Address unsafe string format warnings from gcc (Debian 8.3.0-6) 8.3.0

src/sbbs3/addfiles.c

@@ -1000,7 +1000,7 @@ int main(int argc, char **argv)
 					synclist(str,i);
 				continue;
 			}
-			sprintf(str,"%s%s",scfg.dir[f.dir]->path,auto_name);
+			SAFEPRINTF2(str,"%s%s",scfg.dir[f.dir]->path,auto_name);
 			if(fexistcase(str) && flength(str)>0L) {
 				printf("Auto-adding %s\n",str);
 				addlist(str,f,desc_offset,size_offset);
@@ -1015,7 +1015,7 @@ int main(int argc, char **argv)
 		if(!listgiven && !namegiven) {
 			sprintf(str,"%s%s.lst",scfg.dir[f.dir]->path, scfg.dir[f.dir]->code);
 			if(!fexistcase(str) || flength(str)<=0L)
-				sprintf(str,"%s%s",scfg.dir[f.dir]->path, auto_name);
+				SAFEPRINTF2(str,"%s%s",scfg.dir[f.dir]->path, auto_name);
 			addlist(str,f,desc_offset,size_offset);
 			if(mode&SYNC_LIST)
 				synclist(str,f.dir);

src/sbbs3/allusers.c

@@ -223,7 +223,7 @@ int main(int argc, char **argv)
 					for(;argv[i][j];j++)
 						if(isalpha(argv[i][j]))
 							flags|=FLAG(toupper(argv[i][j]));
-					sprintf(str,"%suser.dat",dir);
+					SAFEPRINTF(str,"%suser.dat",dir);
 					if(!fexistcase(str) || (file=sopen(str,O_RDWR|O_BINARY,SH_DENYNO))==-1) {
 						printf("Error opening %s\n",str);
 						exit(1); 
@@ -287,7 +287,7 @@ int main(int argc, char **argv)
 					for(;argv[i][j];j++)
 						if(isalpha(argv[i][j]))
 							flags|=FLAG(toupper(argv[i][j]));
-					sprintf(str,"%suser.dat",dir);
+					SAFEPRINTF(str,"%suser.dat",dir);
 					if(!fexistcase(str) || (file=sopen(str,O_RDWR|O_BINARY,SH_DENYNO))==-1) {
 						printf("Error opening %s\n",str);
 						exit(1); 
@@ -342,7 +342,7 @@ int main(int argc, char **argv)
 						j=99;
 					if(j<0)
 						j=0;
-					sprintf(str,"%suser.dat",dir);
+					SAFEPRINTF(str,"%suser.dat",dir);
 					if(!fexistcase(str) || (file=sopen(str,O_RDWR|O_BINARY,SH_DENYNO))==-1) {
 						printf("Error opening %s\n",str);
 						exit(1); 

src/sbbs3/chat.cpp

@@ -1436,7 +1436,7 @@ void sbbs_t::nodemsg()
 					bprintf("%4s",nulstr);
 					if(!getstr(line,70,K_WRAP|K_MSG))
 						break;
-					sprintf(str,"%4s%s\r\n",nulstr,line);
+					SAFEPRINTF2(str,"%4s%s\r\n",nulstr,line);
 					SAFECAT(buf,str);
 					if(line[0]) {
 						if(i)

src/sbbs3/delfiles.c

@@ -205,7 +205,7 @@ int main(int argc, char **argv)
 
