From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eigenstate.org ([206.124.132.107]) by ewsd; Tue Jun 11 21:52:22 EDT 2019
Received: from eigenstate.org (localhost [127.0.0.1])
	by eigenstate.org (OpenSMTPD) with ESMTP id d5a80661
	for <9front@9front.org>;
	Tue, 11 Jun 2019 18:52:21 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=eigenstate.org; h=
	message-id:to:subject:date:from:mime-version:content-type
	:content-transfer-encoding; s=mail; bh=GIrYFM5Hb/dP7p+3xE+pAYLRV
	6c=; b=InRAqNsoJZttdhAS9V4ICVuGmQxR9cCHEAHLdcY6dujIZEwV+qUo2NETS
	EynkiiHPt8U4kiOQE1jry9gVVf8ViCuD+xt7ka7WtySy2rtuKJvK+3Y6qaE5BlIE
	PHqxwJcsPAp8YALyge6l/TRMvis/1Od9hKBKjyylpuHJoe/JRw=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=eigenstate.org; h=message-id
	:to:subject:date:from:mime-version:content-type
	:content-transfer-encoding; q=dns; s=mail; b=gsFUktjhOyRyOP9z5ly
	43L4Eo2V73u5Z032SuKGSCNKFBLCM9soGO2NOwfrCjyAjtqPvvtn4q6Hs1LAwr/K
	kBNgF6Vo6Md2f4dkzgjGyBfTN/gxTISO3mhNiLsbixSNjim0axRHXJLKM/GZ9H3k
	xuKWSs5zO52fr1ikRSt+ZM18=
Received: from abbatoir.hsd1.ca.comcast.net (c-76-21-119-139.hsd1.ca.comcast.net [76.21.119.139])
	by eigenstate.org (OpenSMTPD) with ESMTPSA id bc4faf16 (TLSv1.2:ECDHE-RSA-AES256-SHA:256:NO)
	for <9front@9front.org>;
	Tue, 11 Jun 2019 18:52:21 -0700 (PDT)
Message-ID: <941802D411D4A638FCD2BE2F490D0516@eigenstate.org>
To: 9front@9front.org
Subject: Importing Patches from 9legacy: snprint
Date: Tue, 11 Jun 2019 18:52:20 -0700
From: ori@eigenstate.org
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
List-ID: <9front.9front.org>
List-Help: <http://lists.9front.org>
X-Glyph: ➈
X-Bullshit: basic optimized realtime-java app 

This patch grabs a bunch of commits from the 9legacy repository
to replace sprint with snprint. Most of the changes are harmless
cleanup, where an integer is formatted into a string and cannot
possibly overflow the buffer, but a number of them fix overflows
where snprint prints a parameter of unspecified size into a buffer
of fixed size.

Examples of actual bugfixes where sprint can potentially overwrite
useful information include:

	cc/func.c
	cc/lex.c
	sys/src/cmd/ndb/dnudpserver.c

The list of commits is here:

ba1ed3e54b251770cbb32f179a6191e16c0ed56d sys/src/libthread: replace sprint by snprint (thanks Geoff Collyer)
2f1eeb6e9dad9f1194e845fccfc1b0e2e665acc4 sys/src/libsec: replace sprint by snprint (thanks Geoff Collyer)
d4a2c9d46093d04c58be40bd22aaa54cf10e51a0 sys/src/libndb: replace sprint by snprint (thanks Geoff Collyer)
da930d494af815c8a5e5cbef14c716b22c88442b sys/src/libmemdraw: replace sprint by snprint (thanks Geoff Collyer)
f0982378ad7c9ed0eea9a607f67467a7a3c29b1f sys/src/libmach: replace sprint by snprint (thanks Geoff Collyer)
67a30170328c4941a05c4551aea6e875bde9c2f2 sys/src/libip: replace sprint by snprint (thanks Geoff Collyer)
a52a74fd5c44ab0fb5bc09884a095f594379b504 sys/src/libhttpd: replace sprint by snprint (thanks Geoff Collyer)
a3ab18d5d5bee1262e748b4a9d03b9a0843d989b sys/src/libhtml: replace sprint by snprint (thanks Geoff Collyer)
dcbe90ec32610e9b06071f8f39505e35b46edb5f sys/src/libdraw: replace sprint by snprint (thanks Geoff Collyer)
a80ca709e35c8fedaa8d62ce9cd2a033bb1c0c1e sys/src/libcontrol: replace sprint by snprint (thanks Geoff Collyer)
4c1125b3b9e0cbb11cb4d60090d795c7cbfc77c5 sys/src/cmd/ndb: replace sprint by snprint (thanks Geoff Collyer)
8aa8d7321d07ef1d760948c4cf04a8e909d7c397 sys/src/cmd/cc: replace sprint by snprint (thanks Geoff Collyer)
f00f244d9d9dcab57e485af0db635ddea4954285 sys/src/libauth: replace sprint by snprint (thanks Geoff Collyer)
48bb33bb5f40c848d40325d8c4656cb9b458953d sys/src/libc: replace sprint by snprint (thanks Geoff Collyer)
83544e6c0148f81be81e34089adf276510499e8f sys/lib: replace sprint by snprint (thanks Geoff Collyer)

A worthwhile second pass over this may be to look at places where we care that snprint ran out of space,
and error out correctly.

