Replace all calls to sprintf() by calls to snprintf().

examples/OpenGL3test.cxx

@@ -68,7 +68,7 @@ public:
       gl_Position = vec4(p, 0.0, 0.0) + position;\
       }";
       char vss_string[300]; const char *vss = vss_string;
-      sprintf(vss_string, vss_format, Mslv, mslv);
+      snprintf(vss_string, 300, vss_format, Mslv, mslv);
       const char *fss_format="#version %d%d\n\
       in vec4 colourV;\
       out vec4 fragColour;\
@@ -77,7 +77,7 @@ public:
       fragColour = colourV;\
       }";
       char fss_string[200]; const char *fss = fss_string;
-      sprintf(fss_string, fss_format, Mslv, mslv);
+      snprintf(fss_string, 200, fss_format, Mslv, mslv);
       GLint err; GLchar CLOG[1000]; GLsizei length;
       vs = glCreateShader(GL_VERTEX_SHADER);
       glShaderSource(vs, 1, &vss, NULL);

libdecor/build/fl_libdecor-plugins.c

@@ -312,10 +312,10 @@ static const char *get_libdecor_plugin_description(struct libdecor_frame *frame)
      char fname[PATH_MAX];
      const char *dir = getenv("LIBDECOR_PLUGIN_DIR");
      if (!dir) dir = LIBDECOR_PLUGIN_DIR;
-     sprintf(fname, "%s/libdecor-gtk.so", dir);
+     snprintf(fname, PATH_MAX, "%s/libdecor-gtk.so", dir);
      void *dl = dlopen(fname, RTLD_LAZY | RTLD_LOCAL);
      if (!dl) {
-       sprintf(fname, "%s/libdecor-cairo.so", dir);
+       snprintf(fname, PATH_MAX, "%s/libdecor-cairo.so", dir);
        dl = dlopen(fname, RTLD_LAZY | RTLD_LOCAL);
      }
      if (dl) plugin_description = (const struct libdecor_plugin_description*)dlsym(dl, "libdecor_plugin_description");

src/Fl_Color_Chooser.cxx

@@ -100,7 +100,7 @@ static const Fl_Menu_Item mode_menu[] = {
 #ifndef FL_DOXYGEN
 int Flcc_Value_Input::format(char* buf) {
   Fl_Color_Chooser* c = (Fl_Color_Chooser*)parent();
-  if (c->mode() == M_HEX) return sprintf(buf,"0x%02X", int(value()));
+  if (c->mode() == M_HEX) return snprintf(buf, 5,"0x%02X", int(value()));
   else return Fl_Valuator::format(buf);
 }
 #endif // !FL_DOXYGEN
@@ -465,7 +465,7 @@ void Fl_Color_Chooser::mode(int newMode)
 static int copy_rgb(double r, double g, double b) {
   char buf[8];
   int len;
-  len = sprintf(buf, "%02X%02X%02X", int(r * 255 + .5), int(g * 255 + .5), int(b * 255 + .5));
+  len = snprintf(buf, 8, "%02X%02X%02X", int(r * 255 + .5), int(g * 255 + .5), int(b * 255 + .5));
   Fl::copy(buf, len, 1);
   // printf("copied '%s' to clipboard\n", buf); // Debug
   return 1;

src/Fl_File_Chooser2.cxx

@@ -514,7 +514,7 @@ Fl_File_Chooser::favoritesButtonCB()
     if (Fl::system_driver()->home_directory_name()) v = favoritesButton->size() - 5;
     else v = favoritesButton->size() - 4;
 
-    sprintf(menuname, "favorite%02d", v);
+    snprintf(menuname, FL_PATH_MAX, "favorite%02d", v);
 
     prefs_->set(menuname, directory_);
     prefs_->flush();
@@ -557,7 +557,7 @@ Fl_File_Chooser::favoritesCB(Fl_Widget *w)
 
     for (i = 0; i < 100; i ++) {
       // Get favorite directory 0 to 99...
-      sprintf(name, "favorite%02d", i);
+      snprintf(name, sizeof(name), "favorite%02d", i);
 
       prefs_->get(name, pathname, "", sizeof(pathname));
 
@@ -636,7 +636,7 @@ Fl_File_Chooser::favoritesCB(Fl_Widget *w)
     // Copy the new list over...
     for (i = 0; i < favList->size(); i ++) {
       // Set favorite directory 0 to 99...
-      sprintf(name, "favorite%02d", i);
+      snprintf(name, sizeof(name), "favorite%02d", i);
 
       prefs_->set(name, favList->text(i + 1));
     }
@@ -644,7 +644,7 @@ Fl_File_Chooser::favoritesCB(Fl_Widget *w)
     // Clear old entries as necessary...
     for (; i < 100; i ++) {
       // Clear favorite directory 0 to 99...
-      sprintf(name, "favorite%02d", i);
+      snprintf(name, sizeof(name), "favorite%02d", i);
 
       prefs_->get(name, pathname, "", sizeof(pathname));
 
@@ -1228,7 +1228,7 @@ Fl_File_Chooser::update_favorites()
   }
 
   for (i = 0; i < 100; i ++) {
-    sprintf(menuname, "favorite%02d", i);
+    snprintf(menuname, sizeof(menuname), "favorite%02d", i);
     prefs_->get(menuname, pathname, "", sizeof(pathname));
     if (!pathname[0]) break;
 

src/Fl_GIF_Image.cxx

@@ -563,7 +563,7 @@ void Fl_GIF_Image::load_gif_(Fl_Image_Reader &rdr)
   }
 
   // write the first line of xpm data (use suffix as temp array):
-  int length = sprintf((char*)(Suffix),
+  int length = snprintf((char*)(Suffix), sizeof(Suffix),
                        "%d %d %d %d",Width,Height,-numcolors,1);
   new_data[0] = new char[length+1];
   strcpy(new_data[0], (char*)Suffix);

src/Fl_Native_File_Chooser_FLTK.cxx

@@ -271,7 +271,7 @@ void Fl_Native_File_Chooser_FLTK_Driver::parse_filter() {
         if ( wildcard[0] ) {
           // OUT: "name(wild)\tname(wild)"
           char comp[2048];
-          sprintf(comp, "%s%.511s(%.511s)", ((_parsedfilt)?"\t":""),
+          snprintf(comp, 2048, "%s%.511s(%.511s)", ((_parsedfilt)?"\t":""),
                                             name, wildcard);
           _parsedfilt = strapp(_parsedfilt, comp);
           _nfilters++;

src/Fl_Native_File_Chooser_Kdialog.cxx

@@ -111,14 +111,20 @@ int Fl_Kdialog_Native_File_Chooser_Driver::show() {
   const char *preset = ".";
   if (_preset_file) preset = _preset_file;
   else if (_directory) preset = _directory;
-  char *command = new char[strlen(option) + strlen(preset) + (_title?strlen(_title)+11:0) +
+  const int com_size = strlen(option) + strlen(preset) +
-                           (_parsedfilt?strlen(_parsedfilt):0) + 50];
+    (_title?strlen(_title)+11:0) + (_parsedfilt?strlen(_parsedfilt):0) + 50;
+  char *command = new char[com_size];
   strcpy(command, "kdialog ");
   if (_title) {
-    sprintf(command+strlen(command), " --title '%s'", _title);
+    snprintf(command+strlen(command), com_size - strlen(command),
+             " --title '%s'", _title);
+  }
+  snprintf(command+strlen(command), com_size - strlen(command),
+           " %s %s ", option, preset);
+  if (_parsedfilt) {
+    snprintf(command+strlen(command), com_size - strlen(command),
+             " \"%s\" ", _parsedfilt);
   }
-  sprintf(command+strlen(command), " %s %s ", option, preset);
-  if (_parsedfilt) sprintf(command+strlen(command), " \"%s\" ", _parsedfilt);
   strcat(command, "2> /dev/null"); // get rid of stderr output
 //puts(command);
   FILE *pipe = popen(command, "r");