 		if(misc&NO_LINK && cfg.dir[i]->misc&DIR_FCHK) {
 			strcpy(tmp,cfg.dir[i]->path);
-			sprintf(str,"%s*.*",tmp);
+			SAFEPRINTF(str,"%s*.*",tmp);
 			printf("\nSearching %s for unlinked files\n",str);
 			if(!glob(str, GLOB_MARK, NULL, &gl)) {
 				for(j=0; j<(int)gl.gl_pathc; j++) {
@@ -266,7 +266,7 @@ int main(int argc, char **argv)
 			strcpy(workfile.name,fname);
 			unpadfname(workfile.name,fname);
 			workfile.dir=i;
-			sprintf(str,"%s%s"
+			SAFEPRINTF2(str,"%s%s"
 				,workfile.altpath>0 && workfile.altpath<=cfg.altpaths
 					? cfg.altpath[workfile.altpath-1]
 				: cfg.dir[workfile.dir]->path,fname);

src/sbbs3/dstsedit.c

@@ -63,7 +63,7 @@ main(int argc, char **argv)
 	}
 	backslash(path);
 
-	sprintf(str, "%sdsts.dab", path);
+	SAFEPRINTF(str, "%sdsts.dab", path);
 	if ((file = nopen(str, O_RDONLY)) == -1) {
 		printf("Can't open %s\r\n", str);
 		exit(1);
@@ -179,7 +179,7 @@ main(int argc, char **argv)
 				stats.nusers = atoi(str);
 			break;
 		case 'Q':
-			sprintf(str, "%sdsts.dab", path);
+			SAFEPRINTF(str, "%sdsts.dab", path);
 			if ((file = nopen(str, O_WRONLY)) == -1) {
 				printf("Error opening %s\r\n", str);
 				exit(1);

src/sbbs3/fido.cpp

@@ -82,7 +82,7 @@ bool sbbs_t::lookup_netuser(char *into)
 		strupr(name);
 		str[35]=0;
 		truncsp(str+27);
-		sprintf(q,"Do you mean %s @%s",str,str+27);
+		SAFEPRINTF2(q,"Do you mean %s @%s",str,str+27);
 		if(strstr(name,to) && yesno(q)) {
 			fclose(stream);
 			sprintf(into,"%s@%s",str,str+27);

src/sbbs3/filelist.c

@@ -414,7 +414,7 @@ int main(int argc, char **argv)
 			}
 
 			if(misc&MINUS) {
-				sprintf(str,"%s%s",scfg.dir[i]->path,fname);
+				SAFEPRINTF2(str,"%s%s",scfg.dir[i]->path,fname);
 				if(!fexistcase(str))
 					fputc('-',out);
 				else
@@ -425,7 +425,7 @@ int main(int argc, char **argv)
 			desc_off++;
 
 			if(misc&DFD) {
-				sprintf(str,"%s%s",scfg.dir[i]->path,fname);
+				SAFEPRINTF2(str,"%s%s",scfg.dir[i]->path,fname);
 				fprintf(out,"%s ",unixtodstr(&scfg,(time32_t)fdate(str),str));
 				desc_off+=9; 
 			}

src/sbbs3/fmsgdump.c

@@ -51,7 +51,7 @@ const char* fmsgattr_str(uint16_t attr)
 	if(str[0] == 0)
 		return "";
 
-	static char buf[64];
+	static char buf[128];
 	sprintf(buf, "(%s)", str);
 	return buf;
 }

src/sbbs3/js_bbs.cpp

@@ -3339,7 +3339,7 @@ js_put_telegram(JSContext *cx, uintN argc, jsval *arglist)
 			sbbs->bputs("\1n: \1h");
 			if(!sbbs->getstr(line, 70, i < 4 ? (K_WRAP|K_MSG) : (K_MSG)))
 				break;
-			sprintf(str,"%4s%s\r\n",nulstr,line);
+			SAFEPRINTF2(str,"%4s%s\r\n",nulstr,line);
 			SAFECAT(buf, str);
 			if(i && line[0])
 				SAFECAT(logbuf, " ");

