Use snprintf

src/art.cc

@@ -147,7 +147,7 @@ int artInit()
     bool critterDbSelected = false;
     for (int objectType = 0; objectType < OBJ_TYPE_COUNT; objectType++) {
         gArtListDescriptions[objectType].flags = 0;
-        sprintf(path, "%s%s%s\\%s.lst", _cd_path_base, "art\\", gArtListDescriptions[objectType].name, gArtListDescriptions[objectType].name);
+        snprintf(path, sizeof(path), "%s%s%s\\%s.lst", _cd_path_base, "art\\", gArtListDescriptions[objectType].name, gArtListDescriptions[objectType].name);
 
         int oldDb;
         if (objectType == OBJ_TYPE_CRITTER) {
@@ -191,7 +191,7 @@ int artInit()
         gArtCritterFidShoudRunData[critterIndex] = 0;
     }
 
-    sprintf(path, "%s%s%s\\%s.lst", _cd_path_base, "art\\", gArtListDescriptions[OBJ_TYPE_CRITTER].name, gArtListDescriptions[OBJ_TYPE_CRITTER].name);
+    snprintf(path, sizeof(path), "%s%s%s\\%s.lst", _cd_path_base, "art\\", gArtListDescriptions[OBJ_TYPE_CRITTER].name, gArtListDescriptions[OBJ_TYPE_CRITTER].name);
 
     stream = fileOpen(path, "rt");
     if (stream == NULL) {
@@ -282,7 +282,7 @@ int artInit()
         return -1;
     }
 
-    sprintf(path, "%s%s%s\\%s.lst", _cd_path_base, "art\\", gArtListDescriptions[OBJ_TYPE_HEAD].name, gArtListDescriptions[OBJ_TYPE_HEAD].name);
+    snprintf(path, sizeof(path), "%s%s%s\\%s.lst", _cd_path_base, "art\\", gArtListDescriptions[OBJ_TYPE_HEAD].name, gArtListDescriptions[OBJ_TYPE_HEAD].name);
 
     stream = fileOpen(path, "rt");
     if (stream == NULL) {
@@ -653,19 +653,19 @@ char* artBuildFilePath(int fid)
             return NULL;
         }
         if (v10) {
-            sprintf(_art_name, "%s%s%s\\%s%c%c.fr%c", _cd_path_base, "art\\", gArtListDescriptions[1].name, gArtListDescriptions[1].fileNames + v8, v11, v12, v10 + 47);
+            snprintf(_art_name, sizeof(_art_name), "%s%s%s\\%s%c%c.fr%c", _cd_path_base, "art\\", gArtListDescriptions[1].name, gArtListDescriptions[1].fileNames + v8, v11, v12, v10 + 47);
         } else {
-            sprintf(_art_name, "%s%s%s\\%s%c%c.frm", _cd_path_base, "art\\", gArtListDescriptions[1].name, gArtListDescriptions[1].fileNames + v8, v11, v12);
+            snprintf(_art_name, sizeof(_art_name), "%s%s%s\\%s%c%c.frm", _cd_path_base, "art\\", gArtListDescriptions[1].name, gArtListDescriptions[1].fileNames + v8, v11, v12);
         }
     } else if (type == 8) {
         v9 = _head2[v4];
         if (v9 == 'f') {
-            sprintf(_art_name, "%s%s%s\\%s%c%c%d.frm", _cd_path_base, "art\\", gArtListDescriptions[8].name, gArtListDescriptions[8].fileNames + v8, _head1[v4], 102, v5);
+            snprintf(_art_name, sizeof(_art_name), "%s%s%s\\%s%c%c%d.frm", _cd_path_base, "art\\", gArtListDescriptions[8].name, gArtListDescriptions[8].fileNames + v8, _head1[v4], 102, v5);
         } else {
-            sprintf(_art_name, "%s%s%s\\%s%c%c.frm", _cd_path_base, "art\\", gArtListDescriptions[8].name, gArtListDescriptions[8].fileNames + v8, _head1[v4], v9);
+            snprintf(_art_name, sizeof(_art_name), "%s%s%s\\%s%c%c.frm", _cd_path_base, "art\\", gArtListDescriptions[8].name, gArtListDescriptions[8].fileNames + v8, _head1[v4], v9);
         }
     } else {
-        sprintf(_art_name, "%s%s%s\\%s", _cd_path_base, "art\\", gArtListDescriptions[type].name, gArtListDescriptions[type].fileNames + v8);
+        snprintf(_art_name, sizeof(_art_name), "%s%s%s\\%s", _cd_path_base, "art\\", gArtListDescriptions[type].name, gArtListDescriptions[type].fileNames + v8);
     }
 
     return _art_name;
@@ -972,7 +972,7 @@ static int artCacheGetFileSizeImpl(int fid, int* sizePtr)
             }
 
             char localizedPath[COMPAT_MAX_PATH];
-            sprintf(localizedPath, "art\\%s\\%s", gArtLanguage, pch);
+            snprintf(localizedPath, sizeof(localizedPath), "art\\%s\\%s", gArtLanguage, pch);
 
             if (dbGetFileSize(localizedPath, &fileSize) == 0) {
                 loaded = true;
@@ -1019,7 +1019,7 @@ static int artCacheReadDataImpl(int fid, int* sizePtr, unsigned char* data)
             }
 
             char localizedPath[COMPAT_MAX_PATH];
-            sprintf(localizedPath, "art\\%s\\%s", gArtLanguage, pch);
+            snprintf(localizedPath, sizeof(localizedPath), "art\\%s\\%s", gArtLanguage, pch);
 
             if (artRead(localizedPath, data) == 0) {
                 loaded = true;

src/audio.cc

@@ -46,7 +46,7 @@ static int audioSoundDecoderReadHandler(int fileHandle, void* buffer, unsigned i
 int audioOpen(const char* fname, int flags, ...)
 {
     char path[80];
-    sprintf(path, "%s", fname);
+    snprintf(path, sizeof(path), "%s", fname);
 
     int compression;
     if (_queryCompressedFunc(path)) {

src/automap.cc

@@ -272,7 +272,7 @@ int automapReset()
 void automapExit()
 {
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s\\%s\\%s", settings.system.master_patches_path.c_str(), "MAPS", AUTOMAP_DB);
+    snprintf(path, sizeof(path), "%s\\%s\\%s", settings.system.master_patches_path.c_str(), "MAPS", AUTOMAP_DB);
     compat_remove(path);
 }
 
@@ -709,7 +709,7 @@ int automapSaveCurrent()
 
     // NOTE: Not sure about the size.
     char path[256];
-    sprintf(path, "%s\\%s", "MAPS", AUTOMAP_DB);
+    snprintf(path, sizeof(path), "%s\\%s", "MAPS", AUTOMAP_DB);
 
     File* stream1 = fileOpen(path, "r+b");
     if (stream1 == NULL) {
@@ -740,7 +740,7 @@ int automapSaveCurrent()
     }
 
     if (entryOffset != 0) {
-        sprintf(path, "%s\\%s", "MAPS", AUTOMAP_TMP);
+        snprintf(path, sizeof(path), "%s\\%s", "MAPS", AUTOMAP_TMP);
 
         File* stream2 = fileOpen(path, "wb");
         if (stream2 == NULL) {
@@ -836,7 +836,7 @@ int automapSaveCurrent()
 
         // NOTE: Not sure about the size.
         char automapDbPath[512];
-        sprintf(automapDbPath, "%s\\%s\\%s", settings.system.master_patches_path.c_str(), "MAPS", AUTOMAP_DB);
+        snprintf(automapDbPath, sizeof(automapDbPath), "%s\\%s\\%s", settings.system.master_patches_path.c_str(), "MAPS", AUTOMAP_DB);
         if (compat_remove(automapDbPath) != 0) {
             debugPrint("\nAUTOMAP: Error removing database!\n");
             return -1;
@@ -844,7 +844,7 @@ int automapSaveCurrent()
 
         // NOTE: Not sure about the size.
         char automapTmpPath[512];
-        sprintf(automapTmpPath, "%s\\%s\\%s", settings.system.master_patches_path.c_str(), "MAPS", AUTOMAP_TMP);
+        snprintf(automapTmpPath, sizeof(automapTmpPath), "%s\\%s\\%s", settings.system.master_patches_path.c_str(), "MAPS", AUTOMAP_TMP);
         if (compat_rename(automapTmpPath, automapDbPath) != 0) {
             debugPrint("\nAUTOMAP: Error renaming database!\n");
             return -1;
@@ -931,7 +931,7 @@ static int automapLoadEntry(int map, int elevation)
     gAutomapEntry.compressedData = NULL;
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s\\%s", "MAPS", AUTOMAP_DB);
+    snprintf(path, sizeof(path), "%s\\%s", "MAPS", AUTOMAP_DB);
 
     bool success = true;
 
@@ -1106,7 +1106,7 @@ static int automapCreate()
     memcpy(gAutomapHeader.offsets, _defam, sizeof(_defam));
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s\\%s", "MAPS", AUTOMAP_DB);
+    snprintf(path, sizeof(path), "%s\\%s", "MAPS", AUTOMAP_DB);
 
     File* stream = fileOpen(path, "wb");
     if (stream == NULL) {
@@ -1161,7 +1161,7 @@ static int _copy_file_data(File* stream1, File* stream2, int length)
 int automapGetHeader(AutomapHeader** automapHeaderPtr)
 {
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s\\%s", "MAPS", AUTOMAP_DB);
+    snprintf(path, sizeof(path), "%s\\%s", "MAPS", AUTOMAP_DB);
 
     File* stream = fileOpen(path, "rb");
     if (stream == NULL) {

src/cache.cc

@@ -194,13 +194,13 @@ bool cacheFlush(Cache* cache)
 }
 
 // 0x42019C
-bool cachePrintStats(Cache* cache, char* dest)
+bool cachePrintStats(Cache* cache, char* dest, size_t size)
 {
     if (cache == NULL || dest == NULL) {
         return false;
     }
 
-    sprintf(dest, "Cache stats are disabled.%s", "\n");
+    snprintf(dest, size, "Cache stats are disabled.%s", "\n");
 
     return true;
 }

src/cache.h

@@ -1,6 +1,8 @@
 #ifndef CACHE_H
 #define CACHE_H
 
+#include <stddef.h>
+
 #include "heap.h"
 
 namespace fallout {
@@ -66,7 +68,7 @@ bool cacheFree(Cache* cache);
 bool cacheLock(Cache* cache, int key, void** data, CacheEntry** cacheEntryPtr);
 bool cacheUnlock(Cache* cache, CacheEntry* cacheEntry);
 bool cacheFlush(Cache* cache);
-bool cachePrintStats(Cache* cache, char* dest);
+bool cachePrintStats(Cache* cache, char* dest, size_t size);
 
 } // namespace fallout
 

src/character_editor.cc

@@ -1272,7 +1272,7 @@ static int characterEditorWindowInit()
         return -1;
     }
 
-    sprintf(path, "%s%s", asc_5186C8, "editor.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "editor.msg");
 
     if (!messageListLoad(&gCharacterEditorMessageList, path)) {
         return -1;
@@ -2152,9 +2152,9 @@ static void characterEditorDrawPerksFolder()
                 string = perkGetName(perk);
 
                 if (perkLevel == 1) {
-                    strcpy(perkName, string);
+                    snprintf(perkName, sizeof(perkName), "%s", string);
                 } else {
-                    sprintf(perkName, "%s (%d)", string, perkLevel);
+                    snprintf(perkName, sizeof(perkName), "%s (%d)", string, perkLevel);
                 }
 
                 if (characterEditorFolderViewDrawString(perkName)) {
@@ -2218,7 +2218,7 @@ static int characterEditorDrawKillsFolder()
                 gCharacterEditorFolderCardTitle = gCharacterEditorFolderCardString;
                 gCharacterEditorFolderCardSubtitle = NULL;
                 gCharacterEditorFolderCardDescription = killTypeGetDescription(kills[i].killTypeId);
-                sprintf(gCharacterEditorFolderCardString, "%s %s", killInfo->name, getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 126));
+                snprintf(gCharacterEditorFolderCardString, sizeof(gCharacterEditorFolderCardString), "%s %s", killInfo->name, getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 126));
                 hasContent = true;
             }
         }
@@ -2383,7 +2383,7 @@ static void characterEditorDrawPcStats()
     }
 
     int level = pcGetStat(PC_STAT_LEVEL);
-    sprintf(stringBuffer, "%s %d",
+    snprintf(stringBuffer, sizeof(stringBuffer), "%s %d",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 113),
         level);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 32, stringBuffer, 640, 640, color);
@@ -2397,7 +2397,7 @@ static void characterEditorDrawPcStats()
     }
 
     int exp = pcGetStat(PC_STAT_EXPERIENCE);
-    sprintf(stringBuffer, "%s %s",
+    snprintf(stringBuffer, sizeof(stringBuffer), "%s %s",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 114),
         _itostndn(exp, formattedValueBuffer));
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 32, stringBuffer, 640, 640, color);
@@ -2423,7 +2423,7 @@ static void characterEditorDrawPcStats()
         formattedValue = _itostndn(expToNextLevel, formattedValueBuffer);
     }
 
-    sprintf(stringBuffer, "%s %s",
+    snprintf(stringBuffer, sizeof(stringBuffer), "%s %s",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, expMsgId),
         formattedValue);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 32, stringBuffer, 640, 640, color);
@@ -2541,7 +2541,7 @@ static void characterEditorDrawAge()
     age = critterGetStat(gDude, STAT_AGE);
     str = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 104);
 
-    sprintf(text, "%s %d", str, age);
+    snprintf(text, sizeof(text), "%s %d", str, age);
 
     width = _editorFrmImages[EDITOR_GRAPHIC_AGE_ON].getWidth();
     x = (width / 2) + 1 - (fontGetStringWidth(text) / 2);
@@ -2649,10 +2649,10 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 300);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
-    sprintf(t, "%d/%d", currHp, maxHp);
+    snprintf(t, sizeof(t), "%d/%d", currHp, maxHp);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 263, t, 640, 640, color);
 
     // Poisoned
@@ -2665,7 +2665,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 312);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     // Radiated
@@ -2678,7 +2678,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 313);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     // Eye Damage
@@ -2691,7 +2691,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 314);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     // Crippled Right Arm
@@ -2704,7 +2704,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 315);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     // Crippled Left Arm
@@ -2717,7 +2717,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 316);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     // Crippled Right Leg
@@ -2730,7 +2730,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 317);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     // Crippled Left Leg
@@ -2743,7 +2743,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 318);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     y = 179;
@@ -2758,7 +2758,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 302);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     compat_itoa(critterGetStat(gDude, STAT_ARMOR_CLASS), t, 10);
@@ -2774,7 +2774,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 301);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     compat_itoa(critterGetStat(gDude, STAT_MAXIMUM_ACTION_POINTS), t, 10);
@@ -2790,7 +2790,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 311);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     compat_itoa(critterGetStat(gDude, STAT_CARRY_WEIGHT), t, 10);
@@ -2806,7 +2806,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 304);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     // SFALL: Display melee damage without "Bonus HtH Damage" bonus.
@@ -2828,10 +2828,10 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 305);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
-    sprintf(t, "%d%%", critterGetStat(gDude, STAT_DAMAGE_RESISTANCE));
+    snprintf(t, sizeof(t), "%d%%", critterGetStat(gDude, STAT_DAMAGE_RESISTANCE));
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 288, t, 640, 640, color);
 
     // Poison Resistance
@@ -2844,10 +2844,10 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 306);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
-    sprintf(t, "%d%%", critterGetStat(gDude, STAT_POISON_RESISTANCE));
+    snprintf(t, sizeof(t), "%d%%", critterGetStat(gDude, STAT_POISON_RESISTANCE));
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 288, t, 640, 640, color);
 
     // Radiation Resistance
@@ -2860,10 +2860,10 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 307);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
-    sprintf(t, "%d%%", critterGetStat(gDude, STAT_RADIATION_RESISTANCE));
+    snprintf(t, sizeof(t), "%d%%", critterGetStat(gDude, STAT_RADIATION_RESISTANCE));
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 288, t, 640, 640, color);
 
     // Sequence
@@ -2876,7 +2876,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 308);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     compat_itoa(critterGetStat(gDude, STAT_SEQUENCE), t, 10);
@@ -2892,7 +2892,7 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 309);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
     compat_itoa(critterGetStat(gDude, STAT_HEALING_RATE), t, 10);
@@ -2908,10 +2908,10 @@ static void characterEditorDrawDerivedStats()
     }
 
     messageListItemText = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 310);
-    sprintf(t, "%s", messageListItemText);
+    snprintf(t, sizeof(t), "%s", messageListItemText);
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 194, t, 640, 640, color);
 
-    sprintf(t, "%d%%", critterGetStat(gDude, STAT_CRITICAL_CHANCE));
+    snprintf(t, sizeof(t), "%d%%", critterGetStat(gDude, STAT_CRITICAL_CHANCE));
     fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 288, t, 640, 640, color);
 }
 
@@ -2989,7 +2989,7 @@ static void characterEditorDrawSkills(int a1)
         fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 380, str, 640, 640, color);
 
         value = skillGetValue(gDude, i);
-        sprintf(valueString, "%d%%", value);
+        snprintf(valueString, sizeof(valueString), "%d%%", value);
 
         fontDrawText(gCharacterEditorWindowBuffer + 640 * y + 573, valueString, 640, 640, color);
 
@@ -3156,7 +3156,7 @@ static void characterEditorDrawCard()
         char formatted[150]; // TODO: Size is probably wrong.
         const char* base = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 137);
         int defaultValue = skillGetDefaultValue(skill);
-        sprintf(formatted, "%s %d%% %s", base, defaultValue, attributesDescription);
+        snprintf(formatted, sizeof(formatted), "%s %d%% %s", base, defaultValue, attributesDescription);
 
         graphicId = skillGetFrmId(skill);
         title = skillGetName(skill);
@@ -3970,7 +3970,7 @@ static int characterEditorShowOptions()
 
                         if (!characterFileExists(string4)) {
                             // already exists
-                            sprintf(string4,
+                            snprintf(string4, sizeof(string4),
                                 "%s %s",
                                 compat_strupr(string1),
                                 getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 609));
@@ -3991,7 +3991,7 @@ static int characterEditorShowOptions()
                             strcat(string4, string1);
 
                             if (characterPrintToFile(string4) == 0) {
-                                sprintf(string4,
+                                snprintf(string4, sizeof(string4),
                                     "%s%s",
                                     compat_strupr(string1),
                                     getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 607));
@@ -3999,7 +3999,7 @@ static int characterEditorShowOptions()
                             } else {
                                 soundPlayFile("iisxxxx1");
 
-                                sprintf(string4,
+                                snprintf(string4, sizeof(string4),
                                     "%s%s%s",
                                     getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 611),
                                     compat_strupr(string1),
@@ -4132,7 +4132,7 @@ static int characterEditorShowOptions()
 
                         bool shouldSave;
                         if (characterFileExists(string4)) {
-                            sprintf(string4, "%s %s",
+                            snprintf(string4, sizeof(string4), "%s %s",
                                 compat_strupr(string1),
                                 getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 609));
                             strcpy(string5, getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 610));
@@ -4155,13 +4155,13 @@ static int characterEditorShowOptions()
 
                             if (gcdSave(string4) != 0) {
                                 soundPlayFile("iisxxxx1");
-                                sprintf(string4, "%s%s!",
+                                snprintf(string4, sizeof(string4), "%s%s!",
                                     compat_strupr(string1),
                                     getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 611));
                                 showDialogBox(string4, NULL, 0, 169, 126, _colorTable[32328], NULL, _colorTable[32328], DIALOG_BOX_LARGE);
                                 rc = 0;
                             } else {
-                                sprintf(string4, "%s%s",
+                                snprintf(string4, sizeof(string4), "%s%s",
                                     compat_strupr(string1),
                                     getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 607));
                                 showDialogBox(string4, NULL, 0, 169, 126, _colorTable[992], NULL, _colorTable[992], DIALOG_BOX_LARGE);
@@ -4230,7 +4230,7 @@ static int characterEditorShowOptions()
 
         int v42 = 0;
         if (characterFileExists(title)) {
-            sprintf(title,
+            snprintf(title, sizeof(title),
                 "%s %s",
                 compat_strupr(fileName),
                 getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 609));
@@ -4254,7 +4254,7 @@ static int characterEditorShowOptions()
             if (characterPrintToFile(title) != 0) {
                 soundPlayFile("iisxxxx1");
 
-                sprintf(title,
+                snprintf(title, sizeof(title),
                     "%s%s%s",
                     getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 611),
                     compat_strupr(fileName),
@@ -4324,7 +4324,7 @@ static int characterPrintToFile(const char* fileName)
     int year;
     gameTimeGetDate(&month, &day, &year);
 
-    sprintf(title1, "%.2d %s %d  %.4d %s",
+    snprintf(title1, sizeof(title1), "%.2d %s %d  %.4d %s",
         day,
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 500 + month - 1),
         year,
@@ -4343,7 +4343,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Name
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %s",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 642),
         critterGetName(gDude));
@@ -4358,14 +4358,14 @@ static int characterPrintToFile(const char* fileName)
     }
 
     // Age
-    sprintf(title2,
+    snprintf(title2, sizeof(title2),
         "%s%s %d",
         title1,
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 643),
         critterGetStat(gDude, STAT_AGE));
 
     // Gender
-    sprintf(title3,
+    snprintf(title3, sizeof(title3),
         "%s%s %s",
         title2,
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 644),
@@ -4374,7 +4374,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString(title3, stream);
     fileWriteString("\n", stream);
 
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %s ",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 647),
         pcGetStat(PC_STAT_LEVEL),
@@ -4390,7 +4390,7 @@ static int characterPrintToFile(const char* fileName)
         strcat(title1, padding);
     }
 
-    sprintf(title2,
+    snprintf(title2, sizeof(title2),
         "%s%s %s",
         title1,
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 649),
@@ -4400,12 +4400,12 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Statistics
-    sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 623));
+    snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 623));
 
     // Strength / Hit Points / Sequence
     //
     // FIXME: There is bug - it shows strength instead of sequence.
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %.3d/%.3d %s %.2d",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 624),
         critterGetStat(gDude, STAT_STRENGTH),
@@ -4418,7 +4418,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Perception / Armor Class / Healing Rate
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %.3d %s %.2d",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 627),
         critterGetStat(gDude, STAT_PERCEPTION),
@@ -4430,7 +4430,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Endurance / Action Points / Critical Chance
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %.2d %s %.3d%%",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 630),
         critterGetStat(gDude, STAT_ENDURANCE),
@@ -4448,7 +4448,7 @@ static int characterPrintToFile(const char* fileName)
     }
 
     // Charisma / Melee Damage / Carry Weight
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %.2d %s %.3d lbs.",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 633),
         critterGetStat(gDude, STAT_CHARISMA),
@@ -4460,7 +4460,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Intelligence / Damage Resistance
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %.3d%%",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 636),
         critterGetStat(gDude, STAT_INTELLIGENCE),
@@ -4470,7 +4470,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Agility / Radiation Resistance
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %.3d%%",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 638),
         critterGetStat(gDude, STAT_AGILITY),
@@ -4480,7 +4480,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Luck / Poison Resistance
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %.2d %s %.3d%%",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 640),
         critterGetStat(gDude, STAT_LUCK),
@@ -4494,13 +4494,13 @@ static int characterPrintToFile(const char* fileName)
 
     if (gCharacterEditorTempTraits[0] != -1) {
         // ::: Traits :::
-        sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 650));
+        snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 650));
         fileWriteString(title1, stream);
 