Ok to commit?

diff -r b703b47e2940 sys/lib/yaccpar
--- a/sys/lib/yaccpar	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/lib/yaccpar	Tue Jun 11 18:35:01 2019 -0700
@@ -16,7 +16,7 @@
 int	yyerrflag = 0;		/* error recovery flag */
 
 extern	int	fprint(int, char*, ...);
-extern	int	sprint(char*, char*, ...);
+extern	int	snprint(char*, int, char*, ...);
 
 char*
 yytokname(int yyc)
@@ -26,7 +26,7 @@
 	if(yyc > 0 && yyc <= sizeof(yytoknames)/sizeof(yytoknames[0]))
 	if(yytoknames[yyc-1])
 		return yytoknames[yyc-1];
-	sprint(x, "<%d>", yyc);
+	snprint(x, sizeof x, "<%d>", yyc);
 	return x;
 }
 
@@ -38,7 +38,7 @@
 	if(yys >= 0 && yys < sizeof(yystates)/sizeof(yystates[0]))
 	if(yystates[yys])
 		return yystates[yys];
-	sprint(x, "<%d>\n", yys);
+	snprint(x, sizeof x, "<%d>\n", yys);
 	return x;
 }
 
diff -r b703b47e2940 sys/src/cmd/cc/cc.y
--- a/sys/src/cmd/cc/cc.y	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/cmd/cc/cc.y	Tue Jun 11 18:35:01 2019 -0700
@@ -1008,7 +1008,7 @@
 |	LSTRUCT sbody
 	{
 		taggen++;
-		sprint(symb, "_%d_", taggen);
+		snprint(symb, sizeof symb, "_%d_", taggen);
 		$$ = dotag(lookup(), TSTRUCT, autobn);
 		$$->link = $2;
 		sualign($$);
@@ -1033,7 +1033,7 @@
 |	LUNION sbody
 	{
 		taggen++;
-		sprint(symb, "_%d_", taggen);
+		snprint(symb, sizeof symb, "_%d_", taggen);
 		$$ = dotag(lookup(), TUNION, autobn);
 		$$->link = $2;
 		sualign($$);
diff -r b703b47e2940 sys/src/cmd/cc/funct.c
--- a/sys/src/cmd/cc/funct.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/cmd/cc/funct.c	Tue Jun 11 18:35:01 2019 -0700
@@ -262,7 +262,7 @@
 		o = ftabinit[i].op;
 		if(o == OXXX)
 			break;
-		sprint(str, "%s_%s_", t->tag->name, ftabinit[i].name);
+		snprint(str, sizeof str, "%s_%s_", t->tag->name, ftabinit[i].name);
 		n = new(ONAME, Z, Z);
 		n->sym = slookup(str);
 		f->sym[o] = n->sym;
@@ -296,7 +296,7 @@
 		/*
 		 * OCAST types T1 _T2_T1_(T2)
 		 */
-		sprint(str, "_%s%s_", gtabinit[i].name, t->tag->name);
+		snprint(str, sizeof str, "_%s%s_", gtabinit[i].name, t->tag->name);
 		n = new(ONAME, Z, Z);
 		n->sym = slookup(str);
 		f->castto[o] = n->sym;
@@ -305,7 +305,7 @@
 		f1->down = types[o];
 		dodecl(xdecl, CEXTERN, f1, n);
 
