sprintf() -> snprintf()

git-svn-id: http://opensvn.csie.org/pttbbs/pttbbs/trunk/pttbbs@435 63ad8ddf-47c3-0310-b6dd-a9e9d9715204

42 files changed, 709 insertions, 562 deletions

diff --git a/mbbsd/admin.c b/mbbsd/admin.c
index a9fe35ca..a060a123 100644
--- a/mbbsd/admin.c
+++ b/mbbsd/admin.c
@@ -1,4 +1,4 @@
-/* $Id: admin.c,v 1.28 2002/07/21 20:39:34 kcwu Exp $ */
+/* $Id: admin.c,v 1.29 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 /* ¨Ï¥ÎªÌºÞ²z */
@@ -41,7 +41,7 @@ search_key_user(char *passwdfile, int mode)
     while ((fread(&user, sizeof(user), 1, fp1)) > 0 && coun < MAX_USERS) {
 	if (!(++coun & 15)) {
 	    move(1, 0);
-	    sprintf(buf, "²Ä [%d] µ§¸ê®Æ\n", coun);
+	    snprintf(buf, sizeof(buf), "²Ä [%d] µ§¸ê®Æ\n", coun);
 	    outs(buf);
 	    refresh();
 	}
@@ -52,7 +52,7 @@ search_key_user(char *passwdfile, int mode)
 		   strstr(user.address, key) || strstr(user.justify, key) ||
 		      strstr(user.mychicken.name, key)))) {
 	    move(1, 0);
-	    sprintf(buf, "²Ä [%d] µ§¸ê®Æ\n", coun);
+	    snprintf(buf, sizeof(buf), "²Ä [%d] µ§¸ê®Æ\n", coun);
 	    outs(buf);
 	    refresh();
 
@@ -218,7 +218,7 @@ m_mod_board(char *bname)
 
     /* Ptt ³oÃäÂ_¦æ·|Àɨì¤U­± */
     move(9, 0);
-    sprintf(genbuf, "(E)³]©w (V)¹Hªk/¸Ñ°£ %s (D)§R°£ [Q]¨ú®ø¡H",
+    snprintf(genbuf, sizeof(genbuf), "(E)³]©w (V)¹Hªk/¸Ñ°£ %s (D)§R°£ [Q]¨ú®ø¡H",
 	    HAS_PERM(PERM_SYSOP) ?
 	    " (B)BVote (S)±Ï¦^¤å³¹ (G)½ä½L¸Ñ¥d" : "");
     getdata(10, 0, genbuf, ans, sizeof(ans), LCECHO);
@@ -234,8 +234,9 @@ m_mod_board(char *bname)
 	break;
     case 's':
 	if (HAS_PERM(PERM_SYSOP)) {
-	    sprintf(genbuf, BBSHOME "/bin/buildir boards/%c/%s &",
-		    bh.brdname[0], bh.brdname);
+	  snprintf(genbuf, sizeof(genbuf),
+		   BBSHOME "/bin/buildir boards/%c/%s &",
+		   bh.brdname[0], bh.brdname);
 	    system(genbuf);
 	}
 	break;
@@ -244,7 +245,7 @@ m_mod_board(char *bname)
 	    char            bvotebuf[10];
 
 	    memcpy(&newbh, &bh, sizeof(bh));
-	    sprintf(bvotebuf, "%d", newbh.bvote);
+	    snprintf(bvotebuf, sizeof(bvotebuf), "%d", newbh.bvote);
 	    move(20, 0);
 	    prints("¬ÝªO %s ­ì¨Óªº BVote¡G%d", bh.brdname, bh.bvote);
 	    getdata_str(21, 0, "·sªº Bvote¡G", genbuf, 5, LCECHO, bvotebuf);
@@ -275,15 +276,16 @@ m_mod_board(char *bname)
 	if (genbuf[0] != 'y' || !bname[0])
 	    outs(MSG_DEL_CANCEL);
 	else {
-	    strlcpy(bname, bh.brdname, SIZEOF(bname));
-	    sprintf(genbuf,
+	    strlcpy(bname, bh.brdname, sizeof(bh.brdname));
+	    snprintf(genbuf, sizeof(genbuf),
 		    "/bin/tar zcvf tmp/board_%s.tgz boards/%c/%s man/boards/%c/%s >/dev/null 2>&1;"
 		    "/bin/rm -fr boards/%c/%s man/boards/%c/%s",
 		    bname, bname[0], bname, bname[0],
 		    bname, bname[0], bname, bname[0], bname);
 	    system(genbuf);
 	    memset(&bh, 0, sizeof(bh));
-	    sprintf(bh.title, "%s ¬ÝªO %s §R°£", bname, cuser.userid);
+	    snprintf(bh.title, sizeof(bh.title),
+		     "%s ¬ÝªO %s §R°£", bname, cuser.userid);
 	    post_msg("Security", bh.title, "½Ðª`·N§R°£ªº¦Xªk©Ê", "[¨t²Î¦w¥þ§½]");
 	    substitute_record(fn_board, &bh, sizeof(bh), bid);
 	    reset_board(bid);
@@ -749,7 +751,7 @@ scan_register_form(char *regfile, int automode, int neednum)
     int             nSelf = 0, nAuto = 0;
 
     uid = cuser.userid;
-    sprintf(fname, "%s.tmp", regfile);
+    snprintf(fname, sizeof(fname), "%s.tmp", regfile);
     move(2, 0);
     if (dashf(fname)) {
 	if (neednum == 0) {	/* ¦Û¤v¶i Admin ¨Ó¼fªº */
@@ -777,7 +779,7 @@ scan_register_form(char *regfile, int automode, int neednum)
 	    *ptr = '\0';
 	    for (n = 0; field[n]; n++) {
 		if (strcmp(genbuf, field[n]) == 0) {
-		    strlcpy(fdata[n], ptr + 2, SIZEOF(fdata[n]));
+		    strlcpy(fdata[n], ptr + 2, sizeof(fdata[n]));
 		    if ((ptr = (char *)strchr(fdata[n], '\n')))
 			*ptr = '\0';
 		}
@@ -877,7 +879,8 @@ scan_register_form(char *regfile, int automode, int neednum)
 
 			i = buf[0] - '0';
 			strlcpy(buf, reason[i], sizeof(buf));
-			sprintf(genbuf, "[°h¦^­ì¦]] ½Ð%s", buf);
+			snprintf(genbuf, sizeof(genbuf),
+				 "[°h¦^­ì¦]] ½Ð%s", buf);
 
 			sethomepath(buf1, muser.userid);
 			stampfile(buf1, &mhdr);
@@ -918,7 +921,8 @@ scan_register_form(char *regfile, int automode, int neednum)
 		strlcpy(muser.realname, fdata[2], sizeof(muser.realname));
 		strlcpy(muser.address, fdata[4], sizeof(muser.address));
 		strlcpy(muser.email, fdata[6], sizeof(muser.email));
-		sprintf(genbuf, "%s:%s:%s", fdata[5], fdata[3], uid);
+		snprintf(genbuf, sizeof(genbuf),
+			 "%s:%s:%s", fdata[5], fdata[3], uid);
 		strncpy(muser.justify, genbuf, REGLEN);
 		sethomefile(buf, muser.userid, "justify");
 		log_file(buf, genbuf);
@@ -1029,7 +1033,7 @@ give_id_money(char *user_id, int money, FILE * log_fp, char *mail_title, time_t
 	pressanykey();
     } else {
 	fprintf(log_fp, "%ld %s %d", t, user_id, money);
-	sprintf(tt, "%s : %d ptt ¹ô", mail_title, money);
+	snprintf(tt, sizeof(tt), "%s : %d ptt ¹ô", mail_title, money);
 	mail_id(user_id, tt, "~bbs/etc/givemoney.why", "[PTT »È¦æ]");
     }
 }
diff --git a/mbbsd/announce.c b/mbbsd/announce.c
index 5df8a9fa..8413897b 100644
--- a/mbbsd/announce.c
+++ b/mbbsd/announce.c
@@ -1,4 +1,4 @@
-/* $Id: announce.c,v 1.15 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: announce.c,v 1.16 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 static void
@@ -403,7 +403,7 @@ a_showmenu(menu_t * pm)
 	    /*
 	     * Ptt §â®É¶¡§ï¬°¨úÀɮ׮ɶ¡ dtime = atoi(&item->filename[2]);
 	     */
-	    sprintf(buf, "%s/%s", pm->path, item->filename);
+	    snprintf(buf, sizeof(buf), "%s/%s", pm->path, item->filename);
 	    dtime = dasht(buf);
 	    a_timestamp(buf, &dtime);
 	    prints("\n%6d%c %-47.46s%-13s[%s]", pm->page + n + 1,
@@ -629,7 +629,7 @@ gem(char *maintitle, item_t * path, int update)
 			} else
 			    stampdir(newpath, &item);
 			strlcpy(item.owner, cuser.userid, sizeof(item.owner));
-			sprintf(item.title, "%s%.72s",
+			snprintf(item.title, sizeof(item.title), "%s%.72s",
 				(currutmp->pager > 1) ? "" :
 				(mode == (char)0xbc) ? "¡º " : "¡» ",
 				title + 3);
@@ -806,19 +806,19 @@ a_newitem(menu_t * pm, int mode)
 	for (d = 0; d <= 3; d++) {
 	    switch (d) {
 	    case 0:
-		sprintf(lpath, BBSHOME "/man/boards/%c/%s/%s",
+		snprintf(lpath, sizeof(lpath), BBSHOME "/man/boards/%c/%s/%s",
 			currboard[0], currboard, buf);
 		break;
 	    case 1:
-		sprintf(lpath, "%s%s/%c/%s",
+		snprintf(lpath, sizeof(lpath), "%s%s/%c/%s",
 			BBSHOME, "/man/boards/", buf[0], buf);
 		break;
 	    case 2:
-		sprintf(lpath, "%s%s%s",
+		snprintf(lpath, sizeof(lpath), "%s%s%s",
 			BBSHOME, "/", buf);
 		break;
 	    case 3:
-		sprintf(lpath, "%s%s%s",
+		snprintf(lpath, sizeof(lpath), "%s%s%s",
 			BBSHOME, "/etc/", buf);
 		break;
 	    }
@@ -894,7 +894,8 @@ a_pasteitem(menu_t * pm, int mode)
 	    }
 	}
 	if (mode) {
-	    sprintf(buf, "½T©w­n«þ¨©[%s]¶Ü(Y/N)¡H[N] ", copytitle);
+	    snprintf(buf, sizeof(buf),
+		     "½T©w­n«þ¨©[%s]¶Ü(Y/N)¡H[N] ", copytitle);
 	    getdata(b_lines - 1, 1, buf, ans, sizeof(ans), LCECHO);
 	} else
 	    ans[0] = 'y';
@@ -916,18 +917,20 @@ a_pasteitem(menu_t * pm, int mode)
 		if (HAS_PERM(PERM_BBSADM))
 		    Link(copyfile, newpath);
 		else {
-		    sprintf(buf, "/bin/cp %s %s", copyfile, newpath);
+		    snprintf(buf, sizeof(buf), 
+			     "/bin/cp %s %s", copyfile, newpath);
 		    system(buf);
 		}
 	    } else if (dashf(copyfile)) {
 		stampfile(newpath, &item);
 		memcpy(copytitle, "¡º", 2);
-		sprintf(buf, "/bin/cp %s %s", copyfile, newpath);
+		snprintf(buf, sizeof(buf), "/bin/cp %s %s", copyfile, newpath);
 	    } else if (dashd(copyfile)) {
 		stampdir(newpath, &item);
 		memcpy(copytitle, "¡»", 2);
-		sprintf(buf, "/bin/cp -r %s/* %s/.D* %s", copyfile, copyfile,
-			newpath);
+		snprintf(buf, sizeof(buf),
+			 "/bin/cp -r %s/* %s/.D* %s", copyfile, copyfile,
+			 newpath);
 	    } else {
 		outs("µLªk«þ¨©¡I");
 		igetch();
@@ -958,12 +961,12 @@ a_appenditem(menu_t * pm, int isask)
     move(b_lines - 1, 1);
     if (copyfile[0]) {
 	if (dashf(copyfile)) {
-	    sprintf(fname, "%s/%s", pm->path,
+	    snprintf(fname, sizeof(fname), "%s/%s", pm->path,
 		    pm->header[pm->now - pm->page].filename);
 	    if (dashf(fname)) {
 		if (isask) {
-		    sprintf(buf, "½T©w­n±N[%s]ªþ¥[©ó¦¹¶Ü(Y/N)¡H[N] ",
-			    copytitle);
+		    snprintf(buf, sizeof(buf),
+			     "½T©w­n±N[%s]ªþ¥[©ó¦¹¶Ü(Y/N)¡H[N] ", copytitle);
 		    getdata(b_lines - 2, 1, buf, ans, sizeof(ans), LCECHO);
 		}
 		if (ans[0] == 'y') {
@@ -1046,7 +1049,7 @@ a_moveitem(menu_t * pm)
     char            buf[PATHLEN];
     int             fail;
 