         // NOTE: The original code does not use loop, or it was optimized away.
         for (int index = 0; index < TRAITS_MAX_SELECTED_COUNT; index++) {
             if (gCharacterEditorTempTraits[index] != -1) {
-                sprintf(title1, "  %s", traitGetName(gCharacterEditorTempTraits[index]));
+                snprintf(title1, sizeof(title1), "  %s", traitGetName(gCharacterEditorTempTraits[index]));
                 fileWriteString(title1, stream);
                 fileWriteString("\n", stream);
             }
@@ -4516,16 +4516,16 @@ static int characterPrintToFile(const char* fileName)
 
     if (perk < PERK_COUNT) {
         // ::: Perks :::
-        sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 651));
+        snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 651));
         fileWriteString(title1, stream);
 
         for (perk = 0; perk < PERK_COUNT; perk++) {
             int rank = perkGetRank(gDude, perk);
             if (rank != 0) {
                 if (rank == 1) {
-                    sprintf(title1, "  %s", perkGetName(perk));
+                    snprintf(title1, sizeof(title1), "  %s", perkGetName(perk));
                 } else {
-                    sprintf(title1, "  %s (%d)", perkGetName(perk), rank);
+                    snprintf(title1, sizeof(title1), "  %s (%d)", perkGetName(perk), rank);
                 }
 
                 fileWriteString(title1, stream);
@@ -4537,7 +4537,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // ::: Karma :::
-    sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 652));
+    snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 652));
     fileWriteString(title1, stream);
 
     for (int index = 0; index < gKarmaEntriesLength; index++) {
@@ -4553,7 +4553,7 @@ static int characterPrintToFile(const char* fileName)
 
             if (reputation < gGenericReputationEntriesLength) {
                 GenericReputationEntry* reputationDescription = &(gGenericReputationEntries[reputation]);
-                sprintf(title1,
+                snprintf(title1, sizeof(title1),
                     "  %s: %s (%s)",
                     getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 125),
                     compat_itoa(gGameGlobalVars[GVAR_PLAYER_REPUTATION], title2, 10),
@@ -4563,7 +4563,7 @@ static int characterPrintToFile(const char* fileName)
             }
         } else {
             if (gGameGlobalVars[karmaEntry->gvar] != 0) {
-                sprintf(title1, "  %s", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, karmaEntry->name));
+                snprintf(title1, sizeof(title1), "  %s", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, karmaEntry->name));
                 fileWriteString(title1, stream);
                 fileWriteString("\n", stream);
             }
@@ -4579,7 +4579,7 @@ static int characterPrintToFile(const char* fileName)
                 fileWriteString("\n", stream);
 
                 // ::: Reputation :::
-                sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 657));
+                snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 657));
                 fileWriteString(title1, stream);
                 hasTownReputationHeading = true;
             }
@@ -4606,7 +4606,7 @@ static int characterPrintToFile(const char* fileName)
                 townReputationMessageId = 2000; // Idolized
             }
 
-            sprintf(title1,
+            snprintf(title1, sizeof(title1),
                 "  %s: %s",
                 title2,
                 getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, townReputationMessageId));
@@ -4622,12 +4622,12 @@ static int characterPrintToFile(const char* fileName)
                 fileWriteString("\n", stream);
 
                 // ::: Addictions :::
-                sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 656));
+                snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 656));
                 fileWriteString(title1, stream);
                 hasAddictionsHeading = true;
             }
 
-            sprintf(title1,
+            snprintf(title1, sizeof(title1),
                 "  %s",
                 getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 1004 + index));
             fileWriteString(title1, stream);
@@ -4638,12 +4638,12 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // ::: Skills ::: / ::: Kills :::
-    sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 653));
+    snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 653));
     fileWriteString(title1, stream);
 
     int killType = 0;
     for (int skill = 0; skill < SKILL_COUNT; skill++) {
-        sprintf(title1, "%s ", skillGetName(skill));
+        snprintf(title1, sizeof(title1), "%s ", skillGetName(skill));
 
         // NOTE: Uninline.
         _AddDots(title1 + strlen(title1), 16 - static_cast<int>(strlen(title1)));
@@ -4653,12 +4653,12 @@ static int characterPrintToFile(const char* fileName)
         for (; killType < KILL_TYPE_COUNT; killType++) {
             int killsCount = killsGetByType(killType);
             if (killsCount > 0) {
-                sprintf(title2, "%s ", killTypeGetName(killType));
+                snprintf(title2, sizeof(title2), "%s ", killTypeGetName(killType));
 
                 // NOTE: Uninline.
                 _AddDots(title2 + strlen(title2), 16 - static_cast<int>(strlen(title2)));
 
-                sprintf(title3,
+                snprintf(title3, sizeof(title3),
                     "  %s %.3d%%        %s %.3d\n",
                     title1,
                     skillGetValue(gDude, skill),
@@ -4670,7 +4670,7 @@ static int characterPrintToFile(const char* fileName)
         }
 
         if (!hasKillType) {
-            sprintf(title3,
+            snprintf(title3, sizeof(title3),
                 "  %s %.3d%%\n",
                 title1,
                 skillGetValue(gDude, skill));
@@ -4681,7 +4681,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // ::: Inventory :::
-    sprintf(title1, "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 654));
+    snprintf(title1, sizeof(title1), "%s\n", getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 654));
     fileWriteString(title1, stream);
 
     Inventory* inventory = &(gDude->data.inventory);
@@ -4696,7 +4696,7 @@ static int characterPrintToFile(const char* fileName)
 
             InventoryItem* inventoryItem = &(inventory->items[inventoryItemIndex]);
 
-            sprintf(title2,
+            snprintf(title2, sizeof(title2),
                 "  %sx %s",
                 _itostndn(inventoryItem->quantity, title3),
                 objectGetName(inventoryItem->item));
@@ -4718,7 +4718,7 @@ static int characterPrintToFile(const char* fileName)
     fileWriteString("\n", stream);
 
     // Total Weight:
-    sprintf(title1,
+    snprintf(title1, sizeof(title1),
         "%s %d lbs.",
         getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 655),
         objectGetInventoryWeight(gDude));
@@ -5227,7 +5227,7 @@ static void characterEditorHandleAdjustSkillButtonPressed(int keyCode)
                     if (skillAdd(gDude, gCharacterEditorCurrentSkill) == -3) {
                         soundPlayFile("iisxxxx1");
 
-                        sprintf(title, "%s:", skillGetName(gCharacterEditorCurrentSkill));
+                        snprintf(title, sizeof(title), "%s:", skillGetName(gCharacterEditorCurrentSkill));
                         // At maximum level.
                         strcpy(body1, getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 132));
                         // Unable to increment it.
@@ -5255,7 +5255,7 @@ static void characterEditorHandleAdjustSkillButtonPressed(int keyCode)
                 if (rc == 0) {
                     soundPlayFile("iisxxxx1");
 
-                    sprintf(title, "%s:", skillGetName(gCharacterEditorCurrentSkill));
+                    snprintf(title, sizeof(title), "%s:", skillGetName(gCharacterEditorCurrentSkill));
                     // At minimum level.
                     strcpy(body1, getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 134));
                     // Unable to decrement it.
@@ -5534,7 +5534,7 @@ static void characterEditorDrawKarmaFolder()
                 char reputationValue[32];
                 compat_itoa(gGameGlobalVars[GVAR_PLAYER_REPUTATION], reputationValue, 10);
 
-                sprintf(formattedText,
+                snprintf(formattedText, sizeof(formattedText),
                     "%s: %s (%s)",
                     getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, 125),
                     reputationValue,
@@ -5610,7 +5610,7 @@ static void characterEditorDrawKarmaFolder()
             }
 
             msg = getmsg(&gCharacterEditorMessageList, &gCharacterEditorMessageListItem, townReputationBaseMessageId);
-            sprintf(formattedText,
+            snprintf(formattedText, sizeof(formattedText),
                 "%s: %s",
                 cityShortName,
                 msg);
@@ -5783,7 +5783,7 @@ static void perkDialogRefreshPerks()
 
     int rank = perkGetRank(gDude, perk);
     if (rank != 0) {
-        sprintf(perkRankBuffer, "(%d)", rank);
+        snprintf(perkRankBuffer, sizeof(perkRankBuffer), "(%d)", rank);
         perkRank = perkRankBuffer;
     }
 
@@ -5936,7 +5936,7 @@ static int perkDialogShow()
 
     int rank = perkGetRank(gDude, perk);
     if (rank != 0) {
-        sprintf(perkRankBuffer, "(%d)", rank);
+        snprintf(perkRankBuffer, sizeof(perkRankBuffer), "(%d)", rank);
         perkRank = perkRankBuffer;
     }
 
@@ -6325,7 +6325,7 @@ static int perkDialogDrawPerks()
 
         if (perkGetRank(gDude, gPerkDialogOptionList[index].value) != 0) {
             char rankString[256];
-            sprintf(rankString, "(%d)", perkGetRank(gDude, gPerkDialogOptionList[index].value));
+            snprintf(rankString, sizeof(rankString), "(%d)", perkGetRank(gDude, gPerkDialogOptionList[index].value));
             fontDrawText(gPerkDialogWindowBuffer + PERK_WINDOW_WIDTH * y + 207, rankString, PERK_WINDOW_WIDTH, PERK_WINDOW_WIDTH, color);
         }
 

src/character_selector.cc

@@ -559,7 +559,7 @@ static void characterSelectorWindowFree()
 static bool characterSelectorWindowRefresh()
 {
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s.gcd", gCustomPremadeCharacterDescriptions[gCurrentPremadeCharacter].fileName);
+    snprintf(path, sizeof(path), "%s.gcd", gCustomPremadeCharacterDescriptions[gCurrentPremadeCharacter].fileName);
     premadeCharactersLocalizePath(path);
 
     if (_proto_dude_init(path) == -1) {
@@ -637,13 +637,13 @@ static bool characterSelectorWindowRenderStats()
     value = critterGetStat(gDude, STAT_STRENGTH);
     str = statGetName(STAT_STRENGTH);
 
-    sprintf(text, "%s %02d", str, value);
+    snprintf(text, sizeof(text), "%s %02d", str, value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     str = statGetValueDescription(value);
-    sprintf(text, "  %s", str);
+    snprintf(text, sizeof(text), "  %s", str);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -654,13 +654,13 @@ static bool characterSelectorWindowRenderStats()
     value = critterGetStat(gDude, STAT_PERCEPTION);
     str = statGetName(STAT_PERCEPTION);
 
-    sprintf(text, "%s %02d", str, value);
+    snprintf(text, sizeof(text), "%s %02d", str, value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     str = statGetValueDescription(value);
-    sprintf(text, "  %s", str);
+    snprintf(text, sizeof(text), "  %s", str);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -671,13 +671,13 @@ static bool characterSelectorWindowRenderStats()
     value = critterGetStat(gDude, STAT_ENDURANCE);
     str = statGetName(STAT_ENDURANCE);
 
-    sprintf(text, "%s %02d", str, value);
+    snprintf(text, sizeof(text), "%s %02d", str, value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     str = statGetValueDescription(value);
-    sprintf(text, "  %s", str);
+    snprintf(text, sizeof(text), "  %s", str);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -688,13 +688,13 @@ static bool characterSelectorWindowRenderStats()
     value = critterGetStat(gDude, STAT_CHARISMA);
     str = statGetName(STAT_CHARISMA);
 
-    sprintf(text, "%s %02d", str, value);
+    snprintf(text, sizeof(text), "%s %02d", str, value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     str = statGetValueDescription(value);
-    sprintf(text, "  %s", str);
+    snprintf(text, sizeof(text), "  %s", str);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -705,13 +705,13 @@ static bool characterSelectorWindowRenderStats()
     value = critterGetStat(gDude, STAT_INTELLIGENCE);
     str = statGetName(STAT_INTELLIGENCE);
 
-    sprintf(text, "%s %02d", str, value);
+    snprintf(text, sizeof(text), "%s %02d", str, value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     str = statGetValueDescription(value);
-    sprintf(text, "  %s", str);
+    snprintf(text, sizeof(text), "  %s", str);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -722,13 +722,13 @@ static bool characterSelectorWindowRenderStats()
     value = critterGetStat(gDude, STAT_AGILITY);
     str = statGetName(STAT_AGILITY);
 
-    sprintf(text, "%s %02d", str, value);
+    snprintf(text, sizeof(text), "%s %02d", str, value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     str = statGetValueDescription(value);
-    sprintf(text, "  %s", str);
+    snprintf(text, sizeof(text), "  %s", str);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -739,13 +739,13 @@ static bool characterSelectorWindowRenderStats()
     value = critterGetStat(gDude, STAT_LUCK);
     str = statGetName(STAT_LUCK);
 
-    sprintf(text, "%s %02d", str, value);
+    snprintf(text, sizeof(text), "%s %02d", str, value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     str = statGetValueDescription(value);
-    sprintf(text, "  %s", str);
+    snprintf(text, sizeof(text), "  %s", str);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_PRIMARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -765,7 +765,7 @@ static bool characterSelectorWindowRenderStats()
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     value = critterGetStat(gDude, STAT_MAXIMUM_HIT_POINTS);
-    sprintf(text, " %d/%d", critterGetHitPoints(gDude), value);
+    snprintf(text, sizeof(text), " %d/%d", critterGetHitPoints(gDude), value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -780,7 +780,7 @@ static bool characterSelectorWindowRenderStats()
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     value = critterGetStat(gDude, STAT_ARMOR_CLASS);
-    sprintf(text, " %d", value);
+    snprintf(text, sizeof(text), " %d", value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -798,7 +798,7 @@ static bool characterSelectorWindowRenderStats()
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     value = critterGetStat(gDude, STAT_MAXIMUM_ACTION_POINTS);
-    sprintf(text, " %d", value);
+    snprintf(text, sizeof(text), " %d", value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -813,7 +813,7 @@ static bool characterSelectorWindowRenderStats()
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
     value = critterGetStat(gDude, STAT_ARMOR_CLASS);
-    sprintf(text, " %d", value);
+    snprintf(text, sizeof(text), " %d", value);
 
     length = fontGetStringWidth(text);
     fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -834,7 +834,7 @@ static bool characterSelectorWindowRenderStats()
         fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X - length, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
 
         value = skillGetValue(gDude, skills[index]);
-        sprintf(text, " %d%%", value);
+        snprintf(text, sizeof(text), " %d%%", value);
 
         length = fontGetStringWidth(text);
         fontDrawText(gCharacterSelectorWindowBuffer + CS_WINDOW_WIDTH * y + CS_WINDOW_SECONDARY_STAT_MID_X, text, length, CS_WINDOW_WIDTH, _colorTable[992]);
@@ -866,7 +866,7 @@ static bool characterSelectorWindowRenderBio()
     fontSetCurrent(101);
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s.bio", gCustomPremadeCharacterDescriptions[gCurrentPremadeCharacter].fileName);
+    snprintf(path, sizeof(path), "%s.bio", gCustomPremadeCharacterDescriptions[gCurrentPremadeCharacter].fileName);
     premadeCharactersLocalizePath(path);
 
     File* stream = fileOpen(path, "rt");
@@ -938,7 +938,7 @@ void premadeCharactersInit()
                 continue;
             }
 
-            sprintf(gCustomPremadeCharacterDescriptions[index].fileName, "premade\\%s", fileNamesString);
+            snprintf(gCustomPremadeCharacterDescriptions[index].fileName, sizeof(gCustomPremadeCharacterDescriptions[index].fileName), "premade\\%s", fileNamesString);
 
             if (pch != NULL) {
                 *pch = ',';

src/combat.cc

@@ -120,7 +120,7 @@ static void attackComputeDamage(Attack* attack, int ammoQuantity, int a3);
 static void _check_for_death(Object* a1, int a2, int* a3);
 static void _set_new_results(Object* a1, int a2);
 static void _damage_object(Object* a1, int damage, bool animated, int a4, Object* a5);
-static void combatCopyDamageAmountDescription(char* dest, Object* critter_obj, int damage);
+static void combatCopyDamageAmountDescription(char* dest, size_t size, Object* critter_obj, int damage);
 static void combatAddDamageFlagsDescription(char* a1, int flags, Object* a3);
 static void _combat_standup(Object* a1);
 static void _print_tohit(unsigned char* dest, int dest_pitch, int a3);
@@ -2016,7 +2016,7 @@ int combatInit()
         return -1;
     }
 
-    sprintf(path, "%s%s", asc_5186C8, "combat.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "combat.msg");
 
     if (!messageListLoad(&gCombatMessageList, path)) {
         return -1;
@@ -2899,7 +2899,7 @@ void _combat_give_exps(int exp_points)
         return;
     }
 
-    sprintf(text, v7.text, v9.text, xpGained);
+    snprintf(text, sizeof(text), v7.text, v9.text, xpGained);
     displayMonitorAddMessage(text);
 }
 
@@ -4951,7 +4951,7 @@ void _combat_display(Attack* attack)
                 // 708 (female) - Oops! %s was hit instead of you!
                 messageListItem.num = baseMessageId + 8;
                 if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
-                    sprintf(text, messageListItem.text, mainCritterName);
+                    snprintf(text, sizeof(text), messageListItem.text, mainCritterName);
                 }
             } else {
                 // 509 (male) - Oops! %s were hit instead of %s!
@@ -4959,7 +4959,7 @@ void _combat_display(Attack* attack)
                 const char* name = objectGetName(attack->oops);
                 messageListItem.num = baseMessageId + 9;
                 if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
-                    sprintf(text, messageListItem.text, mainCritterName, name);
+                    snprintf(text, sizeof(text), messageListItem.text, mainCritterName, name);
                 }
             }
         } else {
@@ -4973,7 +4973,7 @@ void _combat_display(Attack* attack)
                 }
 
                 if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
-                    sprintf(text, messageListItem.text, you);
+                    snprintf(text, sizeof(text), messageListItem.text, you);
                 }
             } else {
                 const char* name = objectGetName(attack->attacker);
@@ -4986,7 +4986,7 @@ void _combat_display(Attack* attack)
                 }
 
                 if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
-                    sprintf(text, messageListItem.text, name);
+                    snprintf(text, sizeof(text), messageListItem.text, name);
                 }
             }
         }
@@ -5021,13 +5021,13 @@ void _combat_display(Attack* attack)
 
                         if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
                             if (attack->defenderDamage <= 1) {
-                                sprintf(text, messageListItem.text, mainCritterName);
+                                snprintf(text, sizeof(text), messageListItem.text, mainCritterName);
                             } else {
-                                sprintf(text, messageListItem.text, mainCritterName, attack->defenderDamage);
+                                snprintf(text, sizeof(text), messageListItem.text, mainCritterName, attack->defenderDamage);
                             }
                         }
                     } else {
-                        combatCopyDamageAmountDescription(text, v21, attack->defenderDamage);
+                        combatCopyDamageAmountDescription(text, sizeof(text), v21, attack->defenderDamage);
                     }
                 } else {
                     const char* hitLocationName = hitLocationGetName(v21, attack->defenderHitLocation);
@@ -5066,9 +5066,9 @@ void _combat_display(Attack* attack)
 
                         if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
                             if (attack->defenderDamage <= 1) {
-                                sprintf(text, messageListItem.text, mainCritterName, hitLocationName);
+                                snprintf(text, sizeof(text), messageListItem.text, mainCritterName, hitLocationName);
                             } else {
-                                sprintf(text, messageListItem.text, mainCritterName, hitLocationName, attack->defenderDamage);
+                                snprintf(text, sizeof(text), messageListItem.text, mainCritterName, hitLocationName, attack->defenderDamage);
                             }
                         }
                     }
@@ -5103,7 +5103,7 @@ void _combat_display(Attack* attack)
                         }
 
                         if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
-                            sprintf(text, "%s %s", mainCritterName, messageListItem.text);
+                            snprintf(text, sizeof(text), "%s %s", mainCritterName, messageListItem.text);
                         }
                     }
                 } else {
@@ -5141,9 +5141,9 @@ void _combat_display(Attack* attack)
 
             if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
                 if (attack->attackerDamage <= 1) {
-                    sprintf(text, messageListItem.text, mainCritterName);
+                    snprintf(text, sizeof(text), messageListItem.text, mainCritterName);
                 } else {
-                    sprintf(text, messageListItem.text, mainCritterName, attack->attackerDamage);
+                    snprintf(text, sizeof(text), messageListItem.text, mainCritterName, attack->attackerDamage);
                 }
             }
 
@@ -5156,7 +5156,7 @@ void _combat_display(Attack* attack)
 
         if ((attack->attackerFlags & DAM_HIT) != 0 || (attack->attackerFlags & DAM_CRITICAL) == 0) {
             if (attack->attackerDamage > 0) {
-                combatCopyDamageAmountDescription(text, attack->attacker, attack->attackerDamage);
+                combatCopyDamageAmountDescription(text, sizeof(text), attack->attacker, attack->attackerDamage);
                 combatAddDamageFlagsDescription(text, attack->attackerFlags, attack->attacker);
                 strcat(text, ".");
                 displayMonitorAddMessage(text);
@@ -5167,7 +5167,7 @@ void _combat_display(Attack* attack)
     for (int index = 0; index < attack->extrasLength; index++) {
         Object* critter = attack->extras[index];
         if ((critter->data.critter.combat.results & DAM_DEAD) == 0) {
-            combatCopyDamageAmountDescription(text, critter, attack->extrasDamage[index]);
+            combatCopyDamageAmountDescription(text, sizeof(text), critter, attack->extrasDamage[index]);
             combatAddDamageFlagsDescription(text, attack->extrasFlags[index], critter);
             strcat(text, ".");
 
@@ -5177,7 +5177,7 @@ void _combat_display(Attack* attack)
 }
 
 // 0x425A9C
-static void combatCopyDamageAmountDescription(char* dest, Object* critter, int damage)
+static void combatCopyDamageAmountDescription(char* dest, size_t size, Object* critter, int damage)
 {
     MessageListItem messageListItem;
     char text[40];
@@ -5228,9 +5228,9 @@ static void combatCopyDamageAmountDescription(char* dest, Object* critter, int d
     messageListItem.num = messageId;
     if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
         if (damage <= 1) {
-            sprintf(dest, messageListItem.text, name);
+            snprintf(dest, size, messageListItem.text, name);
         } else {
-            sprintf(dest, messageListItem.text, name, damage);
+            snprintf(dest, size, messageListItem.text, name, damage);
         }
     }
 }
@@ -5746,7 +5746,7 @@ void _combat_attack_this(Object* a1)
         messageListItem.num = 100; // You need %d action points.
         if (messageListGetItem(&gCombatMessageList, &messageListItem)) {
             int actionPointsRequired = weaponGetActionPointCost(gDude, hitMode, aiming);
-            sprintf(formattedText, messageListItem.text, actionPointsRequired);
+            snprintf(formattedText, sizeof(formattedText), messageListItem.text, actionPointsRequired);
             displayMonitorAddMessage(formattedText);
         }
         return;
@@ -6172,7 +6172,7 @@ static void criticalsInit()
                     for (int killType = 0; killType < KILL_TYPE_COUNT + 1; killType++) {
                         for (int hitLocation = 0; hitLocation < HIT_LOCATION_COUNT; hitLocation++) {
                             for (int effect = 0; effect < CRTICIAL_EFFECT_COUNT; effect++) {
-                                sprintf(sectionKey, "c_%02d_%d_%d", killType, hitLocation, effect);
+                                snprintf(sectionKey, sizeof(sectionKey), "c_%02d_%d_%d", killType, hitLocation, effect);
 