src/Fl_Native_File_Chooser_MAC.mm

@@ -334,7 +334,7 @@ void Fl_Quartz_Native_File_Chooser_Driver::parse_filter(const char *in) {
         //     If user didn't specify a name, make one
         //
         if ( name[0] == '\0' ) {
-          sprintf(name, "%.*s Files", (int)sizeof(name)-10, wildcard);
+          snprintf(name, sizeof(name), "%.*s Files", (int)sizeof(name)-10, wildcard);
         }
         // APPEND NEW FILTER TO LIST
         if ( wildcard[0] ) {
@@ -434,7 +434,8 @@ static char *prepareMacFilter(int count, const char *filter, char **patterns) {
     l += strlen(patterns[i]) + 3;
     }
   const char *p = filter;
-  char *q; q = new char[strlen(p) + l + 1];
+  const int t_size = strlen(p) + l + 1;
+  char *q; q = new char[t_size];
   const char *r, *s;
   char *t;
   t = q;
@@ -445,7 +446,9 @@ static char *prepareMacFilter(int count, const char *filter, char **patterns) {
     if (s && s < r) {
       memcpy(q, p, s - p);
       q += s - p;
-      if (rank < count) { sprintf(q, " (%s)", patterns[rank]); q += strlen(q); }
+      if (rank < count) {
+        snprintf(q, t_size-(q-t), " (%s)", patterns[rank]); q += strlen(q);
+      }
     }
     else {
       memcpy(q, p, r - p);

src/Fl_Native_File_Chooser_WIN32.cxx

@@ -24,7 +24,7 @@
 #include <FL/Enumerations.H>
 
 #include <stdlib.h>             // malloc
-#include <stdio.h>              // sprintf
+#include <stdio.h>              // snprintf
 #include <wchar.h>
 
 #define FNFC_MAX_PATH 32768     // XXX: MAX_PATH under win32 is 260, too small for modern use
@@ -441,7 +441,7 @@ int Fl_WinAPI_Native_File_Chooser_Driver::showfile() {
     size_t len = strlen(winpath);
     if ( len >= _ofn_ptr->nMaxFile ) {
       char msg[80];
-      sprintf(msg, "preset_file() filename is too long: %ld is >=%ld", (long)len, (long)fsize);
+      snprintf(msg, 80, "preset_file() filename is too long: %ld is >=%ld", (long)len, (long)fsize);
       errmsg(msg);
       return(-1);
     }
@@ -490,7 +490,7 @@ int Fl_WinAPI_Native_File_Chooser_Driver::showfile() {
     if ( exterr == 0 ) return(1);       // user hit cancel
     // Otherwise, an error occurred..
     char msg[80];
-    sprintf(msg, "CommDlgExtendedError() code=%d", exterr);
+    snprintf(msg, 80, "CommDlgExtendedError() code=%d", exterr);
     errmsg(msg);
     return(-1);
   }
@@ -776,12 +776,12 @@ void Fl_WinAPI_Native_File_Chooser_Driver::add_filter(const char *name_in,
   // No name? Make one..
   char name[1024];
   if ( !name_in || name_in[0] == '\0' ) {
-    sprintf(name, "%.*s Files", int(sizeof(name)-10), winfilter);
+    snprintf(name, sizeof(name), "%.*s Files", int(sizeof(name)-10), winfilter);
   } else {
     if ((strlen(name_in)+strlen(winfilter)+3) < sizeof(name)) {
-      sprintf(name, "%s (%s)", name_in, winfilter);
+      snprintf(name, sizeof(name), "%s (%s)", name_in, winfilter);
     } else {
-      sprintf(name, "%.*s", int(sizeof(name))-1, name_in);
+      snprintf(name, sizeof(name), "%.*s", int(sizeof(name))-1, name_in);
     }
   }
   dnullcat(_parsedfilt, name);

src/Fl_Pixmap.cxx

@@ -160,7 +160,7 @@ Fl_Image *Fl_Pixmap::copy(int W, int H) const {
   sscanf(data()[0],"%*d%*d%d%d", &ncolors, &chars_per_pixel);
   chars_per_line = chars_per_pixel * W + 1;
 
-  sprintf(new_info, "%d %d %d %d", W, H, ncolors, chars_per_pixel);
+  snprintf(new_info, sizeof(new_info), "%d %d %d %d", W, H, ncolors, chars_per_pixel);
 
   // Figure out Bresenham step/modulus values...
   xmod   = data_w() % W;
@@ -285,10 +285,12 @@ void Fl_Pixmap::color_average(Fl_Color c, float i) {
         g = (ia * g + ig) >> 8;
         b = (ia * b + ib) >> 8;
 
-        if (chars_per_pixel > 1) sprintf(line, "%c%c c #%02X%02X%02X",
+        if (chars_per_pixel > 1) snprintf(line, sizeof(line),
+                                         "%c%c c #%02X%02X%02X",
                                          data()[color + 1][0],
                                          data()[color + 1][1], r, g, b);
-        else sprintf(line, "%c c #%02X%02X%02X", data()[color + 1][0], r, g, b);
+        else snprintf(line, sizeof(line), "%c c #%02X%02X%02X",
+                      data()[color + 1][0], r, g, b);
 
         delete[] (char *)data()[color + 1];
         ((char **)data())[color + 1] = new char[strlen(line) + 1];
@@ -361,10 +363,13 @@ void Fl_Pixmap::desaturate() {
       if (fl_parse_color(p, r, g, b)) {
         g = (uchar)((r * 31 + g * 61 + b * 8) / 100);
 
-        if (chars_per_pixel > 1) sprintf(line, "%c%c c #%02X%02X%02X", data()[i + 1][0],
+        if (chars_per_pixel > 1) {
-                                         data()[i + 1][1], g, g, g);
+          snprintf(line, sizeof(line), "%c%c c #%02X%02X%02X",
-        else sprintf(line, "%c c #%02X%02X%02X", data()[i + 1][0], g, g, g);
+                   data()[i + 1][0], data()[i + 1][1], g, g, g);
-
+        } else {
+          snprintf(line, sizeof(line), "%c c #%02X%02X%02X",
+                   data()[i + 1][0], g, g, g);
+        }
         delete[] (char *)data()[i + 1];
         ((char **)data())[i + 1] = new char[strlen(line) + 1];
         strcpy((char *)data()[i + 1], line);

src/Fl_Preferences.cxx

@@ -584,7 +584,7 @@ char Fl_Preferences::get( const char *key, int &value, int defaultValue ) {
  \return 0 if setting the value failed
  */
 char Fl_Preferences::set( const char *key, int value ) {
-  sprintf( nameBuffer, "%d", value );
+  snprintf( nameBuffer, sizeof(nameBuffer), "%d", value );
   node->set( key, nameBuffer );
   return 1;
 }
@@ -1081,7 +1081,7 @@ int Fl_Preferences::dirty() {
  */
 Fl_Preferences::Name::Name( unsigned int n ) {
   data_ = (char*)malloc(20);
-  sprintf(data_, "%u", n);
+  snprintf(data_, 20, "%u", n);
 }
 
 /**
@@ -1442,7 +1442,7 @@ void Fl_Preferences::Node::setParent( Node *pn ) {
   parent_ = pn;
   next_ = pn->first_child_;
   pn->first_child_ = this;
-  sprintf( nameBuffer, "%s/%s", pn->path_, path_ );
+  snprintf( nameBuffer, sizeof(nameBuffer), "%s/%s", pn->path_, path_ );
   free( path_ );
   path_ = fl_strdup( nameBuffer );
 }
@@ -1460,7 +1460,7 @@ Fl_Preferences::RootNode *Fl_Preferences::Node::findRoot() {
 