src/sbbs3/listfile.cpp

@@ -1164,8 +1164,8 @@ int sbbs_t::listfileinfo(uint dirnum, char *filespec, long mode)
 								&& findfile(&cfg,f.dir,path))
 								bprintf(text[FileAlreadyThere],path);
 							else {
-								sprintf(path,"%s%s",dirpath,fname);
-								sprintf(tmp,"%s%s",dirpath,str);
+								SAFEPRINTF2(path,"%s%s",dirpath,fname);
+								SAFEPRINTF2(tmp,"%s%s",dirpath,str);
 								if(fexistcase(path) && rename(path,tmp))
 									bprintf(text[CouldntRenameFile],path,tmp);
 								else {
@@ -1226,7 +1226,7 @@ int sbbs_t::listfileinfo(uint dirnum, char *filespec, long mode)
 					update_uldate(&cfg, &f);
 					break;
 				case 'F':   /* delete file only */
-					sprintf(str,"%s%s",dirpath,fname);
+					SAFEPRINTF2(str,"%s%s",dirpath,fname);
 					if(!fexistcase(str))
 						bprintf(text[FileDoesNotExist],str);
 					else {
@@ -1245,7 +1245,7 @@ int sbbs_t::listfileinfo(uint dirnum, char *filespec, long mode)
 					if(noyes(text[RemoveFileQ]))
 						break;
 					removefile(&f);
-					sprintf(str,"%s%s",dirpath,fname);
+					SAFEPRINTF2(str,"%s%s",dirpath,fname);
 					if(fexistcase(str)) {
 						if(dir_op(dirnum)) {
 							if(!noyes(text[DeleteFileQ])) {
@@ -1340,7 +1340,7 @@ int sbbs_t::listfileinfo(uint dirnum, char *filespec, long mode)
 					break; } 
 		}
 		else if(mode==FI_DOWNLOAD || mode==FI_USERXFER) {
-			sprintf(path,"%s%s",dirpath,fname);
+			SAFEPRINTF2(path,"%s%s",dirpath,fname);
 			if(f.size<1L) { /* getfiledat will set this to -1 if non-existant */
 				SYNC;       /* and 0 byte files shouldn't be d/led */
 				mnemonics(text[QuitOrNext]);
@@ -1417,8 +1417,8 @@ int sbbs_t::listfileinfo(uint dirnum, char *filespec, long mode)
 							lncntr=0;
 							seqwait(cfg.dir[f.dir]->seqdev);
 							bprintf(text[RetrievingFile],fname);
-							sprintf(str,"%s%s",dirpath,fname);
-							sprintf(path,"%s%s",cfg.temp_dir,fname);
+							SAFEPRINTF2(str,"%s%s",dirpath,fname);
+							SAFEPRINTF2(path,"%s%s",cfg.temp_dir,fname);
 							mv(str,path,1); /* copy the file to temp dir */
 							if(getnodedat(cfg.node_num,&thisnode,true)==0) {
 								thisnode.aux=0xf0;

src/sbbs3/netmail.cpp

@@ -204,7 +204,7 @@ bool sbbs_t::netmail(const char *into, const char *title, long mode, smb_t* resm
 		SAFECOPY(tmp, cfg.data_dir);
 		if(tmp[0]=='.')    /* Relative path */
 			sprintf(tmp,"%s%s", cfg.node_dir, cfg.data_dir);
-		sprintf(str,"%sfile/%04u.out/%s",tmp,useron.number,fname);
+		SAFEPRINTF3(str,"%sfile/%04u.out/%s",tmp,useron.number,fname);
 		SAFECOPY(subj, str);
 		if(fexistcase(str)) {
 			bputs(text[FileAlreadyThere]);
@@ -1423,7 +1423,7 @@ bool sbbs_t::qnetmail(const char *into, const char *subj, long mode, smb_t* resm
 	useron.etoday++;
 	putuserrec(&cfg,useron.number,U_ETODAY,5,ultoa(useron.etoday,tmp,10));
 