                                 // Update player kill type if needed.
                                 int newKillType = killType == KILL_TYPE_COUNT ? SFALL_KILL_TYPE_COUNT : killType;
@@ -6192,7 +6192,7 @@ static void criticalsInit()
 
                     // Read Sfall kill types (38) plus one for the player.
                     for (int killType = 0; killType < SFALL_KILL_TYPE_COUNT + 1; killType++) {
-                        sprintf(ktSectionKey, "c_%02d", killType);
+                        snprintf(ktSectionKey, sizeof(ktSectionKey), "c_%02d", killType);
 
                         int enabled = 0;
                         configGetInt(&criticalsConfig, ktSectionKey, "Enabled", &enabled);
@@ -6204,7 +6204,7 @@ static void criticalsInit()
                             if (enabled < 2) {
                                 bool hitLocationChanged = false;
 
-                                sprintf(key, "Part_%d", hitLocation);
+                                snprintf(key, sizeof(key), "Part_%d", hitLocation);
                                 configGetBool(&criticalsConfig, ktSectionKey, key, &hitLocationChanged);
 
                                 if (!hitLocationChanged) {
@@ -6212,12 +6212,12 @@ static void criticalsInit()
                                 }
                             }
 
-                            sprintf(hitLocationSectionKey, "c_%02d_%d", killType, hitLocation);
+                            snprintf(hitLocationSectionKey, sizeof(hitLocationSectionKey), "c_%02d_%d", killType, hitLocation);
 
                             for (int effect = 0; effect < CRTICIAL_EFFECT_COUNT; effect++) {
                                 for (int dataMember = 0; dataMember < CRIT_DATA_MEMBER_COUNT; dataMember++) {
                                     int value = criticalsGetValue(killType, hitLocation, effect, dataMember);
-                                    sprintf(key, "e%d_%s", effect, gCritDataMemberKeys[dataMember]);
+                                    snprintf(key, sizeof(key), "e%d_%s", effect, gCritDataMemberKeys[dataMember]);
                                     if (configGetInt(&criticalsConfig, hitLocationSectionKey, key, &value)) {
                                         criticalsSetValue(killType, hitLocation, effect, dataMember, value);
                                     }
@@ -6517,7 +6517,7 @@ static void unarmedInitCustom()
                 }
 
                 UnarmedHitDescription* hitDescription = &(gUnarmedHitDescriptions[hitMode]);
-                sprintf(section, "%d", hitMode);
+                snprintf(section, sizeof(section), "%d", hitMode);
 
                 configGetInt(&unarmedConfig, section, "ReqLevel", &(hitDescription->requiredLevel));
                 configGetInt(&unarmedConfig, section, "SkillLevel", &(hitDescription->requiredSkill));
@@ -6530,7 +6530,7 @@ static void unarmedInitCustom()
                 configGetBool(&unarmedConfig, section, "Secondary", &(hitDescription->isSecondary));
 
                 for (int stat = 0; stat < PRIMARY_STAT_COUNT; stat++) {
-                    sprintf(statKey, "Stat%d", stat);
+                    snprintf(statKey, sizeof(statKey), "Stat%d", stat);
                     configGetInt(&unarmedConfig, section, statKey, &(hitDescription->requiredStats[stat]));
                 }
             }

src/combat_ai.cc

@@ -923,9 +923,9 @@ static int _ai_magic_hands(Object* critter, Object* item, int num)
             char text[200];
             if (item != NULL) {
                 const char* itemName = objectGetName(item);
-                sprintf(text, "%s %s %s.", critterName, messageListItem.text, itemName);
+                snprintf(text, sizeof(text), "%s %s %s.", critterName, messageListItem.text, itemName);
             } else {
-                sprintf(text, "%s %s.", critterName, messageListItem.text);
+                snprintf(text, sizeof(text), "%s %s.", critterName, messageListItem.text);
             }
 
             displayMonitorAddMessage(text);
@@ -3423,7 +3423,7 @@ static int aiMessageListInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "combatai.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "combatai.msg");
 
     if (!messageListLoad(&gCombatAiMessageList, path)) {
         return -1;

src/config.cc

@@ -537,7 +537,7 @@ bool configGetDouble(Config* config, const char* sectionKey, const char* key, do
 bool configSetDouble(Config* config, const char* sectionKey, const char* key, double value)
 {
     char stringValue[32];
-    sprintf(stringValue, "%.6f", value);
+    snprintf(stringValue, sizeof(stringValue), "%.6f", value);
 
     return configSetString(config, sectionKey, key, stringValue);
 }

src/credits.cc

@@ -65,7 +65,7 @@ void creditsOpen(const char* filePath, int backgroundFid, bool useReversedStyle)
     soundContinueAll();
 
     char localizedPath[COMPAT_MAX_PATH];
-    if (_message_make_path(localizedPath, filePath)) {
+    if (_message_make_path(localizedPath, sizeof(localizedPath), filePath)) {
         gCreditsFile = fileOpen(localizedPath, "rt");
         if (gCreditsFile != NULL) {
             soundContinueAll();

src/critter.cc

@@ -171,7 +171,7 @@ int critterInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%sscrname.msg", asc_5186C8);
+    snprintf(path, sizeof(path), "%sscrname.msg", asc_5186C8);
 
     if (!messageListLoad(&gCritterMessageList, path)) {
         debugPrint("\nError: Loading critter name message file!");

src/db.cc

@@ -655,7 +655,7 @@ int fileNameListInit(const char* pattern, char*** fileNameListPtr, int a3, int a
                 // NOTE: Quick and dirty fix to buffer overflow. See RE to
                 // understand the problem.
                 char path[COMPAT_MAX_PATH];
-                sprintf(path, "%s%s", fileName, extension);
+                snprintf(path, sizeof(path), "%s%s", fileName, extension);
                 free(xlist->fileNames[length]);
                 xlist->fileNames[length] = compat_strdup(path);
                 length++;

src/dbox.cc

@@ -265,7 +265,7 @@ int showDialogBox(const char* title, const char** body, int bodyLength, int x, i
         }
 
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%s%s", asc_5186C8, "DBOX.MSG");
+        snprintf(path, sizeof(path), "%s%s", asc_5186C8, "DBOX.MSG");
 
         if (!messageListLoad(&messageList, path)) {
             fontSetCurrent(savedFont);
@@ -372,7 +372,7 @@ int showDialogBox(const char* title, const char** body, int bodyLength, int x, i
             }
 
             char path[COMPAT_MAX_PATH];
-            sprintf(path, "%s%s", asc_5186C8, "DBOX.MSG");
+            snprintf(path, sizeof(path), "%s%s", asc_5186C8, "DBOX.MSG");
 
             if (!messageListLoad(&messageList, path)) {
                 fontSetCurrent(savedFont);
@@ -589,7 +589,7 @@ int showLoadFileDialog(char* title, char** fileList, char* dest, int fileListLen
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "DBOX.MSG");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "DBOX.MSG");
 
     if (!messageListLoad(&messageList, path)) {
         windowDestroy(win);
@@ -955,7 +955,7 @@ int showSaveFileDialog(char* title, char** fileList, char* dest, int fileListLen
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "DBOX.MSG");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "DBOX.MSG");
 
     if (!messageListLoad(&messageList, path)) {
         windowDestroy(win);

src/debug.cc

@@ -140,7 +140,7 @@ int debugPrint(const char* format, ...)
 
     if (gDebugPrintProc != NULL) {
         char string[260];
-        vsprintf(string, format, args);
+        vsnprintf(string, sizeof(string), format, args);
 
         rc = gDebugPrintProc(string);
     } else {

src/elevator.cc

@@ -661,7 +661,7 @@ void elevatorsInit()
                 char sectionKey[4];
                 char key[32];
                 for (int index = 0; index < ELEVATORS_MAX; index++) {
-                    sprintf(sectionKey, "%d", index);
+                    snprintf(sectionKey, sizeof(sectionKey), "%d", index);
 
                     if (index >= ELEVATOR_COUNT) {
                         int levels = 0;
@@ -673,13 +673,13 @@ void elevatorsInit()
                     configGetInt(&elevatorsConfig, sectionKey, "ButtonsFrm", &(gElevatorBackgrounds[index].panelFrmId));
 
                     for (int level = 0; level < ELEVATOR_LEVEL_MAX; level++) {
-                        sprintf(key, "ID%d", level + 1);
+                        snprintf(key, sizeof(key), "ID%d", level + 1);
                         configGetInt(&elevatorsConfig, sectionKey, key, &(gElevatorDescriptions[index][level].map));
 
-                        sprintf(key, "Elevation%d", level + 1);
+                        snprintf(key, sizeof(key), "Elevation%d", level + 1);
                         configGetInt(&elevatorsConfig, sectionKey, key, &(gElevatorDescriptions[index][level].elevation));
 
-                        sprintf(key, "Tile%d", level + 1);
+                        snprintf(key, sizeof(key), "Tile%d", level + 1);
                         configGetInt(&elevatorsConfig, sectionKey, key, &(gElevatorDescriptions[index][level].tile));
                     }
                 }
@@ -689,7 +689,7 @@ void elevatorsInit()
                 // value is then used in the certain places to remap from
                 // requested elevator to the new one.
                 for (int index = 0; index < ELEVATORS_MAX; index++) {
-                    sprintf(sectionKey, "%d", index);
+                    snprintf(sectionKey, sizeof(sectionKey), "%d", index);
 
                     int type;
                     if (configGetInt(&elevatorsConfig, sectionKey, "Image", &type)) {

src/endgame.cc

@@ -581,7 +581,7 @@ static int endgameEndingSlideshowWindowInit()
         return 0;
     }
 
-    sprintf(gEndgameEndingSubtitlesLocalizedPath, "text\\%s\\cuts\\", settings.system.language.c_str());
+    snprintf(gEndgameEndingSubtitlesLocalizedPath, sizeof(gEndgameEndingSubtitlesLocalizedPath), "text\\%s\\cuts\\", settings.system.language.c_str());
 
     gEndgameEndingSubtitles = (char**)internal_malloc(sizeof(*gEndgameEndingSubtitles) * ENDGAME_ENDING_MAX_SUBTITLES);
     if (gEndgameEndingSubtitles == NULL) {
@@ -652,7 +652,7 @@ static void endgameEndingVoiceOverInit(const char* fileBaseName)
     gEndgameEndingVoiceOverSubtitlesLoaded = false;
 
     // Build speech file path.
-    sprintf(path, "%s%s", "narrator\\", fileBaseName);
+    snprintf(path, sizeof(path), "%s%s", "narrator\\", fileBaseName);
 
     if (speechLoad(path, 10, 14, 15) != -1) {
         gEndgameEndingVoiceOverSpeechLoaded = true;
@@ -660,7 +660,7 @@ static void endgameEndingVoiceOverInit(const char* fileBaseName)
 
     if (gEndgameEndingSubtitlesEnabled) {
         // Build subtitles file path.
-        sprintf(path, "%s%s.txt", gEndgameEndingSubtitlesLocalizedPath, fileBaseName);
+        snprintf(path, sizeof(path), "%s%s.txt", gEndgameEndingSubtitlesLocalizedPath, fileBaseName);
 
         if (endgameEndingSubtitlesLoad(path) != 0) {
             return;
@@ -730,7 +730,7 @@ static void endgameEndingLoadPalette(int type, int id)
 
     if (strlen(fileName) <= 8) {
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%s\\%s.pal", "art\\intrface", fileName);
+        snprintf(path, sizeof(path), "%s\\%s.pal", "art\\intrface", fileName);
         colorPaletteLoad(path);
     }
 }

src/font_manager.cc

@@ -119,7 +119,7 @@ static int interfaceFontLoad(int font_index)
     InterfaceFontDescriptor* fontDescriptor = &(gInterfaceFontDescriptors[font_index]);
 
     char path[56];
-    sprintf(path, "font%d.aaf", font_index);
+    snprintf(path, sizeof(path), "font%d.aaf", font_index);
 
     File* stream = fileOpen(path, "rb");
     if (stream == NULL) {

src/game.cc

@@ -319,7 +319,7 @@ int gameInitWithOptions(const char* windowTitle, bool isMapper, int font, int a4
 
     debugPrint(">message_init\t");
 
-    sprintf(path, "%s%s", asc_5186C8, "misc.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "misc.msg");
 
     if (!messageListLoad(&gMiscMessageList, path)) {
         debugPrint("Failed on message_load\n");
@@ -825,7 +825,7 @@ int gameHandleKey(int eventCode, bool isInCombatMode)
             MessageList messageList;
             if (messageListInit(&messageList)) {
                 char path[COMPAT_MAX_PATH];
-                sprintf(path, "%s%s", asc_5186C8, "editor.msg");
+                snprintf(path, sizeof(path), "%s%s", asc_5186C8, "editor.msg");
 
                 if (messageListLoad(&messageList, path)) {
                     MessageListItem messageListItem;
@@ -834,7 +834,7 @@ int gameHandleKey(int eventCode, bool isInCombatMode)
                         char* time = gameTimeGetTimeString();
 
                         char date[128];
-                        sprintf(date, "%s: %d/%d %s", messageListItem.text, day, year, time);
+                        snprintf(date, sizeof(date), "%s: %d/%d %s", messageListItem.text, day, year, time);
 
                         displayMonitorAddMessage(date);
                     }
@@ -903,7 +903,7 @@ int gameHandleKey(int eventCode, bool isInCombatMode)
             soundPlayFile("ib1p1xx1");
 
             char version[VERSION_MAX];
-            versionGetVersion(version);
+            versionGetVersion(version, sizeof(version));
             displayMonitorAddMessage(version);
             displayMonitorAddMessage(_aDec11199816543);
         }
@@ -987,9 +987,9 @@ int gameSetGlobalVar(int var, int value)
             if (diff != 0) {
                 char formattedMessage[80];
                 if (diff > 0) {
-                    sprintf(formattedMessage, "You gained %d karma.", diff);
+                    snprintf(formattedMessage, sizeof(formattedMessage), "You gained %d karma.", diff);
                 } else {
-                    sprintf(formattedMessage, "You lost %d karma.", -diff);
+                    snprintf(formattedMessage, sizeof(formattedMessage), "You lost %d karma.", -diff);
                 }
                 displayMonitorAddMessage(formattedMessage);
             }
@@ -1317,7 +1317,7 @@ static int gameDbInit()
     }
 
     for (patch_index = 0; patch_index < 1000; patch_index++) {
-        sprintf(filename, "patch%03d.dat", patch_index);
+        snprintf(filename, sizeof(filename), "patch%03d.dat", patch_index);
 
         if (access(filename, 0) == 0) {
             dbOpen(filename, 0, NULL, 1);
@@ -1337,15 +1337,15 @@ static void showSplash()
     char path[64];
     const char* language = settings.system.language.c_str();
     if (compat_stricmp(language, ENGLISH) != 0) {
-        sprintf(path, "art\\%s\\splash\\", language);
+        snprintf(path, sizeof(path), "art\\%s\\splash\\", language);
     } else {
-        sprintf(path, "art\\splash\\");
+        snprintf(path, sizeof(path), "art\\splash\\");
     }
 
     File* stream;
     for (int index = 0; index < SPLASH_COUNT; index++) {
         char filePath[64];
-        sprintf(filePath, "%ssplash%d.rix", path, splash);
+        snprintf(filePath, sizeof(filePath), "%ssplash%d.rix", path, splash);
         stream = fileOpen(filePath, "rb");
         if (stream != NULL) {
             break;

src/game_config.cc

@@ -125,7 +125,7 @@ bool gameConfigInit(bool isMapper, int argc, char** argv)
     char* ch = strrchr(executable, '\\');
     if (ch != NULL) {
         *ch = '\0';
-        sprintf(gGameConfigFilePath, "%s\\%s", executable, GAME_CONFIG_FILE_NAME);
+        snprintf(gGameConfigFilePath, sizeof(gGameConfigFilePath), "%s\\%s", executable, GAME_CONFIG_FILE_NAME);
         *ch = '\\';
     } else {
         strcpy(gGameConfigFilePath, GAME_CONFIG_FILE_NAME);

src/game_dialog.cc

@@ -1540,7 +1540,7 @@ void gameDialogReviewWindowUpdate(int win, int origin)
         GameDialogReviewEntry* dialogReviewEntry = &(gDialogReviewEntries[index]);
 
         char name[60];
-        sprintf(name, "%s:", objectGetName(gGameDialogSpeaker));
+        snprintf(name, sizeof(name), "%s:", objectGetName(gGameDialogSpeaker));
         windowDrawText(win, name, 180, 88, y, _colorTable[992] | 0x2000000);
         entriesRect.top += v20;
 
@@ -1573,7 +1573,7 @@ void gameDialogReviewWindowUpdate(int win, int origin)
         }
 
         if (dialogReviewEntry->optionMessageListId != -3) {
-            sprintf(name, "%s:", objectGetName(gDude));
+            snprintf(name, sizeof(name), "%s:", objectGetName(gDude));
             windowDrawText(win, name, 180, 88, y, _colorTable[21140] | 0x2000000);
             entriesRect.top += v20;
 
@@ -1836,7 +1836,7 @@ void gameDialogRenderCaps()
 
     int caps = itemGetTotalCaps(gDude);
     char text[20];
-    sprintf(text, "$%d", caps);
+    snprintf(text, sizeof(text), "$%d", caps);
 
     int width = fontGetStringWidth(text);
     if (width > 60) {
@@ -2485,7 +2485,7 @@ void _gdSetupFidget(int headFrmId, int reaction)
             debugPrint("failure!\n");
 
             char stats[200];
-            cachePrintStats(&gArtCache, stats);
+            cachePrintStats(&gArtCache, stats, sizeof(stats));
             debugPrint("%s", stats);
         }
     }
@@ -2538,7 +2538,7 @@ void _gdSetupFidget(int headFrmId, int reaction)
         debugPrint("failure!\n");
 
         char stats[200];
-        cachePrintStats(&gArtCache, stats);
+        cachePrintStats(&gArtCache, stats, sizeof(stats));
         debugPrint("%s", stats);
     }
 
@@ -3572,13 +3572,13 @@ void partyMemberControlWindowUpdate()
     // Render item in right hand.
     Object* item2 = critterGetItem2(gGameDialogSpeaker);
     text = item2 != NULL ? itemGetName(item2) : getmsg(&gProtoMessageList, &messageListItem, 10);
-    sprintf(formattedText, "%s", text);
+    snprintf(formattedText, sizeof(formattedText), "%s", text);
     fontDrawText(windowBuffer + windowWidth * 20 + 112, formattedText, 110, windowWidth, _colorTable[992]);
 
     // Render armor.
     Object* armor = critterGetArmor(gGameDialogSpeaker);
     text = armor != NULL ? itemGetName(armor) : getmsg(&gProtoMessageList, &messageListItem, 10);
-    sprintf(formattedText, "%s", text);
+    snprintf(formattedText, sizeof(formattedText), "%s", text);
     fontDrawText(windowBuffer + windowWidth * 49 + 112, formattedText, 110, windowWidth, _colorTable[992]);
 
     // Render preview.
@@ -3596,24 +3596,24 @@ void partyMemberControlWindowUpdate()
     // Render hit points.
     int maximumHitPoints = critterGetStat(gGameDialogSpeaker, STAT_MAXIMUM_HIT_POINTS);
     int hitPoints = critterGetStat(gGameDialogSpeaker, STAT_CURRENT_HIT_POINTS);
-    sprintf(formattedText, "%d/%d", hitPoints, maximumHitPoints);
+    snprintf(formattedText, sizeof(formattedText), "%d/%d", hitPoints, maximumHitPoints);
     fontDrawText(windowBuffer + windowWidth * 96 + 240, formattedText, 115, windowWidth, _colorTable[992]);
 
     // Render best skill.
     int bestSkill = partyMemberGetBestSkill(gGameDialogSpeaker);
     text = skillGetName(bestSkill);
-    sprintf(formattedText, "%s", text);
+    snprintf(formattedText, sizeof(formattedText), "%s", text);
     fontDrawText(windowBuffer + windowWidth * 113 + 240, formattedText, 115, windowWidth, _colorTable[992]);
 
     // Render weight summary.
     int inventoryWeight = objectGetInventoryWeight(gGameDialogSpeaker);
     int carryWeight = critterGetStat(gGameDialogSpeaker, STAT_CARRY_WEIGHT);
-    sprintf(formattedText, "%d/%d ", inventoryWeight, carryWeight);
+    snprintf(formattedText, sizeof(formattedText), "%d/%d ", inventoryWeight, carryWeight);
     fontDrawText(windowBuffer + windowWidth * 131 + 240, formattedText, 115, windowWidth, critterIsEncumbered(gGameDialogSpeaker) ? _colorTable[31744] : _colorTable[992]);
 
     // Render melee damage.
     int meleeDamage = critterGetStat(gGameDialogSpeaker, STAT_MELEE_DAMAGE);
-    sprintf(formattedText, "%d", meleeDamage);
+    snprintf(formattedText, sizeof(formattedText), "%d", meleeDamage);
     fontDrawText(windowBuffer + windowWidth * 148 + 240, formattedText, 115, windowWidth, _colorTable[992]);
 
     int actionPoints;
@@ -3623,7 +3623,7 @@ void partyMemberControlWindowUpdate()
         actionPoints = critterGetStat(gGameDialogSpeaker, STAT_MAXIMUM_ACTION_POINTS);
     }
     int maximumActionPoints = critterGetStat(gGameDialogSpeaker, STAT_MAXIMUM_ACTION_POINTS);
-    sprintf(formattedText, "%d/%d ", actionPoints, maximumActionPoints);
+    snprintf(formattedText, sizeof(formattedText), "%d/%d ", actionPoints, maximumActionPoints);
     fontDrawText(windowBuffer + windowWidth * 167 + 240, formattedText, 115, windowWidth, _colorTable[992]);
 
     fontSetCurrent(oldFont);

src/game_mouse.cc

@@ -750,7 +750,7 @@ void gameMouseRefresh()
                     int accuracy;
                     char formattedAccuracy[8];
                     if (_combat_to_hit(pointedObject, &accuracy)) {
-                        sprintf(formattedAccuracy, "%d%%", accuracy);
+                        snprintf(formattedAccuracy, sizeof(formattedAccuracy), "%d%%", accuracy);
 
                         if (pointedObjectIsCritter) {
                             if (pointedObject->data.critter.combat.team != 0) {
@@ -762,7 +762,7 @@ void gameMouseRefresh()
                             color = _colorTable[17969];
                         }
                     } else {
-                        sprintf(formattedAccuracy, " %c ", 'X');
+                        snprintf(formattedAccuracy, sizeof(formattedAccuracy), " %c ", 'X');
 
                         if (pointedObjectIsCritter) {
                             if (pointedObject->data.critter.combat.team != 0) {
@@ -817,15 +817,15 @@ void gameMouseRefresh()
                 }
 
                 if (v8 <= gDude->data.critter.combat.ap) {
-                    sprintf(formattedActionPoints, "%d", v8);
+                    snprintf(formattedActionPoints, sizeof(formattedActionPoints), "%d", v8);
                     color = _colorTable[32767];
                 } else {
-                    sprintf(formattedActionPoints, "%c", 'X');
+                    snprintf(formattedActionPoints, sizeof(formattedActionPoints), "%c", 'X');
                     color = _colorTable[31744];
                 }
             }
         } else {
-            sprintf(formattedActionPoints, "%c", 'X');
+            snprintf(formattedActionPoints, sizeof(formattedActionPoints), "%c", 'X');
             color = _colorTable[31744];
         }
 

src/game_movie.cc

@@ -149,12 +149,12 @@ int gameMoviePlay(int movie, int flags)
     bool movieFound = false;
 
     if (compat_stricmp(language, ENGLISH) != 0) {
-        sprintf(movieFilePath, "art\\%s\\cuts\\%s", language, gMovieFileNames[movie]);
+        snprintf(movieFilePath, sizeof(movieFilePath), "art\\%s\\cuts\\%s", language, gMovieFileNames[movie]);
         movieFound = dbGetFileSize(movieFilePath, &movieFileSize) == 0;
     }
 
     if (!movieFound) {
-        sprintf(movieFilePath, "art\\cuts\\%s", gMovieFileNames[movie]);
+        snprintf(movieFilePath, sizeof(movieFilePath), "art\\cuts\\%s", gMovieFileNames[movie]);
         movieFound = dbGetFileSize(movieFilePath, &movieFileSize) == 0;
     }
 