 // add a child to this node and set its path (try to find it first...)
 Fl_Preferences::Node *Fl_Preferences::Node::addChild( const char *path ) {
-  sprintf( nameBuffer, "%s/%s", path_, path );
+  snprintf( nameBuffer, sizeof(nameBuffer), "%s/%s", path_, path );
   char *name = fl_strdup( nameBuffer );
   Node *nd = find( name );
   free( name );

src/Fl_Screen_Driver.cxx

@@ -379,7 +379,7 @@ void Fl_Screen_Driver::transient_scale_display(float f, int nscreen)
   Fl_Window *win = new Fl_Window((X + W/2) -w/2, (Y + H/2) -w/4, w, w/2, 0);
   b = new Fl_Box(FL_FLAT_BOX, 0, 0, w, w/2, NULL);
   char str[10];
-  sprintf(str, "%d %%", int(f * 100 + 0.5));
+  snprintf(str, 10, "%d %%", int(f * 100 + 0.5));
   b->copy_label(str);
   b->labelfont(FL_TIMES_BOLD);
   b->labelsize(Fl_Fontsize(30 * s / d->scale(nscreen)));

src/Fl_Spinner.cxx

@@ -79,14 +79,14 @@ void Fl_Spinner::update() {
     // Fl_Valuator::format() and works well (but looks ugly)
     int c = 0;
     char temp[64], *sp = temp;
-    sprintf(temp, "%.12f", step_);
+    snprintf(temp, 64, "%.12f", step_);
     while (*sp) sp++;
     sp--;
     while (sp > temp && *sp == '0') sp--;
     while (sp > temp && (*sp >= '0' && *sp <= '9')) { sp--; c++; }
-    sprintf(s, format_, c, value_);
+    snprintf(s, sizeof(s), format_, c, value_);
   } else {
-    sprintf(s, format_, value_);
+    snprintf(s, sizeof(s), format_, value_);
   }
   input_.value(s);
 }

src/Fl_Text_Display.cxx

@@ -3157,7 +3157,8 @@ void Fl_Text_Display::draw_line_numbers(bool /*clearAll*/) {
     for (visLine=0; visLine < mNVisibleLines; visLine++) {
       lineStart = mLineStarts[visLine];
       if (lineStart != -1 && (lineStart==0 || buffer()->char_at(lineStart-1)=='\n')) {
-        sprintf(lineNumString, linenumber_format(), line);
+        snprintf(lineNumString, sizeof(lineNumString),
+                 linenumber_format(), line);
         int xx = x() + xoff + 3,
             yy = Y,
             ww = mLineNumWidth - (3*2),

src/Fl_Tree.cxx

@@ -2657,11 +2657,11 @@ void Fl_Tree::load(Fl_Preferences &prefs) {
     if (vn<40) {
       size_t sze = pn + strlen(key) + vn;
       p = (char*)malloc(sze+5);
-      sprintf(p, "%s/%s = %s", path, key, val);
+      snprintf(p, sze+5, "%s/%s = %s", path, key, val);
     } else {
       size_t sze = pn + strlen(key) + 40;
       p = (char*)malloc(sze+5);
-      sprintf(p, "%s/%s = %.40s...", path, key, val);
+      snprintf(p, sze+5, "%s/%s = %.40s...", path, key, val);
     }
     add(p[0]=='/'?p+1:p);
     free(p);

src/Fl_get_system_colors.cxx

@@ -210,7 +210,7 @@ int Fl::reload_scheme() {
       nb = levels[i] * b / 0xe8;
       if (nb > 255) nb = 255;
 
-      sprintf(tile_cmap[i], "%c c #%02x%02x%02x", "Oo."[i], nr, ng, nb);
+      snprintf(tile_cmap[i], sizeof(tile_cmap[0]), "%c c #%02x%02x%02x", "Oo."[i], nr, ng, nb);
 //      puts(tile_cmap[i]);
     }
 

src/Fl_x.cxx

@@ -317,7 +317,7 @@ extern "C" {
 
   static int xerror_handler(Display* d, XErrorEvent* e) {
     char buf1[128], buf2[128];
-    sprintf(buf1, "XRequest.%d", e->request_code);
+    snprintf(buf1, 128, "XRequest.%d", e->request_code);
     XGetErrorDatabaseText(d,"",buf1,buf1,buf2,128);
     XGetErrorText(d, e->error_code, buf1, 128);
     Fl::warning("%s: %s 0x%lx", buf2, buf1, e->resourceid);

src/drivers/Cairo/Fl_Cairo_Graphics_Driver.cxx

@@ -1025,7 +1025,7 @@ Fl_Font Fl_Cairo_Graphics_Driver::set_fonts(const char* /*pattern_name*/)
       // build the font's FLTK name
       l += strlen(p) + 2;
       char *q = new char[l];
-      sprintf(q, "%s %s", fam_name, p);
+      snprintf(q, l, "%s %s", fam_name, p);
       Fl::set_font((Fl_Font)(count++ + FL_FREE_FONT), q);
     }
     /*g_*/free(faces); // glib source code shows that g_free is equivalent to free
@@ -1098,7 +1098,7 @@ Fl_Cairo_Font_Descriptor::Fl_Cairo_Font_Descriptor(const char* name, Fl_Fontsize
   strcpy(string, name);
   // The factor of 0.75 below gives cairo-produced text the same size as
   // Xft-produced text for the same FLTK font size.
-  sprintf(string + strlen(string), " %d", int(size * 0.75 + 0.5) );
+  snprintf(string + strlen(string), 10, " %d", int(size * 0.75 + 0.5) );
   //A PangoFontDescription describes a font in an implementation-independent manner.
   fontref = pango_font_description_from_string(string);
   delete[] string;

src/drivers/Darwin/Fl_Darwin_System_Driver.cxx

@@ -268,7 +268,7 @@ void Fl_Darwin_System_Driver::newUUID(char *uuidBuffer)
 {
   CFUUIDRef theUUID = CFUUIDCreate(NULL);
   CFUUIDBytes b = CFUUIDGetUUIDBytes(theUUID);
-  sprintf(uuidBuffer, "%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
+  snprintf(uuidBuffer, 36+1, "%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
           b.byte0, b.byte1, b.byte2, b.byte3, b.byte4, b.byte5, b.byte6, b.byte7,
           b.byte8, b.byte9, b.byte10, b.byte11, b.byte12, b.byte13, b.byte14, b.byte15);
   CFRelease(theUUID);

src/drivers/Posix/Fl_Posix_Printer_Driver.cxx

@@ -112,7 +112,7 @@ int Fl_GTK_Printer_Driver::begin_job(int pagecount, int *firstpage, int *lastpag
   GtkPrintSettings *psettings = CALL_GTK(gtk_print_unix_dialog_get_settings)(pdialog); //2.10
   CALL_GTK(gtk_print_settings_set)(psettings, "output-file-format", "ps"); //2.10
   char line[FL_PATH_MAX + 20], cwd[FL_PATH_MAX];
-  sprintf(line, "file://%s/FLTK.ps", fl_getcwd(cwd, FL_PATH_MAX));
+  snprintf(line, FL_PATH_MAX + 20, "file://%s/FLTK.ps", fl_getcwd(cwd, FL_PATH_MAX));
   CALL_GTK(gtk_print_settings_set)(psettings, "output-uri", line); //2.10
   CALL_GTK(gtk_print_unix_dialog_set_settings)(pdialog, psettings); //2.10
   CALL_GTK(g_object_unref)(psettings);
@@ -160,7 +160,7 @@ int Fl_GTK_Printer_Driver::begin_job(int pagecount, int *firstpage, int *lastpag
         response_id = GTK_RESPONSE_NONE + GTK_RESPONSE_OK + 1;
         if (perr_message) {
           *perr_message = new char[strlen(line)+50];
-          sprintf(*perr_message, "Can't open output file %s", line);
+          snprintf(*perr_message, strlen(line)+50, "Can't open output file %s", line);
         }
       }
     } else if ( CALL_GTK(gtk_printer_accepts_ps)(gprinter) && //2.10
@@ -176,7 +176,7 @@ int Fl_GTK_Printer_Driver::begin_job(int pagecount, int *firstpage, int *lastpag
         response_id = GTK_RESPONSE_NONE + GTK_RESPONSE_OK + 1;
         if (perr_message) {
           *perr_message = new char[strlen(tmpfilename)+50];
-          sprintf(*perr_message, "Can't create temporary file %s", tmpfilename);
+          snprintf(*perr_message, strlen(tmpfilename)+50, "Can't create temporary file %s", tmpfilename);
         }
       }
     }
@@ -322,7 +322,7 @@ int Fl_Posix_Printer_Driver::begin_job(int pages, int *firstpage, int *lastpage,
   if (!ps->output) {
     if (perr_message) {
       *perr_message = new char[strlen(command) + 50];
-      sprintf(*perr_message, "could not run command: %s", command);
+      snprintf(*perr_message, strlen(command) + 50, "could not run command: %s", command);
     }
     return 2;
   }