-	sprintf(str,"sent QWK NetMail to %s (%s)"
+	SAFEPRINTF2(str,"sent QWK NetMail to %s (%s)"
 		,to,fulladdr);
 	logline("EN",str);
 	return(true);

src/sbbs3/qwknodes.c

@@ -340,7 +340,7 @@ int main(int argc, char **argv)
 								p=addr;
 							else
 								*(p++)=0;
-							sprintf(str,"%s %s:%s%c%s"
+							safe_snprintf(str, sizeof(str), "%s %s:%s%c%s"
 								,unixtodstr(&cfg,msg.hdr.when_written.time,tmp)
 								,p,cfg.sys_id,p==addr ? 0 : '/'
 								,addr);

src/sbbs3/sbbscon.c

@@ -713,7 +713,7 @@ static int bbs_lputs(void* p, int level, const char *str)
 			,tm.tm_mon+1,tm.tm_mday
 			,tm.tm_hour,tm.tm_min,tm.tm_sec);
 
-	sprintf(logline,"%sterm %.*s",tstr,(int)sizeof(logline)-32,str);
+	sprintf(logline,"%sterm %.*s",tstr,(int)sizeof(logline)-70,str);
 	truncsp(logline);
 	lputs(level,logline);
 
@@ -778,7 +778,7 @@ static int stat_lputs(void* p, int level, const char *str)
 			,tm.tm_mon+1,tm.tm_mday
 			,tm.tm_hour,tm.tm_min,tm.tm_sec);
 
-	sprintf(logline,"%sstat %.*s",tstr,(int)sizeof(logline)-32,str);
+	sprintf(logline,"%sstat %.*s",tstr,(int)sizeof(logline)-70,str);
 	truncsp(logline);
 	lputs(level,logline);
 
@@ -845,7 +845,7 @@ static int ftp_lputs(void* p, int level, const char *str)
 			,tm.tm_mon+1,tm.tm_mday
 			,tm.tm_hour,tm.tm_min,tm.tm_sec);
 
-	sprintf(logline,"%sftp  %.*s",tstr,(int)sizeof(logline)-32,str);
+	sprintf(logline,"%sftp  %.*s",tstr,(int)sizeof(logline)-70,str);
 	truncsp(logline);
 	lputs(level,logline);
 
@@ -911,7 +911,7 @@ static int mail_lputs(void* p, int level, const char *str)
 			,tm.tm_mon+1,tm.tm_mday
 			,tm.tm_hour,tm.tm_min,tm.tm_sec);
 
-	sprintf(logline,"%smail %.*s",tstr,(int)sizeof(logline)-32,str);
+	sprintf(logline,"%smail %.*s",tstr,(int)sizeof(logline)-70,str);
 	truncsp(logline);
 	lputs(level,logline);
 
@@ -977,7 +977,7 @@ static int services_lputs(void* p, int level, const char *str)
 			,tm.tm_mon+1,tm.tm_mday
 			,tm.tm_hour,tm.tm_min,tm.tm_sec);
 
-	sprintf(logline,"%ssrvc %.*s",tstr,(int)sizeof(logline)-32,str);
+	sprintf(logline,"%ssrvc %.*s",tstr,(int)sizeof(logline)-70,str);
 	truncsp(logline);
 	lputs(level,logline);
 
@@ -1043,7 +1043,7 @@ static int event_lputs(void* p, int level, const char *str)
 			,tm.tm_mon+1,tm.tm_mday
 			,tm.tm_hour,tm.tm_min,tm.tm_sec);
 
-	sprintf(logline,"%sevnt %.*s",tstr,(int)sizeof(logline)-32,str);
+	sprintf(logline,"%sevnt %.*s",tstr,(int)sizeof(logline)-70,str);
 	truncsp(logline);
 	lputs(level,logline);
 
@@ -1085,7 +1085,7 @@ static int web_lputs(void* p, int level, const char *str)
 			,tm.tm_mon+1,tm.tm_mday
 			,tm.tm_hour,tm.tm_min,tm.tm_sec);
 