@@ -336,7 +336,7 @@ static char* gameMovieBuildSubtitlesFilePath(char* movieFilePath)
         path = separator + 1;
     }
 
-    sprintf(gGameMovieSubtitlesFilePath, "text\\%s\\cuts\\%s", settings.system.language.c_str(), path);
+    snprintf(gGameMovieSubtitlesFilePath, sizeof(gGameMovieSubtitlesFilePath), "text\\%s\\cuts\\%s", settings.system.language.c_str(), path);
 
     char* pch = strrchr(gGameMovieSubtitlesFilePath, '.');
     if (*pch != '\0') {

src/game_sound.cc

@@ -1099,7 +1099,7 @@ Sound* soundEffectLoad(const char* name, Object* object)
     ++_gsound_active_effect_counter;
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s%s", _sound_sfx_path, name, ".ACM");
+    snprintf(path, sizeof(path), "%s%s%s", _sound_sfx_path, name, ".ACM");
 
     if (soundLoad(sound, path) == 0) {
         if (gGameSoundDebugEnabled) {
@@ -1122,7 +1122,7 @@ Sound* soundEffectLoad(const char* name, Object* object)
                 }
             }
 
-            sprintf(path, "%sH%cXXXX%s%s", _sound_sfx_path, v9, name + 6, ".ACM");
+            snprintf(path, sizeof(path), "%sH%cXXXX%s%s", _sound_sfx_path, v9, name + 6, ".ACM");
 
             if (gGameSoundDebugEnabled) {
                 debugPrint("tyring %s ", path + strlen(_sound_sfx_path));
@@ -1137,7 +1137,7 @@ Sound* soundEffectLoad(const char* name, Object* object)
             }
 
             if (v9 == 'F') {
-                sprintf(path, "%sHMXXXX%s%s", _sound_sfx_path, name + 6, ".ACM");
+                snprintf(path, sizeof(path), "%sHMXXXX%s%s", _sound_sfx_path, name + 6, ".ACM");
 
                 if (gGameSoundDebugEnabled) {
                     debugPrint("tyring %s ", path + strlen(_sound_sfx_path));
@@ -1155,7 +1155,7 @@ Sound* soundEffectLoad(const char* name, Object* object)
     }
 
     if (strncmp(name, "MALIEU", 6) == 0 || strncmp(name, "MAMTN2", 6) == 0) {
-        sprintf(path, "%sMAMTNT%s%s", _sound_sfx_path, name + 6, ".ACM");
+        snprintf(path, sizeof(path), "%sMAMTNT%s%s", _sound_sfx_path, name + 6, ".ACM");
 
         if (gGameSoundDebugEnabled) {
             debugPrint("tyring %s ", path + strlen(_sound_sfx_path));
@@ -1342,7 +1342,7 @@ char* sfxBuildCharName(Object* a1, int anim, int extra)
         v8 = 'Z';
     }
 
-    sprintf(_sfx_file_name, "%s%c%c", v7, v8, v9);
+    snprintf(_sfx_file_name, sizeof(_sfx_file_name), "%s%c%c", v7, v8, v9);
     compat_strupr(_sfx_file_name);
     return _sfx_file_name;
 }
@@ -1351,7 +1351,7 @@ char* sfxBuildCharName(Object* a1, int anim, int extra)
 // 0x4516F0
 char* gameSoundBuildAmbientSoundEffectName(const char* a1)
 {
-    sprintf(_sfx_file_name, "A%6s%1d", a1, 1);
+    snprintf(_sfx_file_name, sizeof(_sfx_file_name), "A%6s%1d", a1, 1);
     compat_strupr(_sfx_file_name);
     return _sfx_file_name;
 }
@@ -1360,7 +1360,7 @@ char* gameSoundBuildAmbientSoundEffectName(const char* a1)
 // 0x451718
 char* gameSoundBuildInterfaceName(const char* a1)
 {
-    sprintf(_sfx_file_name, "N%6s%1d", a1, 1);
+    snprintf(_sfx_file_name, sizeof(_sfx_file_name), "N%6s%1d", a1, 1);
     compat_strupr(_sfx_file_name);
     return _sfx_file_name;
 }
@@ -1437,7 +1437,7 @@ char* sfxBuildWeaponName(int effectType, Object* weapon, int hitMode, Object* ta
         }
     }
 
-    sprintf(_sfx_file_name, "W%c%c%1d%cXX%1d", effectTypeCode, weaponSoundCode, v6, materialCode, 1);
+    snprintf(_sfx_file_name, sizeof(_sfx_file_name), "W%c%c%1d%cXX%1d", effectTypeCode, weaponSoundCode, v6, materialCode, 1);
     compat_strupr(_sfx_file_name);
     return _sfx_file_name;
 }
@@ -1449,7 +1449,7 @@ char* sfxBuildSceneryName(int actionType, int action, const char* name)
     char actionTypeCode = actionType == SOUND_EFFECT_ACTION_TYPE_PASSIVE ? 'P' : 'A';
     char actionCode = _snd_lookup_scenery_action[action];
 
-    sprintf(_sfx_file_name, "S%c%c%4s%1d", actionTypeCode, actionCode, name, 1);
+    snprintf(_sfx_file_name, sizeof(_sfx_file_name), "S%c%c%4s%1d", actionTypeCode, actionCode, name, 1);
     compat_strupr(_sfx_file_name);
 
     return _sfx_file_name;
@@ -1467,11 +1467,11 @@ char* sfxBuildOpenName(Object* object, int action)
         } else {
             scenerySoundId = 'A';
         }
-        sprintf(_sfx_file_name, "S%cDOORS%c", _snd_lookup_scenery_action[action], scenerySoundId);
+        snprintf(_sfx_file_name, sizeof(_sfx_file_name), "S%cDOORS%c", _snd_lookup_scenery_action[action], scenerySoundId);
     } else {
         Proto* proto;
         protoGetProto(object->pid, &proto);
-        sprintf(_sfx_file_name, "I%cCNTNR%c", _snd_lookup_scenery_action[action], proto->item.field_80);
+        snprintf(_sfx_file_name, sizeof(_sfx_file_name), "I%cCNTNR%c", _snd_lookup_scenery_action[action], proto->item.field_80);
     }
     compat_strupr(_sfx_file_name);
     return _sfx_file_name;
@@ -1723,7 +1723,7 @@ int gameSoundFindBackgroundSoundPathWithCopy(char* dest, const char* src)
     }
 
     char outPath[COMPAT_MAX_PATH];
-    sprintf(outPath, "%s%s%s", _sound_music_path1, src, ".ACM");
+    snprintf(outPath, sizeof(outPath), "%s%s%s", _sound_music_path1, src, ".ACM");
     if (_gsound_file_exists_f(outPath)) {
         strncpy(dest, outPath, COMPAT_MAX_PATH);
         dest[COMPAT_MAX_PATH] = '\0';
@@ -1737,7 +1737,7 @@ int gameSoundFindBackgroundSoundPathWithCopy(char* dest, const char* src)
     gameSoundDeleteOldMusicFile();
 
     char inPath[COMPAT_MAX_PATH];
-    sprintf(inPath, "%s%s%s", _sound_music_path2, src, ".ACM");
+    snprintf(inPath, sizeof(inPath), "%s%s%s", _sound_music_path2, src, ".ACM");
 
     FILE* inStream = compat_fopen(inPath, "rb");
     if (inStream == NULL) {
@@ -1824,7 +1824,7 @@ int gameSoundFindBackgroundSoundPath(char* dest, const char* src)
         debugPrint(" finding background sound ");
     }
 
-    sprintf(path, "%s%s%s", _sound_music_path1, src, ".ACM");
+    snprintf(path, sizeof(path), "%s%s%s", _sound_music_path1, src, ".ACM");
     if (_gsound_file_exists_f(path)) {
         strncpy(dest, path, COMPAT_MAX_PATH);
         dest[COMPAT_MAX_PATH] = '\0';
@@ -1835,7 +1835,7 @@ int gameSoundFindBackgroundSoundPath(char* dest, const char* src)
         debugPrint("in 2nd path ");
     }
 
-    sprintf(path, "%s%s%s", _sound_music_path2, src, ".ACM");
+    snprintf(path, sizeof(path), "%s%s%s", _sound_music_path2, src, ".ACM");
     if (_gsound_file_exists_f(path)) {
         strncpy(dest, path, COMPAT_MAX_PATH);
         dest[COMPAT_MAX_PATH] = '\0';
@@ -1868,7 +1868,7 @@ int gameSoundFindSpeechSoundPath(char* dest, const char* src)
         debugPrint(" finding speech sound ");
     }
 
-    sprintf(path, "%s%s%s", _sound_speech_path, src, ".ACM");
+    snprintf(path, sizeof(path), "%s%s%s", _sound_speech_path, src, ".ACM");
 
     // Check for existence by getting file size.
     int fileSize;
@@ -1892,7 +1892,7 @@ void gameSoundDeleteOldMusicFile()
 {
     if (_background_fname_copied[0] != '\0') {
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%s%s%s", "sound\\music\\", _background_fname_copied, ".ACM");
+        snprintf(path, sizeof(path), "%s%s%s", "sound\\music\\", _background_fname_copied, ".ACM");
         if (compat_remove(path)) {
             if (gGameSoundDebugEnabled) {
                 debugPrint("Deleting old music file failed.\n");

src/heap.cc

@@ -73,7 +73,7 @@ typedef struct HeapMoveableExtent {
 static bool heapInternalsInit();
 static void heapInternalsFree();
 static bool heapHandleListInit(Heap* heap);
-static bool heapPrintStats(Heap* heap, char* dest);
+static bool heapPrintStats(Heap* heap, char* dest, size_t size);
 static bool heapFindFreeHandle(Heap* heap, int* handleIndexPtr);
 static bool heapFindFreeBlock(Heap* heap, int size, void** blockPtr, int a4);
 static int heapBlockCompareBySize(const void* a1, const void* a2);
@@ -601,7 +601,7 @@ bool heapUnlock(Heap* heap, int handleIndex)
 }
 
 // 0x4532AC
-static bool heapPrintStats(Heap* heap, char* dest)
+static bool heapPrintStats(Heap* heap, char* dest, size_t size)
 {
     if (heap == NULL || dest == NULL) {
         return false;
@@ -619,7 +619,7 @@ static bool heapPrintStats(Heap* heap, char* dest)
                          "Total handles: %d\n"
                          "Total heaps: %d";
 
-    sprintf(dest, format,
+    snprintf(dest, size, format,
         heap->freeBlocks,
         heap->freeSize,
         heap->moveableBlocks,
@@ -914,7 +914,7 @@ system:
 
     if (1) {
         char stats[512];
-        if (heapPrintStats(heap, stats)) {
+        if (heapPrintStats(heap, stats, sizeof(stats))) {
             debugPrint("\n%s\n", stats);
         }
 

src/input.cc

@@ -484,7 +484,7 @@ int screenshotHandlerDefaultImpl(int width, int height, unsigned char* data, uns
     unsigned short shortValue;
 
     for (index = 0; index < 100000; index++) {
-        sprintf(fileName, "scr%.5d.bmp", index);
+        snprintf(fileName, sizeof(fileName), "scr%.5d.bmp", index);
 
         stream = compat_fopen(fileName, "rb");
         if (stream == NULL) {

src/interface.cc

@@ -2199,7 +2199,7 @@ static int indicatorBarInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "intrface.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "intrface.msg");
 
     if (rc != -1) {
         if (!messageListLoad(&messageList, path)) {
@@ -2486,7 +2486,7 @@ static void customInterfaceBarInit()
     gInterfaceBarContentOffset = gInterfaceBarWidth - 640;
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "art\\intrface\\HR_IFACE_%d.FRM", gInterfaceBarWidth);
+    snprintf(path, sizeof(path), "art\\intrface\\HR_IFACE_%d.FRM", gInterfaceBarWidth);
 
     int size;
     if (dbGetFileSize(path, &size) != 0 || gInterfaceBarContentOffset <= 0 || screenGetWidth() <= 640) {
@@ -2543,10 +2543,10 @@ static void sidePanelsInit()
     gInterfaceSidePanelsTrailingWindow = windowCreate(windowRect.right + 1, windowRect.top, screenGetWidth() - windowRect.right - 1, windowRect.bottom - windowRect.top + 1, 0, WINDOW_HIDDEN | WINDOW_FLAG_0x02);
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "art\\intrface\\HR_IFACELFT%d.frm", gInterfaceSidePanelsImageId);
+    snprintf(path, sizeof(path), "art\\intrface\\HR_IFACELFT%d.frm", gInterfaceSidePanelsImageId);
     sidePanelsDraw(path, gInterfaceSidePanelsLeadingWindow, true);
 
-    sprintf(path, "art\\intrface\\HR_IFACERHT%d.frm", gInterfaceSidePanelsImageId);
+    snprintf(path, sizeof(path), "art\\intrface\\HR_IFACERHT%d.frm", gInterfaceSidePanelsImageId);
     sidePanelsDraw(path, gInterfaceSidePanelsTrailingWindow, false);
 }
 

src/interpreter.cc

@@ -216,7 +216,7 @@ int _interpretOutput(const char* format, ...)
 
     va_list args;
     va_start(args, format);
-    int rc = vsprintf(string, format, args);
+    int rc = vsnprintf(string, sizeof(string), format, args);
     va_end(args);
 
     debugPrint(string);
@@ -253,7 +253,7 @@ static char* programGetCurrentProcedureName(Program* program)
 
     va_list argptr;
     va_start(argptr, format);
-    vsprintf(string, format, argptr);
+    vsnprintf(string, sizeof(string), format, argptr);
     va_end(argptr);
 
     debugPrint("\nError during execution: %s\n", string);
@@ -466,7 +466,7 @@ Program* programCreateByPath(const char* path)
     File* stream = fileOpen(path, "rb");
     if (stream == NULL) {
         char err[260];
-        sprintf(err, "Couldn't open %s for read\n", path);
+        snprintf(err, sizeof(err), "Couldn't open %s for read\n", path);
         programFatalError(err);
         return NULL;
     }
@@ -884,11 +884,11 @@ static void opConditionalOperatorNotEqual(Program* program)
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             break;
         case VALUE_TYPE_FLOAT:
-            sprintf(stringBuffers[0], "%.5f", value[0].floatValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%.5f", value[0].floatValue);
             strings[0] = stringBuffers[0];
             break;
         case VALUE_TYPE_INT:
-            sprintf(stringBuffers[0], "%d", value[0].integerValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%d", value[0].integerValue);
             strings[0] = stringBuffers[0];
             break;
         default:
@@ -901,7 +901,7 @@ static void opConditionalOperatorNotEqual(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%.5f", value[1].floatValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%.5f", value[1].floatValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) != 0;
@@ -920,7 +920,7 @@ static void opConditionalOperatorNotEqual(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%d", value[1].integerValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%d", value[1].integerValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) != 0;
@@ -980,11 +980,11 @@ static void opConditionalOperatorEqual(Program* program)
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             break;
         case VALUE_TYPE_FLOAT:
-            sprintf(stringBuffers[0], "%.5f", value[0].floatValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%.5f", value[0].floatValue);
             strings[0] = stringBuffers[0];
             break;
         case VALUE_TYPE_INT:
-            sprintf(stringBuffers[0], "%d", value[0].integerValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%d", value[0].integerValue);
             strings[0] = stringBuffers[0];
             break;
         default:
@@ -997,7 +997,7 @@ static void opConditionalOperatorEqual(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%.5f", value[1].floatValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%.5f", value[1].floatValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) == 0;
@@ -1016,7 +1016,7 @@ static void opConditionalOperatorEqual(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%d", value[1].integerValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%d", value[1].integerValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) == 0;
@@ -1076,11 +1076,11 @@ static void opConditionalOperatorLessThanEquals(Program* program)
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             break;
         case VALUE_TYPE_FLOAT:
-            sprintf(stringBuffers[0], "%.5f", value[0].floatValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%.5f", value[0].floatValue);
             strings[0] = stringBuffers[0];
             break;
         case VALUE_TYPE_INT:
-            sprintf(stringBuffers[0], "%d", value[0].integerValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%d", value[0].integerValue);
             strings[0] = stringBuffers[0];
             break;
         default:
@@ -1093,7 +1093,7 @@ static void opConditionalOperatorLessThanEquals(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%.5f", value[1].floatValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%.5f", value[1].floatValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) <= 0;
@@ -1112,7 +1112,7 @@ static void opConditionalOperatorLessThanEquals(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%d", value[1].integerValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%d", value[1].integerValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) <= 0;
@@ -1168,11 +1168,11 @@ static void opConditionalOperatorGreaterThanEquals(Program* program)
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             break;
         case VALUE_TYPE_FLOAT:
-            sprintf(stringBuffers[0], "%.5f", value[0].floatValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%.5f", value[0].floatValue);
             strings[0] = stringBuffers[0];
             break;
         case VALUE_TYPE_INT:
-            sprintf(stringBuffers[0], "%d", value[0].integerValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%d", value[0].integerValue);
             strings[0] = stringBuffers[0];
             break;
         default:
@@ -1185,7 +1185,7 @@ static void opConditionalOperatorGreaterThanEquals(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%.5f", value[1].floatValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%.5f", value[1].floatValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) >= 0;
@@ -1204,7 +1204,7 @@ static void opConditionalOperatorGreaterThanEquals(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%d", value[1].integerValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%d", value[1].integerValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) >= 0;
@@ -1249,11 +1249,11 @@ static void opConditionalOperatorLessThan(Program* program)
             str_ptr[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             break;
         case VALUE_TYPE_FLOAT:
-            sprintf(text[0], "%.5f", value[0].floatValue);
+            snprintf(text[0], sizeof(text[0]), "%.5f", value[0].floatValue);
             str_ptr[0] = text[0];
             break;
         case VALUE_TYPE_INT:
-            sprintf(text[0], "%d", value[0].integerValue);
+            snprintf(text[0], sizeof(text[0]), "%d", value[0].integerValue);
             str_ptr[0] = text[0];
             break;
         default:
@@ -1266,7 +1266,7 @@ static void opConditionalOperatorLessThan(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(text[1], "%.5f", value[1].floatValue);
+            snprintf(text[1], sizeof(text[1]), "%.5f", value[1].floatValue);
             str_ptr[1] = text[1];
             str_ptr[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(str_ptr[1], str_ptr[0]) < 0;
@@ -1285,7 +1285,7 @@ static void opConditionalOperatorLessThan(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(text[1], "%d", value[1].integerValue);
+            snprintf(text[1], sizeof(text[1]), "%d", value[1].integerValue);
             str_ptr[1] = text[1];
             str_ptr[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(str_ptr[1], str_ptr[0]) < 0;
@@ -1330,11 +1330,11 @@ static void opConditionalOperatorGreaterThan(Program* program)
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             break;
         case VALUE_TYPE_FLOAT:
-            sprintf(stringBuffers[0], "%.5f", value[0].floatValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%.5f", value[0].floatValue);
             strings[0] = stringBuffers[0];
             break;
         case VALUE_TYPE_INT:
-            sprintf(stringBuffers[0], "%d", value[0].integerValue);
+            snprintf(stringBuffers[0], sizeof(stringBuffers[0]), "%d", value[0].integerValue);
             strings[0] = stringBuffers[0];
             break;
         default:
@@ -1347,7 +1347,7 @@ static void opConditionalOperatorGreaterThan(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%.5f", value[1].floatValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%.5f", value[1].floatValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) > 0;
@@ -1366,7 +1366,7 @@ static void opConditionalOperatorGreaterThan(Program* program)
         switch (value[0].opcode) {
         case VALUE_TYPE_STRING:
         case VALUE_TYPE_DYNAMIC_STRING:
-            sprintf(stringBuffers[1], "%d", value[1].integerValue);
+            snprintf(stringBuffers[1], sizeof(stringBuffers[1]), "%d", value[1].integerValue);
             strings[1] = stringBuffers[1];
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             result = strcmp(strings[1], strings[0]) > 0;
@@ -1423,15 +1423,15 @@ static void opAdd(Program* program)
             break;
         case VALUE_TYPE_FLOAT:
             strings[0] = (char*)internal_malloc_safe(80, __FILE__, __LINE__); // "..\\int\\INTRPRET.C", 1011
-            sprintf(strings[0], "%.5f", value[0].floatValue);
+            snprintf(strings[0], 80, "%.5f", value[0].floatValue);
             break;
         case VALUE_TYPE_INT:
             strings[0] = (char*)internal_malloc_safe(80, __FILE__, __LINE__); // "..\\int\\INTRPRET.C", 1007
-            sprintf(strings[0], "%d", value[0].integerValue);
+            snprintf(strings[0], 80, "%d", value[0].integerValue);
             break;
         case VALUE_TYPE_PTR:
             strings[0] = (char*)internal_malloc_safe(80, __FILE__, __LINE__);
-            sprintf(strings[0], "%p", value[0].pointerValue);
+            snprintf(strings[0], 80, "%p", value[0].pointerValue);
             break;
         }
 
@@ -1450,7 +1450,7 @@ static void opAdd(Program* program)
         case VALUE_TYPE_DYNAMIC_STRING:
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             tempString = (char*)internal_malloc_safe(strlen(strings[0]) + 80, __FILE__, __LINE__); // "..\\int\\INTRPRET.C", 1039
-            sprintf(tempString, "%.5f", value[1].floatValue);
+            snprintf(tempString, strlen(strings[0]) + 80, "%.5f", value[1].floatValue);
             strcat(tempString, strings[0]);
 
             programStackPushString(program, tempString);
@@ -1471,7 +1471,7 @@ static void opAdd(Program* program)
         case VALUE_TYPE_DYNAMIC_STRING:
             strings[0] = programGetString(program, value[0].opcode, value[0].integerValue);
             tempString = (char*)internal_malloc_safe(strlen(strings[0]) + 80, __FILE__, __LINE__); // "..\\int\\INTRPRET.C", 1070
-            sprintf(tempString, "%d", value[1].integerValue);
+            snprintf(tempString, strlen(strings[0]) + 80, "%d", value[1].integerValue);
             strcat(tempString, strings[0]);
 
             programStackPushString(program, tempString);
@@ -2253,7 +2253,7 @@ static void opStoreExternalVariable(Program* program)
 
     if (externalVariableSetValue(program, identifier, value)) {
         char err[256];
-        sprintf(err, "External variable %s does not exist\n", identifier);
+        snprintf(err, sizeof(err), "External variable %s does not exist\n", identifier);
         programFatalError(err);
     }
 }
@@ -2268,7 +2268,7 @@ static void opFetchExternalVariable(Program* program)
     ProgramValue value;
     if (externalVariableGetValue(program, identifier, value) != 0) {
         char err[256];
-        sprintf(err, "External variable %s does not exist\n", identifier);
+        snprintf(err, sizeof(err), "External variable %s does not exist\n", identifier);
         programFatalError(err);
     }
 