-    sprintf(buf, "½Ð¿é¤J²Ä %d ¿ï¶µªº·s¦¸§Ç¡G", pm->now + 1);
+    snprintf(buf, sizeof(buf), "½Ð¿é¤J²Ä %d ¿ï¶µªº·s¦¸§Ç¡G", pm->now + 1);
     if (!getdata(b_lines - 1, 1, buf, newnum, sizeof(newnum), DOECHO))
 	return;
     num = (newnum[0] == '$') ? 9999 : atoi(newnum) - 1;
@@ -1084,7 +1087,7 @@ a_delrange(menu_t * pm)
 {
     char            fname[256];
 
-    sprintf(fname, "%s/.DIR", pm->path);
+    snprintf(fname, sizeof(fname), "%s/.DIR", pm->path);
     del_range(0, NULL, fname);
     pm->num = get_num_records(fname, FHSZ);
 }
@@ -1096,7 +1099,8 @@ a_delete(menu_t * pm)
     char            ans[4];
     fileheader_t    backup;
 
-    sprintf(fpath, "%s/%s", pm->path, pm->header[pm->now - pm->page].filename);
+    snprintf(fpath, sizeof(fpath),
+	     "%s/%s", pm->path, pm->header[pm->now - pm->page].filename);
     setadir(buf, pm->path);
 
     if (pm->header[pm->now - pm->page].filename[0] == 'H' &&
@@ -1130,7 +1134,8 @@ a_delete(menu_t * pm)
 		pm->header[pm->now - pm->page].title + 2,
 		sizeof(backup.title));
 
-	sprintf(cmd, "mv -f %s %s", fpath, buf);
+	snprintf(cmd, sizeof(cmd),
+		 "mv -f %s %s", fpath, buf);
 	system(cmd);
 	setbdir(buf, "deleted");
 	append_record(buf, &backup, sizeof(backup));
@@ -1145,7 +1150,8 @@ a_delete(menu_t * pm)
 	setapath(buf, "deleted");
 	stampdir(buf, &backup);
 
-	sprintf(cmd, "rm -rf %s;/bin/mv -f %s %s", buf, fpath, buf);
+	snprintf(cmd, sizeof(cmd),
+		 "rm -rf %s;/bin/mv -f %s %s", buf, fpath, buf);
 	system(cmd);
 
 	strlcpy(backup.owner, cuser.userid, sizeof(backup.owner));
@@ -1202,7 +1208,7 @@ a_editsign(menu_t * pm)
     fileheader_t    item;
 
     memcpy(&item, &pm->header[pm->now - pm->page], FHSZ);
-    sprintf(buf, "%c%c", item.title[0], item.title[1]);
+    snprintf(buf, sizeof(buf), "%c%c", item.title[0], item.title[1]);
     if (getdata_buf(b_lines - 1, 1, "²Å¸¹", buf, 5, DOECHO)) {
 	item.title[0] = buf[0] ? buf[0] : ' ';
 	item.title[1] = buf[1] ? buf[1] : ' ';
@@ -1221,7 +1227,8 @@ a_showname(menu_t * pm)
     int             sym;
 
     move(b_lines - 1, 1);
-    sprintf(buf, "%s/%s", pm->path, pm->header[pm->now - pm->page].filename);
+    snprintf(buf, sizeof(buf),
+	     "%s/%s", pm->path, pm->header[pm->now - pm->page].filename);
     if (dashl(buf)) {
 	prints("¦¹ symbolic link ¦WºÙ¬° %s\n",
 	       pm->header[pm->now - pm->page].filename);
@@ -1392,7 +1399,8 @@ a_menu(char *maintitle, char *path, int lastlevel)
 
 	case 'e':
 	case 'E':
-	    sprintf(fname, "%s/%s", path, me.header[me.now - me.page].filename);
+	    snprintf(fname, sizeof(fname),
+		     "%s/%s", path, me.header[me.now - me.page].filename);
 	    if (dashf(fname) && me.level >= MANAGER) {
 		*quote_file = 0;
 		if (vedit(fname, NA, NULL) != -1) {
@@ -1421,8 +1429,8 @@ a_menu(char *maintitle, char *path, int lastlevel)
 	    if (me.now < me.num) {
 		if (!isvisible_man(&me))
 		    break;
-		sprintf(fname, "%s/%s", path,
-			me.header[me.now - me.page].filename);
+		snprintf(fname, sizeof(fname), "%s/%s", path,
+			 me.header[me.now - me.page].filename);
 		a_copyitem(fname, me.header[me.now - me.page].title, 0, 1);
 		me.page = 9999;
 		break;
@@ -1435,7 +1443,7 @@ a_menu(char *maintitle, char *path, int lastlevel)
 		fileheader_t   *fhdr = &me.header[me.now - me.page];
 		if (!isvisible_man(&me))
 		    break;
-		sprintf(fname, "%s/%s", path, fhdr->filename);
+		snprintf(fname, sizeof(fname), "%s/%s", path, fhdr->filename);
 		if (*fhdr->filename == 'H' && fhdr->filename[1] == '.') {
 		    item_t          item;
 		    strlcpy(item.X.G.server, fhdr->filename + 2,
@@ -1483,8 +1491,8 @@ a_menu(char *maintitle, char *path, int lastlevel)
 			    break;
 			if (!isvisible_man(&me))
 			    break;
-			sprintf(fname, "%s/%s", path,
-				me.header[me.now - me.page].filename);
+			snprintf(fname, sizeof(fname), "%s/%s", path,
+				 me.header[me.now - me.page].filename);
 			if (!dashf(fname))
 			    break;
 		    }
@@ -1502,7 +1510,8 @@ a_menu(char *maintitle, char *path, int lastlevel)
 
 	case 'F':
 	case 'U':
-	    sprintf(fname, "%s/%s", path, me.header[me.now - me.page].filename);
+	    snprintf(fname, sizeof(fname),
+		     "%s/%s", path, me.header[me.now - me.page].filename);
 	    if (me.now < me.num && HAS_PERM(PERM_BASIC) && dashf(fname)) {
 		a_forward(path, &me.header[me.now - me.page], ch /* == 'U' */ );
 		/* By CharlieL */
diff --git a/mbbsd/args.c b/mbbsd/args.c
index e517b512..1d128673 100644
--- a/mbbsd/args.c
+++ b/mbbsd/args.c
@@ -1,4 +1,4 @@
-/* $Id: args.c,v 1.6 2002/07/21 20:39:34 kcwu Exp $ */
+/* $Id: args.c,v 1.7 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 #ifdef HAVE_SETPROCTITLE
 
@@ -49,7 +49,7 @@ do_setproctitle(const char *cmdline)
     if (i > LastArgv - Argv[0] - 2) {
 	i = LastArgv - Argv[0] - 2;
     }
-    strlcpy(Argv[0], buf, SIZEOF(Argv[0]);
+    strlcpy(Argv[0], buf, sizeof(buf));
     p = &Argv[0][i];
     while (p < LastArgv)
 	*p++ = '\0';
@@ -62,7 +62,7 @@ setproctitle(const char *format,...)
     char            buf[256];
     va_list         args;
     va_start(args, format);
-    vsprintf(buf, format, args);
+    vsnprintf(buf, sizeof(buf), format, args);
     do_setproctitle(buf);
     va_end(args);
 }
diff --git a/mbbsd/bbcall.c b/mbbsd/bbcall.c
index c3527e01..676816f7 100644
--- a/mbbsd/bbcall.c
+++ b/mbbsd/bbcall.c
@@ -1,4 +1,4 @@
-/* $Id: bbcall.c,v 1.7 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: bbcall.c,v 1.8 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define SERVER_0941     "www.chips.com.tw"
@@ -144,7 +144,8 @@ static void halpha0943(char* CoId) {
     char Msg[64], atrn[512], sendform[1024];
     int Year = 99, Month = 1, Day = 15, Hour = 13, Minute = 8;
 