-	sprintf(logline,"%sweb  %.*s",tstr,(int)sizeof(logline)-32,str);
+	sprintf(logline,"%sweb  %.*s",tstr,(int)sizeof(logline)-70,str);
 	truncsp(logline);
 	lputs(level,logline);
 

src/sbbs3/services.c

@@ -1128,9 +1128,9 @@ static void js_service_thread(void* arg)
 	/* RUN SCRIPT */
 	SAFECOPY(fname,service->cmd);
 	truncstr(fname," ");
-	sprintf(spath,"%s%s",scfg.mods_dir,fname);
+	SAFEPRINTF2(spath,"%s%s",scfg.mods_dir,fname);
 	if(scfg.mods_dir[0]==0 || !fexist(spath))
-		sprintf(spath,"%s%s",scfg.exec_dir,fname);
+		SAFEPRINTF2(spath,"%s%s",scfg.exec_dir,fname);
 
 	js_init_args(js_cx, js_glob, service->cmd);
 
@@ -1246,9 +1246,9 @@ static void js_static_service_thread(void* arg)
 
 	SAFECOPY(fname,service->cmd);
 	truncstr(fname," ");
-	sprintf(spath,"%s%s",scfg.mods_dir,fname);
+	SAFEPRINTF2(spath,"%s%s",scfg.mods_dir,fname);
 	if(scfg.mods_dir[0]==0 || !fexist(spath))
-		sprintf(spath,"%s%s",scfg.exec_dir,fname);
+		SAFEPRINTF2(spath,"%s%s",scfg.exec_dir,fname);
 
 	do {
 		if((js_cx=js_initcx(js_runtime,INVALID_SOCKET,&service_client,&js_glob))==NULL) {

src/sbbs3/slog.c

@@ -54,7 +54,7 @@ if(!dir[0]) {
 
 backslash(dir);
 
-sprintf(str,"%scsts.dab",dir);
+SAFEPRINTF(str,"%scsts.dab",dir);
 if(!fexistcase(str)) {
 	printf("%s does not exist\r\n",str);
 	return(1); }

src/sbbs3/un_qwk.cpp

@@ -396,7 +396,7 @@ bool sbbs_t::unpack_qwk(char *packet,uint hubnum)
 		MKDIR(inbox);
 
 		// Copy files
-		sprintf(fname,"%s/%s",inbox,dirent->d_name);
+		SAFEPRINTF2(fname,"%s/%s",inbox,dirent->d_name);
 		mv(str,fname,1 /* overwrite */);
 		sprintf(str,text[ReceivedFileViaQWK],dirent->d_name,cfg.qhub[hubnum]->id);
 		putsmsg(&cfg,1,str);

src/sbbs3/upload.cpp

@@ -316,7 +316,7 @@ bool sbbs_t::upload(uint dirnum)
 			,cfg.dir[dirnum]->sname);
 	if(!yesno(str)) return(false);
 	action=NODE_ULNG;
-	sprintf(str,"%s%s",path,fname);
+	SAFEPRINTF2(str,"%s%s",path,fname);
 	if(fexistcase(str)) {   /* File is on disk */
 #ifdef _WIN32
 		GetShortPathName(str, spath, sizeof(spath));
@@ -459,7 +459,7 @@ bool sbbs_t::upload(uint dirnum)
 		if(!noyes(text[AnonymousQ]))
 			f.misc|=FM_ANON; 
 	}
-	sprintf(str,"%s%s",path,fname);
+	SAFEPRINTF2(str,"%s%s",path,fname);
 	if(fexistcase(str)) {   /* File is on disk */
 		if(!uploadfile(&f))
 			return(false); 
@@ -570,7 +570,7 @@ bool sbbs_t::bulkupload(uint dirnum)
 	SYNC;
 	dir=opendir(path);
 	while(dir!=NULL && (dirent=readdir(dir))!=NULL && !msgabort()) {
-		sprintf(str,"%s%s",path,dirent->d_name);
+		SAFEPRINTF2(str,"%s%s",path,dirent->d_name);
 		if(isdir(str))
 			continue;
 #ifdef _WIN32