-		sprint(str, "%s_%s_", t->tag->name, gtabinit[i].name);
+		snprint(str, sizeof str, "%s_%s_", t->tag->name, gtabinit[i].name);
 		n = new(ONAME, Z, Z);
 		n->sym = slookup(str);
 		f->castfr[o] = n->sym;
diff -r b703b47e2940 sys/src/cmd/cc/lex.c
--- a/sys/src/cmd/cc/lex.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/cmd/cc/lex.c	Tue Jun 11 18:35:01 2019 -0700
@@ -274,11 +274,11 @@
 				av[i++] = strdup(opt);
 			}
 			for(c = 0; c < ndef; c++) {
-				sprint(opt, "-D%s", defs[c]);
+				snprint(opt, sizeof opt, "-D%s", defs[c]);
 				av[i++] = strdup(opt);
 			}
 			for(c = 0; c < ninclude; c++) {
-				sprint(opt, "-I%s", include[c]);
+				snprint(opt, sizeof opt, "-I%s", include[c]);
 				av[i++] = strdup(opt);
 			}
 			if(strcmp(file, "stdin") != 0)
@@ -1421,19 +1421,19 @@
 		if(str[0])
 			strcat(str, " ");
 		if(t->garb&~GINCOMPLETE) {
-			sprint(s, "%s ", gnames[t->garb&~GINCOMPLETE]);
+			snprint(s, sizeof s, "%s ", gnames[t->garb&~GINCOMPLETE]);
 			if(strlen(str) + strlen(s) < STRINGSZ)
 				strcat(str, s);
 		}
-		sprint(s, "%s", tnames[et]);
+		snprint(s, sizeof s, "%s", tnames[et]);
 		if(strlen(str) + strlen(s) < STRINGSZ)
 			strcat(str, s);
 		if(et == TFUNC && (t1 = t->down)) {
-			sprint(s, "(%T", t1);
+			snprint(s, sizeof s, "(%T", t1);
 			if(strlen(str) + strlen(s) < STRINGSZ)
 				strcat(str, s);
 			while(t1 = t1->down) {
-				sprint(s, ", %T", t1);
+				snprint(s, sizeof s, ", %T", t1);
 				if(strlen(str) + strlen(s) < STRINGSZ)
 					strcat(str, s);
 			}
@@ -1444,12 +1444,12 @@
 			n = t->width;
 			if(t->link && t->link->width)
 				n /= t->link->width;
-			sprint(s, "[%ld]", n);
+			snprint(s, sizeof s, "[%ld]", n);
 			if(strlen(str) + strlen(s) < STRINGSZ)
 				strcat(str, s);
 		}
 		if(t->nbits) {
-			sprint(s, " %d:%d", t->shift, t->nbits);
+			snprint(s, sizeof s, " %d:%d", t->shift, t->nbits);
 			if(strlen(str) + strlen(s) < STRINGSZ)
 				strcat(str, s);
 		}
diff -r b703b47e2940 sys/src/cmd/ndb/dnudpserver.c
--- a/sys/src/cmd/ndb/dnudpserver.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/cmd/ndb/dnudpserver.c	Tue Jun 11 18:35:01 2019 -0700
@@ -286,7 +286,7 @@
 	static int whined;
 
 	/* get a udp port */
-	sprint(datafile, "%s/udp!*!dns", mntpt);
+	snprint(datafile, sizeof datafile, "%s/udp!*!dns", mntpt);
 	ctl = announce(datafile, dir);
 	if(ctl < 0){
 		if(!whined++)
diff -r b703b47e2940 sys/src/libauth/newns.c
--- a/sys/src/libauth/newns.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libauth/newns.c	Tue Jun 11 18:35:01 2019 -0700
@@ -344,7 +344,7 @@
 	char ename[ANAMELEN+6];
 	long s;
 
-	sprint(ename, "#e/%s", name);
+	snprint(ename, sizeof ename, "#e/%s", name);
 	f = create(ename, OWRITE, 0664);
 	if(f < 0)
 		return -1;
diff -r b703b47e2940 sys/src/libc/9sys/getnetconninfo.c
--- a/sys/src/libc/9sys/getnetconninfo.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libc/9sys/getnetconninfo.c	Tue Jun 11 18:35:01 2019 -0700
@@ -77,7 +77,7 @@
 	/* figure out bind spec */
 	d = dirstat(nci->dir);
 	if(d != nil){
-		sprint(spec, "#%C%d", d->type, d->dev);
+		snprint(spec, sizeof spec, "#%C%d", d->type, d->dev);
 		nci->spec = strdup(spec);
 	}
 	if(nci->spec == nil)
diff -r b703b47e2940 sys/src/libc/9sys/postnote.c
--- a/sys/src/libc/9sys/postnote.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libc/9sys/postnote.c	Tue Jun 11 18:35:01 2019 -0700
@@ -9,10 +9,10 @@
 
 	switch(group) {
 	case PNPROC:
-		sprint(file, "/proc/%d/note", pid);
+		snprint(file, sizeof file, "/proc/%d/note", pid);
 		break;
 	case PNGROUP:
-		sprint(file, "/proc/%d/notepg", pid);
+		snprint(file, sizeof file, "/proc/%d/notepg", pid);
 		break;
 	default:
 		return -1;
diff -r b703b47e2940 sys/src/libc/9sys/pushssl.c
--- a/sys/src/libc/9sys/pushssl.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libc/9sys/pushssl.c	Tue Jun 11 18:35:01 2019 -0700
@@ -21,7 +21,7 @@
 	if(n < 0)
 		goto error;
 	buf[n] = 0;
-	sprint(dname, "#D/ssl/%s/data", buf);
+	snprint(dname, sizeof dname, "#D/ssl/%s/data", buf);
 	data = open(dname, ORDWR);
 	if(data < 0)
 		goto error;
diff -r b703b47e2940 sys/src/libc/9sys/pushtls.c
--- a/sys/src/libc/9sys/pushtls.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libc/9sys/pushtls.c	Tue Jun 11 18:35:01 2019 -0700
@@ -60,13 +60,13 @@
 		sprint(dir, "#a/tls/%s", buf);
 
 	// get application fd
-	sprint(dname, "#a/tls/%s/data", buf);
+	snprint(dname, sizeof dname, "#a/tls/%s/data", buf);
 	data = open(dname, ORDWR);
 	if(data < 0)
 		goto error;
 