-    sprintf(tmpbuf, "\033[1;37m½Ð¿é¤J±z­n¶Ç©Iªº¸¹½X\033[m : %s-", CoId);
+    snprintf(tmpbuf, sizeof(tmpbuf),
+	     "\033[1;37m½Ð¿é¤J±z­n¶Ç©Iªº¸¹½X\033[m : %s-", CoId);
     if(!getdata(7,0, tmpbuf, ID, sizeof(ID), LCECHO) ||
        !getdata(8,0, "\033[1;37m½Ð¿é¤J¶Ç©I°T®§\033[m¡G", tmpbuf, 63, LCECHO)) {
         hpressanykey("©ñ±ó¶Ç©I");
@@ -157,10 +158,11 @@ static void halpha0943(char* CoId) {
     if(ans[0] != '1')
         Gettime(0, &Year, &Month, &Day, &Hour, &Minute);
 
-    sprintf(atrn, "CoId=%s&ID=%s&Year=19%02d&Month=%02d&Day=%02d"
-            "&Hour=%02d&Minute=%02d&Msg=%s",
-            CoId, ID,Year,Month,Day,Hour,Minute,Msg);
-    sprintf(sendform, "POST %s HTTP/1.0\nReferer: "
+    snprintf(atrn, sizeof(atrn),
+	     "CoId=%s&ID=%s&Year=19%02d&Month=%02d&Day=%02d"
+	     "&Hour=%02d&Minute=%02d&Msg=%s",
+	     CoId, ID,Year,Month,Day,Hour,Minute,Msg);
+    snprintf(sendform, sizeof(sendform), "POST %s HTTP/1.0\nReferer: "
             "%s\n%sContent-length:%d\n\n%s",
             CGI_0943, REFER_0943, PARA, strlen(atrn), atrn);
     Connect(sendform, SERVER_0943);
@@ -187,13 +189,15 @@ static void hcall0941() {
         Gettime(0, &year, &month, &day, &hour, &min);
     } else
         strlcpy(TIME, "NOW", sizeof(TIME));
-    sprintf(trn,"PAGER_NO=%s&TRAN_MSG=%s&MSG_TYPE=NUMERIC&%s=1"
-            "&year=19%02d&month=%02d&day=%02d&hour=%02d&min=%02d",
-            PAGER_NO, TRAN_MSG, TIME,year,month,day,hour,min);
+    snprintf(trn, sizeof(trn),
+	     "PAGER_NO=%s&TRAN_MSG=%s&MSG_TYPE=NUMERIC&%s=1"
+	     "&year=19%02d&month=%02d&day=%02d&hour=%02d&min=%02d",
+	     PAGER_NO, TRAN_MSG, TIME,year,month,day,hour,min);
 
-    sprintf(sendform, "POST %s HTTP/1.0\nReferer: %s\n%s"
-            "Content-length:%d\n\n%s",
-            CGI_0941, REFER_0941, PARA, strlen(trn), trn);
+    snprintf(sendform, sizeof(sendform),
+	     "POST %s HTTP/1.0\nReferer: %s\n%s"
+	     "Content-length:%d\n\n%s",
+	     CGI_0941, REFER_0941, PARA, strlen(trn), trn);
 
     Connect(sendform, SERVER_0941);
     return ;
@@ -220,11 +224,13 @@ static void hcall0948() {
         ya = 1;
     }
 
-    sprintf(trn, "MfcISAPICommand=SinglePage&svc_no=%s&reminder=%d"
-            "&year=%02d&month=%02d&day=%02d&hour=%02d&min=%02d&message=%s",
+    snprintf(trn, sizeof(trn),
+	     "MfcISAPICommand=SinglePage&svc_no=%s&reminder=%d"
+	     "&year=%02d&month=%02d&day=%02d&hour=%02d&min=%02d&message=%s",
             svc_no, ya, year, month, day, hour, min, message);
 
-    sprintf(sendform, "GET %s?%s Http/1.0\n\n", CGI_0948, trn);
+    snprintf(sendform, sizeof(sendform),
+	     "GET %s?%s Http/1.0\n\n", CGI_0948, trn);
 
     Connect(sendform, SERVER_0948);
     return;
diff --git a/mbbsd/bbs.c b/mbbsd/bbs.c
index a706ff0c..84749b1c 100644
--- a/mbbsd/bbs.c
+++ b/mbbsd/bbs.c
@@ -1,4 +1,4 @@
-/* $Id: bbs.c,v 1.65 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: bbs.c,v 1.66 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 static void
@@ -7,13 +7,15 @@ mail_by_link(char *owner, char *title, char *path)
     char            genbuf[200];
     fileheader_t    mymail;
 
-    sprintf(genbuf, BBSHOME "/home/%c/%s", cuser.userid[0], cuser.userid);
+    snprintf(genbuf, sizeof(genbuf),
+	     BBSHOME "/home/%c/%s", cuser.userid[0], cuser.userid);
     stampfile(genbuf, &mymail);
     strlcpy(mymail.owner, owner, sizeof(mymail.owner));
-    sprintf(mymail.title, title);
+    snprintf(mymail.title, sizeof(mymail.title), title);
     unlink(genbuf);
     Link(path, genbuf);
-    sprintf(genbuf, BBSHOME "/home/%c/%s/.DIR", cuser.userid[0], cuser.userid);
+    snprintf(genbuf, sizeof(genbuf),
+	     BBSHOME "/home/%c/%s/.DIR", cuser.userid[0], cuser.userid);
 
     append_record(genbuf, &mymail, sizeof(mymail));
 }
@@ -24,7 +26,7 @@ anticrosspost()
 {
     char            buf[200];
 
-    sprintf(buf,
+    snprintf(buf, sizeof(buf),
 	    "\033[1;33;46m%s \033[37;45mcross post ¤å³¹ \033[37m %s\033[m",
 	    cuser.userid, ctime(&now));
     log_file("etc/illegal_money", buf);
@@ -55,9 +57,9 @@ save_violatelaw()
     }
     reload_money();
     if (cuser.money < (int)cuser.vl_count * 1000) {
-	sprintf(buf, "\033[1;31m³o¬O§A²Ä %d ¦¸¹H¤Ï¥»¯¸ªk³W"
-		"¥²¶·Ãº¥X %d $Ptt ,§A¥u¦³ %d ¤¸, ¿ú¤£°÷°Õ!!\033[m",
-	      (int)cuser.vl_count, (int)cuser.vl_count * 1000, cuser.money);
+	snprintf(buf, sizeof(buf), "\033[1;31m³o¬O§A²Ä %d ¦¸¹H¤Ï¥»¯¸ªk³W"
+		 "¥²¶·Ãº¥X %d $Ptt ,§A¥u¦³ %d ¤¸, ¿ú¤£°÷°Õ!!\033[m",
+		 (int)cuser.vl_count, (int)cuser.vl_count * 1000, cuser.money);
 	mprints(22, 0, buf);
 	pressanykey();
 	return 0;
@@ -74,8 +76,8 @@ save_violatelaw()
 	pressanykey();
 	return 0;
     }
-    sprintf(buf, "³o¬O§A²Ä %d ¦¸¹Hªk ¥²¶·Ãº¥X %d $Ptt",
-	    cuser.vl_count, cuser.vl_count * 1000);
+    snprintf(buf, sizeof(buf), "³o¬O§A²Ä %d ¦¸¹Hªk ¥²¶·Ãº¥X %d $Ptt",
+	     cuser.vl_count, cuser.vl_count * 1000);
     mprints(11, 0, buf);
 
     if (!getdata(10, 0, "­n¥I¿ú[y/n]:", ok, sizeof(ok), LCECHO) ||
@@ -108,7 +110,7 @@ set_board()
     brd_title = bp->BM;
     if (brd_title[0] <= ' ')
 	brd_title = "¼x¨D¤¤";
-    sprintf(currBM, "ªO¥D¡G%s", brd_title);
+    snprintf(currBM, sizeof(currBM), "ªO¥D¡G%s", brd_title);
     brd_title = ((bp->bvote != 2 && bp->bvote) ? "¥»¬ÝªO¶i¦æ§ë²¼¤¤" :
 		 bp->title + 7);
     currmode = (currmode & (MODE_DIRTY | MODE_MENU)) | MODE_STARTED;
@@ -359,11 +361,11 @@ do_reply_title(int row, char *title)
     char            genbuf2[4];
 
     if (strncasecmp(title, str_reply, 4))
-	sprintf(save_title, "Re: %s", title);
+	snprintf(save_title, sizeof(save_title), "Re: %s", title);
     else
 	strlcpy(save_title, title, sizeof(save_title));
     save_title[TTLEN - 1] = '\0';
-    sprintf(genbuf, "±Ä¥Î­ì¼ÐÃD¡m%.60s¡n¶Ü?[Y] ", save_title);
+    snprintf(genbuf, sizeof(genbuf), "±Ä¥Î­ì¼ÐÃD¡m%.60s¡n¶Ü?[Y] ", save_title);
     getdata(row, 0, genbuf, genbuf2, 4, LCECHO);
     if (genbuf2[0] == 'n' || genbuf2[0] == 'N')
 	getdata(++row, 0, "¼ÐÃD¡G", save_title, TTLEN, DOECHO);
@@ -446,7 +448,8 @@ do_general()
 		save_title, 3, LCECHO);
 	local_article = save_title[0] - '1';
 	if (local_article >= 0 && local_article <= 6)
-	    sprintf(save_title, "[%s] ", ctype[local_article]);
+	    snprintf(save_title, sizeof(save_title),
+		     "[%s] ", ctype[local_article]);
 	else
 	    save_title[0] = '\0';
 	getdata_buf(22, 0, "¼ÐÃD¡G", save_title, TTLEN, DOECHO);
@@ -799,11 +802,11 @@ cross_post(int ent, fileheader_t * fhdr, char *direct)
 	}
     }
     if (ent)
-	sprintf(xtitle, "[Âà¿ý]%.66s", fhdr->title);
+	snprintf(xtitle, sizeof(xtitle), "[Âà¿ý]%.66s", fhdr->title);
     else
 	strlcpy(xtitle, fhdr->title, sizeof(xtitle));
 