src/drivers/Posix/Fl_Posix_System_Driver.cxx

@@ -177,16 +177,16 @@ int Fl_Posix_System_Driver::run_program(const char *program, char **argv, char *
 static void* quadruple_dlopen(const char *libname)
 {
   char filename2[FL_PATH_MAX];
-  sprintf(filename2, "%s.so", libname);
+  snprintf(filename2, FL_PATH_MAX, "%s.so", libname);
   void *ptr = dlopen(filename2, RTLD_LAZY | RTLD_GLOBAL);
   if (!ptr) {
-    sprintf(filename2, "%s.so.2", libname);
+    snprintf(filename2, FL_PATH_MAX, "%s.so.2", libname);
     ptr = dlopen(filename2, RTLD_LAZY | RTLD_GLOBAL);
     if (!ptr) {
-      sprintf(filename2, "%s.so.1", libname);
+      snprintf(filename2, FL_PATH_MAX, "%s.so.1", libname);
       ptr = dlopen(filename2, RTLD_LAZY | RTLD_GLOBAL);
       if (!ptr) {
-        sprintf(filename2, "%s.so.0", libname);
+        snprintf(filename2, FL_PATH_MAX, "%s.so.0", libname);
         ptr = dlopen(filename2, RTLD_LAZY | RTLD_GLOBAL);
       }
     }
@@ -219,13 +219,13 @@ void *Fl_Posix_System_Driver::dlopen_or_dlsym(const char *lib_name, const char *
 #ifdef __APPLE_CC__ // allows testing on Darwin + XQuartz + fink
   if (lib_name) {
     char path[FL_PATH_MAX];
-    sprintf(path, "/opt/X11/lib/%s.dylib", lib_name);
+    snprintf(path, FL_PATH_MAX, "/opt/X11/lib/%s.dylib", lib_name);
     lib_address = dlopen(path, RTLD_LAZY | RTLD_GLOBAL);
     if (!lib_address) {
-      sprintf(path, "/opt/sw/lib/%s.dylib", lib_name);
+      snprintf(path, FL_PATH_MAX, "/opt/sw/lib/%s.dylib", lib_name);
       lib_address = dlopen(path, RTLD_LAZY | RTLD_GLOBAL);
       if (!lib_address) {
-        sprintf(path, "/sw/lib/%s.dylib", lib_name);
+        snprintf(path, FL_PATH_MAX, "/sw/lib/%s.dylib", lib_name);
         lib_address = dlopen(path, RTLD_LAZY | RTLD_GLOBAL);
       }
     }

src/drivers/PostScript/Fl_PostScript.cxx

@@ -1503,7 +1503,7 @@ int Fl_PostScript_Graphics_Driver::start_postscript(int pagecount,
   if (!cairo_) return 1;
   nPages=0;
   char feature[250];
-  sprintf(feature, "%%%%BeginFeature: *PageSize %s\n<</PageSize[%d %d]>>setpagedevice\n%%%%EndFeature",
+  snprintf(feature, 250, "%%%%BeginFeature: *PageSize %s\n<</PageSize[%d %d]>>setpagedevice\n%%%%EndFeature",
           Fl_Paged_Device::page_formats[format].name, Fl_Paged_Device::page_formats[format].width, Fl_Paged_Device::page_formats[format].height);
   cairo_ps_surface_dsc_comment(cairo_get_target(cairo_), feature);
   return 0;
@@ -1635,7 +1635,7 @@ int Fl_PostScript_File_Device::begin_page (void)
 #if USE_PANGO
   cairo_ps_surface_dsc_begin_page_setup(cairo_get_target(ps->cr()));
   char feature[200];
-  sprintf(feature, "%%%%PageOrientation: %s", ps->pw_ > ps->ph_ ? "Landscape" : "Portrait");
+  snprintf(feature, 200, "%%%%PageOrientation: %s", ps->pw_ > ps->ph_ ? "Landscape" : "Portrait");
   cairo_ps_surface_dsc_comment(cairo_get_target(ps->cr()), feature);
   if (ps->pw_ > ps->ph_) {
     cairo_translate(ps->cr(), 0, ps->pw_);

src/drivers/SVG/Fl_SVG_File_Surface.cxx

@@ -206,9 +206,11 @@ void Fl_SVG_Graphics_Driver::compute_dasharray(float s, char *dashes) {
   if (user_dash_array_ && user_dash_array_ != dashes) {free(user_dash_array_); user_dash_array_ = NULL;}
   if (dashes && *dashes) {
     if (dasharray_) free(dasharray_);
-    dasharray_ = (char*)calloc(10*strlen(dashes) + 1, 1);
+    int array_len = 10*strlen(dashes) + 1;
+    dasharray_ = (char*)calloc(array_len, 1);
     for (char *p = dashes; *p; p++) {
-      sprintf(dasharray_+strlen(dasharray_), "%.3f,", (*p)/s);
+      int c = snprintf(dasharray_+strlen(dasharray_), array_len, "%.3f,", (*p)/s);
+      array_len -= c;
     }
     dasharray_[strlen(dasharray_) - 1] = 0;
     if (user_dash_array_ != dashes) user_dash_array_ = fl_strdup(dashes);
@@ -228,10 +230,10 @@ void Fl_SVG_Graphics_Driver::compute_dasharray(float s, char *dashes) {
     float big = (is_flat ? 3*width_/s : width_*2.5f/s);
     if (dasharray_) free(dasharray_);
     dasharray_ = (char*)malloc(61);
-    if (dash_part == FL_DOT) sprintf(dasharray_, "%.3f,%.3f", dot, gap);
+    if (dash_part == FL_DOT) snprintf(dasharray_, 61, "%.3f,%.3f", dot, gap);
-    else if (dash_part == FL_DASH) sprintf(dasharray_, "%.3f,%.3f", big, gap);
+    else if (dash_part == FL_DASH) snprintf(dasharray_, 61, "%.3f,%.3f", big, gap);
-    else if (dash_part == FL_DASHDOT) sprintf(dasharray_, "%.3f,%.3f,%.3f,%.3f", big, gap, dot, gap);
+    else if (dash_part == FL_DASHDOT) snprintf(dasharray_, 61, "%.3f,%.3f,%.3f,%.3f", big, gap, dot, gap);
-    else sprintf(dasharray_, "%.3f,%.3f,%.3f,%.3f,%.3f,%.3f", big, gap, dot, gap, dot, gap);
+    else snprintf(dasharray_, 61, "%.3f,%.3f,%.3f,%.3f,%.3f,%.3f", big, gap, dot, gap, dot, gap);
   }
 }
 