 	// get handshake fd
-	sprint(dname, "#a/tls/%s/hand", buf);
+	snprint(dname, sizeof dname, "#a/tls/%s/hand", buf);
 	hand = open(dname, ORDWR);
 	if(hand < 0)
 		goto error;
diff -r b703b47e2940 sys/src/libc/fmt/fltfmt.c
--- a/sys/src/libc/fmt/fltfmt.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libc/fmt/fltfmt.c	Tue Jun 11 18:35:01 2019 -0700
@@ -133,13 +133,13 @@
 		d = e;
 		s1[NSIGNIF-2] = '0';
 		s1[NSIGNIF-1] = '0';
-		sprint(s1+NSIGNIF, "e%d", e-NSIGNIF+1);
+		snprint(s1+NSIGNIF, sizeof s1-NSIGNIF, "e%d", e-NSIGNIF+1);
 		g = strtod(s1, nil);
 		if(g == f)
 			goto found;
 		if(xadd(s1, NSIGNIF-3, 1)) {
 			e++;
-			sprint(s1+NSIGNIF, "e%d", e-NSIGNIF+1);
+			snprint(s1+NSIGNIF, sizeof s1-NSIGNIF, "e%d", e-NSIGNIF+1);
 		}
 		g = strtod(s1, nil);
 		if(g == f)
@@ -152,7 +152,7 @@
 	 * convert back so s1 gets exact answer
 	 */
 	for(;;) {
-		sprint(s1+NSIGNIF, "e%d", e-NSIGNIF+1);
+		snprint(s1+NSIGNIF, sizeof s1-NSIGNIF, "e%d", e-NSIGNIF+1);
 		g = strtod(s1, nil);
 		if(f > g) {
 			if(xadd(s1, NSIGNIF-1, 1))
diff -r b703b47e2940 sys/src/libcontrol/control.c
--- a/sys/src/libcontrol/control.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libcontrol/control.c	Tue Jun 11 18:35:01 2019 -0700
@@ -342,9 +342,12 @@
 char*
 _ctlstrrune(Rune *r)
 {
+	int nb;
 	char *s;
-	s = ctlmalloc(runestrlen(r)*UTFmax+1);
-	sprint(s, "%S", r);
+
+	nb = runestrlen(r)*UTFmax+1;
+	s = ctlmalloc(nb);
+	snprint(s, nb, "%S", r);
 	return s;
 }
 
diff -r b703b47e2940 sys/src/libcontrol/scribble.c
--- a/sys/src/libcontrol/scribble.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libcontrol/scribble.c	Tue Jun 11 18:35:01 2019 -0700
@@ -109,9 +109,9 @@
 	else if(r == ' ')
 		strcpy(b->lastchar, "' '");
 	else if(r < ' ')
-		sprint(b->lastchar, "ctl-%c", r+'@');
+		snprint(b->lastchar, sizeof b->lastchar, "ctl-%c", r+'@');
 	else
-		sprint(b->lastchar, "%C", r);
+		snprint(b->lastchar, sizeof b->lastchar, "%C", r);
 }
 
 
diff -r b703b47e2940 sys/src/libdraw/event.c
--- a/sys/src/libdraw/event.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libdraw/event.c	Tue Jun 11 18:35:01 2019 -0700
@@ -423,7 +423,7 @@
 	char buf[2*12+2];
 	int n;
 
-	n = sprint(buf, "m%d %d", pt.x, pt.y);
+	n = snprint(buf, sizeof buf, "m%d %d", pt.x, pt.y);
 	write(mousefd, buf, n);
 }
 
diff -r b703b47e2940 sys/src/libdraw/init.c
--- a/sys/src/libdraw/init.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libdraw/init.c	Tue Jun 11 18:35:01 2019 -0700
@@ -217,7 +217,7 @@
 	if(t == nil)
 		return nil;
 
-	sprint(buf, "%s/draw/new", dev);
+	snprint(buf, sizeof buf, "%s/draw/new", dev);
 	ctlfd = open(buf, ORDWR|OCEXEC);
 	if(ctlfd < 0){
     Error1:
@@ -236,11 +236,11 @@
 	isnew = 0;
 	if(n < NINFO)	/* this will do for now, we need something better here */
 		isnew = 1;
-	sprint(buf, "%s/draw/%d/data", dev, atoi(info+0*12));
+	snprint(buf, sizeof buf, "%s/draw/%d/data", dev, atoi(info+0*12));
 	datafd = open(buf, ORDWR|OCEXEC);
 	if(datafd < 0)
 		goto Error2;
-	sprint(buf, "%s/draw/%d/refresh", dev, atoi(info+0*12));
+	snprint(buf, sizeof buf, "%s/draw/%d/refresh", dev, atoi(info+0*12));
 	reffd = open(buf, OREAD|OCEXEC);
 	if(reffd < 0){
     Error3:
diff -r b703b47e2940 sys/src/libdraw/keyboard.c
--- a/sys/src/libdraw/keyboard.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libdraw/keyboard.c	Tue Jun 11 18:35:01 2019 -0700
@@ -57,6 +57,7 @@
 Keyboardctl*
 initkeyboard(char *file)
 {
+	int nb;
 	Keyboardctl *kc;
 	char *t;
 