@@ -2288,7 +2288,7 @@ static void opExportProcedure(Program* program)
 
     if (externalProcedureCreate(program, procedureName, procedureAddress, argumentCount) != 0) {
         char err[256];
-        sprintf(err, "Error exporting procedure %s", procedureName);
+        snprintf(err, sizeof(err), "Error exporting procedure %s", procedureName);
         programFatalError(err);
     }
 }
@@ -2302,7 +2302,7 @@ static void opExportVariable(Program* program)
 
     if (externalVariableCreate(program, identifier)) {
         char err[256];
-        sprintf(err, "External variable %s already exists", identifier);
+        snprintf(err, sizeof(err), "External variable %s already exists", identifier);
         programFatalError(err);
     }
 }
@@ -2357,7 +2357,7 @@ static void opCallStart(Program* program)
     program->child = runScript(name);
     if (program->child == NULL) {
         char err[260];
-        sprintf(err, "Error spawning child %s", name);
+        snprintf(err, sizeof(err), "Error spawning child %s", name);
         programFatalError(err);
     }
 
@@ -2381,7 +2381,7 @@ static void opSpawn(Program* program)
     program->child = runScript(name);
     if (program->child == NULL) {
         char err[260];
-        sprintf(err, "Error spawning child %s", name);
+        snprintf(err, sizeof(err), "Error spawning child %s", name);
         programFatalError(err);
     }
 
@@ -2403,7 +2403,7 @@ static Program* forkProgram(Program* program)
 
     if (forked == NULL) {
         char err[256];
-        sprintf(err, "couldn't fork script '%s'", name);
+        snprintf(err, sizeof(err), "couldn't fork script '%s'", name);
         programFatalError(err);
     }
 
@@ -2457,7 +2457,7 @@ static void opCheckProcedureArgumentCount(Program* program)
     if (actualArgumentCount != expectedArgumentCount) {
         const char* identifier = programGetIdentifier(program, stackReadInt32(program->procedures + 4 + 24 * procedureIndex, 0));
         char err[260];
-        sprintf(err, "Wrong number of args to procedure %s\n", identifier);
+        snprintf(err, sizeof(err), "Wrong number of args to procedure %s\n", identifier);
         programFatalError(err);
     }
 }
@@ -2487,7 +2487,7 @@ static void opLookupStringProc(Program* program)
     }
 
     char err[260];
-    sprintf(err, "Couldn't find string procedure %s\n", procedureNameToLookup);
+    snprintf(err, sizeof(err), "Couldn't find string procedure %s\n", procedureNameToLookup);
     programFatalError(err);
 }
 
@@ -2652,14 +2652,14 @@ void _interpret(Program* program, int a2)
         program->flags |= (opcode << 16);
 
         if (!((opcode >> 8) & 0x80)) {
-            sprintf(err, "Bad opcode %x %c %d.", opcode, opcode, opcode);
+            snprintf(err, sizeof(err), "Bad opcode %x %c %d.", opcode, opcode, opcode);
             programFatalError(err);
         }
 
         unsigned int opcodeIndex = opcode & 0x3FF;
         OpcodeHandler* handler = gInterpreterOpcodeHandlers[opcodeIndex];
         if (handler == NULL) {
-            sprintf(err, "Undefined opcode %x.", opcode);
+            snprintf(err, sizeof(err), "Undefined opcode %x.", opcode);
             programFatalError(err);
         }
 
@@ -2768,11 +2768,11 @@ void _executeProc(Program* program, int procedureIndex)
         if (externalProgram != NULL) {
             if (externalProcedureArgumentCount == 0) {
             } else {
-                sprintf(err, "External procedure cannot take arguments in interrupt context");
+                snprintf(err, sizeof(err), "External procedure cannot take arguments in interrupt context");
                 _interpretOutput(err);
             }
         } else {
-            sprintf(err, "External procedure %s not found\n", procedureIdentifier);
+            snprintf(err, sizeof(err), "External procedure %s not found\n", procedureIdentifier);
             _interpretOutput(err);
         }
 
@@ -2849,11 +2849,11 @@ void _executeProcedure(Program* program, int procedureIndex)
                 _interpret(externalProgram, -1);
                 memcpy(externalProgram->env, env, sizeof(env));
             } else {
-                sprintf(err, "External procedure cannot take arguments in interrupt context");
+                snprintf(err, sizeof(err), "External procedure cannot take arguments in interrupt context");
                 _interpretOutput(err);
             }
         } else {
-            sprintf(err, "External procedure %s not found\n", procedureIdentifier);
+            snprintf(err, sizeof(err), "External procedure %s not found\n", procedureIdentifier);
             _interpretOutput(err);
         }
     } else {

src/interpreter_extra.cc

@@ -416,7 +416,7 @@ static void scriptPredefinedError(Program* program, const char* name, int error)
 {
     char string[260];
 
-    sprintf(string, "Script Error: %s: op_%s: %s", program->name, name, _dbg_error_strs[error]);
+    snprintf(string, sizeof(string), "Script Error: %s: op_%s: %s", program->name, name, _dbg_error_strs[error]);
 
     debugPrint(string);
 }
@@ -428,7 +428,7 @@ static void scriptError(const char* format, ...)
 
     va_list argptr;
     va_start(argptr, format);
-    vsprintf(string, format, argptr);
+    vsnprintf(string, sizeof(string), format, argptr);
     va_end(argptr);
 
     debugPrint(string);
@@ -566,7 +566,7 @@ static void opOverrideMapStart(Program* program)
     int x = programStackPopInteger(program);
 
     char text[60];
-    sprintf(text, "OVERRIDE_MAP_START: x: %d, y: %d", x, y);
+    snprintf(text, sizeof(text), "OVERRIDE_MAP_START: x: %d, y: %d", x, y);
     debugPrint(text);
 
     int tile = 200 * y + x;

src/interpreter_lib.cc

@@ -345,13 +345,13 @@ static void opPrintRect(Program* program)
     char string[80];
     switch (value.opcode & VALUE_TYPE_MASK) {
     case VALUE_TYPE_STRING:
-        sprintf(string, "%s", programGetString(program, value.opcode, value.integerValue));
+        snprintf(string, sizeof(string), "%s", programGetString(program, value.opcode, value.integerValue));
         break;
     case VALUE_TYPE_FLOAT:
-        sprintf(string, "%.5f", value.floatValue);
+        snprintf(string, sizeof(string), "%.5f", value.floatValue);
         break;
     case VALUE_TYPE_INT:
-        sprintf(string, "%d", value.integerValue);
+        snprintf(string, sizeof(string), "%d", value.integerValue);
         break;
     }
 

src/inventory.cc

@@ -524,7 +524,7 @@ static int inventoryMessageListInit()
     if (!messageListInit(&gInventoryMessageList))
         return -1;
 
-    sprintf(path, "%s%s", asc_5186C8, "inventry.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "inventry.msg");
     if (!messageListLoad(&gInventoryMessageList, path))
         return -1;
 
@@ -1766,14 +1766,14 @@ static void _display_inventory(int a1, int a2, int inventoryWindowType)
         if (PID_TYPE(object->pid) == OBJ_TYPE_CRITTER) {
             int carryWeight = critterGetStat(object, STAT_CARRY_WEIGHT);
             int inventoryWeight = objectGetInventoryWeight(object);
-            sprintf(formattedText, "%d/%d", inventoryWeight, carryWeight);
+            snprintf(formattedText, sizeof(formattedText), "%d/%d", inventoryWeight, carryWeight);
 
             if (critterIsEncumbered(object)) {
                 color = _colorTable[31744];
             }
         } else {
             int inventoryWeight = objectGetInventoryWeight(object);
-            sprintf(formattedText, "%d", inventoryWeight);
+            snprintf(formattedText, sizeof(formattedText), "%d", inventoryWeight);
         }
 
         int width = fontGetStringWidth(formattedText);
@@ -1889,7 +1889,7 @@ static void _display_target_inventory(int a1, int a2, Inventory* inventory, int
         if (PID_TYPE(object->pid) == OBJ_TYPE_CRITTER) {
             int currentWeight = objectGetInventoryWeight(object);
             int maxWeight = critterGetStat(object, STAT_CARRY_WEIGHT);
-            sprintf(formattedText, "%d/%d", currentWeight, maxWeight);
+            snprintf(formattedText, sizeof(formattedText), "%d/%d", currentWeight, maxWeight);
 
             if (critterIsEncumbered(object)) {
                 color = _colorTable[31744];
@@ -1898,11 +1898,11 @@ static void _display_target_inventory(int a1, int a2, Inventory* inventory, int
             if (itemGetType(object) == ITEM_TYPE_CONTAINER) {
                 int currentSize = containerGetTotalSize(object);
                 int maxSize = containerGetMaxSize(object);
-                sprintf(formattedText, "%d/%d", currentSize, maxSize);
+                snprintf(formattedText, sizeof(formattedText), "%d/%d", currentSize, maxSize);
             }
         } else {
             int inventoryWeight = objectGetInventoryWeight(object);
-            sprintf(formattedText, "%d", inventoryWeight);
+            snprintf(formattedText, sizeof(formattedText), "%d", inventoryWeight);
         }
 
         int width = fontGetStringWidth(formattedText);
@@ -1938,7 +1938,7 @@ static void _display_inventory_info(Object* item, int quantity, unsigned char* d
             ammoQuantity = 99999;
         }
 
-        sprintf(formattedText, "x%d", ammoQuantity);
+        snprintf(formattedText, sizeof(formattedText), "x%d", ammoQuantity);
         draw = true;
     } else {
         if (quantity > 1) {
@@ -1954,7 +1954,7 @@ static void _display_inventory_info(Object* item, int quantity, unsigned char* d
                     v9 = 99999;
                 }
 
-                sprintf(formattedText, "x%d", v9);
+                snprintf(formattedText, sizeof(formattedText), "x%d", v9);
                 draw = true;
             }
         }
@@ -2909,7 +2909,7 @@ static void inventoryRenderSummary()
         }
 
         int value = critterGetStat(_stack[0], stat);
-        sprintf(formattedText, "%d", value);
+        snprintf(formattedText, sizeof(formattedText), "%d", value);
         fontDrawText(windowBuffer + offset + 24, formattedText, 80, INVENTORY_WINDOW_WIDTH, _colorTable[992]);
 
         offset += INVENTORY_WINDOW_WIDTH * fontGetLineHeight();
@@ -2925,12 +2925,12 @@ static void inventoryRenderSummary()
 
         if (v57[index] == -1) {
             int value = critterGetStat(_stack[0], v56[index]);
-            sprintf(formattedText, "   %d", value);
+            snprintf(formattedText, sizeof(formattedText), "   %d", value);
         } else {
             int value1 = critterGetStat(_stack[0], v56[index]);
             int value2 = critterGetStat(_stack[0], v57[index]);
             const char* format = index != 0 ? "%d/%d%%" : "%d/%d";
-            sprintf(formattedText, format, value1, value2);
+            snprintf(formattedText, sizeof(formattedText), format, value1, value2);
         }
 
         fontDrawText(windowBuffer + offset + 104, formattedText, 80, INVENTORY_WINDOW_WIDTH, _colorTable[992]);
@@ -3002,7 +3002,7 @@ static void inventoryRenderSummary()
                 int bonusDamage = unarmedGetDamage(hitMode, &minDamage, &maxDamage);
                 int meleeDamage = critterGetStat(_stack[0], STAT_MELEE_DAMAGE);
                 // TODO: Localize unarmed attack names.
-                sprintf(formattedText, "%s %d-%d",
+                snprintf(formattedText, sizeof(formattedText), "%s %d-%d",
                     messageListItem.text,
                     bonusDamage + minDamage,
                     bonusDamage + meleeDamage + maxDamage);
@@ -3084,7 +3084,7 @@ static void inventoryRenderSummary()
                         damageMin += 2 * perkGetRank(gDude, PERK_BONUS_HTH_DAMAGE);
                     }
                 }
-                sprintf(formattedText, "%s %d-%d", messageListItem.text, damageMin, damageMax + meleeDamage);
+                snprintf(formattedText, sizeof(formattedText), "%s %d-%d", messageListItem.text, damageMin, damageMax + meleeDamage);
             } else {
                 MessageListItem rangeMessageListItem;
                 rangeMessageListItem.num = 16; // Rng:
@@ -3101,7 +3101,7 @@ static void inventoryRenderSummary()
                         }
                     }
 
-                    sprintf(formattedText, "%s %d-%d   %s %d", messageListItem.text, damageMin, damageMax + meleeDamage, rangeMessageListItem.text, range);
+                    snprintf(formattedText, sizeof(formattedText), "%s %d-%d   %s %d", messageListItem.text, damageMin, damageMax + meleeDamage, rangeMessageListItem.text, range);
                 }
             }
 
@@ -3122,17 +3122,17 @@ static void inventoryRenderSummary()
                         const char* ammoName = protoGetName(ammoTypePid);
                         int capacity = ammoGetCapacity(item);
                         int quantity = ammoGetQuantity(item);
-                        sprintf(formattedText, "%s %d/%d %s", messageListItem.text, quantity, capacity, ammoName);
+                        snprintf(formattedText, sizeof(formattedText), "%s %d/%d %s", messageListItem.text, quantity, capacity, ammoName);
                     } else {
                         int capacity = ammoGetCapacity(item);
                         int quantity = ammoGetQuantity(item);
-                        sprintf(formattedText, "%s %d/%d", messageListItem.text, quantity, capacity);
+                        snprintf(formattedText, sizeof(formattedText), "%s %d/%d", messageListItem.text, quantity, capacity);
                     }
                 }
             } else {
                 int capacity = ammoGetCapacity(item);
                 int quantity = ammoGetQuantity(item);
-                sprintf(formattedText, "%s %d/%d", messageListItem.text, quantity, capacity);
+                snprintf(formattedText, sizeof(formattedText), "%s %d/%d", messageListItem.text, quantity, capacity);
             }
 
             fontDrawText(windowBuffer + offset, formattedText, 140, INVENTORY_WINDOW_WIDTH, _colorTable[992]);
@@ -3147,7 +3147,7 @@ static void inventoryRenderSummary()
         if (PID_TYPE(_stack[0]->pid) == OBJ_TYPE_CRITTER) {
             int carryWeight = critterGetStat(_stack[0], STAT_CARRY_WEIGHT);
             int inventoryWeight = objectGetInventoryWeight(_stack[0]);
-            sprintf(formattedText, "%s %d/%d", messageListItem.text, inventoryWeight, carryWeight);
+            snprintf(formattedText, sizeof(formattedText), "%s %d/%d", messageListItem.text, inventoryWeight, carryWeight);
 
             int color = _colorTable[992];
             if (critterIsEncumbered(_stack[0])) {
@@ -3157,7 +3157,7 @@ static void inventoryRenderSummary()
             fontDrawText(windowBuffer + offset + 15, formattedText, 120, INVENTORY_WINDOW_WIDTH, color);
         } else {
             int inventoryWeight = objectGetInventoryWeight(_stack[0]);
-            sprintf(formattedText, "%s %d", messageListItem.text, inventoryWeight);
+            snprintf(formattedText, sizeof(formattedText), "%s %d", messageListItem.text, inventoryWeight);
 
             fontDrawText(windowBuffer + offset + 30, formattedText, 80, INVENTORY_WINDOW_WIDTH, _colorTable[992]);
         }
@@ -3683,7 +3683,7 @@ static void inventoryExamineItem(Object* critter, Object* item)
         }
 
         char formattedText[40];
-        sprintf(formattedText, messageListItem.text, weight);
+        snprintf(formattedText, sizeof(formattedText), messageListItem.text, weight);
         inventoryRenderItemDescription(formattedText);
     }
 
@@ -4464,7 +4464,7 @@ int inventoryOpenLooting(Object* a1, Object* a2)
                     messageListItem.num = 29;
                     if (messageListGetItem(&gInventoryMessageList, &messageListItem)) {
                         char formattedText[200];
-                        sprintf(formattedText, messageListItem.text, xpGained);
+                        snprintf(formattedText, sizeof(formattedText), messageListItem.text, xpGained);
                         displayMonitorAddMessage(formattedText);
                     }
                 }
@@ -4961,11 +4961,11 @@ static void inventoryWindowRenderInnerInventories(int win, Object* a2, Object* a
 
             if (messageListGetItem(&gInventoryMessageList, &messageListItem)) {
                 int weight = objectGetInventoryWeight(a2);
-                sprintf(formattedText, "%s %d", messageListItem.text, weight);
+                snprintf(formattedText, sizeof(formattedText), "%s %d", messageListItem.text, weight);
             }
         } else {
             int cost = objectGetCost(a2);
-            sprintf(formattedText, "$%d", cost);
+            snprintf(formattedText, sizeof(formattedText), "$%d", cost);
         }
 
         fontDrawText(windowBuffer + INVENTORY_TRADE_WINDOW_WIDTH * (INVENTORY_SLOT_HEIGHT * gInventorySlotsCount + INVENTORY_TRADE_INNER_LEFT_SCROLLER_Y_PAD) + INVENTORY_TRADE_INNER_LEFT_SCROLLER_X_PAD, formattedText, 80, INVENTORY_TRADE_WINDOW_WIDTH, _colorTable[32767]);
@@ -5000,11 +5000,11 @@ static void inventoryWindowRenderInnerInventories(int win, Object* a2, Object* a
 
             if (messageListGetItem(&gInventoryMessageList, &messageListItem)) {
                 int weight = _barter_compute_value(gDude, _target_stack[0]);
-                sprintf(formattedText, "%s %d", messageListItem.text, weight);
+                snprintf(formattedText, sizeof(formattedText), "%s %d", messageListItem.text, weight);
             }
         } else {
             int cost = _barter_compute_value(gDude, _target_stack[0]);
-            sprintf(formattedText, "$%d", cost);
+            snprintf(formattedText, sizeof(formattedText), "$%d", cost);
         }
 
         fontDrawText(windowBuffer + INVENTORY_TRADE_WINDOW_WIDTH * (INVENTORY_SLOT_HEIGHT * gInventorySlotsCount + INVENTORY_TRADE_INNER_RIGHT_SCROLLER_Y_PAD) + INVENTORY_TRADE_INNER_RIGHT_SCROLLER_X_PAD, formattedText, 80, INVENTORY_TRADE_WINDOW_WIDTH, _colorTable[32767]);

src/item.cc

@@ -195,7 +195,7 @@ int itemsInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "item.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "item.msg");
 
     if (!messageListLoad(&gItemsMessageList, path)) {
         return -1;
@@ -2254,7 +2254,7 @@ int _item_m_use_charged_item(Object* critter, Object* miscItem)
             if (messageListGetItem(&gItemsMessageList, &messageListItem)) {
                 char text[80];
                 const char* itemName = objectGetName(miscItem);
-                sprintf(text, messageListItem.text, itemName);
+                snprintf(text, sizeof(text), messageListItem.text, itemName);
                 displayMonitorAddMessage(text);
             }
         }
@@ -2300,7 +2300,7 @@ int miscItemTrickleEventProcess(Object* item, void* data)
             if (messageListGetItem(&gItemsMessageList, &messageListItem)) {
                 char text[80];
                 const char* itemName = objectGetName(item);
-                sprintf(text, messageListItem.text, itemName);
+                snprintf(text, sizeof(text), messageListItem.text, itemName);
                 displayMonitorAddMessage(text);
             }
         }
@@ -2349,7 +2349,7 @@ int miscItemTurnOn(Object* item)
             messageListItem.num = 5;
             if (messageListGetItem(&gItemsMessageList, &messageListItem)) {
                 char* name = objectGetName(item);
-                sprintf(text, messageListItem.text, name);
+                snprintf(text, sizeof(text), messageListItem.text, name);
                 displayMonitorAddMessage(text);
             }
         }
@@ -2375,7 +2375,7 @@ int miscItemTurnOn(Object* item)
         messageListItem.num = 6;
         if (messageListGetItem(&gItemsMessageList, &messageListItem)) {
             char* name = objectGetName(item);
-            sprintf(text, messageListItem.text, name);
+            snprintf(text, sizeof(text), messageListItem.text, name);
             displayMonitorAddMessage(text);
         }
 
@@ -2384,7 +2384,7 @@ int miscItemTurnOn(Object* item)
             messageListItem.num = 8;
             if (messageListGetItem(&gItemsMessageList, &messageListItem)) {
                 int radiation = critterGetRadiation(critter);
-                sprintf(text, messageListItem.text, radiation);
+                snprintf(text, sizeof(text), messageListItem.text, radiation);
                 displayMonitorAddMessage(text);
             }
         }
@@ -2423,7 +2423,7 @@ int miscItemTurnOff(Object* item)
         if (messageListGetItem(&gItemsMessageList, &messageListItem)) {
             const char* name = objectGetName(item);
             char text[80];
-            sprintf(text, messageListItem.text, name);
+            snprintf(text, sizeof(text), messageListItem.text, name);
             displayMonitorAddMessage(text);
         }
     }
@@ -2667,7 +2667,7 @@ static void _perform_drug_effect(Object* critter, int* stats, int* mods, bool is
                 name = critterGetName(critter);
                 // %s succumbs to the adverse effects of chems.
                 text = getmsg(&gItemsMessageList, &messageListItem, 600);
-                sprintf(v24, text, name);
+                snprintf(v24, sizeof(v24), text, name);
                 _combatKillCritterOutsideCombat(critter, v24);
             }
         }
@@ -2686,7 +2686,7 @@ static void _perform_drug_effect(Object* critter, int* stats, int* mods, bool is
                 messageListItem.num = after < before ? 2 : 1;
                 if (messageListGetItem(&gItemsMessageList, &messageListItem)) {
                     char* statName = statGetName(stat);
-                    sprintf(str, messageListItem.text, after < before ? before - after : after - before, statName);
+                    snprintf(str, sizeof(str), messageListItem.text, after < before ? before - after : after - before, statName);
                     displayMonitorAddMessage(str);
                     statsChanged = true;
                 }
@@ -2714,7 +2714,7 @@ static void _perform_drug_effect(Object* critter, int* stats, int* mods, bool is
             name = critterGetName(critter);
             // %s succumbs to the adverse effects of chems.
             text = getmsg(&gItemsMessageList, &messageListItem, 600);
-            sprintf(v24, text, name);
+            snprintf(v24, sizeof(v24), text, name);
             // TODO: Why message is ignored?
         }
     }
@@ -3306,7 +3306,7 @@ static void booksInitCustom()
                 char sectionKey[4];
                 for (int index = 0; index < bookCount; index++) {
                     // Books numbering starts with 1.
-                    sprintf(sectionKey, "%d", index + 1);
+                    snprintf(sectionKey, sizeof(sectionKey), "%d", index + 1);
 
                     int bookPid;
                     if (!configGetInt(&booksConfig, sectionKey, "PID", &bookPid)) continue;

src/lips.cc

@@ -406,7 +406,7 @@ static int _lips_make_speech()
 
     char path[COMPAT_MAX_PATH];
     char* v1 = _lips_fix_string(gLipsData.field_50, sizeof(gLipsData.field_50));
-    sprintf(path, "%s%s\\%s.%s", "SOUND\\SPEECH\\", _lips_subdir_name, v1, "ACM");
+    snprintf(path, sizeof(path), "%s%s\\%s.%s", "SOUND\\SPEECH\\", _lips_subdir_name, v1, "ACM");
 
     if (gLipsData.sound != NULL) {
         soundDelete(gLipsData.sound);

src/loadsave.cc

@@ -358,7 +358,7 @@ int lsgSaveGame(int mode)
     _patches = settings.system.master_patches_path.c_str();
 
     if (mode == LOAD_SAVE_MODE_QUICK && _quick_done) {
-        sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+        snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
         strcat(_gmpath, "SAVE.DAT");
 