@@ -604,7 +606,7 @@ void Fl_SVG_Graphics_Driver::draw_rgb(Fl_RGB_Image *rgb, int XP, int YP, int WP,
   char name[24];
   bool need_clip = (cx || cy || WP != rgb->w() || HP != rgb->h());
   void *p = (void*)*Fl_Graphics_Driver::id(rgb);
-  if (p) sprintf(name, "FLrgb%p", p); else name[0] = 0;
+  if (p) snprintf(name, 24, "FLrgb%p", p); else name[0] = 0;
   if (!p || !last_rgb_name_ || strcmp(name, last_rgb_name_) != 0) {
     if (*name==0 && need_clip) push_clip(XP, YP, WP, HP);
 #if defined(HAVE_LIBJPEG)
@@ -627,7 +629,7 @@ void Fl_SVG_Graphics_Driver::draw_pixmap(Fl_Pixmap *pxm, int XP, int YP, int WP,
   char name[24];
   bool need_clip = (cx || cy || WP != pxm->w() || HP != pxm->h());
   void *p = (void*)*Fl_Graphics_Driver::id(pxm);
-  if (p) sprintf(name, "FLpx%p", p); else name[0] = 0;
+  if (p) snprintf(name, 24, "FLpx%p", p); else name[0] = 0;
   if (!p || !last_rgb_name_ || strcmp(name, last_rgb_name_) != 0) {
     Fl_RGB_Image *rgb = new Fl_RGB_Image(pxm);
     if (*name==0 && need_clip) push_clip(XP, YP, WP, HP);
@@ -648,7 +650,7 @@ void Fl_SVG_Graphics_Driver::draw_bitmap(Fl_Bitmap *bm, int XP, int YP, int WP,
   char name[45];
   bool need_clip = (cx || cy || WP != bm->w() || HP != bm->h());
   void *p = (void*)*Fl_Graphics_Driver::id(bm);
-  if (p) sprintf(name, "FLbm%p%X", p, fl_color()); else name[0] = 0;
+  if (p) snprintf(name, 45, "FLbm%p%X", p, fl_color()); else name[0] = 0;
   if (!p || !last_rgb_name_ || strcmp(name, last_rgb_name_) != 0) {
     uchar R, G, B;
     Fl::get_color(fl_color(), R, G, B);
@@ -740,7 +742,7 @@ void Fl_SVG_Graphics_Driver::push_clip(int x, int y, int w, int h) {
   Clip * c=new Clip();
   clip_box(x,y,w,h,c->x,c->y,c->w,c->h);
   c->prev=clip_;
-  sprintf(c->Id, "FLclip%d", clip_count_++);
+  snprintf(c->Id, sizeof(c->Id), "FLclip%d", clip_count_++);
   clip_=c;
   fprintf(out_, "<clipPath id=\"%s\"><rect x=\"%d\" y=\"%d\" width=\"%d\" height=\"%d\"/></clipPath><g clip-path=\"url(#%s)\">\n",
           c->Id, clip_->x , clip_->y , clip_->w, clip_->h, c->Id);

src/drivers/Unix/Fl_Unix_System_Driver.cxx

@@ -436,7 +436,7 @@ void Fl_Unix_System_Driver::newUUID(char *uuidBuffer)
     gethostname(name, 79);
     memcpy(b+12, name, 4);
   }
-  sprintf(uuidBuffer, "%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
+  snprintf(uuidBuffer, 36+1, "%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
           b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7],
           b[8], b[9], b[10], b[11], b[12], b[13], b[14], b[15]);
 }

src/drivers/Wayland/Fl_Wayland_Window_Driver.cxx

@@ -978,7 +978,7 @@ static Fl_Window *calc_transient_parent(int &center_x, int &center_y) {
 static const char *get_prog_name() {
   pid_t pid = getpid();
   char fname[100];
-  sprintf(fname, "/proc/%u/cmdline", pid);
+  snprintf(fname, 100, "/proc/%u/cmdline", pid);
   FILE *in = fopen(fname, "r");
   if (in) {
     static char line[200];

src/drivers/WinAPI/Fl_WinAPI_Printer_Driver.cxx

@@ -129,7 +129,7 @@ int Fl_WinAPI_Printer_Driver::begin_job (int pagecount, int *frompage, int *topa
             while (srclen > 0 && (lpMsgBuf[srclen-1] == '\n' || lpMsgBuf[srclen-1] == '\r')) srclen--;
             unsigned l = fl_utf8fromwc(NULL, 0, lpMsgBuf, srclen);
             *perr_message = new char[l+51];
-            sprintf(*perr_message, "begin_job() failed with error %lu: ", dw);
+            snprintf(*perr_message, l+51, "begin_job() failed with error %lu: ", dw);
             fl_utf8fromwc(*perr_message + strlen(*perr_message), l+1, lpMsgBuf, srclen);
             LocalFree(lpMsgBuf);
           }

src/drivers/WinAPI/Fl_WinAPI_System_Driver.cxx

@@ -742,7 +742,7 @@ int Fl_WinAPI_System_Driver::file_browser_load_filesystem(Fl_File_Browser *brows
   drives = GetLogicalDrives();
   for (int i = 'A'; i <= 'Z'; i ++, drives >>= 1) {
     if (drives & 1) {
-      sprintf(filename, "%c:/", i);
+      snprintf(filename, lname, "%c:/", i);
       if (i < 'C') // see also: GetDriveType and GetVolumeInformation in Windows
         browser->add(filename, icon);
       else
@@ -794,7 +794,7 @@ void Fl_WinAPI_System_Driver::newUUID(char *uuidBuffer)
           (rpc_res == RPC_S_UUID_NO_ADDRESS)    // probably only locally unique
           ) {
         got_uuid = -1;
-        sprintf(uuidBuffer, "%08lX-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X",
+        snprintf(uuidBuffer, 36+1, "%08lX-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X",
                 pu->Data1, pu->Data2, pu->Data3, pu->Data4[0], pu->Data4[1],
                 pu->Data4[2], pu->Data4[3], pu->Data4[4],
                 pu->Data4[5], pu->Data4[6], pu->Data4[7]);
@@ -833,7 +833,7 @@ void Fl_WinAPI_System_Driver::newUUID(char *uuidBuffer)
     for (int ii = 0; ii < 4; ii++) {
       b[12 + ii] = (unsigned char)name[ii];
     }
-    sprintf(uuidBuffer, "%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
+    snprintf(uuidBuffer, 36+1, "%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X",
             b[0], b[1], b[2], b[3], b[4], b[5], b[6], b[7],
             b[8], b[9], b[10], b[11], b[12], b[13], b[14], b[15]);
   }

src/drivers/Xlib/Fl_Xlib_Graphics_Driver_font_x.cxx

@@ -457,7 +457,7 @@ static const char *find_best_font(const char *fname, int size) {
       // whoa!  A scalable font!  Use unless exact match found:
       int l = c-thisname;
       memcpy(namebuffer,thisname,l);
-      l += sprintf(namebuffer+l,"%d",size);
+      l += snprintf(namebuffer+l, 1024-l,"%d",size);
       while (*c == '0') c++;
       strcpy(namebuffer+l,c);
       name = namebuffer;

src/drivers/Xlib/Fl_Xlib_Graphics_Driver_font_xft.cxx

@@ -1352,7 +1352,7 @@ Fl_Font Fl_Xlib_Graphics_Driver::set_fonts(const char* pattern_name)
       // build the font's FLTK name
       l += strlen(p) + 2;
       char *q = new char[l];
-      sprintf(q, "%s %s", fam_name, p);
+      snprintf(q, l, "%s %s", fam_name, p);
       Fl::set_font((Fl_Font)(count++ + FL_FREE_FONT), q);
     }
     /*g_*/free(faces); // glib source code shows that g_free is equivalent to free

src/forms_timer.cxx

@@ -49,10 +49,10 @@ void Fl_Timer::draw() {
   if (type() == FL_VALUE_TIMER && delay>0.0) {
     double d = direction_ ? total-delay : delay;
     if (d < 60.0)
-      sprintf(str, "%.1f", d);
+      snprintf(str, 32, "%.1f", d);
     else {
       tt = (int) ((d+0.05) / 60.0);
-      sprintf(str, "%d:%04.1f", tt, d - 60.0 * tt);
+      snprintf(str, 32, "%d:%04.1f", tt, d - 60.0 * tt);
     }
     fl_font(labelfont(), labelsize());
     fl_color(labelcolor());

test/ask.cxx

@@ -106,7 +106,7 @@ void timer_cb(void *) {
   // test message title assignment with a local buffer
   {                                 // local scope for buf
     char buf[40];                   // test: use local variable
-    sprintf(buf, "Message #%d", n); // fill message title
+    snprintf(buf, 40, "Message #%d", n); // fill message title
     fl_message_title(buf);          // set message title
     strcpy(buf, "** void **");      // overwrite buffer to be sure
   }                                 // buf goes out of scope here

test/blocks.cxx

@@ -720,21 +720,21 @@ void BlockWindow::draw() {
   // Draw the scores and level...
   char s[255];
 
-  sprintf(s, " Score: %d", score_);
+  snprintf(s, sizeof(s), " Score: %d", score_);
   fl_color(FL_WHITE);
   fl_font(FL_HELVETICA, 14);
   fl_draw(s, 40, 0, w() - 40, 20, FL_ALIGN_LEFT);
 