src/sbbs3/websrvr.c

@@ -1518,18 +1518,19 @@ static void send_error(http_session_t * session, unsigned line, const char* mess
 
 		if(session->req.error_dir) {
 			/* We have a custom error directory from webctrl.ini look there first */
-			sprintf(sbuf,"%s%s%s",session->req.error_dir,error_code,startup->ssjs_ext);
+			SAFEPRINTF3(sbuf,"%s%s%s",session->req.error_dir,error_code,startup->ssjs_ext);
 			if(stat(sbuf,&sb)) {
 				/* No custom .ssjs error message... check for custom .html */
-				sprintf(sbuf2,"%s%s.html",session->req.error_dir,error_code);
+				SAFEPRINTF2(sbuf2,"%s%s.html",session->req.error_dir,error_code);
 				if(stat(sbuf2,&sb)) {
 					/* Nope, no custom .html error either, check for global ssjs one */
-					sprintf(sbuf,"%s%s%s",error_dir,error_code,startup->ssjs_ext);
+					SAFEPRINTF3(sbuf,"%s%s%s",error_dir,error_code,startup->ssjs_ext);
 				}
 			}
 		}
-		else
-			sprintf(sbuf,"%s%s%s",error_dir,error_code,startup->ssjs_ext);
+		else {
+			SAFEPRINTF3(sbuf,"%s%s%s",error_dir,error_code,startup->ssjs_ext);
+		}
 		if(!stat(sbuf,&sb)) {
 			lprintf(LOG_INFO,"%04d Using SSJS error page",session->socket);
 			session->req.dynamic=IS_SSJS;
@@ -3611,7 +3612,7 @@ static BOOL check_request(http_session_t * session)
 		p=last_slash;
 		/* Terminate the path after the slash */
 		*(last_slash+1)=0;
-		sprintf(str,"%saccess.ars",curdir);
+		SAFEPRINTF(str,"%saccess.ars",curdir);
 		if(!stat(str,&sb)) {
 			/* NEVER serve up an access.ars file */
 			lprintf(LOG_WARNING,"%04d !WARNING! access.ars support is deprecated and will be REMOVED very soon.",session->socket);
@@ -3633,7 +3634,7 @@ static BOOL check_request(http_session_t * session)
 			/* Truncate at \r or \n - can use last_slash since I'm done with it.*/
 			truncsp(session->req.ars);
 		}
-		sprintf(str,"%swebctrl.ini",curdir);
+		SAFEPRINTF(str,"%swebctrl.ini",curdir);
 		if(!stat(str,&sb)) {
 			/* NEVER serve up a webctrl.ini file */
 			if(!strcmp(path,str)) {

src/sbbs3/xtrn_sec.cpp

@@ -212,7 +212,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 			return; 
 		}
 
-		sprintf(str,"%s\n%s\n%s\n%s\n"
+		safe_snprintf(str, sizeof(str), "%s\n%s\n%s\n%s\n"
 			,name								/* User name */
 			,cfg.sys_name						/* System name */
 			,cfg.sys_op 						/* Sysop name */
@@ -220,7 +220,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		lfexpand(str,misc);
 		write(file,str,strlen(str));
 
-		sprintf(str,"%s\n%s\n%u\n%u\n%lu\n%s\n%lu\n%lu\n"
+		safe_snprintf(str, sizeof(str), "%s\n%s\n%u\n%u\n%lu\n%s\n%lu\n%lu\n"
 			,ctrl_dir							/* Ctrl dir */
 			,data_dir							/* Data dir */
 			,cfg.sys_nodes						/* Total system nodes */
@@ -234,7 +234,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		lfexpand(str,misc);
 		write(file,str,strlen(str));
 