@@ -67,13 +68,14 @@
 		file = "/dev/cons";
 	kc->file = strdup(file);
 	kc->consfd = open(file, ORDWR|OCEXEC);
-	t = malloc(strlen(file)+16);
+	nb = strlen(file)+16;
+	t = malloc(nb);
 	if(kc->consfd<0 || t==nil){
 Error1:
 		free(kc);
 		return nil;
 	}
-	sprint(t, "%sctl", file);
+	snprint(t, nb, "%sctl", file);
 	kc->ctlfd = open(t, OWRITE|OCEXEC);
 	if(kc->ctlfd < 0){
 		fprint(2, "initkeyboard: can't open %s: %r\n", t);
diff -r b703b47e2940 sys/src/libdraw/readcolmap.c
--- a/sys/src/libdraw/readcolmap.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libdraw/readcolmap.c	Tue Jun 11 18:35:01 2019 -0700
@@ -26,7 +26,7 @@
 
 	USED(screen);
 
-	sprint(buf, "/dev/draw/%d/colormap", d->dirno);
+	snprint(buf, sizeof buf, "/dev/draw/%d/colormap", d->dirno);
 	b = Bopen(buf, OREAD);
 	if(b == 0)
 		drawerror(d, "rdcolmap: can't open colormap device");
diff -r b703b47e2940 sys/src/libdraw/writecolmap.c
--- a/sys/src/libdraw/writecolmap.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libdraw/writecolmap.c	Tue Jun 11 18:35:01 2019 -0700
@@ -15,7 +15,7 @@
 	char buf[64], *t;
 	ulong r, g, b;
 
-	sprint(buf, "/dev/draw/%d/colormap", d->dirno);
+	snprint(buf, sizeof buf, "/dev/draw/%d/colormap", d->dirno);
 	fd = open(buf, OWRITE);
 	if(fd < 0)
 		drawerror(d, "writecolmap: open colormap failed");
diff -r b703b47e2940 sys/src/libdraw/writeimage.c
--- a/sys/src/libdraw/writeimage.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libdraw/writeimage.c	Tue Jun 11 18:35:01 2019 -0700
@@ -94,7 +94,7 @@
 		free(chain);
 		goto ErrOut0;
 	}
-	sprint(hdr, "compressed\n%11s %11d %11d %11d %11d ",
+	snprint(hdr, sizeof hdr, "compressed\n%11s %11d %11d %11d %11d ",
 		chantostr(cbuf, i->chan), r.min.x, r.min.y, r.max.x, r.max.y);
 	if(write(fd, hdr, 11+5*12) != 11+5*12)
 		goto ErrOut;
@@ -200,7 +200,7 @@
 		if(loutp == outbuf)
 			goto ErrOut;
 		n = loutp-outbuf;
-		sprint(hdr, "%11d %11ld ", r.max.y, n);
+		snprint(hdr, sizeof hdr, "%11d %11ld ", r.max.y, n);
 		write(fd, hdr, 2*12);
 		write(fd, outbuf, n);
 		r.min.y = r.max.y;
diff -r b703b47e2940 sys/src/libdraw/writesubfont.c
--- a/sys/src/libdraw/writesubfont.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libdraw/writesubfont.c	Tue Jun 11 18:35:01 2019 -0700
@@ -27,7 +27,7 @@
 	uchar *data;
 	int nb;
 
-	sprint(hdr, "%11d %11d %11d ", f->n, f->height, f->ascent);
+	snprint(hdr, sizeof hdr, "%11d %11d %11d ", f->n, f->height, f->ascent);
 	if(write(fd, hdr, 3*12) != 3*12){
    Err:
 		werrstr("writesubfont: bad write: %r");
diff -r b703b47e2940 sys/src/libhtml/lex.c
--- a/sys/src/libhtml/lex.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libhtml/lex.c	Tue Jun 11 18:35:01 2019 -0700
@@ -1423,7 +1423,7 @@
 
 	t = va_arg(f->args, Token*);
 	if(t == nil)
-		sprint(buf, "<null>");
+		snprint(buf, sizeof buf, "<null>");
 	else {
 		i = 0;
 		if(dbglex > 1)
diff -r b703b47e2940 sys/src/libhttpd/redirected.c
--- a/sys/src/libhttpd/redirected.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libhttpd/redirected.c	Tue Jun 11 18:35:01 2019 -0700
@@ -9,7 +9,7 @@
 	Hio *hout;
 	char *s, *ss, *scheme, *host;
 	char sayport[NETPATHLEN];
-	int n;
+	int n, nb;
 