-  sprintf(s, "High Score: %d ", high_score_);
+  snprintf(s, sizeof(s), "High Score: %d ", high_score_);
   fl_draw(s, 0, 0, w(), 20, FL_ALIGN_RIGHT);
 
   if (level_ > 1 || title_y_ <= 0) {
-    sprintf(s, "Level: %d ", level_);
+    snprintf(s, sizeof(s), "Level: %d ", level_);
     fl_draw(s, 0, 0, w(), 20, FL_ALIGN_CENTER);
   }
 
   if (show_fps_) {
-    sprintf(s, "FPS: %d ", frames_per_second_);
+    snprintf(s, sizeof(s), "FPS: %d ", frames_per_second_);
     fl_draw(s, 0, h() - 20, w(), 20, FL_ALIGN_LEFT);
   }
 
@@ -898,7 +898,7 @@ void BlockWindow::up_level() {
   opened_columns_ = 0;
   if (num_colors_ < 7) num_colors_ ++;
   level_ ++;
-  sprintf(title_, "Level: %d", level_);
+  snprintf(title_, sizeof(title_), "Level: %d", level_);
   title_y_ = h();
 }
 

test/boxtype.cxx

@@ -113,7 +113,7 @@ int main(int argc, char ** argv) {
   // set window title to show active scheme
   Fl::scheme(Fl::scheme()); // init scheme
   char title[100];
-  sprintf(title,"FLTK boxtypes: scheme = '%s'",Fl::scheme()?Fl::scheme():"none");
+  snprintf(title, 100,"FLTK boxtypes: scheme = '%s'",Fl::scheme()?Fl::scheme():"none");
   window->label(title);
 
   // create special container group for box size debugging

test/checkers.cxx

@@ -963,7 +963,7 @@ void Board::draw() {
       int y1 = squarey(n->from)+BOXSIZE/2-5;
       int x2 = squarex(n->to)+BOXSIZE/2-5;
       int y2 = squarey(n->to)+BOXSIZE/2-5;
-      char buf[20]; sprintf(buf,"%d",num);
+      char buf[20]; snprintf(buf, 20,"%d",num);
       fl_draw(buf, x1+int((x2-x1)*.85)-3, y1+int((y2-y1)*.85)+5);
       num++;
     }

test/clipboard.cxx

@@ -95,7 +95,7 @@ public:
       if (!cl_img)
         return 1;
       char title[300];
-      sprintf(title, "%dx%d", cl_img->w(), cl_img->h()); // display the image original size
+      snprintf(title, 300, "%dx%d", cl_img->w(), cl_img->h()); // display the image original size
 
       // optional: display extra technical info about clipboard content
 
@@ -105,20 +105,20 @@ public:
       char *p = title + strlen(title);
       int format = EnumClipboardFormats(0);
       if (format && format < CF_MAX) {
-        sprintf(p, " %d", format);
+        snprintf(p, sizeof(title) - strlen(title), " %d", format);
         p += strlen(p);
       }
       while (format) {
         format = EnumClipboardFormats(format);
         if (format && format < CF_MAX) {
-          sprintf(p, " %d", format);
+          snprintf(p, sizeof(title) - strlen(title), " %d", format);
           p += strlen(p);
         }
       }
       HANDLE h;
       if ((h = GetClipboardData(CF_DIB))) {
         LPBITMAPINFO lpBI = (LPBITMAPINFO)GlobalLock(h);
-        sprintf(p, " biBitCount=%d biCompression=%d biClrUsed=%d",
+        snprintf(p, sizeof(title) - strlen(title), " biBitCount=%d biCompression=%d biClrUsed=%d",
                 lpBI->bmiHeader.biBitCount,
                 (int)lpBI->bmiHeader.biCompression,
                 (int)lpBI->bmiHeader.biClrUsed);

test/colbrowser.cxx

@@ -157,7 +157,7 @@ static int load_browser(const char *fname)
       lr = r;
       lg = g;
       lb = b;
-      sprintf(buf, "(%3d %3d %3d) %s", r, g, b, name);
+      snprintf(buf, sizeof(buf), "(%3d %3d %3d) %s", r, g, b, name);
       colbr->add(buf);
     }
   }

test/demo.cxx

@@ -407,17 +407,17 @@ void dobut(Fl_Widget *, long arg) {
 
   if (params[0]) {
     // we assume that we have only one argument which is a filename in 'data_path'
-    sprintf(command, "open '%s/%s%s' --args '%s/%s'", path, cmdbuf, suffix, data_path, params);
+    snprintf(command, sizeof(command), "open '%s/%s%s' --args '%s/%s'", path, cmdbuf, suffix, data_path, params);
   } else {
-    sprintf(command, "open '%s/%s%s'", path, cmdbuf, suffix);
+    snprintf(command, sizeof(command), "open '%s/%s%s'", path, cmdbuf, suffix);
   }
 
 #else // other platforms
 
   if (params[0])
-    sprintf(command, "%s/%s%s %s", path, cmdbuf, suffix, params);
+    snprintf(command, sizeof(command), "%s/%s%s %s", path, cmdbuf, suffix, params);
   else
-    sprintf(command, "%s/%s%s", path, cmdbuf, suffix);
+    snprintf(command, sizeof(command), "%s/%s%s", path, cmdbuf, suffix);
 
 #endif
 

test/file_chooser.cxx

@@ -295,9 +295,9 @@ pdf_check(const char *name,     // I - Name of file
     return 0;
 
   home = fl_getenv("HOME");
-  sprintf(preview, "%s/.preview.ppm", home ? home : "");
+  snprintf(preview, FL_PATH_MAX, "%s/.preview.ppm", home ? home : "");
 
-  sprintf(command,
+  snprintf(command, sizeof(command),
           "gs -r100 -dFIXED -sDEVICE=ppmraw -dQUIET -dNOPAUSE -dBATCH "
           "-sstdout=\"%%stderr\" -sOUTPUTFILE=\'%s\' "
           "-dFirstPage=1 -dLastPage=1 \'%s\' 2>/dev/null", preview, name);
@@ -331,11 +331,11 @@ ps_check(const char *name,      // I - Name of file
     return 0;
 
   home = fl_getenv("HOME");
-  sprintf(preview, "%s/.preview.ppm", home ? home : "");
+  snprintf(preview, FL_PATH_MAX, "%s/.preview.ppm", home ? home : "");
 
   if (memcmp(header, "%!PS", 4) == 0) {
     // PS file has DSC comments; extract the first page...
-    sprintf(outname, "%s/.preview.ps", home ? home : "");
+    snprintf(outname, FL_PATH_MAX, "%s/.preview.ps", home ? home : "");
 
     if (strcmp(name, outname) != 0) {
       in   = fl_fopen(name, "rb");
@@ -360,7 +360,7 @@ ps_check(const char *name,      // I - Name of file
     outname[sizeof(outname) - 1] = '\0';
   }
 
-  sprintf(command,
+  snprintf(command, sizeof(command),
           "gs -r100 -dFIXED -sDEVICE=ppmraw -dQUIET -dNOPAUSE -dBATCH "
           "-sstdout=\"%%stderr\" -sOUTPUTFILE=\'%s\' \'%s\' 2>/dev/null",
           preview, outname);

test/fonts.cxx

@@ -68,8 +68,8 @@ void font_cb(Fl_Widget *, long) {
     int j = 1;
     for (int i = 1; i<64 || i<s[n-1]; i++) {
       char buf[20];
-      if (j < n && i==s[j]) {sprintf(buf,"@b%d",i); j++;}
+      if (j < n && i==s[j]) {snprintf(buf, 20,"@b%d",i); j++;}
-      else sprintf(buf,"%d",i);
+      else snprintf(buf, 20,"%d",i);
       sizeobj->add(buf);
     }
     sizeobj->value(pickedsize);
@@ -79,7 +79,7 @@ void font_cb(Fl_Widget *, long) {
     for (int i = 0; i < n; i++) {
       if (s[i]<=pickedsize) w = i;
       char buf[20];
-      sprintf(buf,"@b%d",s[i]);
+      snprintf(buf, 20,"@b%d",s[i]);
       sizeobj->add(buf);
     }
     sizeobj->value(w+1);

test/fractals.cxx

@@ -637,7 +637,7 @@ void display(void)
   glLoadIdentity();
   gluOrtho2D(0.0, winwidth, 0.0, winheight);
 