-    sprintf(genbuf, "±Ä¥Î­ì¼ÐÃD¡m%.60s¡n¶Ü?[Y] ", xtitle);
+    snprintf(genbuf, sizeof(genbuf), "±Ä¥Î­ì¼ÐÃD¡m%.60s¡n¶Ü?[Y] ", xtitle);
     getdata(2, 0, genbuf, genbuf2, 4, LCECHO);
     if (genbuf2[0] == 'n' || genbuf2[0] == 'N') {
 	if (getdata_str(2, 0, "¼ÐÃD¡G", genbuf, TTLEN, DOECHO, xtitle))
@@ -980,7 +983,7 @@ b_man()
     if ((currmode & MODE_BOARD) || HAS_PERM(PERM_SYSOP)) {
 	char            genbuf[128];
 	int             fd;
-	sprintf(genbuf, "%s/.rebuild", buf);
+	snprintf(genbuf, sizeof(genbuf), "%s/.rebuild", buf);
 	if ((fd = open(genbuf, O_CREAT, 0640)) > 0)
 	    close(fd);
     }
@@ -1082,17 +1085,18 @@ hold_gamble(int ent, fileheader_t * fhdr, char *direct)
 	substitute_record(fn_board, bp, sizeof(boardheader_t), currbid);
     }
     move(6, 0);
-    sprintf(genbuf, "½Ð¨ì %s ªO «ö'f'°Ñ»P½ä³Õ!\n\n¤@±i %d Ptt¹ô, ³o¬O%sªº½ä³Õ\n%s%s",
-	    currboard,
-	    i, i < 100 ? "¤p½ä¦¡" : i < 500 ? "¥­¥Á¯Å" :
-	    i < 1000 ? "¶Q±Ú¯Å" : i < 5000 ? "´I»¨¯Å" : "¶É®a¿º²£",
-	    bp->endgamble ? "½ä½Lµ²§ô®É¶¡: " : "",
-	    bp->endgamble ? Cdate(&bp->endgamble) : ""
-	);
+    snprintf(genbuf, sizeof(genbuf),
+	     "½Ð¨ì %s ªO «ö'f'°Ñ»P½ä³Õ!\n\n¤@±i %d Ptt¹ô, ³o¬O%sªº½ä³Õ\n%s%s",
+	     currboard,
+	     i, i < 100 ? "¤p½ä¦¡" : i < 500 ? "¥­¥Á¯Å" :
+	     i < 1000 ? "¶Q±Ú¯Å" : i < 5000 ? "´I»¨¯Å" : "¶É®a¿º²£",
+	     bp->endgamble ? "½ä½Lµ²§ô®É¶¡: " : "",
+	     bp->endgamble ? Cdate(&bp->endgamble) : ""
+	     );
     strcat(msg, genbuf);
     prints("½Ð¨Ì¦¸¿é¤J±m²¼¦WºÙ, »Ý´£¨Ñ2~8¶µ. (¥¼º¡¤K¶µ, ¿é¤Jª½±µ«öenter)\n");
     for (i = 0; i < 8; i++) {
-	sprintf(yn, " %d)", i + 1);
+	snprintf(yn, sizeof(yn), " %d)", i + 1);
 	getdata(7 + i, 0, yn, genbuf, 9, DOECHO);
 	if (!genbuf[0] && i > 1)
 	    break;
@@ -1101,7 +1105,7 @@ hold_gamble(int ent, fileheader_t * fhdr, char *direct)
     fclose(fp);
     move(8 + i, 0);
     prints("½ä½L³]©w§¹¦¨");
-    sprintf(genbuf, "[¤½§i] %s ªO ¶}©l½ä³Õ!", currboard);
+    snprintf(genbuf, sizeof(genbuf), "[¤½§i] %s ªO ¶}©l½ä³Õ!", currboard);
     post_msg(currboard, genbuf, msg, cuser.userid);
     post_msg("Record", genbuf + 7, msg, "[°¨¸ô±´¤l]");
     /* Tim ±±¨îCS, ¥H§K¥¿¦bª±ªºuser§â¸ê®Æ¤w¸g¼g¶i¨Ó */
@@ -1146,7 +1150,7 @@ edit_title(int ent, fileheader_t * fhdr, char *direct)
 	    dirty++;
 	}
 	if (getdata(b_lines - 1, 0, "¤é´Á¡G", genbuf, 6, DOECHO)) {
-	    sprintf(tmpfhdr.date, "%.5s", genbuf);
+	    snprintf(tmpfhdr.date, sizeof(tmpfhdr.date), "%.5s", genbuf);
 	    dirty++;
 	}
     }
@@ -1223,11 +1227,11 @@ recommend(int ent, fileheader_t * fhdr, char *direct)
 	|| yn[0] != 'y')
 	return FULLUPDATE;
 
-    sprintf(buf,
-    "\033[1;31m¡÷ \033[33m%s\033[m\033[33m:%s\033[m%*s±ÀÂ˦Û:%s %02d/%02d\n",
-	    cuser.userid, path,
-	    45 - strlen(cuser.userid) - strlen(path), " ", fromhost,
-	    ptime->tm_mon + 1, ptime->tm_mday);
+    snprintf(buf, sizeof(buf),
+	     "\033[1;31m¡÷ \033[33m%s\033[m\033[33m:%s\033[m%*s±ÀÂ˦Û:%s %02d/%02d\n",
+	     cuser.userid, path,
+	     45 - strlen(cuser.userid) - strlen(path), " ", fromhost,
+	     ptime->tm_mon + 1, ptime->tm_mday);
     setdirpath(path, direct, fhdr->filename);
     log_file(path, buf);
     if (fhdr->recommend < 9) {
@@ -1429,7 +1433,7 @@ tar_addqueue(int ent, fileheader_t * fhdr, char *direct)
 	pressanykey();
 	return FULLUPDATE;
     }
-    sprintf(qfn, BBSHOME "/jobspool/tarqueue.%s", currboard);
+    snprintf(qfn, sizeof(qfn), BBSHOME "/jobspool/tarqueue.%s", currboard);
     if (access(qfn, 0) == 0) {
 	outs("¤w¸g±Æ©w¦æµ{, µy«á·|¶i¦æ³Æ¥÷");
 	pressanykey();
@@ -1699,7 +1703,7 @@ board_select()
     char            genbuf[100];
 
     currmode &= ~MODE_SELECT;
-    sprintf(fpath, "SR.%s", cuser.userid);
+    snprintf(fpath, sizeof(fpath), "SR.%s", cuser.userid);
     setbfile(genbuf, currboard, fpath);
     unlink(genbuf);
     if (currstat == RMAIL)
@@ -1768,13 +1772,13 @@ good_post(int ent, fileheader_t * fhdr, char *direct)
 	strlcpy(buf, direct, sizeof(buf));
 	ptr = strrchr(buf, '/') + 1;
 	ptr[0] = '\0';
-	sprintf(genbuf, "%s%s", buf, digest.filename);
+	snprintf(genbuf, sizeof(genbuf), "%s%s", buf, digest.filename);
 
 	if (dashf(genbuf))
 	    unlink(genbuf);
 
 	digest.filemode = 0;
-	sprintf(genbuf2, "%s%s", buf, fhdr->filename);
+	snprintf(genbuf2, sizeof(genbuf2), "%s%s", buf, fhdr->filename);
 	Link(genbuf2, genbuf);
 	strcpy(ptr, fn_mandex);
 	append_record(buf, &digest, sizeof(digest));
@@ -2008,8 +2012,8 @@ log_board(char *mode, time_t usetime)
     char            buf[256];
 
     if (usetime > 30) {
-	sprintf(buf, "USE %-20.20s Stay: %5ld (%s) %s",
-		mode, usetime, cuser.userid, ctime(&now));
+	snprintf(buf, sizeof(buf), "USE %-20.20s Stay: %5ld (%s) %s",
+		 mode, usetime, cuser.userid, ctime(&now));
 	log_file(FN_USEBOARD, buf);
     }
 }
diff --git a/mbbsd/board.c b/mbbsd/board.c
index d6d8c8ea..cbbfea1b 100644
--- a/mbbsd/board.c
+++ b/mbbsd/board.c
@@ -1,4 +1,4 @@
-/* $Id: board.c,v 1.42 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: board.c,v 1.43 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 #define BRC_STRLEN 15		/* Length of board name */
 #define BRC_MAXSIZE     24576
@@ -328,8 +328,9 @@ have_author(char *brdname)
 {
     char            dirname[100];
 
-    sprintf(dirname, "¥¿¦b·j´M§@ªÌ%s ¬ÝªO:%s.....",
-	    currauthor, brdname);
+    snprintf(dirname, sizeof(dirname),
+	     "¥¿¦b·j´M§@ªÌ%s ¬ÝªO:%s.....",
+	     currauthor, brdname);
     move(b_lines, 0);
     clrtoeol();
     outs(dirname);
diff --git a/mbbsd/cache.c b/mbbsd/cache.c
index fd61cf55..0ceb8376 100644
--- a/mbbsd/cache.c
+++ b/mbbsd/cache.c
@@ -1,4 +1,4 @@
-/* $Id: cache.c,v 1.43 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: cache.c,v 1.44 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #ifndef __FreeBSD__
@@ -42,7 +42,7 @@ safe_sleep(unsigned int seconds)
 static void
 setapath(char *buf, char *boardname)
 {
-    sprintf(buf, "man/boards/%c/%s", boardname[0], boardname);
+    snprintf(buf, "man/boards/%c/%s", boardname[0], boardname);
 }
 
 static char    *str_dotdir = ".DIR";
@@ -329,8 +329,8 @@ setutmpmode(int mode)
     /* °lÂÜ¨Ï¥ÎªÌ */
     if (HAS_PERM(PERM_LOGUSER)) {
 	char            msg[200];
-	sprintf(msg, "%s setutmpmode to %s(%d) at %s",
-		cuser.userid, modestring(currutmp, 0), mode, Cdate(&now));
+	snprintf(msg, sizeof(msg), "%s setutmpmode to %s(%d) at %s",
+		 cuser.userid, modestring(currutmp, 0), mode, Cdate(&now));
 	log_user(msg);
     }
 }
@@ -779,7 +779,8 @@ setbtotal(int bid)
     char            genbuf[256];
     int             num, fd;
 