-		sprintf(str,"%u\n%u\n%s\n%c\n%u\n%s\n"
+		safe_snprintf(str, sizeof(str), "%u\n%u\n%s\n%c\n%u\n%s\n"
 			,useron.level						/* User main level */
 			,useron.level						/* User transfer level */
 			,useron.birth						/* User birthday */
@@ -244,7 +244,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		lfexpand(str,misc);
 		write(file,str,strlen(str));
 
-		sprintf(str,"%u\n%u\n%x\n%lu\n%s\n%s\n"
+		safe_snprintf(str, sizeof(str), "%u\n%u\n%x\n%lu\n%s\n%s\n"
 			"%s\n%s\n%s\n%s\n%s\n%s\n%lu\n"
 			,misc&(XTRN_STDIO|XTRN_CONIO) ? 0:cfg.com_port		/* Com port or 0 if !FOSSIL */
 			,cfg.com_irq						/* Com IRQ */
@@ -295,7 +295,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		lfexpand(str,misc);
 		write(file,str,strlen(str));
 
-		sprintf(str,"%s\n%s\n%d\n%s\n%lu\n%s\n%s\n%s\n%s\n"
+		safe_snprintf(str, sizeof(str), "%s\n%s\n%d\n%s\n%lu\n%s\n%s\n%s\n%s\n"
 			"%" PRIx32 "\n%d\n"
 			,ltoaf(useron.flags3,tmp)			/* Flag set #3 */
 			,ltoaf(useron.flags4,tmp2)			/* Flag set #4 */
@@ -329,7 +329,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		if(tleft>0x7fff)	/* Reduce time-left for broken 16-bit doors		*/
 			tleft=0x7fff;	/* That interpret this value as a signed short	*/
 
-		sprintf(str,"%u\n%s\n%s\n%s\n%u\n%c\n"
+		safe_snprintf(str, sizeof(str), "%u\n%s\n%s\n%s\n%u\n%c\n"
 			,useron.number						/* User number */
 			,name								/* User name */
 			,useron.name						/* User real name */
@@ -340,7 +340,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		lfexpand(str,misc);
 		write(file,str,strlen(str));
 
-		sprintf(str,"%lu\n%s\n%lu\n%ld\n%u\n%u\n%u\n%ld\n%u\n"
+		safe_snprintf(str, sizeof(str), "%lu\n%s\n%lu\n%ld\n%u\n%u\n%u\n%ld\n%u\n"
 			,useron.cdt+useron.freecdt			/* Gold */
 			,unixtodstr(&cfg,useron.laston,tmp)	/* User last on date */
 			,cols 								/* User screen width */
@@ -353,7 +353,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		lfexpand(str,misc);
 		write(file,str,strlen(str));
 
-		sprintf(str,"%lu\n%s\n%s\n%s\n%lu\n%d\n%s\n%s\n"
+		safe_snprintf(str, sizeof(str), "%lu\n%s\n%s\n%s\n%lu\n%d\n%s\n%s\n"
 			"%u\n%u\n%lu\n%u\n%lu\n%u\n%s\n"
 			,tleft								/* Time left in seconds */
 			,node_dir							/* Gfiles dir (log dir) */
@@ -464,7 +464,7 @@ void sbbs_t::xtrndat(const char *name, const char *dropdir, uchar type, ulong tl
 		lfexpand(str,misc);
 		write(file,str,strlen(str));
 
-		sprintf(str,"%u\n%lu\n%s\n%s\n%s\n%s"
+		safe_snprintf(str, sizeof(str), "%u\n%lu\n%s\n%s\n%s\n%s"
 			"\n%s\n%02d:%02d\n%c\n"
 			,0									/* 30: Kbytes downloaded today */
 			,(useron.cdt+useron.freecdt)/1024UL /* 31: Max Kbytes to download today */