-  sprintf(buf, "FPS=%d", fps);
+  snprintf(buf, sizeof(buf), "FPS=%d", fps);
   glColor3f(1.0f, 1.0f, 1.0f);
   gl_font(FL_HELVETICA, 12);
   gl_draw(buf, 10, 10);

test/fullscreen.cxx

@@ -226,20 +226,20 @@ void update_screeninfo(Fl_Widget *b, void *p) {
     char line[128];
     browser->clear();
 
-    sprintf(line, "Main screen work area: %dx%d@%d,%d", Fl::w(), Fl::h(), Fl::x(), Fl::y());
+    snprintf(line, sizeof(line), "Main screen work area: %dx%d@%d,%d", Fl::w(), Fl::h(), Fl::x(), Fl::y());
     browser->add(line);
     Fl::screen_work_area(x, y, w, h);
-    sprintf(line, "Mouse screen work area: %dx%d@%d,%d", w, h, x, y);
+    snprintf(line, sizeof(line), "Mouse screen work area: %dx%d@%d,%d", w, h, x, y);
     browser->add(line);
     for (int n = 0; n < Fl::screen_count(); n++) {
         int x, y, w, h;
         float dpih, dpiv;
         Fl::screen_xywh(x, y, w, h, n);
         Fl::screen_dpi(dpih, dpiv, n);
-        sprintf(line, "Screen %d: %dx%d@%d,%d DPI:%.1fx%.1f scale:%.2f", n, w, h, x, y, dpih, dpiv, Fl::screen_scale(n));
+        snprintf(line, sizeof(line), "Screen %d: %dx%d@%d,%d DPI:%.1fx%.1f scale:%.2f", n, w, h, x, y, dpih, dpiv, Fl::screen_scale(n));
         browser->add(line);
         Fl::screen_work_area(x, y, w, h, n);
-        sprintf(line, "Work area %d: %dx%d@%d,%d", n, w, h, x, y);
+        snprintf(line, sizeof(line), "Work area %d: %dx%d@%d,%d", n, w, h, x, y);
         browser->add(line);
     }
 }

test/glpuzzle.cxx

@@ -491,7 +491,7 @@ solidifyChain(struct puzzle *puzzle)
     puzzle->backptr->solnptr = puzzle;
     puzzle = puzzle->backptr;
   }
-  sprintf(buf, "%d moves to complete!", i);
+  snprintf(buf, 256, "%d moves to complete!", i);
   glutSetWindowTitle(buf);
 }
 
@@ -763,7 +763,7 @@ solvePuzzle(void)
   }
   if (puzzles == NULL) {
     freeSolutions();
-    sprintf(buf, "I can't solve it! (%d positions examined)", i);
+    snprintf(buf, 256, "I can't solve it! (%d positions examined)", i);
     glutSetWindowTitle(buf);
     return 1;
   }

test/keyboard.cxx

@@ -119,20 +119,20 @@ int main(int argc, char** argv) {
     if (!k)
       keyname = "0";
     else if (k < 128) { // ASCII
-      sprintf(buffer, "'%c'", k);
+      snprintf(buffer, sizeof(buffer), "'%c'", k);
     } else if (k >= 0xa0 && k <= 0xff) { // ISO-8859-1 (international keyboards)
       char key[8];
       int kl = fl_utf8encode((unsigned)k, key);
       key[kl] = '\0';
-      sprintf(buffer, "'%s'", key);
+      snprintf(buffer, sizeof(buffer), "'%s'", key);
     } else if (k > FL_F && k <= FL_F_Last) {
-      sprintf(buffer, "FL_F+%d", k - FL_F);
+      snprintf(buffer, sizeof(buffer), "FL_F+%d", k - FL_F);
     } else if (k >= FL_KP && k <= FL_KP_Last) {
-      sprintf(buffer, "FL_KP+'%c'", k-FL_KP);
+      snprintf(buffer, sizeof(buffer), "FL_KP+'%c'", k-FL_KP);
     } else if (k >= FL_Button && k <= FL_Button+7) {
-      sprintf(buffer, "FL_Button+%d", k-FL_Button);
+      snprintf(buffer, sizeof(buffer), "FL_Button+%d", k-FL_Button);
     } else {
-      sprintf(buffer, "0x%04x", k);
+      snprintf(buffer, sizeof(buffer), "0x%04x", k);
       for (int i = 0; i < int(sizeof(table)/sizeof(*table)); i++)
         if (table[i].n == k) {keyname = table[i].text; break;}
     }

test/list_visuals.cxx

@@ -92,7 +92,7 @@ static void print_mask(XVisualInfo* p) {
     else new_what = '?';
     if (new_what != what) {
       if (what && (what != '?' || print_anything)) {
-        q += sprintf(q,"%d%c", n, what);
+        q += snprintf(q, sizeof(buf) - (q-buf), "%d%c", n, what);
         print_anything = 1;
       }
       what = new_what;

test/mandelbrot.cxx

@@ -72,9 +72,9 @@ int main(int argc, char **argv) {
 
 void Drawing_Window::update_label() {
   char buffer[128];
-  sprintf(buffer, "%+.10f", d->X); x_input->value(buffer);
+  snprintf(buffer, 128, "%+.10f", d->X); x_input->value(buffer);
-  sprintf(buffer, "%+.10f", d->Y); y_input->value(buffer);
+  snprintf(buffer, 128, "%+.10f", d->Y); y_input->value(buffer);
-  sprintf(buffer, "%.2g", d->scale); w_input->value(buffer);
+  snprintf(buffer, 128, "%.2g", d->scale); w_input->value(buffer);
 }
 
 void Drawing_Area::draw() {
@@ -187,7 +187,7 @@ int Drawing_Area::handle(int event) {
       jbrot.d->jX = X + (ix-x()-W/2)*scale/W;
       jbrot.d->jY = Y + (H/2-iy+y())*scale/W;
       static char s[128];
-      sprintf(s, "Julia %.7f %.7f",jbrot.d->jX,jbrot.d->jY);
+      snprintf(s, 128, "Julia %.7f %.7f",jbrot.d->jX,jbrot.d->jY);
       jbrot.window->label(s);
       jbrot.window->show();
       jbrot.d->new_display();

test/menubar.cxx

@@ -225,7 +225,7 @@ int main(int argc, char **argv) {
   //Fl::set_color(Fl_Color(15),0,0,128);
   for (int i=0; i<99; i++) {
     char buf[100];
-    sprintf(buf,"item %d",i);
+    snprintf(buf, 100,"item %d",i);
     hugemenu[i].text = fl_strdup(buf);
   }
   Fl_Double_Window window(WIDTH,400+TERMINAL_HEIGHT);

test/pack.cxx

@@ -104,7 +104,7 @@ int main(int argc, char **argv) {
   int xx = 35;
   for (int i = 0; i < nbuttons; i++) {
     char ltxt[8];
-    sprintf(ltxt, "b%d", i + 1);
+    snprintf(ltxt, 8, "b%d", i + 1);
     Fl_Button *b = new Fl_Button(xx, xx, 25, 25);
     b->copy_label(ltxt);
     xx += 10;

test/scroll.cxx

@@ -95,7 +95,7 @@ int main(int argc, char** argv) {
 
   int n = 0;
   for (int y=0; y<16; y++) for (int x=0; x<5; x++) {
-    char buf[20]; sprintf(buf,"%d",n++);
+    char buf[20]; snprintf(buf, 20,"%d",n++);
     Fl_Button* b = new Fl_Button(x*75,y*25+(y>=8?5*75:0),75,25);
     b->copy_label(buf);
     b->color(n);

test/sudoku.cxx

@@ -1006,7 +1006,7 @@ Sudoku::load_game() {
 
       SudokuCell *cell = grid_cells_[j][k];
 