-    sprintf(genbuf, "boards/%c/%s/.DIR", bh->brdname[0], bh->brdname);
+    snprintf(genbuf, sizeof(genbuf),
+	     "boards/%c/%s/.DIR", bh->brdname[0], bh->brdname);
 
     if ((fd = open(genbuf, O_RDWR)) < 0)
 	return;			/* .DIR±¾¤F */
@@ -892,15 +893,16 @@ reload_pttcache()
 	if ((fp = fopen(buf, "r"))) {
 	    while (fread(&item, sizeof(item), 1, fp)) {
 		if (item.title[3] == '<' && item.title[8] == '>') {
-		    sprintf(buf, "%s/%s", pbuf, item.filename);
+		    snprintf(buf, sizeof(buf), "%s/%s", pbuf, item.filename);
 		    setadir(buf, buf);
 		    if (!(fp1 = fopen(buf, "r")))
 			continue;
 		    SHM->next_refresh[section] = SHM->n_notes[section] = id;
 		    section++;
 		    while (fread(&subitem, sizeof(subitem), 1, fp1)) {
-			sprintf(buf, "%s/%s/%s", pbuf, item.filename,
-				subitem.filename);
+			snprintf(buf, sizeof(buf),
+				 "%s/%s/%s", pbuf, item.filename,
+				 subitem.filename);
 			if (!(fp2 = fopen(buf, "r")))
 			    continue;
 			fread(SHM->notes[id], sizeof(char), 200 * 11, fp2);
diff --git a/mbbsd/cal.c b/mbbsd/cal.c
index fb0c2802..ee23879b 100644
--- a/mbbsd/cal.c
+++ b/mbbsd/cal.c
@@ -1,4 +1,4 @@
-/* $Id: cal.c,v 1.18 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: cal.c,v 1.19 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 /* ¨¾°ô Multi play */
@@ -63,15 +63,16 @@ vice(int money, char *item)
     unsigned int    viceserial = (currutmp->lastact % 1000000) * 100 + rand() % 100;
     FILE           *fp;
     demoney(-money);
-    sprintf(buf, BBSHOME "/home/%c/%s/%s",
-	    cuser.userid[0], cuser.userid, VICE_NEW);
+    snprintf(buf, sizeof(buf), BBSHOME "/home/%c/%s/%s",
+	     cuser.userid[0], cuser.userid, VICE_NEW);
     fp = fopen(buf, "a");
     if (!fp) {
 	return 0;
     }
     fprintf(fp, "%08d\n", viceserial);
     fclose(fp);
-    sprintf(buf, "%s ªá¤F%d$ ½s¸¹[%08d]", item, money, viceserial);
+    snprintf(buf, sizeof(buf),
+	     "%s ªá¤F%d$ ½s¸¹[%08d]", item, money, viceserial);
     mail_id(cuser.userid, buf, "etc/vice.txt", "Ptt¸gÀÙ³¡");
     return 0;
 }
@@ -117,7 +118,8 @@ osong(char *defaultid)
     }
     move(12, 0);
     clrtobot();
-    sprintf(buf, "¿Ë·Rªº %s Åwªï¨Ó¨ì¼Ú®á¦Û°ÊÂIºq¨t²Î\n", cuser.userid);
+    snprintf(buf, sizeof(buf),
+	     "¿Ë·Rªº %s Åwªï¨Ó¨ì¼Ú®á¦Û°ÊÂIºq¨t²Î\n", cuser.userid);
     outs(buf);
     trans_buffer[0] = 0;
     if (!defaultid) {
@@ -141,7 +143,8 @@ osong(char *defaultid)
     }
     getdata_str(14, 0, "·Q­n­n¹ï¥L(¦o)»¡..:", say,
 		sizeof(say), DOECHO, "§Ú·R©p..");
-    sprintf(save_title, "%s:%s", (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, say);
+    snprintf(save_title, sizeof(save_title),
+	     "%s:%s", (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, say);
     getdata_str(16, 0, "±H¨ì½Öªº«H½c(¥i¥ÎE-mail)?",
 		receiver, sizeof(receiver), LCECHO, destid);
 
@@ -167,7 +170,9 @@ osong(char *defaultid)
 	return 0;
     }
     strlcpy(mail.owner, "ÂIºq¾÷", sizeof(mail.owner));
-    sprintf(mail.title, "¡º %s ÂIµ¹ %s ", (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, destid);
+    snprintf(mail.title, sizeof(mail.title),
+	     "¡º %s ÂIµ¹ %s ",
+	     (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, destid);
 
     while (fgets(buf, 200, fp)) {
 	char           *po;
@@ -182,17 +187,19 @@ osong(char *defaultid)
 	}
 	while ((po = strstr(buf, "<~Src~>"))) {
 	    po[0] = 0;
-	    sprintf(genbuf, "%s%s%s", buf, (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, po + 7);
+	    snprintf(genbuf, sizeof(genbuf),
+		     "%s%s%s", buf,
+		     (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, po + 7);
 	    strlcpy(buf, genbuf, sizeof(buf));
 	}
 	while ((po = strstr(buf, "<~Des~>"))) {
 	    po[0] = 0;
-	    sprintf(genbuf, "%s%s%s", buf, destid, po + 7);
+	    snprintf(genbuf, sizeof(genbuf), "%s%s%s", buf, destid, po + 7);
 	    strlcpy(buf, genbuf, sizeof(buf));
 	}
 	while ((po = strstr(buf, "<~Say~>"))) {
 	    po[0] = 0;
-	    sprintf(genbuf, "%s%s%s", buf, say, po + 7);
+	    snprintf(genbuf, sizeof(genbuf), "%s%s%s", buf, say, po + 7);
 	    strlcpy(buf, genbuf, sizeof(buf));
 	}
 	fputs(buf, fp1);
@@ -212,7 +219,8 @@ osong(char *defaultid)
 	/* §â²Ä¤@­º®³±¼ */
 	vice(200, "ÂIºq");
     }
-    sprintf(save_title, "%s:%s", (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, say);
+    snprintf(save_title, sizeof(save_title),
+	     "%s:%s", (ano[0] == 'y') ? "°Î¦WªÌ" : cuser.userid, say);
     hold_mail(filename, destid);
 
     if (receiver[0]) {
@@ -304,13 +312,14 @@ p_exmail()
     int             n;
 
     if (cuser.exmailbox >= MAX_EXKEEPMAIL) {
-	sprintf(buf, "®e¶q³Ì¦h¼W¥[ %d «Ê¡A¤£¯à¦A¶R¤F¡C", MAX_EXKEEPMAIL);
+	snprintf(buf, sizeof(buf),
+		 "®e¶q³Ì¦h¼W¥[ %d «Ê¡A¤£¯à¦A¶R¤F¡C", MAX_EXKEEPMAIL);
 	outs(buf);
 	refresh();
 	return 0;
     }
-    sprintf(buf, "±z´¿¼WÁÊ %d «Ê®e¶q¡AÁÙ­n¦A¶R¦h¤Ö?",
-	    cuser.exmailbox);
+    snprintf(buf, sizeof(buf),
+	     "±z´¿¼WÁÊ %d «Ê®e¶q¡AÁÙ­n¦A¶R¦h¤Ö?", cuser.exmailbox);
 
     getdata_str(b_lines - 2, 0, buf, ans, sizeof(ans), LCECHO, "10");
 
@@ -333,7 +342,7 @@ mail_redenvelop(char *from, char *to, int money, char mode)
     char            genbuf[200];
     fileheader_t    fhdr;
     FILE           *fp;
-    sprintf(genbuf, "home/%c/%s", to[0], to);
+    snprintf(genbuf, sizeof(genbuf), "home/%c/%s", to[0], to);
     stampfile(genbuf, &fhdr);
     if (!(fp = fopen(genbuf, "w")))
 	return;
@@ -345,12 +354,12 @@ mail_redenvelop(char *from, char *to, int money, char mode)
 	    "    §»´±¡·N­«¡A½Ð¯º¯Ç...... ^_^\033[m\n"
 	    ,from, ctime(&now), to, money);
     fclose(fp);
-    sprintf(fhdr.title, "©Û°]¶iÄ_");
+    snprintf(fhdr.title, sizeof(fhdr.title), "©Û°]¶iÄ_");
     strlcpy(fhdr.owner, from, sizeof(fhdr.owner));
 
     if (mode == 'y')
 	vedit(genbuf, NA, NULL);
-    sprintf(genbuf, "home/%c/%s/.DIR", to[0], to);
+    snprintf(genbuf, sizeof(genbuf), "home/%c/%s/.DIR", to[0], to);
     append_record(genbuf, &fhdr, sizeof(fhdr));
 }
 
@@ -388,8 +397,8 @@ p_give()
 	    return 0;		/* ú§¹µ|´N¨S¿úµ¹¤F */
 	deumoney(searchuser(id), money - tax);
 	demoney(-money);
-	sprintf(genbuf, "%s\tµ¹%s\t%d\t%s", cuser.userid, id, money - tax,
-		ctime(&now));
+	snprintf(genbuf, sizeof(genbuf), "%s\tµ¹%s\t%d\t%s",
+		 cuser.userid, id, money - tax, ctime(&now));
 	log_file(FN_MONEY, genbuf);
 	genbuf[0] = 'n';
 	getdata(3, 0, "­n¦Û¦æ®Ñ¼g¬õ¥]³U¶Ü¡H[y/N]", genbuf, 2, LCECHO);
@@ -474,7 +483,7 @@ cal()
 	    b[0] = '0';
 	    b[1] = 0;
 	    move(b_lines - 1, 0);
-	    sprintf(buf, "[%13.2f] [%c] ", a, ch);
+	    snprintf(buf, sizeof(buf), "[%13.2f] [%c] ", a, ch);
 	    outs(buf);
 	    break;
 	case '.':
@@ -495,11 +504,11 @@ cal()
 	    if (strlen(b) > 13)
 		break;
 	    if (flo || b[0] != '0')
-		sprintf(b, "%s%c", b, ch);
+		snprintf(b, sizeof(b), "%s%c", b, ch);
 	    else
 		b[0] = ch;
 	    move(b_lines - 1, 0);
-	    sprintf(buf, "[%13s] [%c]", b, mode[(int)cmode]);
+	    snprintf(buf, sizeof(buf), "[%13s] [%c]", b, mode[(int)cmode]);
 	    outs(buf);
 	    break;
 	case 'q':
diff --git a/mbbsd/card.c b/mbbsd/card.c
index 1c457046..55102df5 100644
--- a/mbbsd/card.c
+++ b/mbbsd/card.c
@@ -1,4 +1,4 @@
-/* $Id: card.c,v 1.5 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: card.c,v 1.6 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 static int
@@ -372,8 +372,9 @@ card_double_ask()
 {
     char            buf[100], buf2[3];
 