 	scheme = c->scheme? c->scheme: "http";
 	host = c->head.host;
@@ -19,8 +19,9 @@
 		s = strrchr(c->req.uri, '/');
 		if(s != nil)
 			*s = '\0';
-		ss = halloc(c, strlen(c->req.uri) + strlen(uri) + 2 + UTFmax);
-		sprint(ss, "%s/%s", c->req.uri, uri);
+		nb = strlen(c->req.uri) + strlen(uri) + 2 + UTFmax;
+		ss = halloc(c, nb);
+		snprint(ss, nb, "%s/%s", c->req.uri, uri);
 		uri = ss;
 		if(s != nil)
 			*s = '/';
diff -r b703b47e2940 sys/src/libip/eipfmt.c
--- a/sys/src/libip/eipfmt.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libip/eipfmt.c	Tue Jun 11 18:35:01 2019 -0700
@@ -61,14 +61,14 @@
 		n = 0;
 		for(i = 0; i < 16; i += 2){
 			if(i == eli){
-				n += sprint(buf+n, "::");
+				n += snprint(buf+n, sizeof buf-n, "::");
 				i += eln;
 				if(i >= 16)
 					break;
 			} else if(i != 0)
-				n += sprint(buf+n, ":");
+				n += snprint(buf+n, sizeof buf-n, ":");
 			s = (p[i]<<8) + p[i+1];
-			n += sprint(buf+n, "%ux", s);
+			n += snprint(buf+n, sizeof buf-n, "%ux", s);
 		}
 		return fmtstrcpy(f, buf);
 
diff -r b703b47e2940 sys/src/libmach/5db.c
--- a/sys/src/libmach/5db.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libmach/5db.c	Tue Jun 11 18:35:01 2019 -0700
@@ -637,7 +637,7 @@
 		ulong v;
 		ulong s = (i->w & BITS(7,11)) >> 7;
 
-		sprint(buf, "R%ld", i->w & 0xf);
+		snprint(buf, sizeof buf, "R%ld", i->w & 0xf);
 		v = rget(map, buf);
 
 		switch((i->w & BITS(4, 6)) >> 4) {
@@ -645,14 +645,14 @@
 		case 0:					/* LSLIMM */
 			return v << s;
 		case 1:					/* LSLREG */
-			sprint(buf, "R%lud", s >> 1);
+			snprint(buf, sizeof buf, "R%lud", s >> 1);
 			s = rget(map, buf) & 0xFF;
 			if(s >= 32) return 0;
 			return v << s;
 		case 2:					/* LSRIMM */
 			return LSR(v, s);
 		case 3:					/* LSRREG */
-			sprint(buf, "R%ld", s >> 1);
+			snprint(buf, sizeof buf, "R%ld", s >> 1);
 			s = rget(map, buf) & 0xFF;
 			if(s >= 32) return 0;
 			return LSR(v, s);
@@ -664,7 +664,7 @@
 			}
 			return ASR(v, s);
 		case 5:					/* ASRREG */
-			sprint(buf, "R%ld", s >> 1);
+			snprint(buf, sizeof buf, "R%ld", s >> 1);
 			s = rget(map, buf) & 0xFF;
 			if(s >= 32) {
 				if((v & (1U<<31)) == 0)
@@ -712,7 +712,7 @@
 	ulong rn;
 
 	rn = (i->w >> 16) & 0xf;
-	sprint(buf,"R%ld", rn);
+	snprint(buf, sizeof buf, "R%ld", rn);
 
 	v = rget(map, buf);
 	nb = nbits(i->w & ((1 << 15) - 1));
@@ -747,7 +747,7 @@
 		uchar c;
 		uchar rm;
 
-		sprint(buf, "R%ld", i->w & 0xf);
+		snprint(buf, sizeof buf, "R%ld", i->w & 0xf);
 		rm = rget(map, buf);
 
 		switch((i->w & BITS(5,6)) >> 5) {
@@ -780,7 +780,7 @@
 		return pc+4;
 
 	r = (i->w >> 16) & 0xf;
-	sprint(buf, "R%d", r);
+	snprint(buf, sizeof buf, "R%d", r);
 
 	return rget(map, buf) + armshiftval(map, rget, i);
 }
@@ -794,7 +794,7 @@
 	if(!armcondpass(map, rget, (i->w>>28)&0xf))
 		return pc+4;
 	r = (i->w >> 0) & 0xf;
-	sprint(buf, "R%d", r);
+	snprint(buf, sizeof buf, "R%d", r);
 	return rget(map, buf);
 }
 
diff -r b703b47e2940 sys/src/libmach/kdb.c
--- a/sys/src/libmach/kdb.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libmach/kdb.c	Tue Jun 11 18:35:01 2019 -0700
@@ -56,9 +56,9 @@
 	if(tbr < sizeof trapname/sizeof(char*))
 		return trapname[tbr];
 	if(tbr >= 130)
-		sprint(buf, "trap instruction %ld", tbr-128);
+		snprint(buf, sizeof buf, "trap instruction %ld", tbr-128);
 	else if(17<=tbr && tbr<=31)
-		sprint(buf, "interrupt level %ld", tbr-16);
+		snprint(buf, sizeof buf, "interrupt level %ld", tbr-16);
 	else switch(tbr){
 	case 36:
 		return "cp disabled";
@@ -69,7 +69,7 @@
 	case 129:
 		return "breakpoint";
 	default:
-		sprint(buf, "unknown trap %ld", tbr);
+		snprint(buf, sizeof buf, "unknown trap %ld", tbr);
 	}
 	return buf;
 }
@@ -678,7 +678,7 @@
 		s = "";
 		if((op3&11)==1 || (op3&11)==2)
 			s="U";
-		sprint(buf, "MOV%c%s", c, s);
+		snprint(buf, sizeof buf, "MOV%c%s", c, s);
 		return buf;
 	}
 	return m;
@@ -1035,12 +1035,12 @@
 	}
 
