(buf, sizeof(buf), "%02x%02x%02x%02x:%02x%02x%02x%02x%02x%02x:%u",
 		((struct sockaddr_ipx *)addr)->sa_netnum[0] & 0xff,
 		((struct sockaddr_ipx *)addr)->sa_netnum[1] & 0xff,
 		((struct sockaddr_ipx *)addr)->sa_netnum[2] & 0xff,
@@ -382,12 +382,12 @@ int WIPX_GetAddrFromName(char *name, struct qsockaddr *addr)
 
 	if (n == 12)
 	{
-		sprintf(buf, "00000000:%s:%u", name, net_hostport);
+		snprintf(buf, sizeof(buf), "00000000:%s:%u", name, net_hostport);
 		return WIPX_StringToAddr (buf, addr);
 	}
 	if (n == 21)
 	{
-		sprintf(buf, "%s:%u", name, net_hostport);
+		snprintf(buf, sizeof(buf), "%s:%u", name, net_hostport);
 		return WIPX_StringToAddr (buf, addr);
 	}
 	if (n > 21 && n <= 27)

uquake/r_part.c

@@ -202,7 +202,7 @@ void R_ReadPointFile_f (void)
 	particle_t	*p;
 	char	name[MAX_OSPATH];
 	
-	sprintf (name,"maps/%s.pts", sv.name);
+	snprintf(name, sizeof(name),"maps/%s.pts", sv.name);
 
 	COM_FOpenFile (name, &f);
 	if (!f)

uquake/sbar.c

@@ -438,7 +438,7 @@ void Sbar_UpdateScoreboard (void)
 	{
 		k = fragsort[i];
 		s = &cl.scores[k];
-		sprintf (&scoreboardtext[i][1], "%3i %s", s->frags, s->name);
+		snprintf(&scoreboardtext[i][1], sizeof(&scoreboardtext[i][1]), "%3i %s", s->frags, s->name);
 
 		top = s->colors & 0xf0;
 		bottom = (s->colors & 15) <<4;
@@ -460,10 +460,10 @@ void Sbar_SoloScoreboard (void)
 	int		minutes, seconds, tens, units;
 	int		l;
 
-	sprintf (str,"Monsters:%3i /%3i", cl.stats[STAT_MONSTERS], cl.stats[STAT_TOTALMONSTERS]);
+	snprintf(str, sizeof(str),"Monsters:%3i /%3i", cl.stats[STAT_MONSTERS], cl.stats[STAT_TOTALMONSTERS]);
 	Sbar_DrawString (8, 4, str);
 
-	sprintf (str,"Secrets :%3i /%3i", cl.stats[STAT_SECRETS], cl.stats[STAT_TOTALSECRETS]);
+	snprintf(str, sizeof(str),"Secrets :%3i /%3i", cl.stats[STAT_SECRETS], cl.stats[STAT_TOTALSECRETS]);
 	Sbar_DrawString (8, 12, str);
 
 // time
@@ -471,7 +471,7 @@ void Sbar_SoloScoreboard (void)
 	seconds = cl.time - 60*minutes;
 	tens = seconds / 10;
 	units = seconds - 10*tens;
-	sprintf (str,"Time :%3i:%i%i", minutes, tens, units);
+	snprintf(str, sizeof(str),"Time :%3i:%i%i", minutes, tens, units);
 	Sbar_DrawString (184, 4, str);
 
 // draw level name
@@ -661,7 +661,7 @@ void Sbar_DrawInventory (void)
 // ammo counts
 	for (i=0 ; i<4 ; i++)
 	{
-		sprintf (num, "%3i",cl.stats[STAT_SHELLS+i] );
+		snprintf(num, sizeof(num), "%3i",cl.stats[STAT_SHELLS+i] );
 		if (num[0] != ' ')
 			Sbar_DrawCharacter ( (6*i+1)*8 - 2, -24, 18 + num[0] - '0');
 		if (num[1] != ' ')
@@ -802,7 +802,7 @@ void Sbar_DrawFrags (void)
 
 	// draw number
 		f = s->frags;
-		sprintf (num, "%3i",f);
+		snprintf(num, sizeof(num), "%3i",f);
 
 		Sbar_DrawCharacter ( (x+1)*8 , -24, num[0]);
 		Sbar_DrawCharacter ( (x+2)*8 , -24, num[1]);
@@ -859,7 +859,7 @@ void Sbar_DrawFace (void)
 
 		// draw number
 		f = s->frags;
-		sprintf (num, "%3i",f);
+		snprintf(num, sizeof(num), "%3i",f);
 
 		if (top==8)
 		{
@@ -1124,7 +1124,7 @@ void Sbar_DeathmatchOverlay (void)
 