-    sprintf(buf, "[ %s ]±z²{¦b¦@¦³ %d P¹ô,  ²{¦b­n¤À²Õ(¥[¦¬ %d ¤¸)¶Ü? [y/N]",
-	    cuser.userid, cuser.money, JACK);
+    snprintf(buf, sizeof(buf),
+	     "[ %s ]±z²{¦b¦@¦³ %d P¹ô,  ²{¦b­n¤À²Õ(¥[¦¬ %d ¤¸)¶Ü? [y/N]",
+	     cuser.userid, cuser.money, JACK);
     reload_money();
     if (cuser.money < JACK)
 	return 0;
@@ -388,7 +389,7 @@ card_ask()
 {
     char            buf[100], buf2[3];
 
-    sprintf(buf, "[ %s ]±z²{¦b¦@¦³ %d P¹ô,  ÁÙ­n¥[µP¶Ü? [y/N]",
+    snprintf(buf, sizeof(buf), "[ %s ]±z²{¦b¦@¦³ %d P¹ô,  ÁÙ­n¥[µP¶Ü? [y/N]",
 	    cuser.userid, cuser.money);
     getdata(20, 0, buf, buf2, sizeof(buf2), LCECHO);
     if (buf2[0] == 'y' || buf2[0] == 'Y')
diff --git a/mbbsd/chat.c b/mbbsd/chat.c
index e852fbf2..4c58b290 100644
--- a/mbbsd/chat.c
+++ b/mbbsd/chat.c
@@ -1,4 +1,4 @@
-/* $Id: chat.c,v 1.8 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: chat.c,v 1.9 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 static int      chatline, stop_line;
@@ -51,7 +51,7 @@ chat_send(int fd, char *buf)
     int             len;
     char            genbuf[200];
 
-    sprintf(genbuf, "%s\n", buf);
+    snprintf(genbuf, sizeof(genbuf), "%s\n", buf);
     len = strlen(genbuf);
     return (send(fd, genbuf, len, 0) == len);
 }
@@ -94,7 +94,7 @@ chat_recv(int fd, char *chatid)
 	    case 't':
 		move(0, 0);
 		clrtoeol();
-		sprintf(genbuf, "½Í¤Ñ«Ç [%s]", chatroom);
+		snprintf(genbuf, sizeof(genbuf), "½Í¤Ñ«Ç [%s]", chatroom);
 		prints("\033[1;37;46m %-21s \033[45m ¸ÜÃD¡G%-48s\033[m",
 		       genbuf, bptr + 2);
 	    }
@@ -131,9 +131,9 @@ printuserent(userinfo_t * uentp)
     if (!HAS_PERM(PERM_SYSOP) && !HAS_PERM(PERM_SEECLOAK) && uentp->invisible)
 	return 0;
 
-    sprintf(pline, "%-13s%c%-10s ", uentp->userid,
-	    uentp->invisible ? '#' : ' ',
-	    modestring(uentp, 1));
+    snprintf(pline, sizeof(pline), "%-13s%c%-10s ", uentp->userid,
+	     uentp->invisible ? '#' : ' ',
+	     modestring(uentp, 1));
     if (cnt < 2)
 	strcat(pline, "¢x");
     strcat(uline, pline);
@@ -150,7 +150,7 @@ chathelp(char *cmd, char *desc)
 {
     char            buf[STRLEN];
 
-    sprintf(buf, "  %-20s- %s", cmd, desc);
+    snprintf(buf, sizeof(buf), "  %-20s- %s", cmd, desc);
     printchatline(buf);
 }
 
@@ -190,7 +190,8 @@ chat_date()
 {
     char            genbuf[200];
 
-    sprintf(genbuf, "¡» " BBSNAME "¼Ð·Ç®É¶¡: %s", Cdate(&now));
+    snprintf(genbuf, sizeof(genbuf),
+	     "¡» " BBSNAME "¼Ð·Ç®É¶¡: %s", Cdate(&now));
     printchatline(genbuf);
 }
 
@@ -200,8 +201,8 @@ chat_pager()
     char            genbuf[200];
 
     char           *msgs[] = {"Ãö³¬", "¥´¶}", "©Þ±¼", "¨¾¤ô", "¦n¤Í"};
-    sprintf(genbuf, "¡» ±zªº©I¥s¾¹:[%s]",
-	    msgs[currutmp->pager = (currutmp->pager + 1) % 5]);
+    snprintf(genbuf, sizeof(genbuf), "¡» ±zªº©I¥s¾¹:[%s]",
+	     msgs[currutmp->pager = (currutmp->pager + 1) % 5]);
     printchatline(genbuf);
 }
 
@@ -217,11 +218,13 @@ chat_query(char *arg)
 	char            buf[128], *ptr;
 	FILE           *fp;
 
-	sprintf(buf, "%s(%s) ¦@¤W¯¸ %d ¦¸¡Aµoªí¹L %d ½g¤å³¹",
-	     xuser.userid, xuser.username, xuser.numlogins, xuser.numposts);
+	snprintf(buf, sizeof(buf), "%s(%s) ¦@¤W¯¸ %d ¦¸¡Aµoªí¹L %d ½g¤å³¹",
+		 xuser.userid, xuser.username,
+		 xuser.numlogins, xuser.numposts);
 	printchatline(buf);
 
-	sprintf(buf, "³Ìªñ(%s)±q[%s]¤W¯¸", Cdate(&xuser.lastlogin),
+	snprintf(buf, sizeof(buf),
+		 "³Ìªñ(%s)±q[%s]¤W¯¸", Cdate(&xuser.lastlogin),
 		(xuser.lasthost[0] ? xuser.lasthost : "(¤£¸Ô)"));
 	printchatline(buf);
 
@@ -308,8 +311,9 @@ select_address()
     trans_buffer[0] = 0;
     if ((fp = fopen("etc/teashop", "r"))) {
 	for (c = 0; fscanf(fp, "%s%s", iptab[c], nametab[c]) != EOF; c++) {
-	    sprintf(buf, "\n            (\033[36m%d\033[0m) %-30s     [%s]",
-		    c + 1, nametab[c], iptab[c]);
+	    snprintf(buf, sizeof(buf),
+		     "\n            (\033[36m%d\033[0m) %-30s     [%s]",
+		     c + 1, nametab[c], iptab[c]);
 	    outs(buf);
 	}
 	getdata(20, 10, "¡¹\033[32m ½Ð¿ï¾Ü¡A[0]Â÷¶}¡G\033[0m", buf, 3,
@@ -379,18 +383,19 @@ t_chat()
 
     while (1) {
 	getdata(b_lines - 1, 0, "½Ð¿é¤J²á¤Ñ¥N¸¹¡G", inbuf, 9, DOECHO);
-	sprintf(chatid, "%s", (inbuf[0] ? inbuf : cuser.userid));
+	snprintf(chatid, sizeof(chatid),
+		 "%s", (inbuf[0] ? inbuf : cuser.userid));
 	chatid[8] = '\0';
 	/*
 	 * ®榡:    /! ¨Ï¥ÎªÌ½s¸¹ ¨Ï¥ÎªÌµ¥¯Å UserID ChatID ·s®æ¦¡:    /!
 	 * UserID ChatID Password
 	 */
 	if (roomtype == 1)
-	    sprintf(inbuf, "/! %s %s %s",
-		    cuser.userid, chatid, cuser.passwd);
+	    snprintf(inbuf, sizeof(inbuf), "/! %s %s %s",
+		     cuser.userid, chatid, cuser.passwd);
 	else
-	    sprintf(inbuf, "/! %d %d %s %s",
-		    usernum, cuser.userlevel, cuser.userid, chatid);
+	    snprintf(inbuf, sizeof(inbuf), "/! %d %d %s %s",
+		     usernum, cuser.userlevel, cuser.userid, chatid);
 	chat_send(cfd, inbuf);
 	if (recv(cfd, inbuf, 3, 0) != 3)
 	    return 0;
diff --git a/mbbsd/chicken.c b/mbbsd/chicken.c
index e42a2a5a..4744141e 100644
--- a/mbbsd/chicken.c
+++ b/mbbsd/chicken.c
@@ -1,4 +1,4 @@
-/* $Id: chicken.c,v 1.8 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: chicken.c,v 1.9 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define NUM_KINDS   13		/* ¦³¦h¤ÖºØ°Êª« */
@@ -128,9 +128,10 @@ new_chicken()
 	getdata(8, 0, "À°¨e¨ú­Ó¦n¦W¦r¡G", mychicken->name,
 		sizeof(mychicken->name), DOECHO);
 
-    sprintf(buf, "\033[31m%s \033[m¾i¤F¤@°¦¥s\033[33m %s \033[mªº "
-	    "\033[32m%s\033[m  ©ó %s", cuser.userid,
-	  mychicken->name, chicken_type[(int)mychicken->type], ctime(&now));
+    snprintf(buf, sizeof(buf),
+	     "\033[31m%s \033[m¾i¤F¤@°¦¥s\033[33m %s \033[mªº "
+	     "\033[32m%s\033[m  ©ó %s", cuser.userid,
+	     mychicken->name, chicken_type[(int)mychicken->type], ctime(&now));
     log_file(CHICKENLOG, buf);
     mychicken->lastvisit = mychicken->birthday = mychicken->cbirth = now;
     mychicken->food = 0;
@@ -219,8 +220,8 @@ show_chicken_data(chicken_t * thechicken, chicken_t * pkchicken)
 
     show_chicken_stat(thechicken);
 
-    sprintf(buf, CHICKEN_PIC "/%c%d", thechicken->type + 'a',
-	    age > 16 ? 16 : age);
+    snprintf(buf, sizeof(buf), CHICKEN_PIC "/%c%d", thechicken->type + 'a',
+	     age > 16 ? 16 : age);
     show_file(buf, 5, 14, NO_RELOAD);
 
     move(18, 0);
@@ -424,16 +425,17 @@ ch_kill()
 {
     char            buf[150], ans[4];
 