 	if((w&0xC1F80000) == 0x81C00000){	/* JMPL */
-		sprint(buf, "R%ld", (w>>14)&0xF);
+		snprint(buf, sizeof buf, "R%ld", (w>>14)&0xF);
 		r1 = (*rget)(map, buf);
 		if(w & 0x2000)			/* JMPL R1+simm13 */
 			r2 = i.simm13;
 		else{				/* JMPL R1+R2 */
-			sprint(buf, "R%ld", w&0xF);
+			snprint(buf, sizeof buf, "R%ld", w&0xF);
 			r2 = (*rget)(map, buf);
 		}
 		foll[0] = r1 + r2;
diff -r b703b47e2940 sys/src/libmach/qdb.c
--- a/sys/src/libmach/qdb.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libmach/qdb.c	Tue Jun 11 18:35:01 2019 -0700
@@ -84,7 +84,7 @@
 	c = (*rget)(map, "CAUSE") >> 8;
 	if(c < nelem(excname))
 		return excname[c];
-	sprint(buf, "unknown trap #%lx", c);
+	snprint(buf, sizeof buf, "unknown trap #%lx", c);
 	return buf;
 }
 
@@ -357,7 +357,7 @@
 	if(bo==4 || bo==12 || bo==20) {	/* simple forms */
 		if(bo != 20) {
 			bi = i->bi&3;
-			sprint(buf, "B%s%%L", bo==12? tcrbits[bi]: fcrbits[bi]);
+			snprint(buf, sizeof buf, "B%s%%L", bo==12? tcrbits[bi]: fcrbits[bi]);
 			format(buf, i, nil);
 			bprint(i, "\t");
 			if(i->bi > 4)
diff -r b703b47e2940 sys/src/libmach/sym.c
--- a/sys/src/libmach/sym.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libmach/sym.c	Tue Jun 11 18:35:01 2019 -0700
@@ -1080,7 +1080,7 @@
 	else {
 		k = fileelem(fnames, (uchar*)start->name, str, n);
 		if(k+8 < n)
-			sprint(str+k, ":%ld", line);
+			snprint(str+k, n-k, ":%ld", line);
 	}
 /**********Remove comments for complete back-trace of include sequence
  *	if(start != base) {
@@ -1091,7 +1091,7 @@
  *		}
  *		k += fileelem(fnames, (uchar*) base->name, str+k, n-k);
  *		if(k+10 < n)
- *			sprint(str+k, ":%ld}", start->line-delta);
+ *			snprint(str+k, n-k, ":%ld}", start->line-delta);
  *	}
  ********************/
 	return 0;
diff -r b703b47e2940 sys/src/libmach/vcodas.c
--- a/sys/src/libmach/vcodas.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libmach/vcodas.c	Tue Jun 11 18:35:01 2019 -0700
@@ -412,19 +412,19 @@
 	switch (i->rs) {
 
 	case 0:
-		sprint(buf, "mfc%d", cop);
+		snprint(buf, sizeof buf, "mfc%d", cop);
 		break;
 
 	case 2:
-		sprint(buf, "cfc%d", cop);
+		snprint(buf, sizeof buf, "cfc%d", cop);
 		break;
 
 	case 4:
-		sprint(buf, "mtc%d", cop);
+		snprint(buf, sizeof buf, "mtc%d", cop);
 		break;
 
 	case 6:
-		sprint(buf, "ctc%d", cop);
+		snprint(buf, sizeof buf, "ctc%d", cop);
 		break;
 
 	case 8:
@@ -432,30 +432,30 @@
 		switch (i->rt) {
 
 		case 0:
-			sprint(buf, "bc%df", cop);
+			snprint(buf, sizeof buf, "bc%df", cop);
 			break;
 
 		case 1:
-			sprint(buf, "bc%dt", cop);
+			snprint(buf, sizeof buf, "bc%dt", cop);
 			break;
 
 		case 2:
-			sprint(buf, "bc%dfl", cop);
+			snprint(buf, sizeof buf, "bc%dfl", cop);
 			break;
 
 		case 3:
-			sprint(buf, "bc%dtl", cop);
+			snprint(buf, sizeof buf, "bc%dtl", cop);
 			break;
 
 		default:
-			sprint(buf, "cop%d", cop);
+			snprint(buf, sizeof buf, "cop%d", cop);
 			f = mipscoxxx;
 			break;
 		}
 		break;
 