 	// draw number
 		f = s->frags;
-		sprintf (num, "%3i",f);
+		snprintf(num, sizeof(num), "%3i",f);
 
 		Draw_Character ( x+8 , y, num[0]);
 		Draw_Character ( x+16 , y, num[1]);
@@ -1145,7 +1145,7 @@ void Sbar_DeathmatchOverlay (void)
 		tens = n/10;
 		units = n%10;
 
-		sprintf (num, "%3i:%i%i", minutes, tens, units);
+		snprintf(num, sizeof(num), "%3i:%i%i", minutes, tens, units);
 
 		Draw_String ( x+48 , y, num);
 }
@@ -1223,7 +1223,7 @@ void Sbar_MiniDeathmatchOverlay (void)
 
 	// draw number
 		f = s->frags;
-		sprintf (num, "%3i",f);
+		snprintf(num, sizeof(num), "%3i",f);
 
 		Draw_Character ( x+8 , y, num[0]);
 		Draw_Character ( x+16 , y, num[1]);
@@ -1246,7 +1246,7 @@ void Sbar_MiniDeathmatchOverlay (void)
 		tens = n/10;
 		units = n%10;
 
-		sprintf (num, "%3i:%i%i", minutes, tens, units);
+		snprintf(num, sizeof(num), "%3i:%i%i", minutes, tens, units);
 
 		Draw_String ( x+48 , y, num);
 }

uquake/screen.c

@@ -625,7 +625,7 @@ void SCR_ScreenShot_f (void)
 	{ 
 		pcxname[5] = i/10 + '0'; 
 		pcxname[6] = i%10 + '0'; 
-		sprintf (checkname, "%s/%s", com_gamedir, pcxname);
+		snprintf(checkname, sizeof(checkname), "%s/%s", com_gamedir, pcxname);
 		if (Sys_FileTime(checkname) == -1)
 			break;	// file doesn't exist
 	} 

uquake/sv_main.c

@@ -59,7 +59,7 @@ void SV_Init (void)
 	Cvar_RegisterVariable (&sv_nostep);
 
 	for (i=0 ; i<MAX_MODELS ; i++)
-		sprintf (localmodels[i], "*%i", i);
+		snprintf(localmodels[i], sizeof(localmodels[i]), "*%i", i);
 }
 
 /*
@@ -192,7 +192,7 @@ void SV_SendServerinfo (client_t *client)
 	char			message[2048];
 
 	MSG_WriteByte (&client->message, svc_print);
-	sprintf (message, "%c\nVERSION %s SERVER (%i CRC)", 2, VERSION, pr_crc);
+	snprintf(message, sizeof(message), "%c\nVERSION %s SERVER (%i CRC)", 2, VERSION, pr_crc);
 	MSG_WriteString (&client->message,message);
 
 	MSG_WriteByte (&client->message, svc_serverinfo);
@@ -204,7 +204,7 @@ void SV_SendServerinfo (client_t *client)
 	else
 		MSG_WriteByte (&client->message, GAME_COOP);
 
-	sprintf (message, pr_strings+sv.edicts->v.message);
+	snprintf(message, sizeof(message), pr_strings+sv.edicts->v.message);
 
 	MSG_WriteString (&client->message,message);
 
@@ -1122,7 +1122,7 @@ void SV_SpawnServer (char *server)
 	sv.time = 1.0;
 	
 	strcpy (sv.name, server);
-	sprintf (sv.modelname,"maps/%s.bsp", server);
+	snprintf(sv.modelname, sizeof(sv.modelname),"maps/%s.bsp", server);
 	sv.worldmodel = Mod_ForName (sv.modelname, false);
 	if (!sv.worldmodel)
 	{

uquake/sys_dos.c

@@ -576,7 +576,7 @@ void Sys_Quit (void)
 		memcpy (screen, d, sizeof(screen));
 
 // write the version number directly to the end screen
-	sprintf (ver, " v" VERSION);
+	snprintf(ver, sizeof(ver), " v" VERSION);
 	for (i=0 ; i<6 ; i++)
 		screen[0*80*2 + 72*2 + i*2] = ver[i];
 

uquake/sys_win.c

@@ -378,7 +378,7 @@ void Sys_Error (char *error, ...)
 		vsprintf (text, error, argptr);
 		va_end (argptr);
 
-		sprintf (text2, "ERROR: %s\n", text);
+		snprintf(text2, sizeof(text2), "ERROR: %s\n", text);
 		WriteFile (houtput, text5, strlen (text5), &dummy, NULL);
 		WriteFile (houtput, text4, strlen (text4), &dummy, NULL);
 		WriteFile (houtput, text2, strlen (text2), &dummy, NULL);