-    sprintf(buf, "±ó¾i³o%s­n³Q»@ 100 ¤¸, ¬O§_­n±ó¾i?(y/N)",
+    snprintf(buf, sizeof(buf), "±ó¾i³o%s­n³Q»@ 100 ¤¸, ¬O§_­n±ó¾i?(y/N)",
 	    chicken_type[(int)mychicken->type]);
     getdata_str(23, 0, buf, ans, sizeof(ans), DOECHO, "N");
     if (ans[0] == 'y') {
 
 	vice(100, "±ó¾iÃdª«¶O");
 	more(CHICKEN_PIC "/deadth", YEA);
-	sprintf(buf, "\033[31m%s \033[m§â \033[33m%s\033[m\033[32m %s "
-		"\033[m®_¤F ©ó %s", cuser.userid,
-	  mychicken->name, chicken_type[(int)mychicken->type], ctime(&now));
+	snprintf(buf, sizeof(buf),
+		 "\033[31m%s \033[m§â \033[33m%s\033[m\033[32m %s "
+		 "\033[m®_¤F ©ó %s", cuser.userid, mychicken->name,
+		 chicken_type[(int)mychicken->type], ctime(&now));
 	log_file(CHICKENLOG, buf);
 	mychicken->name[0] = 0;
     }
@@ -485,11 +487,11 @@ ch_sell()
 	pressanykey();
 	return 0;
     }
-    sprintf(buf, "³o°¦%d·³%s¥i¥H½æ %d ¤¸, ¬O§_­n½æ?(y/N)", age,
-	    chicken_type[(int)mychicken->type], money);
+    snprintf(buf, sizeof(buf), "³o°¦%d·³%s¥i¥H½æ %d ¤¸, ¬O§_­n½æ?(y/N)", age,
+	     chicken_type[(int)mychicken->type], money);
     getdata_str(23, 0, buf, ans, sizeof(ans), DOECHO, "N");
     if (ans[0] == 'y') {
-	sprintf(buf, "\033[31m%s\033[m §â \033[33m%s\033[m "
+	snprintf(buf, sizeof(buf), "\033[31m%s\033[m §â \033[33m%s\033[m "
 		"\033[32m%s\033[m ¥Î \033[36m%d\033[m ½æ¤F ©ó %s",
 		cuser.userid, mychicken->name,
 		chicken_type[(int)mychicken->type], money, ctime(&now));
@@ -645,11 +647,12 @@ deadtype(chicken_t * thechicken)
 	return 0;
 
     if (thechicken == mychicken) {
-	sprintf(buf, "\033[31m%s\033[m ©Ò¯k·Rªº\033[33m %s\033[32m %s "
-		"\033[m±¾¤F ©ó %s",
-		cuser.userid, thechicken->name,
-		chicken_type[(int)thechicken->type],
-		ctime(&now));
+	snprintf(buf, sizeof(buf),
+		 "\033[31m%s\033[m ©Ò¯k·Rªº\033[33m %s\033[32m %s "
+		 "\033[m±¾¤F ©ó %s",
+		 cuser.userid, thechicken->name,
+		 chicken_type[(int)thechicken->type],
+		 ctime(&now));
 	log_file(CHICKENLOG, buf);
 	mychicken->name[0] = 0;
 	passwd_update(usernum, &cuser);
@@ -702,11 +705,12 @@ ch_changename()
 		mychicken->name);
 
     if (strlen(newname) >= 3 && strcmp(newname, mychicken->name)) {
-	sprintf(buf, "\033[31m%s\033[m §â¯k·Rªº\033[33m %s\033[32m %s "
-		"\033[m§ï¦W¬°\033[33m %s\033[m ©ó %s",
-		cuser.userid, mychicken->name,
-		chicken_type[(int)mychicken->type],
-		newname, ctime(&now));
+	snprintf(buf, sizeof(buf),
+		 "\033[31m%s\033[m §â¯k·Rªº\033[33m %s\033[32m %s "
+		 "\033[m§ï¦W¬°\033[33m %s\033[m ©ó %s",
+		 cuser.userid, mychicken->name,
+		 chicken_type[(int)mychicken->type],
+		 newname, ctime(&now));
 	strlcpy(mychicken->name, newname, sizeof(mychicken->name));
 	log_file(CHICKENLOG, buf);
     }
@@ -815,9 +819,9 @@ recover_chicken(chicken_t * thechicken)
 	   "³Ìªñ¯Ê¿ú·QÁÈ¥~§Ö \033[m");
     bell();
     igetch();
-    sprintf(buf, "\033[33;44m¡¹ÆF¬É¦u½Ã\033[37;45m "
-	    "§A¦³¤@­Ó­è¨«¤£¤[ªº%s­n©Û´«¦^¨Ó¶Ü? ¥u­n%d¤¸­ò \033[m",
-	    chicken_type[(int)thechicken->type], price * 2);
+    snprintf(buf, sizeof(buf), "\033[33;44m¡¹ÆF¬É¦u½Ã\033[37;45m "
+	     "§A¦³¤@­Ó­è¨«¤£¤[ªº%s­n©Û´«¦^¨Ó¶Ü? ¥u­n%d¤¸­ò \033[m",
+	     chicken_type[(int)thechicken->type], price * 2);
     outmsg(buf);
     bell();
     getdata_str(21, 0, "    ¿ï¾Ü¡G(N:§|¤H¹À/y:½ÐÀ°À°§Ú)", buf, 3, LCECHO, "N");
@@ -835,8 +839,9 @@ recover_chicken(chicken_t * thechicken)
 	thechicken->sick = 0;
 	thechicken->satis = 2;
 	vice(money, "ÆF¬É¦u½Ã");
-	sprintf(buf, "\033[33;44m¡¹ÆF¬É¦u½Ã\033[37;45m OK¤F °O±oÁý¥LÂIªF¦è "
-		"¤£µM¥i¯à¥¢®Ä ©À¦b§Ú¤]¦³ª±Ptt ®³§A%d´N¦n \033[m", money);
+	snprintf(buf, sizeof(buf),
+		 "\033[33;44m¡¹ÆF¬É¦u½Ã\033[37;45m OK¤F °O±oÁý¥LÂIªF¦è "
+		 "¤£µM¥i¯à¥¢®Ä ©À¦b§Ú¤]¦³ª±Ptt ®³§A%d´N¦n \033[m", money);
 	outmsg(buf);
 	bell();
 	igetch();
@@ -949,8 +954,8 @@ chickenpk(int fd)
 	    switch (ch) {
 	    case 'y':
 		if (catched == 1) {
-		    sprintf(data, "lÅý %s ¸¨¶]¤F\n",
-			    ochicken->name);
+		    snprintf(data, sizeof(data),
+			     "lÅý %s ¸¨¶]¤F\n", ochicken->name);
 		}
 		break;
 	    case 'n':
@@ -959,13 +964,15 @@ chickenpk(int fd)
 	    case 'k':
 		r = r % (attmax + 2);
 		if (r) {
-		    sprintf(data, "M%s %s%s %s ¶Ë¤F %d ÂI\n", mychicken->name,
-			    damage_degree[r / 3 > 15 ? 15 : r / 3],
-			    attack_type[(int)mychicken->type],
-			    ochicken->name, r);
+		    snprintf(data, sizeof(data),
+			     "M%s %s%s %s ¶Ë¤F %d ÂI\n", mychicken->name,
+			     damage_degree[r / 3 > 15 ? 15 : r / 3],
+			     attack_type[(int)mychicken->type],
+			     ochicken->name, r);
 		    ochicken->hp -= r;
 		} else
-		    sprintf(data, "M%s ı±o¤â³n¥XÀ»µL®Ä\n", mychicken->name);
+		    snprintf(data, sizeof(data),
+			     "M%s ı±o¤â³n¥XÀ»µL®Ä\n", mychicken->name);
 		break;
 	    case 'o':
 		if (mychicken->oo > 0) {
@@ -974,26 +981,28 @@ chickenpk(int fd)
 		    if (mychicken->hp > mychicken->hp_max)
 			mychicken->hp = mychicken->hp_max;
 		    mychicken->tiredstrong = 0;
-		    sprintf(data, "M%s ¦Y¤FÁû¤j¸É¤Y¸É¥RÅé¤O\n",
-			    mychicken->name);
+		    snprintf(data, sizeof(data), "M%s ¦Y¤FÁû¤j¸É¤Y¸É¥RÅé¤O\n",
+			     mychicken->name);
 		} else
-		    sprintf(data, "M%s ·Q¦Y¤j¸É¤Y, ¥i¬O¨S¦³¤j¸É¤Y¥i¦Y\n",
+		    snprintf(data, sizeof(data),
+			    "M%s ·Q¦Y¤j¸É¤Y, ¥i¬O¨S¦³¤j¸É¤Y¥i¦Y\n",
 			    mychicken->name);
 		break;
 	    case 'q':
 		if (r % (mychicken->run + 1) > r % (ochicken->run + 1))
-		    sprintf(data, "q%s ¸¨¶]¤F\n",
-			    mychicken->name);
+		    snprintf(data, sizeof(data), "q%s ¸¨¶]¤F\n",
+			     mychicken->name);
 		else
-		    sprintf(data, "c%s ·Q¸¨¶], ¦ý³Q %s §ì¨ì¤F\n",
-			    mychicken->name, ochicken->name);
+		    snprintf(data, sizeof(data),
+			     "c%s ·Q¸¨¶], ¦ý³Q %s §ì¨ì¤F\n",
+			     mychicken->name, ochicken->name);
 		break;
 	    }
 	    if (deadtype(ochicken)) {
 		strtok(data, "\n");
 		strlcpy(buf, data, sizeof(buf));
-		sprintf(data, "d%s , %s ³Q %s ¥´¦º¤F\n",
-			buf + 1, ochicken->name, mychicken->name);
+		snprintf(data, sizeof(data), "d%s , %s ³Q %s ¥´¦º¤F\n",
+			 buf + 1, ochicken->name, mychicken->name);
 	    }
 	    move(17, 0);
 	    outs(data + 1);
diff --git a/mbbsd/dark.c b/mbbsd/dark.c
index cd37fd0b..4c9c6486 100644
--- a/mbbsd/dark.c
+++ b/mbbsd/dark.c
@@ -1,4 +1,4 @@
-/* $Id: dark.c,v 1.7 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: dark.c,v 1.8 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define RED   1
@@ -156,14 +156,14 @@ draw_line(sint y, sint f)
     strlcpy(buf, "\033[43;30m", sizeof(buf));
     for (i = 0; i < 8; i++) {
 	if (brd[y][i].die == 1)
-	    sprintf(tmp, "¢x  ");
+	    snprintf(tmp, sizeof(tmp), "¢x  ");
 	else if (brd[y][i].out == 0)
-	    sprintf(tmp, "¢x¡´");
+	    snprintf(tmp, sizeof(tmp), "¢x¡´");
 	else {
-	    sprintf(tmp, "¢x\033[%s1;%dm%s\033[m\033[43;30m",
-		    (f == i) ? "1;47;" : "", (brd[y][i].color) ? 31 : 34,
-		    (brd[y][i].color) ? rname[brd[y][i].value] :
-		    bname[brd[y][i].value]);
+	    snprintf(tmp, sizeof(tmp), "¢x\033[%s1;%dm%s\033[m\033[43;30m",
+		     (f == i) ? "1;47;" : "", (brd[y][i].color) ? 31 : 34,
+		     (brd[y][i].color) ? rname[brd[y][i].value] :
+		     bname[brd[y][i].value]);
 	}
 	strcat(buf, tmp);
     }
diff --git a/mbbsd/dice.c b/mbbsd/dice.c
index 69d7486f..fae9d262 100644
--- a/mbbsd/dice.c
+++ b/mbbsd/dice.c
@@ -1,4 +1,4 @@
-/* $Id: dice.c,v 1.5 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: dice.c,v 1.6 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define DICE_TXT   BBSHOME "/etc/dice.txt"
@@ -454,9 +454,10 @@ dice_main(void)
 	    demoney(table[j].mymoney * ya + table[j].mymoney);
 	    total += table[j].mymoney * ya;
 	    if (table[j].mymoney * ya > 500) {	/* ¶W¹L500¶ô¿ú¤~°µlog ´î¤Öio */
-		sprintf(data, "%-15s ©ã%-2d¿ï¶µ%-8d¶ô¿ú ¤¤¤F%d­¿ ²bÁÈ:%-8d\n",
-			cuser.userid, table[j].mybet,
-			table[j].mymoney, ya, table[j].mymoney * ya);
+		snprintf(data, sizeof(data),
+			 "%-15s ©ã%-2d¿ï¶µ%-8d¶ô¿ú ¤¤¤F%d­¿ ²bÁÈ:%-8d\n",
+			 cuser.userid, table[j].mybet,
+			 table[j].mymoney, ya, table[j].mymoney * ya);
 		fputs(data, winfp);
 	    }
 	    ya = 0;
diff --git a/mbbsd/edit.c b/mbbsd/edit.c
index 212f893b..ad210b12 100644
--- a/mbbsd/edit.c
+++ b/mbbsd/edit.c
@@ -1,4 +1,4 @@
-/* $Id: edit.c,v 1.14 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: edit.c,v 1.15 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 typedef struct textline_t {
     struct textline_t *prev;
@@ -784,9 +784,11 @@ write_header(FILE * fp)
 		ifuseanony = 1;
 	    } else {
 		if (!strcmp("r", real_name) || (!defanony && !real_name[0]))
-		    sprintf(postlog.author, "%s", cuser.userid);
+		    snprintf(postlog.author, sizeof(postlog.author),
+			     "%s", cuser.userid);
 		else {
-		    sprintf(postlog.author, "%s.", real_name);
+		    snprintf(postlog.author, sizeof(postlog.author),
+			     "%s.", real_name);
 		    ifuseanony = 1;
 		}
 	    }
@@ -1644,7 +1646,7 @@ vedit(char *fpath, int saveheader, int *islocal)
 	}
 	/* ³sÄò240­Óinterval¤@¼Ë , ¤À©ú¬O¦bÀÄ°] */
 	if (count >= 240) {
-	    sprintf(buf, "\033[1;33;46m%s\033[37m¦b\033[37;45m%s"
+	    snprintf(buf, sizeof(buf), "\033[1;33;46m%s\033[37m¦b\033[37;45m%s"
 		    "\033[37mªO¹HªkÁÈ¿ú , %s\033[m", cuser.userid,
 		    currboard, ctime(&now));
 	    log_file("etc/illegal_money", buf);
@@ -1782,25 +1784,26 @@ vedit(char *fpath, int saveheader, int *islocal)
 