 	default:
-		sprint(buf, "cop%d", cop);
+		snprint(buf, sizeof buf, "cop%d", cop);
 		if (i->rs & 0x10)
 			f = "function %c";
 		else
diff -r b703b47e2940 sys/src/libmach/vdb.c
--- a/sys/src/libmach/vdb.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libmach/vdb.c	Tue Jun 11 18:35:01 2019 -0700
@@ -869,19 +869,19 @@
 	switch (i->rs) {
 
 	case 0:
-		sprint(buf, "mfc%d", cop);
+		snprint(buf, sizeof buf, "mfc%d", cop);
 		break;
 
 	case 2:
-		sprint(buf, "cfc%d", cop);
+		snprint(buf, sizeof buf, "cfc%d", cop);
 		break;
 
 	case 4:
-		sprint(buf, "mtc%d", cop);
+		snprint(buf, sizeof buf, "mtc%d", cop);
 		break;
 
 	case 6:
-		sprint(buf, "ctc%d", cop);
+		snprint(buf, sizeof buf, "ctc%d", cop);
 		break;
 
 	case 8:
@@ -889,30 +889,30 @@
 		switch (i->rt) {
 
 		case 0:
-			sprint(buf, "bc%df", cop);
+			snprint(buf, sizeof buf, "bc%df", cop);
 			break;
 
 		case 1:
-			sprint(buf, "bc%dt", cop);
+			snprint(buf, sizeof buf, "bc%dt", cop);
 			break;
 
 		case 2:
-			sprint(buf, "bc%dfl", cop);
+			snprint(buf, sizeof buf, "bc%dfl", cop);
 			break;
 
 		case 3:
-			sprint(buf, "bc%dtl", cop);
+			snprint(buf, sizeof buf, "bc%dtl", cop);
 			break;
 
 		default:
-			sprint(buf, "cop%d", cop);
+			snprint(buf, sizeof buf, "cop%d", cop);
 			f = mipscoxxx;
 			break;
 		}
 		break;
 
 	default:
-		sprint(buf, "cop%d", cop);
+		snprint(buf, sizeof buf, "cop%d", cop);
 		if (i->rs & 0x10)
 			f = "function %c";
 		else
@@ -1142,7 +1142,7 @@
 	switch(l){
 	case 0:		/* SPECIAL */
 		if((w&0x3E) == 0x08){	/* JR, JALR */
-			sprint(buf, "R%ld", (w>>21)&0x1F);
+			snprint(buf, sizeof buf, "R%ld", (w>>21)&0x1F);
 			foll[0] = (*rget)(map, buf);
 			return 1;
 		}
diff -r b703b47e2940 sys/src/libmemdraw/write.c
--- a/sys/src/libmemdraw/write.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libmemdraw/write.c	Tue Jun 11 18:35:01 2019 -0700
@@ -70,7 +70,7 @@
 		free(chain);
 		goto ErrOut0;
 	}
-	sprint(hdr, "compressed\n%11s %11d %11d %11d %11d ",
+	snprint(hdr, sizeof hdr, "compressed\n%11s %11d %11d %11d %11d ",
 		chantostr(cbuf, i->chan), r.min.x, r.min.y, r.max.x, r.max.y);
 	if(write(fd, hdr, 11+5*12) != 11+5*12)
 		goto ErrOut;
@@ -176,7 +176,7 @@
 		if(loutp == outbuf)
 			goto ErrOut;
 		n = loutp-outbuf;
-		sprint(hdr, "%11d %11ld ", r.max.y, n);
+		snprint(hdr, sizeof hdr, "%11d %11ld ", r.max.y, n);
 		write(fd, hdr, 2*12);
 		write(fd, outbuf, n);
 		r.min.y = r.max.y;
diff -r b703b47e2940 sys/src/libndb/ndbhash.c
--- a/sys/src/libndb/ndbhash.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libndb/ndbhash.c	Tue Jun 11 18:35:01 2019 -0700
@@ -86,7 +86,7 @@
 
 	/* compare it to the database file */
 	strncpy(hf->attr, attr, sizeof(hf->attr)-1);
-	sprint(buf, "%s.%s", db->file, hf->attr);
+	snprint(buf, sizeof buf, "%s.%s", db->file, hf->attr);
 	hf->fd = open(buf, OREAD);
 	if(hf->fd >= 0){
 		hf->len = 0;
diff -r b703b47e2940 sys/src/libthread/debug.c
--- a/sys/src/libthread/debug.c	Sat Jun 08 15:56:03 2019 +0930
+++ b/sys/src/libthread/debug.c	Tue Jun 11 18:35:01 2019 -0700
@@ -42,7 +42,7 @@
 
 	p = _threadgetproc();
 	if(p && p->thread)
-		n = sprint(buf, "%d.%d ", p->pid, p->thread->id);
+		n = snprint(buf, sizeof buf, "%d.%d ", p->pid, p->thread->id);
 	else
 		n = 0;
 	snprint(buf+n, sizeof(buf)-n, "%s: assertion failed\n", s);