         _flptr = fileOpen(_gmpath, "rb");
@@ -391,7 +391,7 @@ int lsgSaveGame(int mode)
         }
 
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%s%s", asc_5186C8, "LSGAME.MSG");
+        snprintf(path, sizeof(path), "%s%s", asc_5186C8, "LSGAME.MSG");
         if (!messageListLoad(&gLoadSaveMessageList, path)) {
             return -1;
         }
@@ -433,7 +433,7 @@ int lsgSaveGame(int mode)
         // Save game directory:
         strcpy(_str1, getmsg(&gLoadSaveMessageList, &messageListItem, 107));
 
-        sprintf(_str2, "\"%s\\\"", "SAVEGAME");
+        snprintf(_str2, sizeof(_str2), "\"%s\\\"", "SAVEGAME");
 
         // TODO: Check.
         strcpy(_str2, getmsg(&gLoadSaveMessageList, &messageListItem, 108));
@@ -746,7 +746,7 @@ int lsgSaveGame(int mode)
                         // Save game directory:
                         strcpy(_str1, getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, 107));
 
-                        sprintf(_str2, "\"%s\\\"", "SAVEGAME");
+                        snprintf(_str2, sizeof(_str2), "\"%s\\\"", "SAVEGAME");
 
                         char text[260];
                         // Doesn't exist or is corrupted.
@@ -897,7 +897,7 @@ int lsgLoadGame(int mode)
         }
 
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%s\\%s", asc_5186C8, "LSGAME.MSG");
+        snprintf(path, sizeof(path), "%s\\%s", asc_5186C8, "LSGAME.MSG");
         if (!messageListLoad(&gLoadSaveMessageList, path)) {
             return -1;
         }
@@ -948,7 +948,7 @@ int lsgLoadGame(int mode)
         soundPlayFile("iisxxxx1");
         strcpy(_str0, getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, 106));
         strcpy(_str1, getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, 107));
-        sprintf(_str2, "\"%s\\\"", "SAVEGAME");
+        snprintf(_str2, sizeof(_str2), "\"%s\\\"", "SAVEGAME");
         showDialogBox(_str0, body, 2, 169, 116, _colorTable[32328], 0, _colorTable[32328], DIALOG_BOX_LARGE);
         lsgWindowFree(windowType);
         return -1;
@@ -1268,7 +1268,7 @@ static int lsgWindowInit(int windowType)
         return -1;
     }
 
-    sprintf(_str, "%s%s", asc_5186C8, LSGAME_MSG_NAME);
+    snprintf(_str, sizeof(_str), "%s%s", asc_5186C8, LSGAME_MSG_NAME);
     if (!messageListLoad(&gLoadSaveMessageList, _str)) {
         return -1;
     }
@@ -1516,10 +1516,10 @@ static int lsgPerformSaveGame()
 
     backgroundSoundPause();
 
-    sprintf(_gmpath, "%s\\%s", _patches, "SAVEGAME");
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s", _patches, "SAVEGAME");
     compat_mkdir(_gmpath);
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     compat_mkdir(_gmpath);
 
     strcat(_gmpath, "\\" PROTO_DIR_NAME);
@@ -1537,7 +1537,7 @@ static int lsgPerformSaveGame()
         debugPrint("\nLOADSAVE: Warning, can't backup save file!\n");
     }
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
     strcat(_gmpath, "SAVE.DAT");
 
     debugPrint("\nLOADSAVE: Save name: %s\n", _gmpath);
@@ -1546,7 +1546,7 @@ static int lsgPerformSaveGame()
     if (_flptr == NULL) {
         debugPrint("\nLOADSAVE: ** Error opening save game for writing! **\n");
         _RestoreSave();
-        sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+        snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
         _MapDirErase(_gmpath, "BAK");
         _partyMemberUnPrepSave();
         backgroundSoundResume();
@@ -1559,7 +1559,7 @@ static int lsgPerformSaveGame()
         debugPrint("LOADSAVE: Save file header size written: %d bytes.\n", fileTell(_flptr) - pos);
         fileClose(_flptr);
         _RestoreSave();
-        sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+        snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
         _MapDirErase(_gmpath, "BAK");
         _partyMemberUnPrepSave();
         backgroundSoundResume();
@@ -1573,7 +1573,7 @@ static int lsgPerformSaveGame()
             debugPrint("\nLOADSAVE: ** Error writing save function #%d data! **\n", index);
             fileClose(_flptr);
             _RestoreSave();
-            sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+            snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
             _MapDirErase(_gmpath, "BAK");
             _partyMemberUnPrepSave();
             backgroundSoundResume();
@@ -1587,7 +1587,7 @@ static int lsgPerformSaveGame()
 
     fileClose(_flptr);
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
     _MapDirErase(_gmpath, "BAK");
 
     gLoadSaveMessageListItem.num = 140;
@@ -1619,7 +1619,7 @@ static int lsgLoadGameInSlot(int slot)
         gameMouseSetCursor(MOUSE_CURSOR_WAIT_PLANET);
     }
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
     strcat(_gmpath, "SAVE.DAT");
 
     STRUCT_613D30* ptr = &(_LSData[slot]);
@@ -1662,7 +1662,7 @@ static int lsgLoadGameInSlot(int slot)
     debugPrint("LOADSAVE: Total load data read: %ld bytes.\n", fileTell(_flptr));
     fileClose(_flptr);
 
-    sprintf(_str, "%s\\", "MAPS");
+    snprintf(_str, sizeof(_str), "%s\\", "MAPS");
     _MapDirErase(_str, "BAK");
     _proto_dude_update_gender();
 
@@ -1887,7 +1887,7 @@ static int _GetSlotList()
 {
     int index = 0;
     for (; index < 10; index += 1) {
-        sprintf(_str, "%s\\%s%.2d\\%s", "SAVEGAME", "SLOT", index + 1, "SAVE.DAT");
+        snprintf(_str, sizeof(_str), "%s\\%s%.2d\\%s", "SAVEGAME", "SLOT", index + 1, "SAVE.DAT");
 
         int fileSize;
         if (dbGetFileSize(_str, &fileSize) != 0) {
@@ -1928,7 +1928,7 @@ static void _ShowSlotList(int a1)
 
         int color = index == _slot_cursor ? _colorTable[32747] : _colorTable[992];
         const char* text = getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, a1 != 0 ? 110 : 109);
-        sprintf(_str, "[   %s %.2d:   ]", text, index + 1);
+        snprintf(_str, sizeof(_str), "[   %s %.2d:   ]", text, index + 1);
         fontDrawText(gLoadSaveWindowBuffer + LS_WINDOW_WIDTH * y + 55, _str, LS_WINDOW_WIDTH, LS_WINDOW_WIDTH, color);
 
         y += fontGetLineHeight();
@@ -1939,18 +1939,18 @@ static void _ShowSlotList(int a1)
         case SLOT_STATE_EMPTY:
             // - EMPTY -
             text = getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, 111);
-            sprintf(_str, "       %s", text);
+            snprintf(_str, sizeof(_str), "       %s", text);
             break;
         case SLOT_STATE_ERROR:
             // - CORRUPT SAVE FILE -
             text = getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, 112);
-            sprintf(_str, "%s", text);
+            snprintf(_str, sizeof(_str), "%s", text);
             color = _colorTable[32328];
             break;
         case SLOT_STATE_UNSUPPORTED_VERSION:
             // - OLD VERSION -
             text = getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, 113);
-            sprintf(_str, " %s", text);
+            snprintf(_str, sizeof(_str), " %s", text);
             color = _colorTable[32328];
             break;
         }
@@ -1981,14 +1981,14 @@ static void _DrawInfoBox(int a1)
             int v21 = 4 * v6 + v5;
 
             text = getmsg(&gLoadSaveMessageList, &gLoadSaveMessageListItem, 116 + ptr->field_68);
-            sprintf(_str, "%.2d %s %.4d   %.4d", ptr->field_6A, text, ptr->field_6C, v21);
+            snprintf(_str, sizeof(_str), "%.2d %s %.4d   %.4d", ptr->field_6A, text, ptr->field_6C, v21);
 
             int v2 = fontGetLineHeight();
             fontDrawText(gLoadSaveWindowBuffer + LS_WINDOW_WIDTH * (256 + v2) + 397, _str, LS_WINDOW_WIDTH, LS_WINDOW_WIDTH, color);
 
             const char* v22 = mapGetName(ptr->field_76, ptr->field_74);
             const char* v9 = mapGetCityName(ptr->field_76);
-            sprintf(_str, "%s %s", v9, v22);
+            snprintf(_str, sizeof(_str), "%s %s", v9, v22);
 
             int y = v2 + 3 + v2 + 256;
             short beginnings[WORD_WRAP_MAX_COUNT];
@@ -2037,7 +2037,7 @@ static int _LoadTumbSlot(int a1)
 
     v2 = _LSstatus[_slot_cursor];
     if (v2 != 0 && v2 != 2 && v2 != 3) {
-        sprintf(_str, "%s\\%s%.2d\\%s", "SAVEGAME", "SLOT", _slot_cursor + 1, "SAVE.DAT");
+        snprintf(_str, sizeof(_str), "%s\\%s%.2d\\%s", "SAVEGAME", "SLOT", _slot_cursor + 1, "SAVE.DAT");
         debugPrint(" Filename %s\n", _str);
 
         stream = fileOpen(_str, "rb");
@@ -2349,14 +2349,14 @@ static int _GameMap2Slot(File* stream)
         const char* critterItemPath = (pid >> 24) == OBJ_TYPE_CRITTER
             ? PROTO_DIR_NAME "\\" CRITTERS_DIR_NAME
             : PROTO_DIR_NAME "\\" ITEMS_DIR_NAME;
-        sprintf(_str0, "%s\\%s\\%s", _patches, critterItemPath, path);
+        snprintf(_str0, sizeof(_str0), "%s\\%s\\%s", _patches, critterItemPath, path);
-        sprintf(_str1, "%s\\%s\\%s%.2d\\%s\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, critterItemPath, path);
+        snprintf(_str1, sizeof(_str1), "%s\\%s\\%s%.2d\\%s\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, critterItemPath, path);
         if (fileCopyCompressed(_str0, _str1) == -1) {
             return -1;
         }
     }
 
-    sprintf(_str0, "%s\\*.%s", "MAPS", "SAV");
+    snprintf(_str0, sizeof(_str0), "%s\\*.%s", "MAPS", "SAV");
 
     char** fileNameList;
     int fileNameListLength = fileNameListInit(_str0, &fileNameList, 0, 0);
@@ -2374,14 +2374,14 @@ static int _GameMap2Slot(File* stream)
         return -1;
     }
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
 
     if (_MapDirErase(_gmpath, "SAV") == -1) {
         fileNameListFree(&fileNameList, 0);
         return -1;
     }
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     _strmfe(_str0, "AUTOMAP.DB", "SAV");
     strcat(_gmpath, _str0);
     compat_remove(_gmpath);
@@ -2393,8 +2393,8 @@ static int _GameMap2Slot(File* stream)
             return -1;
         }
 
-        sprintf(_str0, "%s\\%s\\%s", _patches, "MAPS", string);
+        snprintf(_str0, sizeof(_str0), "%s\\%s\\%s", _patches, "MAPS", string);
-        sprintf(_str1, "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, string);
+        snprintf(_str1, sizeof(_str1), "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, string);
         if (fileCopyCompressed(_str0, _str1) == -1) {
             fileNameListFree(&fileNameList, 0);
             return -1;
@@ -2404,14 +2404,14 @@ static int _GameMap2Slot(File* stream)
     fileNameListFree(&fileNameList, 0);
 
     _strmfe(_str0, "AUTOMAP.DB", "SAV");
-    sprintf(_str1, "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, _str0);
+    snprintf(_str1, sizeof(_str1), "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, _str0);
-    sprintf(_str0, "%s\\%s\\%s", _patches, "MAPS", "AUTOMAP.DB");
+    snprintf(_str0, sizeof(_str0), "%s\\%s\\%s", _patches, "MAPS", "AUTOMAP.DB");
 
     if (fileCopyCompressed(_str0, _str1) == -1) {
         return -1;
     }
 
-    sprintf(_str0, "%s\\%s", "MAPS", "AUTOMAP.DB");
+    snprintf(_str0, sizeof(_str0), "%s\\%s", "MAPS", "AUTOMAP.DB");
     File* inStream = fileOpen(_str0, "rb");
     if (inStream == NULL) {
         return -1;
@@ -2453,26 +2453,26 @@ static int _SlotMap2Game(File* stream)
         return -1;
     }
 
-    sprintf(_str0, "%s\\", PROTO_DIR_NAME "\\" CRITTERS_DIR_NAME);
+    snprintf(_str0, sizeof(_str0), "%s\\", PROTO_DIR_NAME "\\" CRITTERS_DIR_NAME);
 
     if (_MapDirErase(_str0, PROTO_FILE_EXT) == -1) {
         debugPrint("LOADSAVE: returning 3\n");
         return -1;
     }
 
-    sprintf(_str0, "%s\\", PROTO_DIR_NAME "\\" ITEMS_DIR_NAME);
+    snprintf(_str0, sizeof(_str0), "%s\\", PROTO_DIR_NAME "\\" ITEMS_DIR_NAME);
     if (_MapDirErase(_str0, PROTO_FILE_EXT) == -1) {
         debugPrint("LOADSAVE: returning 4\n");
         return -1;
     }
 
-    sprintf(_str0, "%s\\", "MAPS");
+    snprintf(_str0, sizeof(_str0), "%s\\", "MAPS");
     if (_MapDirErase(_str0, "SAV") == -1) {
         debugPrint("LOADSAVE: returning 5\n");
         return -1;
     }
 
-    sprintf(_str0, "%s\\%s\\%s", _patches, "MAPS", "AUTOMAP.DB");
+    snprintf(_str0, sizeof(_str0), "%s\\%s\\%s", _patches, "MAPS", "AUTOMAP.DB");
     compat_remove(_str0);
 
     for (int index = 1; index < gPartyMemberDescriptionsLength; index += 1) {
@@ -2483,8 +2483,8 @@ static int _SlotMap2Game(File* stream)
                 const char* basePath = PID_TYPE(pid) == OBJ_TYPE_CRITTER
                     ? PROTO_DIR_NAME "\\" CRITTERS_DIR_NAME
                     : PROTO_DIR_NAME "\\" ITEMS_DIR_NAME;
-                sprintf(_str0, "%s\\%s\\%s", _patches, basePath, protoPath);
+                snprintf(_str0, sizeof(_str0), "%s\\%s\\%s", _patches, basePath, protoPath);
-                sprintf(_str1, "%s\\%s\\%s%.2d\\%s\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, basePath, protoPath);
+                snprintf(_str1, sizeof(_str1), "%s\\%s\\%s%.2d\\%s\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, basePath, protoPath);
 
                 if (_gzdecompress_file(_str1, _str0) == -1) {
                     debugPrint("LOADSAVE: returning 6\n");
@@ -2500,8 +2500,8 @@ static int _SlotMap2Game(File* stream)
             break;
         }
 
-        sprintf(_str0, "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, fileName);
+        snprintf(_str0, sizeof(_str0), "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, fileName);
-        sprintf(_str1, "%s\\%s\\%s", _patches, "MAPS", fileName);
+        snprintf(_str1, sizeof(_str1), "%s\\%s\\%s", _patches, "MAPS", fileName);
 
         if (_gzdecompress_file(_str0, _str1) == -1) {
             debugPrint("LOADSAVE: returning 7\n");
@@ -2510,14 +2510,14 @@ static int _SlotMap2Game(File* stream)
     }
 
     const char* automapFileName = _strmfe(_str1, "AUTOMAP.DB", "SAV");
-    sprintf(_str0, "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, automapFileName);
+    snprintf(_str0, sizeof(_str0), "%s\\%s\\%s%.2d\\%s", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1, automapFileName);
-    sprintf(_str1, "%s\\%s\\%s", _patches, "MAPS", "AUTOMAP.DB");
+    snprintf(_str1, sizeof(_str1), "%s\\%s\\%s", _patches, "MAPS", "AUTOMAP.DB");
     if (fileCopyDecompressed(_str0, _str1) == -1) {
         debugPrint("LOADSAVE: returning 8\n");
         return -1;
     }
 
-    sprintf(_str1, "%s\\%s", "MAPS", "AUTOMAP.DB");
+    snprintf(_str1, sizeof(_str1), "%s\\%s", "MAPS", "AUTOMAP.DB");
 
     int v12;
     if (fileReadInt32(stream, &v12) == -1) {
@@ -2637,7 +2637,7 @@ out:
 void lsgInit()
 {
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s\\", "MAPS");
+    snprintf(path, sizeof(path), "%s\\", "MAPS");
     _MapDirErase(path, "SAV");
 }
 
@@ -2645,12 +2645,12 @@ void lsgInit()
 static int _MapDirErase(const char* relativePath, const char* extension)
 {
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s*.%s", relativePath, extension);
+    snprintf(path, sizeof(path), "%s*.%s", relativePath, extension);
 
     char** fileList;
     int fileListLength = fileNameListInit(path, &fileList, 0, 0);
     while (--fileListLength >= 0) {
-        sprintf(path, "%s\\%s%s", _patches, relativePath, fileList[fileListLength]);
+        snprintf(path, sizeof(path), "%s\\%s%s", _patches, relativePath, fileList[fileListLength]);
         compat_remove(path);
     }
     fileNameListFree(&fileList, 0);
@@ -2663,7 +2663,7 @@ int _MapDirEraseFile_(const char* a1, const char* a2)
 {
     char path[COMPAT_MAX_PATH];
 
-    sprintf(path, "%s\\%s%s", _patches, a1, a2);
+    snprintf(path, sizeof(path), "%s\\%s%s", _patches, a1, a2);
     if (compat_remove(path) != 0) {
         return -1;
     }
@@ -2676,7 +2676,7 @@ static int _SaveBackup()
 {
     debugPrint("\nLOADSAVE: Backing up save slot files..\n");
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     strcpy(_str0, _gmpath);
 
     strcat(_str0, "SAVE.DAT");
@@ -2691,8 +2691,8 @@ static int _SaveBackup()
         }
     }
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
-    sprintf(_str0, "%s*.%s", _gmpath, "SAV");
+    snprintf(_str0, sizeof(_str0), "%s*.%s", _gmpath, "SAV");
 
     char** fileList;
     int fileListLength = fileNameListInit(_str0, &fileList, 0, 0);
@@ -2702,7 +2702,7 @@ static int _SaveBackup()
 
     _map_backup_count = fileListLength;
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     for (int index = fileListLength - 1; index >= 0; index--) {
         strcpy(_str0, _gmpath);
         strcat(_str0, fileList[index]);
@@ -2718,13 +2718,13 @@ static int _SaveBackup()
 
     debugPrint("\nLOADSAVE: %d map files backed up.\n", fileListLength);
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
 
     char* v1 = _strmfe(_str2, "AUTOMAP.DB", "SAV");
-    sprintf(_str0, "%s\\%s", _gmpath, v1);
+    snprintf(_str0, sizeof(_str0), "%s\\%s", _gmpath, v1);
 
     char* v2 = _strmfe(_str2, "AUTOMAP.DB", "BAK");
-    sprintf(_str1, "%s\\%s", _gmpath, v2);
+    snprintf(_str1, sizeof(_str1), "%s\\%s", _gmpath, v2);
 
     _automap_db_flag = 0;
 
@@ -2749,7 +2749,7 @@ static int _RestoreSave()
 
     _EraseSave();
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     strcpy(_str0, _gmpath);
     strcat(_str0, "SAVE.DAT");
     _strmfe(_str1, _str0, "BAK");
@@ -2760,8 +2760,8 @@ static int _RestoreSave()
         return -1;
     }
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
-    sprintf(_str0, "%s*.%s", _gmpath, "BAK");
+    snprintf(_str0, sizeof(_str0), "%s*.%s", _gmpath, "BAK");
 
     char** fileList;
     int fileListLength = fileNameListInit(_str0, &fileList, 0, 0);
@@ -2775,7 +2775,7 @@ static int _RestoreSave()
         return -1;
     }
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
 
     for (int index = fileListLength - 1; index >= 0; index--) {
         strcpy(_str0, _gmpath);
@@ -2795,7 +2795,7 @@ static int _RestoreSave()
         return 0;
     }
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     char* v1 = _strmfe(_str2, "AUTOMAP.DB", "BAK");
     strcpy(_str0, _gmpath);
     strcat(_str0, v1);
@@ -2837,13 +2837,13 @@ static int _EraseSave()
 {
     debugPrint("\nLOADSAVE: Erasing save(bad) slot...\n");
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     strcpy(_str0, _gmpath);
     strcat(_str0, "SAVE.DAT");
     compat_remove(_str0);
 
-    sprintf(_gmpath, "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s%.2d\\", "SAVEGAME", "SLOT", _slot_cursor + 1);
-    sprintf(_str0, "%s*.%s", _gmpath, "SAV");
+    snprintf(_str0, sizeof(_str0), "%s*.%s", _gmpath, "SAV");
 
     char** fileList;
     int fileListLength = fileNameListInit(_str0, &fileList, 0, 0);
@@ -2851,7 +2851,7 @@ static int _EraseSave()
         return -1;
     }
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
     for (int index = fileListLength - 1; index >= 0; index--) {
         strcpy(_str0, _gmpath);
         strcat(_str0, fileList[index]);
@@ -2860,7 +2860,7 @@ static int _EraseSave()
 
     fileNameListFree(&fileList, 0);
 
-    sprintf(_gmpath, "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
+    snprintf(_gmpath, sizeof(_gmpath), "%s\\%s\\%s%.2d\\", _patches, "SAVEGAME", "SLOT", _slot_cursor + 1);
 
     char* v1 = _strmfe(_str1, "AUTOMAP.DB", "SAV");
     strcpy(_str0, _gmpath);

src/main.cc

@@ -728,7 +728,7 @@ static int _mainDeathGrabTextFile(const char* fileName, char* dest)
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "text\\%s\\cuts\\%s%s", settings.system.language.c_str(), p + 1, ".TXT");
+    snprintf(path, sizeof(path), "text\\%s\\cuts\\%s%s", settings.system.language.c_str(), p + 1, ".TXT");
 
     File* stream = fileOpen(path, "rt");
     if (stream == NULL) {
@@ -863,7 +863,7 @@ static int mainMenuWindowInit()
     // TODO: Allow to move version text
     // Version.
     char version[VERSION_MAX];
-    versionGetVersion(version);
+    versionGetVersion(version, sizeof(version));
     len = fontGetStringWidth(version);
     windowDrawText(gMainMenuWindow, version, 0, 615 - len, 460, fontSettings | 0x06000000);
 

src/map.cc

@@ -159,11 +159,6 @@ int gIsoWindow;
 // 0x631E50
 static char _scratchStr[40];
 