-      sprintf(name, "value%d.%d", j, k);
+      snprintf(name, sizeof(name), "value%d.%d", j, k);
       if (!prefs_.get(name, val, 0)) {
         j = 9;
         grid_values_[0][0] = 0;
@@ -1015,11 +1015,11 @@ Sudoku::load_game() {
 
       grid_values_[j][k] = val;
 
-      sprintf(name, "state%d.%d", j, k);
+      snprintf(name, sizeof(name), "state%d.%d", j, k);
       prefs_.get(name, val, 0);
       cell->value(val);
 
-      sprintf(name, "readonly%d.%d", j, k);
+      snprintf(name, sizeof(name), "readonly%d.%d", j, k);
       prefs_.get(name, val, 0);
       cell->readonly(val != 0);
 
@@ -1030,7 +1030,7 @@ Sudoku::load_game() {
       }
 
       for (int m = 0; m < 8; m ++) {
-        sprintf(name, "test%d%d.%d", m, j, k);
+        snprintf(name, sizeof(name), "test%d%d.%d", m, j, k);
         prefs_.get(name, val, 0);
         cell->test_value(val, m);
       }
@@ -1261,17 +1261,17 @@ Sudoku::save_game() {
       char name[255];
       SudokuCell *cell = grid_cells_[j][k];
 
-      sprintf(name, "value%d.%d", j, k);
+      snprintf(name, sizeof(name), "value%d.%d", j, k);
       prefs_.set(name, grid_values_[j][k]);
 
-      sprintf(name, "state%d.%d", j, k);
+      snprintf(name, sizeof(name), "state%d.%d", j, k);
       prefs_.set(name, cell->value());
 
-      sprintf(name, "readonly%d.%d", j, k);
+      snprintf(name, sizeof(name), "readonly%d.%d", j, k);
       prefs_.set(name, cell->readonly());
 
       for (int m = 0; m < 8; m ++) {
-        sprintf(name, "test%d%d.%d", m, j, k);
+        snprintf(name, sizeof(name), "test%d%d.%d", m, j, k);
         prefs_.set(name, cell->test_value(m));
       }
     }

test/symbols.cxx

@@ -44,15 +44,15 @@ void slider_cb(Fl_Widget *, void *) {
     if ( l && *l == '@' ) {                       // all children with '@'
       l ++;
       if ( wc->box() == FL_NO_BOX ) {             // ascii legend?
-        if (val&&sze) sprintf(buf, "@@%+d%d%s", sze, val, l);
+        if (val&&sze) snprintf(buf, sizeof(buf), "@@%+d%d%s", sze, val, l);
-        else if (val) sprintf(buf, "@@%d%s", val, l);
+        else if (val) snprintf(buf, sizeof(buf), "@@%d%s", val, l);
-        else if (sze) sprintf(buf, "@@%+d%s", sze, l);
+        else if (sze) snprintf(buf, sizeof(buf), "@@%+d%s", sze, l);
-        else          sprintf(buf, "@@%s", l);
+        else          snprintf(buf, sizeof(buf), "@@%s", l);
       } else {                                    // box with symbol
-        if (val&&sze) sprintf(buf, "@%+d%d%s", sze, val, l);
+        if (val&&sze) snprintf(buf, sizeof(buf), "@%+d%d%s", sze, val, l);
-        else if (val) sprintf(buf, "@%d%s", val, l);
+        else if (val) snprintf(buf, sizeof(buf), "@%d%s", val, l);
-        else if (sze) sprintf(buf, "@%+d%s", sze, l);
+        else if (sze) snprintf(buf, sizeof(buf), "@%+d%s", sze, l);
-        else          sprintf(buf, "@%s", l);
+        else          snprintf(buf, sizeof(buf), "@%s", l);
       }
       wc->copy_label(buf);
     }
@@ -67,7 +67,7 @@ void bt(const char *name) {
   N++;
   x = x*W+10;
   y = y*H+10;
-  sprintf(buf, "@%s", name);
+  snprintf(buf, sizeof(buf), "@%s", name);
   Fl_Box *a = new Fl_Box(x,y,W-20,H-20);
   a->box(FL_NO_BOX);
   a->copy_label(buf);

test/table.cxx

@@ -54,7 +54,7 @@ void DemoTable::draw_cell(TableContext context,
                           int R, int C, int X, int Y, int W, int H)
 {
     static char s[40];
-    sprintf(s, "%d/%d", R, C);          // text for each cell
+    snprintf(s, 40, "%d/%d", R, C);          // text for each cell
 
     switch ( context )
     {
@@ -271,7 +271,7 @@ void setcellbgcolor_cb(Fl_Widget *w, void *data)
 char *itoa(int val)
 {
     static char s[80];
-    sprintf(s, "%d", val);
+    snprintf(s, 80, "%d", val);
     return(s);
 }
 

test/threads.cxx

@@ -73,7 +73,7 @@ extern "C" void* prime_func(void* p)
     for (pp=3; pp<=hn; pp+=2) if ( n%pp == 0 ) break;
     if (pp >= hn) {
       char s[128];
-      sprintf(s, "%d", n);
+      snprintf(s, 128, "%d", n);
 
       // Obtain a lock before we access the browser widget...
       Fl::lock();

test/tree.fl

@@ -270,7 +270,7 @@ tree->add("Long Line/Longer Line/The quick brown fox jumped over the lazy dog. -
 // Add 500 items in numerical order
 for ( int t=0; t<500; t++ ) {
     static char s[80];
-    sprintf(s, "500 Items/item %04d", t+1);
+    snprintf(s, 80, "500 Items/item %04d", t+1);
     tree->add(s);
 }
 tree->close("500 Items");       // close the 500 items by default
@@ -986,7 +986,7 @@ while (item) {
         if ( parent == 0 ) parent = tree->root();
         char s[80];
         for ( int i=0; i<20000; i++ ) {
-            sprintf(s, "Item \#%d", item_id+i);
+            snprintf(s, 80, "Item \#%d", item_id+i);
             tree->add(parent, s);
         }
         item_id += 20000;

test/unittest_scrollbarsize.cxx

@@ -39,7 +39,7 @@ class MyTable : public Fl_Table {
         fl_font(FL_HELVETICA, 8);               // set font for drawing operations
         return;
       case CONTEXT_CELL:                        // Draw data in cells
-        sprintf(s, "%c", 'A'+ROW+COL);
+        snprintf(s, 10, "%c", 'A'+ROW+COL);
         fl_push_clip(X,Y,W,H);
           // Draw cell bg
           fl_color(FL_WHITE); fl_rectf(X,Y,W,H);

test/utf8.cxx

@@ -174,11 +174,11 @@ static void font_cb(Fl_Widget *, long)
       char buf[16];
       if (j < size_count && i == size_array[j])
       {
-        sprintf(buf, "@b%d", i);
+        snprintf(buf, 16, "@b%d", i);
         j++;
       }
       else
-        sprintf(buf, "%d", i);
+        snprintf(buf, 16, "%d", i);
       sizeobj->add(buf);
     }
     sizeobj->value(pickedsize);
@@ -193,7 +193,7 @@ static void font_cb(Fl_Widget *, long)
       if (size_array[i] <= pickedsize) w = i;
 
       char buf[16];
-      sprintf(buf, "@b%d", size_array[i]);
+      snprintf(buf, 16, "@b%d", size_array[i]);
       sizeobj->add(buf);
     }
     sizeobj->value(w + 1);
@@ -304,7 +304,7 @@ static void own_face_cb(Fl_Widget *, void *)
       // Show font in its own face
       // this is neat, but really slow on some systems:
       // uses each font to display its own name
-      sprintf (buffer, "@F%d@.%s", font_idx, name);
+      snprintf (buffer, sizeof(buffer), "@F%d@.%s", font_idx, name);
     }
     fontobj->add(buffer);
   }
@@ -616,7 +616,7 @@ int main(int argc, char** argv)
       i++;
     }
     buf[o] = '\0';
-    sprintf(bu, "0x%06lX", y * 16);
+    snprintf(bu, sizeof(bu), "0x%06lX", y * 16);
     Fl_Input *b = new Fl_Input(200,(y-off)*25,80,25);
     b->textfont(FL_COURIER);
     b->value(fl_strdup(bu));