-// Last map file name.
-//
-// 0x631E78
-static char _map_path[COMPAT_MAX_PATH];
-
 // CE: Basically the same problem described in |gMapLocalPointers|, but this
 // time Olympus folks use global map variables to store objects (looks like
 // only `self_obj`).
@@ -293,7 +288,7 @@ void _map_init()
 
     if (messageListInit(&gMapMessageList)) {
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%smap.msg", asc_5186C8);
+        snprintf(path, sizeof(path), "%smap.msg", asc_5186C8);
 
         if (!messageListLoad(&gMapMessageList, path)) {
             debugPrint("\nError loading map_msg_file!");
@@ -709,10 +704,13 @@ int mapScroll(int dx, int dy)
 // 0x482900
 static char* mapBuildPath(char* name)
 {
+    // 0x631E78
+    static char map_path[COMPAT_MAX_PATH];
+
     if (*name != '\\') {
         // NOTE: Uppercased from "maps".
-        sprintf(_map_path, "MAPS\\%s", name);
+        snprintf(map_path, sizeof(map_path), "MAPS\\%s", name);
-        return _map_path;
+        return map_path;
     }
     return name;
 }
@@ -928,7 +926,7 @@ static int mapLoad(File* stream)
 
     if ((gMapHeader.flags & 1) == 0) {
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "maps\\%s", gMapHeader.name);
+        snprintf(path, sizeof(path), "maps\\%s", gMapHeader.name);
 
         char* extension = strstr(path, ".MAP");
         if (extension == NULL) {
@@ -983,7 +981,7 @@ err:
 
     if (error != NULL) {
         char message[100]; // TODO: Size is probably wrong.
-        sprintf(message, "%s while loading map.", error);
+        snprintf(message, sizeof(message), "%s while loading map.", error);
         debugPrint(message);
         mapNewMap();
         rc = -1;
@@ -1319,12 +1317,12 @@ static int _map_save()
             rc = _map_save_file(stream);
             fileClose(stream);
         } else {
-            sprintf(temp, "Unable to open %s to write!", gMapHeader.name);
+            snprintf(temp, sizeof(temp), "Unable to open %s to write!", gMapHeader.name);
             debugPrint(temp);
         }
 
         if (rc == 0) {
-            sprintf(temp, "%s saved.", gMapHeader.name);
+            snprintf(temp, sizeof(temp), "%s saved.", gMapHeader.name);
             debugPrint(temp);
         }
     } else {
@@ -1403,12 +1401,12 @@ static int _map_save_file(File* stream)
     char err[80];
 
     if (scriptSaveAll(stream) == -1) {
-        sprintf(err, "Error saving scripts in %s", gMapHeader.name);
+        snprintf(err, sizeof(err), "Error saving scripts in %s", gMapHeader.name);
         _win_msg(err, 80, 80, _colorTable[31744]);
     }
 
     if (objectSaveAll(stream) == -1) {
-        sprintf(err, "Error saving objects in %s", gMapHeader.name);
+        snprintf(err, sizeof(err), "Error saving objects in %s", gMapHeader.name);
         _win_msg(err, 80, 80, _colorTable[31744]);
     }
 

src/memory_manager.cc

@@ -28,9 +28,6 @@ static ReallocProc* gMemoryManagerReallocProc = memoryManagerDefaultReallocImpl;
 // 0x519594
 static FreeProc* gMemoryManagerFreeProc = memoryManagerDefaultFreeImpl;
 
-// 0x631F7C
-static char gMemoryManagerLastError[256];
-
 // 0x4845B0
 static void memoryManagerDefaultPrintErrorImpl(const char* string)
 {
@@ -40,15 +37,18 @@ static void memoryManagerDefaultPrintErrorImpl(const char* string)
 // 0x4845C8
 static int memoryManagerPrintError(const char* format, ...)
 {
+    // 0x631F7C
+    static char err[256];
+
     int length = 0;
 
     if (gMemoryManagerPrintErrorProc != NULL) {
         va_list args;
         va_start(args, format);
-        length = vsprintf(gMemoryManagerLastError, format, args);
+        length = vsnprintf(err, sizeof(err), format, args);
         va_end(args);
 
-        gMemoryManagerPrintErrorProc(gMemoryManagerLastError);
+        gMemoryManagerPrintErrorProc(err);
     }
 
     return length;

src/message.cc

@@ -223,14 +223,14 @@ bool messageListLoad(MessageList* messageList, const char* path)
         return false;
     }
 
-    sprintf(localized_path, "%s\\%s\\%s", "text", settings.system.language.c_str(), path);
+    snprintf(localized_path, sizeof(localized_path), "%s\\%s\\%s", "text", settings.system.language.c_str(), path);
 
     file_ptr = fileOpen(localized_path, "rt");
 
     // SFALL: Fallback to english if requested localization does not exist.
     if (file_ptr == NULL) {
         if (compat_stricmp(settings.system.language.c_str(), ENGLISH) != 0) {
-            sprintf(localized_path, "%s\\%s\\%s", "text", ENGLISH, path);
+            snprintf(localized_path, sizeof(localized_path), "%s\\%s\\%s", "text", ENGLISH, path);
             file_ptr = fileOpen(localized_path, "rt");
         }
     }
@@ -318,7 +318,7 @@ bool messageListGetItem(MessageList* msg, MessageListItem* entry)
 // Builds language-aware path in "text" subfolder.
 //
 // 0x484CB8
-bool _message_make_path(char* dest, const char* path)
+bool _message_make_path(char* dest, size_t size, const char* path)
 {
     if (dest == NULL) {
         return false;
@@ -328,7 +328,7 @@ bool _message_make_path(char* dest, const char* path)
         return false;
     }
 
-    sprintf(dest, "%s\\%s\\%s", "text", settings.system.language.c_str(), path);
+    snprintf(dest, size, "%s\\%s\\%s", "text", settings.system.language.c_str(), path);
 
     return true;
 }
@@ -659,7 +659,7 @@ bool messageListRepositoryInit()
             nextMessageListId = atoi(sep + 1);
         }
 
-        sprintf(path, "%s\\%s.msg", "game", fileList);
+        snprintf(path, sizeof(path), "%s\\%s.msg", "game", fileList);
 
         if (sep != nullptr) {
             *sep = ':';

src/message.h

@@ -1,6 +1,8 @@
 #ifndef MESSAGE_H
 #define MESSAGE_H
 
+#include <stddef.h>
+
 namespace fallout {
 
 #define MESSAGE_LIST_ITEM_TEXT_FILTERED 0x01
@@ -76,7 +78,7 @@ bool messageListInit(MessageList* msg);
 bool messageListFree(MessageList* msg);
 bool messageListLoad(MessageList* msg, const char* path);
 bool messageListGetItem(MessageList* msg, MessageListItem* entry);
-bool _message_make_path(char* dest, const char* path);
+bool _message_make_path(char* dest, size_t size, const char* path);
 char* getmsg(MessageList* msg, MessageListItem* entry, int num);
 bool messageListFilterBadwords(MessageList* messageList);
 

src/options.cc

@@ -563,7 +563,7 @@ static int optionsWindowInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "options.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "options.msg");
     if (!messageListLoad(&gOptionsMessageList, path)) {
         return -1;
     }
@@ -742,7 +742,7 @@ int showPause(bool a1)
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "options.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "options.msg");
     if (!messageListLoad(&gOptionsMessageList, path)) {
         // FIXME: Leaking graphics.
         return -1;

src/party_member.cc

@@ -125,12 +125,12 @@ int partyMembersInit()
     }
 
     char section[50];
-    sprintf(section, "Party Member %d", gPartyMemberDescriptionsLength);
+    snprintf(section, sizeof(section), "Party Member %d", gPartyMemberDescriptionsLength);
 
     int partyMemberPid;
     while (configGetInt(&config, section, "party_member_pid", &partyMemberPid)) {
         gPartyMemberDescriptionsLength++;
-        sprintf(section, "Party Member %d", gPartyMemberDescriptionsLength);
+        snprintf(section, sizeof(section), "Party Member %d", gPartyMemberDescriptionsLength);
     }
 
     gPartyMemberPids = (int*)internal_malloc(sizeof(*gPartyMemberPids) * gPartyMemberDescriptionsLength);
@@ -160,7 +160,7 @@ int partyMembersInit()
     memset(_partyMemberLevelUpInfoList, 0, sizeof(*_partyMemberLevelUpInfoList) * gPartyMemberDescriptionsLength);
 
     for (int index = 0; index < gPartyMemberDescriptionsLength; index++) {
-        sprintf(section, "Party Member %d", index);
+        snprintf(section, sizeof(section), "Party Member %d", index);
 
         if (!configGetInt(&config, section, "party_member_pid", &partyMemberPid)) {
             break;
@@ -1528,7 +1528,7 @@ int _partyMemberIncLevels()
                     name = critterGetName(obj);
                     // %s has gained in some abilities.
                     text = getmsg(&gMiscMessageList, &msg, 9000);
-                    sprintf(str, text, name);
+                    snprintf(str, sizeof(str), text, name);
                     displayMonitorAddMessage(str);
 
                     debugPrint(str);
@@ -1537,7 +1537,7 @@ int _partyMemberIncLevels()
                     msg.num = 9000 + 10 * v0 + ptr_519DBC->field_0 - 1;
                     if (messageListGetItem(&gMiscMessageList, &msg)) {
                         name = critterGetName(obj);
-                        sprintf(str, msg.text, name);
+                        snprintf(str, sizeof(str), msg.text, name);
                         textObjectAdd(obj, str, 101, _colorTable[0x7FFF], _colorTable[0], &v19);
                         tileWindowRefreshRect(&v19, obj->elevation);
                     }

src/perk.cc

@@ -192,7 +192,7 @@ int perksInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "perk.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "perk.msg");
 
     if (!messageListLoad(&gPerksMessageList, path)) {
         return -1;

src/pipboy.cc

@@ -519,7 +519,7 @@ static int pipboyWindowInit(int intent)
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "pipboy.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "pipboy.msg");
 
     if (!(messageListLoad(&gPipboyMessageList, path))) {
         return -1;
@@ -1135,7 +1135,7 @@ static void pipboyWindowHandleStatus(int a1)
         const char* text1 = getmsg(&gPipboyMessageList, &gPipboyMessageListItem, 210);
         const char* text2 = getmsg(&gMapMessageList, &gPipboyMessageListItem, questDescription->location);
         char formattedText[1024];
-        sprintf(formattedText, "%s %s", text2, text1);
+        snprintf(formattedText, sizeof(formattedText), "%s %s", text2, text1);
         pipboyDrawText(formattedText, PIPBOY_TEXT_STYLE_UNDERLINE, _colorTable[992]);
 
         if (gPipboyLinesCount >= 3) {
@@ -1148,7 +1148,7 @@ static void pipboyWindowHandleStatus(int a1)
             if (gGameGlobalVars[questDescription->gvar] >= questDescription->displayThreshold) {
                 const char* text = getmsg(&gQuestsMessageList, &gPipboyMessageListItem, questDescription->description);
                 char formattedText[1024];
-                sprintf(formattedText, "%d. %s", number, text);
+                snprintf(formattedText, sizeof(formattedText), "%d. %s", number, text);
                 number += 1;
 
                 short beginnings[WORD_WRAP_MAX_COUNT];
@@ -1321,7 +1321,7 @@ static void pipboyRenderHolodiskText()
         // of
         const char* of = getmsg(&gPipboyMessageList, &gPipboyMessageListItem, 212);
         char formattedText[60]; // TODO: Size is probably wrong.
-        sprintf(formattedText, "%d %s %d", _view_page + 1, of, gPipboyHolodiskLastPage + 1);
+        snprintf(formattedText, sizeof(formattedText), "%d %s %d", _view_page + 1, of, gPipboyHolodiskLastPage + 1);
 
         int len = fontGetStringWidth(of);
         fontDrawText(gPipboyWindowBuffer + PIPBOY_WINDOW_WIDTH * 47 + 616 + 604 - len, formattedText, 350, PIPBOY_WINDOW_WIDTH, _colorTable[992]);
@@ -1886,7 +1886,7 @@ static void pipboyDrawHitPoints()
     max_hp = critterGetStat(gDude, STAT_MAXIMUM_HIT_POINTS);
     cur_hp = critterGetHitPoints(gDude);
     text = getmsg(&gPipboyMessageList, &gPipboyMessageListItem, 301); // Hit Points
-    sprintf(msg, "%s %d/%d", text, cur_hp, max_hp);
+    snprintf(msg, sizeof(msg), "%s %d/%d", text, cur_hp, max_hp);
     len = fontGetStringWidth(msg);
     fontDrawText(gPipboyWindowBuffer + 66 * PIPBOY_WINDOW_WIDTH + 254 + (350 - len) / 2, msg, PIPBOY_WINDOW_WIDTH, PIPBOY_WINDOW_WIDTH, _colorTable[992]);
 }

src/proto.cc

@@ -1065,7 +1065,7 @@ int protoInit()
     char path[COMPAT_MAX_PATH];
     int i;
 
-    sprintf(path, "%s\\proto", settings.system.master_patches_path.c_str());
+    snprintf(path, sizeof(path), "%s\\proto", settings.system.master_patches_path.c_str());
     len = strlen(path);
 
     compat_mkdir(path);
@@ -1103,7 +1103,7 @@ int protoInit()
     }
 
     for (i = 0; i < 6; i++) {
-        sprintf(path, "%spro_%.4s%s", asc_5186C8, artGetObjectTypeName(i), ".msg");
+        snprintf(path, sizeof(path), "%spro_%.4s%s", asc_5186C8, artGetObjectTypeName(i), ".msg");
 
         if (!messageListLoad(&(_proto_msg_files[i]), path)) {
             debugPrint("\nError: Loading proto message files!");
@@ -1141,7 +1141,7 @@ int protoInit()
         return -1;
     }
 
-    sprintf(path, "%sproto.msg", asc_5186C8);
+    snprintf(path, sizeof(path), "%sproto.msg", asc_5186C8);
 
     if (!messageListLoad(&gProtoMessageList, path)) {
         debugPrint("\nError: Loading main proto message file!");

src/proto_instance.cc

@@ -216,7 +216,7 @@ int _obj_look_at_func(Object* a1, Object* a2, void (*a3)(char* string))
             const char* objectName = objectGetName(a2);
 
             char formattedText[260];
-            sprintf(formattedText, messageListItem.text, objectName);
+            snprintf(formattedText, sizeof(formattedText), messageListItem.text, objectName);
 
             a3(formattedText);
         }
@@ -326,7 +326,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                 }
 
                 char format[80];
-                sprintf(format, "%s%s", hpMessageListItem.text, weaponMessageListItem.text);
+                snprintf(format, sizeof(format), "%s%s", hpMessageListItem.text, weaponMessageListItem.text);
 
                 if (ammoGetCaliber(item2) != 0) {
                     const int ammoTypePid = weaponGetAmmoTypePid(item2);
@@ -336,7 +336,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                     const char* weaponName = objectGetName(item2);
                     const int maxiumHitPoints = critterGetStat(target, STAT_MAXIMUM_HIT_POINTS);
                     const int currentHitPoints = critterGetStat(target, STAT_CURRENT_HIT_POINTS);
-                    sprintf(formattedText,
+                    snprintf(formattedText, sizeof(formattedText),
                         format,
                         currentHitPoints,
                         maxiumHitPoints,
@@ -348,7 +348,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                     const char* weaponName = objectGetName(item2);
                     const int maxiumHitPoints = critterGetStat(target, STAT_MAXIMUM_HIT_POINTS);
                     const int currentHitPoints = critterGetStat(target, STAT_CURRENT_HIT_POINTS);
-                    sprintf(formattedText,
+                    snprintf(formattedText, sizeof(formattedText),
                         format,
                         currentHitPoints,
                         maxiumHitPoints,
@@ -370,7 +370,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
 
                 const int maxiumHitPoints = critterGetStat(target, STAT_MAXIMUM_HIT_POINTS);
                 const int currentHitPoints = critterGetStat(target, STAT_CURRENT_HIT_POINTS);
-                sprintf(formattedText, hpMessageListItem.text, currentHitPoints, maxiumHitPoints);
+                snprintf(formattedText, sizeof(formattedText), hpMessageListItem.text, currentHitPoints, maxiumHitPoints);
                 strcat(formattedText, endingMessageListItem.text);
             }
         } else {
@@ -419,7 +419,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                     exit(1);
                 }
 
-                sprintf(formattedText, v66.text, hpMessageListItem.text);
+                snprintf(formattedText, sizeof(formattedText), v66.text, hpMessageListItem.text);
             } else {
                 // %s %s
                 v66.num = 521 + v12;
@@ -435,7 +435,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                     exit(1);
                 }
 
-                sprintf(formattedText, v63.text, hpMessageListItem.text);
+                snprintf(formattedText, sizeof(formattedText), v63.text, hpMessageListItem.text);
             }
         }
 
@@ -475,7 +475,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
             }
 
             if (car != 0) {
-                sprintf(formattedText, carMessageListItem.text, 100 * wmCarGasAmount() / 80000);
+                snprintf(formattedText, sizeof(formattedText), carMessageListItem.text, 100 * wmCarGasAmount() / 80000);
             } else {
                 strcpy(formattedText, carMessageListItem.text);
             }
@@ -498,7 +498,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                 const char* ammoName = protoGetName(ammoTypePid);
                 int ammoCapacity = ammoGetCapacity(target);
                 int ammoQuantity = ammoGetQuantity(target);
-                sprintf(formattedText, weaponMessageListItem.text, ammoQuantity, ammoCapacity, ammoName);
+                snprintf(formattedText, sizeof(formattedText), weaponMessageListItem.text, ammoQuantity, ammoCapacity, ammoName);
                 fn(formattedText);
             }
         } else if (itemType == ITEM_TYPE_AMMO) {
@@ -516,7 +516,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                 exit(1);
             }
 
-            sprintf(formattedText,
+            snprintf(formattedText, sizeof(formattedText),
                 ammoMessageListItem.text,
                 ammoGetArmorClassModifier(target));
             if (fn == gameDialogRenderSupplementaryMessage) {
@@ -531,7 +531,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                 exit(1);
             }
 
-            sprintf(formattedText,
+            snprintf(formattedText, sizeof(formattedText),
                 ammoMessageListItem.text,
                 ammoGetDamageResistanceModifier(target));
             if (fn == gameDialogRenderSupplementaryMessage) {
@@ -547,7 +547,7 @@ int _obj_examine_func(Object* critter, Object* target, void (*fn)(char* string))
                 exit(1);
             }
 
-            sprintf(formattedText,
+            snprintf(formattedText, sizeof(formattedText),
                 ammoMessageListItem.text,
                 ammoGetDamageMultiplier(target),
                 ammoGetDamageDivisor(target));
@@ -1201,7 +1201,7 @@ static int _protinst_default_use_item(Object* a1, Object* a2, Object* item)
                 return -1;
             }
 
-            sprintf(formattedText, messageListItem.text, objectGetName(item), objectGetName(a2));
+            snprintf(formattedText, sizeof(formattedText), messageListItem.text, objectGetName(item), objectGetName(a2));
             displayMonitorAddMessage(formattedText);
         }
 
@@ -1233,7 +1233,7 @@ static int _protinst_default_use_item(Object* a1, Object* a2, Object* item)
 
     messageListItem.num = 582;
     if (messageListGetItem(&gProtoMessageList, &messageListItem)) {
-        sprintf(formattedText, "%s", messageListItem.text);
+        snprintf(formattedText, sizeof(formattedText), "%s", messageListItem.text);
         displayMonitorAddMessage(formattedText);
     }
     return -1;
@@ -1494,7 +1494,7 @@ int _obj_use(Object* a1, Object* a2)
 
             char formattedText[260];
             const char* name = objectGetName(a2);
-            sprintf(formattedText, messageListItem.text, name);
+            snprintf(formattedText, sizeof(formattedText), messageListItem.text, name);
             displayMonitorAddMessage(formattedText);
         }
     }
@@ -1857,7 +1857,7 @@ int _obj_use_container(Object* critter, Object* item)
 
         char formattedText[260];
         const char* objectName = objectGetName(item);
-        sprintf(formattedText, messageListItem.text, objectName);
+        snprintf(formattedText, sizeof(formattedText), messageListItem.text, objectName);
         displayMonitorAddMessage(formattedText);
     }
 

src/scripts.cc

@@ -73,7 +73,7 @@ static int scriptsClearPendingRequests();
 static int scriptLocateProcs(Script* scr);
 static int scriptsLoadScriptsList();
 static int scriptsFreeScriptsList();
-static int scriptsGetFileName(int scriptIndex, char* name);
+static int scriptsGetFileName(int scriptIndex, char* name, size_t size);
 static int _scr_header_load();
 static int scriptWrite(Script* scr, File* stream);
 static int scriptListExtentWrite(ScriptListExtent* a1, File* stream);
@@ -256,11 +256,6 @@ static MessageList _script_dialog_msgs[SCRIPT_DIALOG_MESSAGE_LIST_CAPACITY];
 // 0x667724
 static MessageList gScrMessageList;
 
-// time string (h:ss)
-//
-// 0x66772C
-static char _hour_str[7];
-
 // 0x667748
 static int _lasttime;
 
@@ -334,8 +329,11 @@ int gameTimeGetHour()
 // 0x4A3420
 char* gameTimeGetTimeString()
 {
-    sprintf(_hour_str, "%d:%02d", (gGameTime / 600) / 60 % 24, (gGameTime / 600) % 60);
+    // 0x66772C
-    return _hour_str;
+    static char hour_str[7];
+
+    snprintf(hour_str, sizeof(hour_str), "%d:%02d", (gGameTime / 600) / 60 % 24, (gGameTime / 600) % 60);
+    return hour_str;
 }
 
 // TODO: Make unsigned.
@@ -1258,7 +1256,7 @@ int scriptExecProc(int sid, int proc)
         clock();
 
         char name[16];
-        if (scriptsGetFileName(script->field_14 & 0xFFFFFF, name) == -1) {
+        if (scriptsGetFileName(script->field_14 & 0xFFFFFF, name, sizeof(name)) == -1) {
             return -1;
         }
 
@@ -1431,9 +1429,9 @@ int _scr_find_str_run_info(int scriptIndex, int* a2, int sid)
 }
 
 // 0x4A4F68
-static int scriptsGetFileName(int scriptIndex, char* name)
+static int scriptsGetFileName(int scriptIndex, char* name, size_t size)
 {
-    sprintf(name, "%s.int", gScriptsListEntries[scriptIndex].name);
+    snprintf(name, size, "%s.int", gScriptsListEntries[scriptIndex].name);
     return 0;
 }
 
@@ -1558,7 +1556,7 @@ int _scr_game_init()
         }
     }
 
-    sprintf(path, "%s%s", asc_5186C8, "script.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "script.msg");
     if (!messageListLoad(&gScrMessageList, path)) {
         debugPrint("\nError loading script message file!");
         return -1;
@@ -2658,7 +2656,7 @@ static int scriptsGetMessageList(int a1, MessageList** messageListPtr)
     if (messageList->entries_num == 0) {
         char scriptName[20];
         scriptName[0] = '\0';
-        scriptsGetFileName(messageListIndex & 0xFFFFFF, scriptName);
+        scriptsGetFileName(messageListIndex & 0xFFFFFF, scriptName, sizeof(scriptName));
 
         char* pch = strrchr(scriptName, '.');
         if (pch != NULL) {
@@ -2666,7 +2664,7 @@ static int scriptsGetMessageList(int a1, MessageList** messageListPtr)
         }
 
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "dialog\\%s.msg", scriptName);
+        snprintf(path, sizeof(path), "dialog\\%s.msg", scriptName);
 
         if (!messageListLoad(messageList, path)) {
             debugPrint("\nError loading script dialog message file!");
@@ -2752,7 +2750,7 @@ int scriptGetLocalVar(int sid, int variable, ProgramValue& value)
         debugPrint("\nError! System scripts/Map scripts not allowed local_vars! ");
 
         _tempStr1[0] = '\0';
-        scriptsGetFileName(sid & 0xFFFFFF, _tempStr1);
+        scriptsGetFileName(sid & 0xFFFFFF, _tempStr1, sizeof(_tempStr1));
 
         debugPrint(":%s\n", _tempStr1);
 

src/selfrun.cc

@@ -65,7 +65,7 @@ int selfrunPreparePlayback(const char* fileName, SelfrunData* selfrunData)
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", "selfrun\\", fileName);
+    snprintf(path, sizeof(path), "%s%s", "selfrun\\", fileName);
 
     if (selfrunReadData(path, selfrunData) != 0) {
         return -1;
@@ -81,7 +81,7 @@ void selfrunPlaybackLoop(SelfrunData* selfrunData)
 {
     if (gSelfrunState == SELFRUN_STATE_PLAYING) {
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%s%s", "selfrun\\", selfrunData->recordingFileName);
+        snprintf(path, sizeof(path), "%s%s", "selfrun\\", selfrunData->recordingFileName);
 
         if (vcrPlay(path, VCR_TERMINATE_ON_KEY_PRESS | VCR_TERMINATE_ON_MOUSE_PRESS, selfrunPlaybackCompleted)) {
             bool cursorWasHidden = cursorIsHidden();
@@ -136,13 +136,13 @@ int selfrunPrepareRecording(const char* recordingName, const char* mapFileName,
         return -1;
     }
 
-    sprintf(selfrunData->recordingFileName, "%s%s", recordingName, ".vcr");
+    snprintf(selfrunData->recordingFileName, sizeof(selfrunData->recordingFileName), "%s%s", recordingName, ".vcr");
     strcpy(selfrunData->mapFileName, mapFileName);
 
     selfrunData->stopKeyCode = KEY_CTRL_R;
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s%s", "selfrun\\", recordingName, ".sdf");
+    snprintf(path, sizeof(path), "%s%s%s", "selfrun\\", recordingName, ".sdf");
 
     if (selfrunWriteData(path, selfrunData) != 0) {
         return -1;
@@ -158,7 +158,7 @@ void selfrunRecordingLoop(SelfrunData* selfrunData)
 {
     if (gSelfrunState == SELFRUN_STATE_RECORDING) {
         char path[COMPAT_MAX_PATH];
-        sprintf(path, "%s%s", "selfrun\\", selfrunData->recordingFileName);
+        snprintf(path, sizeof(path), "%s%s", "selfrun\\", selfrunData->recordingFileName);
         if (vcrRecord(path)) {
             if (!cursorIsHidden()) {
                 mouseShowCursor();
@@ -232,7 +232,7 @@ int selfrunWriteData(const char* path, SelfrunData* selfrunData)
     }
 
     char selfrunDirectoryPath[COMPAT_MAX_PATH];
-    sprintf(selfrunDirectoryPath, "%s\\%s", settings.system.master_patches_path.c_str(), "selfrun\\");
+    snprintf(selfrunDirectoryPath, sizeof(selfrunDirectoryPath), "%s\\%s", settings.system.master_patches_path.c_str(), "selfrun\\");
 
     compat_mkdir(selfrunDirectoryPath);
 

src/sfall_config.cc

@@ -56,7 +56,7 @@ bool sfallConfigInit(int argc, char** argv)
     char* ch = strrchr(executable, '\\');
     if (ch != NULL) {
         *ch = '\0';
-        sprintf(path, "%s\\%s", executable, SFALL_CONFIG_FILE_NAME);
+        snprintf(path, sizeof(path), "%s\\%s", executable, SFALL_CONFIG_FILE_NAME);
         *ch = '\\';
     } else {
         strcpy(path, SFALL_CONFIG_FILE_NAME);

src/skill.cc

@@ -126,7 +126,7 @@ int skillsInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "skill.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "skill.msg");
 
     if (!messageListLoad(&gSkillsMessageList, path)) {
         return -1;
@@ -535,7 +535,7 @@ static void _show_skill_use_messages(Object* obj, int skill, Object* a3, int a4,
             int after = pcGetStat(PC_STAT_EXPERIENCE);
 
             char text[60];
-            sprintf(text, messageListItem.text, after - before);
+            snprintf(text, sizeof(text), messageListItem.text, after - before);
             displayMonitorAddMessage(text);
         }
     }
@@ -621,7 +621,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                         hpToHeal = maximumHp - currentHp;
                     }
 
-                    sprintf(text, messageListItem.text, hpToHeal);
+                    snprintf(text, sizeof(text), messageListItem.text, hpToHeal);
                     displayMonitorAddMessage(text);
                 }
 
@@ -641,7 +641,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                     return -1;
                 }
 
-                sprintf(text, messageListItem.text, hpToHeal);
+                snprintf(text, sizeof(text), messageListItem.text, hpToHeal);
                 displayMonitorAddMessage(text);
             }
 
@@ -659,7 +659,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                 if (a2 == gDude) {
                     strcpy(text, messageListItem.text);
                 } else {
-                    sprintf(text, messageListItem.text, objectGetName(a2));
+                    snprintf(text, sizeof(text), messageListItem.text, objectGetName(a2));
                 }
 
                 displayMonitorAddMessage(text);
@@ -743,7 +743,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                             return -1;
                         }
 
-                        sprintf(text, prefix.text, messageListItem.text);
+                        snprintf(text, sizeof(text), prefix.text, messageListItem.text);
                         displayMonitorAddMessage(text);
                         _show_skill_use_messages(obj, skill, a2, v1, criticalChanceModifier);
 
@@ -774,7 +774,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                     if (maximumHp - currentHp < hpToHeal) {
                         hpToHeal = maximumHp - currentHp;
                     }
-                    sprintf(text, messageListItem.text, hpToHeal);
+                    snprintf(text, sizeof(text), messageListItem.text, hpToHeal);
                     displayMonitorAddMessage(text);
                 }
 
@@ -801,7 +801,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                     return -1;
                 }
 
-                sprintf(text, messageListItem.text, hpToHeal);
+                snprintf(text, sizeof(text), messageListItem.text, hpToHeal);
                 displayMonitorAddMessage(text);
 
                 scriptsExecMapUpdateProc();
@@ -819,7 +819,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                 if (a2 == gDude) {
                     strcpy(text, messageListItem.text);
                 } else {
-                    sprintf(text, messageListItem.text, objectGetName(a2));
+                    snprintf(text, sizeof(text), messageListItem.text, objectGetName(a2));
                 }
 
                 displayMonitorAddMessage(text);
@@ -928,7 +928,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                         return -1;
                     }
 
-                    sprintf(text, prefix.text, messageListItem.text);
+                    snprintf(text, sizeof(text), prefix.text, messageListItem.text);
                     displayMonitorAddMessage(text);
 
                     _show_skill_use_messages(obj, skill, a2, v1, criticalChanceModifier);
@@ -953,7 +953,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                     if (maximumHp - currentHp < hpToHeal) {
                         hpToHeal = maximumHp - currentHp;
                     }
-                    sprintf(text, messageListItem.text, hpToHeal);
+                    snprintf(text, sizeof(text), messageListItem.text, hpToHeal);
                     displayMonitorAddMessage(text);
                 }
 
@@ -980,7 +980,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                     return -1;
                 }
 
-                sprintf(text, messageListItem.text, hpToHeal);
+                snprintf(text, sizeof(text), messageListItem.text, hpToHeal);
                 displayMonitorAddMessage(text);
 
                 scriptsExecMapUpdateProc();
@@ -995,7 +995,7 @@ int skillUse(Object* obj, Object* a2, int skill, int criticalChanceModifier)
                     return -1;
                 }
 
-                sprintf(text, messageListItem.text, objectGetName(a2));
+                snprintf(text, sizeof(text), messageListItem.text, objectGetName(a2));
                 displayMonitorAddMessage(text);
 
                 giveExp = false;
@@ -1092,7 +1092,7 @@ int skillsPerformStealing(Object* a1, Object* a2, Object* item, bool isPlanting)
             return -1;
         }
 
-        sprintf(text, messageListItem.text, objectGetName(item));
+        snprintf(text, sizeof(text), messageListItem.text, objectGetName(item));
         displayMonitorAddMessage(text);
 
         return 1;
@@ -1104,7 +1104,7 @@ int skillsPerformStealing(Object* a1, Object* a2, Object* item, bool isPlanting)
             return -1;
         }
 
-        sprintf(text, messageListItem.text, objectGetName(item));
+        snprintf(text, sizeof(text), messageListItem.text, objectGetName(item));
         displayMonitorAddMessage(text);
 
         return 0;

src/skilldex.cc

@@ -159,7 +159,7 @@ static int skilldexWindowInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "skilldex.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "skilldex.msg");
 
     if (!messageListLoad(&gSkilldexMessageList, path)) {
         return -1;

src/sound_effects_list.cc

@@ -86,9 +86,9 @@ int soundEffectsListInit(const char* soundEffectsPath, int a2, int debugLevel)
     gSoundEffectsListPathLength = strlen(gSoundEffectsListPath);
 
     if (gSoundEffectsListPathLength == 0 || soundEffectsPath[gSoundEffectsListPathLength - 1] == '\\') {
-        sprintf(path, "%sSNDLIST.LST", soundEffectsPath);
+        snprintf(path, sizeof(path), "%sSNDLIST.LST", soundEffectsPath);
     } else {
-        sprintf(path, "%s\\SNDLIST.LST", soundEffectsPath);
+        snprintf(path, sizeof(path), "%s\\SNDLIST.LST", soundEffectsPath);
     }
 
     File* stream = fileOpen(path, "rt");

src/stat.cc

@@ -111,7 +111,7 @@ int statsInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "stat.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "stat.msg");
 
     if (!messageListLoad(&gStatsMessageList, path)) {
         return -1;

src/text_font.cc

@@ -152,7 +152,7 @@ int textFontLoad(int font)
     int rc = -1;
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "font%d.fon", font);
+    snprintf(path, sizeof(path), "font%d.fon", font);
 
     // NOTE: Original code is slightly different. It uses deep nesting and
     // unwinds everything from the point of failure.

src/trait.cc

@@ -62,7 +62,7 @@ int traitsInit()
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "%s%s", asc_5186C8, "trait.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "trait.msg");
 
     if (!messageListLoad(&gTraitsMessageList, path)) {
         return -1;

src/version.cc

@@ -5,9 +5,9 @@
 namespace fallout {
 
 // 0x4B4580
-void versionGetVersion(char* dest)
+void versionGetVersion(char* dest, size_t size)
 {
-    sprintf(dest, "FALLOUT II %d.%02d", VERSION_MAJOR, VERSION_MINOR);
+    snprintf(dest, size, "FALLOUT II %d.%02d", VERSION_MAJOR, VERSION_MINOR);
 }
 
 } // namespace fallout

src/version.h

@@ -1,6 +1,8 @@
 #ifndef VERSION_H
 #define VERSION_H
 
+#include <stddef.h>
+
 namespace fallout {
 
 // The size of buffer for version string.
@@ -11,7 +13,7 @@ namespace fallout {
 #define VERSION_RELEASE ('R')
 #define VERSION_BUILD_TIME ("Dec 11 1998 16:54:30")
 
-void versionGetVersion(char* dest);
+void versionGetVersion(char* dest, size_t size);
 
 } // namespace fallout
 

src/window.cc

@@ -1342,37 +1342,37 @@ void _initWindow(int resolution, int a2)
     if (rc != WINDOW_MANAGER_OK) {
         switch (rc) {
         case WINDOW_MANAGER_ERR_INITIALIZING_VIDEO_MODE:
-            sprintf(err, "Error initializing video mode %dx%d\n", _xres, _yres);
+            snprintf(err, sizeof(err), "Error initializing video mode %dx%d\n", _xres, _yres);
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_NO_MEMORY:
-            sprintf(err, "Not enough memory to initialize video mode\n");
+            snprintf(err, sizeof(err), "Not enough memory to initialize video mode\n");
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_INITIALIZING_TEXT_FONTS:
-            sprintf(err, "Couldn't find/load text fonts\n");
+            snprintf(err, sizeof(err), "Couldn't find/load text fonts\n");
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_WINDOW_SYSTEM_ALREADY_INITIALIZED:
-            sprintf(err, "Attempt to initialize window system twice\n");
+            snprintf(err, sizeof(err), "Attempt to initialize window system twice\n");
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_WINDOW_SYSTEM_NOT_INITIALIZED:
-            sprintf(err, "Window system not initialized\n");
+            snprintf(err, sizeof(err), "Window system not initialized\n");
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_CURRENT_WINDOWS_TOO_BIG:
-            sprintf(err, "Current windows are too big for new resolution\n");
+            snprintf(err, sizeof(err), "Current windows are too big for new resolution\n");
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_INITIALIZING_DEFAULT_DATABASE:
-            sprintf(err, "Error initializing default database.\n");
+            snprintf(err, sizeof(err), "Error initializing default database.\n");
             showMesageBox(err);
             exit(1);
             break;
@@ -1380,22 +1380,22 @@ void _initWindow(int resolution, int a2)
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_ALREADY_RUNNING:
-            sprintf(err, "Program already running.\n");
+            snprintf(err, sizeof(err), "Program already running.\n");
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_TITLE_NOT_SET:
-            sprintf(err, "Program title not set.\n");
+            snprintf(err, sizeof(err), "Program title not set.\n");
             showMesageBox(err);
             exit(1);
             break;
         case WINDOW_MANAGER_ERR_INITIALIZING_INPUT:
-            sprintf(err, "Failure initializing input devices.\n");
+            snprintf(err, sizeof(err), "Failure initializing input devices.\n");
             showMesageBox(err);
             exit(1);
             break;
         default:
-            sprintf(err, "Unknown error code %d\n", rc);
+            snprintf(err, sizeof(err), "Unknown error code %d\n", rc);
             showMesageBox(err);
             exit(1);
             break;

src/window_manager_private.cc

@@ -1178,10 +1178,10 @@ size_t _calc_max_field_chars_wcursor(int a1, int a2)
         return -1;
     }
 
-    sprintf(str, "%d", a1);
+    snprintf(str, 17, "%d", a1);
     size_t len1 = strlen(str);
 
-    sprintf(str, "%d", a2);
+    snprintf(str, 17, "%d", a2);
     size_t len2 = strlen(str);
 
     internal_free(str);

src/worldmap.cc

@@ -830,7 +830,7 @@ int wmWorldMap_init()
         return -1;
     }
 
-    sprintf(path, "%s%s", asc_5186C8, "worldmap.msg");
+    snprintf(path, sizeof(path), "%s%s", asc_5186C8, "worldmap.msg");
 
     if (!messageListLoad(&wmMsgFile, path)) {
         return -1;
@@ -1257,7 +1257,7 @@ static int wmConfigInit()
 
         for (int index = 0;; index++) {
             char section[40];
-            sprintf(section, "Encounter Table %d", index);
+            snprintf(section, sizeof(section), "Encounter Table %d", index);
 
             char* lookupName;
             if (!configGetString(&config, section, "lookup_name", &lookupName)) {
@@ -1276,7 +1276,7 @@ static int wmConfigInit()
 
         for (int tileIndex = 0; tileIndex < 9999; tileIndex++) {
             char section[40];
-            sprintf(section, "Tile %d", tileIndex);
+            snprintf(section, sizeof(section), "Tile %d", tileIndex);
 
             int artIndex;
             if (!configGetInt(&config, section, "art_idx", &artIndex)) {
@@ -1313,7 +1313,7 @@ static int wmConfigInit()
             for (int column = 0; column < SUBTILE_GRID_HEIGHT; column++) {
                 for (int row = 0; row < SUBTILE_GRID_WIDTH; row++) {
                     char key[40];
-                    sprintf(key, "%d_%d", row, column);
+                    snprintf(key, sizeof(key), "%d_%d", row, column);
 
                     char* subtileProps;
                     if (!configGetString(&config, section, key, &subtileProps)) {
@@ -1373,7 +1373,7 @@ static int wmReadEncounterType(Config* config, char* lookupName, char* sectionKe
 
     for (;;) {
         char key[40];
-        sprintf(key, "enc_%02d", encounterTable->entriesLength);
+        snprintf(key, sizeof(key), "enc_%02d", encounterTable->entriesLength);
 
         char* str;
         if (!configGetString(config, sectionKey, key, &str)) {
@@ -1593,10 +1593,10 @@ static int wmFindEncBaseTypeMatch(char* str, int* valuePtr)
 static int wmReadEncBaseType(char* name, int* valuePtr)
 {
     char section[40];
-    sprintf(section, "Encounter: %s", name);
+    snprintf(section, sizeof(section), "Encounter: %s", name);
 
     char key[40];
-    sprintf(key, "type_00");
+    snprintf(key, sizeof(key), "type_00");
 
     char* string;
     if (!configGetString(pConfigCfg, section, key, &string)) {
@@ -1627,7 +1627,7 @@ static int wmReadEncBaseType(char* name, int* valuePtr)
 
         entry->field_34++;
 
-        sprintf(key, "type_%02d", entry->field_34);
+        snprintf(key, sizeof(key), "type_%02d", entry->field_34);
 
         if (!configGetString(pConfigCfg, section, key, &string)) {
             int team;
@@ -1886,11 +1886,11 @@ static int wmParseTerrainTypes(Config* config, char* string)
 static int wmParseTerrainRndMaps(Config* config, Terrain* terrain)
 {
     char section[40];
-    sprintf(section, "Random Maps: %s", terrain->lookupName);
+    snprintf(section, sizeof(section), "Random Maps: %s", terrain->lookupName);
 
     for (;;) {
         char key[40];
-        sprintf(key, "map_%02d", terrain->mapsLength);
+        snprintf(key, sizeof(key), "map_%02d", terrain->mapsLength);
 
         char* string;
         if (!configGetString(config, section, key, &string)) {
@@ -2389,7 +2389,7 @@ static int wmAreaInit()
     if (configRead(&cfg, "data\\city.txt", true)) {
         area_idx = 0;
         do {
-            sprintf(section, "Area %02d", area_idx);
+            snprintf(section, sizeof(section), "Area %02d", area_idx);
             if (!configGetInt(&cfg, section, "townmap_art_idx", &num)) {
                 break;
             }
@@ -2470,7 +2470,7 @@ static int wmAreaInit()
             }
 
             while (city->entrancesLength < ENTRANCE_LIST_CAPACITY) {
-                sprintf(key, "entrance_%d", city->entrancesLength);
+                snprintf(key, sizeof(key), "entrance_%d", city->entrancesLength);
 
                 if (!configGetString(&cfg, section, key, &str)) {
                     break;
@@ -2593,7 +2593,7 @@ static int wmMapInit()
     if (configRead(&config, "data\\maps.txt", true)) {
         for (int mapIdx = 0;; mapIdx++) {
             char section[40];
-            sprintf(section, "Map %03d", mapIdx);
+            snprintf(section, sizeof(section), "Map %03d", mapIdx);
 
             if (!configGetString(&config, section, "lookup_name", &str)) {
                 break;
@@ -2727,7 +2727,7 @@ static int wmMapInit()
                     }
 
                     char key[40];
-                    sprintf(key, "random_start_point_%1d", ++j);
+                    snprintf(key, sizeof(key), "random_start_point_%1d", ++j);
 
                     if (!configGetString(&config, section, key, &str)) {
                         str = NULL;
@@ -2768,7 +2768,7 @@ int wmMapIdxToName(int mapIdx, char* dest)
         return -1;
     }
 
-    sprintf(dest, "%s.MAP", wmMapInfoList[mapIdx].mapFileName);
+    snprintf(dest, sizeof(dest), "%s.MAP", wmMapInfoList[mapIdx].mapFileName);
     return 0;
 }
 
@@ -3469,7 +3469,7 @@ static int wmRndEncounterOccurred()
                 char* text = getmsg(&gMiscMessageList, &messageListItem, 8500);
                 if (strlen(text) < 110) {
                     char formattedText[120];
-                    sprintf(formattedText, text, xpGained);
+                    snprintf(formattedText, sizeof(formattedText), text, xpGained);
                     displayMonitorAddMessage(formattedText);
                 } else {
                     debugPrint("WorldMap: Error: Rnd Encounter string too long!");
@@ -3649,7 +3649,7 @@ int wmSetupRandomEncounter()
 
     // SFALL: Display encounter description in one line.
     char formattedText[512];
-    sprintf(formattedText,
+    snprintf(formattedText, sizeof(formattedText),
         "%s %s",
         getmsg(&wmMsgFile, &messageListItem, 2998),
         getmsg(&wmMsgFile, &messageListItem, 3000 + 50 * wmGenData.encounterTableId + wmGenData.encounterEntryId));
@@ -4206,7 +4206,7 @@ static int wmGrabTileWalkMask(int tileIdx)
     }
 
     char path[COMPAT_MAX_PATH];
-    sprintf(path, "data\\%s.msk", tileInfo->walkMaskName);
+    snprintf(path, sizeof(path), "data\\%s.msk", tileInfo->walkMaskName);
 
     File* stream = fileOpen(path, "rb");
     if (stream == NULL) {

src/xfile.cc

@@ -95,7 +95,7 @@ XFile* xfileOpen(const char* filePath, const char* mode)
         }
 
         stream->type = XFILE_TYPE_FILE;
-        sprintf(path, "%s", filePath);
+        snprintf(path, sizeof(path), "%s", filePath);
     } else {
         // [filePath] is a relative path. Loop thru open xbases and attempt to
         // open [filePath] from appropriate xbase.
@@ -106,12 +106,12 @@ XFile* xfileOpen(const char* filePath, const char* mode)
                 stream->dfile = dfileOpen(curr->dbase, filePath, mode);
                 if (stream->dfile != NULL) {
                     stream->type = XFILE_TYPE_DFILE;
-                    sprintf(path, "%s", filePath);
+                    snprintf(path, sizeof(path), "%s", filePath);
                     break;
                 }
             } else {
                 // Build path relative to directory-based xbase.
-                sprintf(path, "%s\\%s", curr->path, filePath);
+                snprintf(path, sizeof(path), "%s\\%s", curr->path, filePath);
 
                 // Attempt to open plain stream.
                 stream->file = compat_fopen(path, mode);
@@ -133,7 +133,7 @@ XFile* xfileOpen(const char* filePath, const char* mode)
             }
 
             stream->type = XFILE_TYPE_FILE;
-            sprintf(path, "%s", filePath);
+            snprintf(path, sizeof(path), "%s", filePath);
         }
     }
 
@@ -620,7 +620,7 @@ static bool xlistEnumerate(const char* pattern, XListEnumerationHandler* handler
             }
         } else {
             char path[COMPAT_MAX_PATH];
-            sprintf(path, "%s\\%s", xbase->path, pattern);
+            snprintf(path, sizeof(path), "%s\\%s", xbase->path, pattern);
             compat_windows_path_to_native(path);
 
             if (fileFindFirst(path, &directoryFileFindData)) {
@@ -722,7 +722,7 @@ static int xbaseMakeDirectory(const char* filePath)
         XBase* curr = gXbaseHead;
         while (curr != NULL) {
             if (!curr->isDbase) {
-                sprintf(path, "%s\\%s", curr->path, filePath);
+                snprintf(path, sizeof(path), "%s\\%s", curr->path, filePath);
                 break;
             }
             curr = curr->next;
@@ -731,7 +731,7 @@ static int xbaseMakeDirectory(const char* filePath)
         if (curr == NULL) {
             // Either there are no directory-based xbase, or there are no open
             // xbases at all - resolve path against current working directory.
-            sprintf(path, "%s\\%s", workingDirectory, filePath);
+            snprintf(path, sizeof(path), "%s\\%s", workingDirectory, filePath);
         }
     }