 			strlcpy(color, "\033[", sizeof(color));
 			if (isdigit(*apos)) {
-			    sprintf(color, "%s%c", color, *(apos++));
+			    snprintf(color, sizeof(color),
+				     "%s%c", color, *(apos++));
 			    if (*apos)
-				sprintf(color, "%s;", color);
+				snprintf(color, sizeof(color), "%s;", color);
 			}
 			if (*apos) {
 			    if ((tmp = strchr(t, toupper(*(apos++)))))
 				fg = tmp - t + 30;
 			    else
 				fg = 37;
-			    sprintf(color, "%s%d", color, fg);
+			    snprintf(color, sizeof(color), "%s%d", color, fg);
 			}
 			if (*apos) {
 			    if ((tmp = strchr(t, toupper(*(apos++)))))
 				bg = tmp - t + 40;
 			    else
 				bg = 40;
-			    sprintf(color, "%s;%d", color, bg);
+			    snprintf(color, sizeof(color), "%s;%d", color, bg);
 			}
-			sprintf(color, "%sm", color);
+			snprintf(color, sizeof(color), "%sm", color);
 			insert_string(color);
 		    } else
 			insert_string(reset_color);
diff --git a/mbbsd/friend.c b/mbbsd/friend.c
index 6029bfd8..2df2025b 100644
--- a/mbbsd/friend.c
+++ b/mbbsd/friend.c
@@ -1,4 +1,4 @@
-/* $Id: friend.c,v 1.11 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: friend.c,v 1.12 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 /* ------------------------------------- */
@@ -114,7 +114,7 @@ friend_special()
 
     friend_file[FRIEND_SPECIAL] = special_list;
     for (i = 0; i <= 9; i++) {
-	sprintf(genbuf, "  (\033[36m%d\033[m)  .. ", i);
+	snprintf(genbuf, sizeof(genbuf), "  (\033[36m%d\033[m)  .. ", i);
 	special_des[5] = i + '0';
 	setuserfile(fname, special_des);
 	if (dashf(fname)) {
@@ -153,15 +153,17 @@ friend_append(int type, int count)
 	for (j = i = 0; i <= 4; i++)
 	    if (i != type) {
 		++j;
-		sprintf(buf, "  (%d) %-s\n", i + 1, friend_list[(int)i]);
+		snprintf(buf, sizeof(buf),
+			 "  (%d) %-s\n", i + 1, friend_list[(int)i]);
 		outs(buf);
 	    }
 	if (HAVE_PERM(PERM_SYSOP) || currmode & MODE_BOARD)
 	    for (; i < 8; ++i)
 		if (i != type) {
 		    ++j;
-		    sprintf(buf, "  (%d) %s ªOªº %s\n", j, currboard,
-			    friend_list[(int)i]);
+		    snprintf(buf, sizeof(buf),
+			     "  (%d) %s ªOªº %s\n", j, currboard,
+			     friend_list[(int)i]);
 		    outs(buf);
 		}
 	outs("  (S) ¿ï¾Ü¨ä¥L¬ÝªOªº¯S§O¦W³æ");
@@ -229,7 +231,7 @@ friend_editdesc(char *uident, int type)
     FILE           *fp, *nfp;
     char            fnnew[200], genbuf[200], fn[200];
     setfriendfile(fn, type);
-    sprintf(fnnew, "%s-", fn);
+    snprintf(fnnew, sizeof(fnnew), "%s-", fn);
     if ((fp = fopen(fn, "r")) && (nfp = fopen(fnnew, "w"))) {
 	int             length = strlen(uident);
 
@@ -324,7 +326,8 @@ friend_edit(int type)
 
     if (type == FRIEND_ALOHA || type == FRIEND_POST) {
 	if (dashf(fpath)) {
-	    sprintf(genbuf, "/bin/cp %s %s.old", fpath, fpath);
+	    snprintf(genbuf, sizeof(genbuf),
+		     "/bin/cp %s %s.old", fpath, fpath);
 	    system(genbuf);
 	}
     }
@@ -332,7 +335,7 @@ friend_edit(int type)
     while (1) {
 	stand_title(friend_list[type]);
 	move(0, 40);
-	sprintf(line, "(¦W³æ¤W­­:%d­Ó¤H)", friend_max[type]);
+	snprintf(line, sizeof(line), "(¦W³æ¤W­­:%d­Ó¤H)", friend_max[type]);
 	outs(line);
 	count = 0;
 	CreateNameList();
@@ -406,7 +409,7 @@ friend_edit(int type)
 	outs("§ó·s¸ê®Æ¤¤..½Ðµy­Ô.....");
 	refresh();
 	if (type == FRIEND_ALOHA || type == FRIEND_POST) {
-	    sprintf(genbuf, "%s.old", fpath);
+	    snprintf(genbuf, sizeof(genbuf), "%s.old", fpath);
 	    if ((fp = fopen(genbuf, "r"))) {
 		while (fgets(line, 80, fp)) {
 		    sscanf(line, "%s", uident);
@@ -416,7 +419,7 @@ friend_edit(int type)
 		}
 		fclose(fp);
 	    }
-	    sprintf(genbuf, "%s", fpath);
+	    snprintf(genbuf, sizeof(genbuf), "%s", fpath);
 	    if ((fp = fopen(genbuf, "r"))) {
 		while (fgets(line, 80, fp)) {
 		    sscanf(line, "%s", uident);
diff --git a/mbbsd/gamble.c b/mbbsd/gamble.c
index 97961898..836dbc25 100644
--- a/mbbsd/gamble.c
+++ b/mbbsd/gamble.c
@@ -1,4 +1,4 @@
-/* $Id: gamble.c,v 1.27 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: gamble.c,v 1.28 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #ifndef _BBS_UTIL_C_
@@ -18,7 +18,7 @@ post_msg(char *bname, char *title, char *msg, char *author)
     char            genbuf[256];
 
     /* ¦b bname ªOµoªí·s¤å³¹ */
-    sprintf(genbuf, "boards/%c/%s", bname[0], bname);
+    snprintf(genbuf, sizeof(genbuf), "boards/%c/%s", bname[0], bname);
     stampfile(genbuf, &fhdr);
     fp = fopen(genbuf, "w");
 
@@ -69,7 +69,7 @@ load_ticket_record(char *direct, int ticket[])
     char            buf[256];
     int             i, total = 0;
     FILE           *fp;
-    sprintf(buf, "%s/" FN_TICKET_RECORD, direct);
+    snprintf(buf, sizeof(buf), "%s/" FN_TICKET_RECORD, direct);
     if (!(fp = fopen(buf, "r")))
 	return 0;
     for (i = 0; i < MAX_ITEM && fscanf(fp, "%9d ", &ticket[i]); i++)
@@ -87,19 +87,21 @@ show_ticket_data(char *direct, int *price, boardheader_t * bh)
 
     clear();
     if (bh) {
-	sprintf(genbuf, "%s ½ä½L", bh->brdname);
-	if (bh->endgamble && now < bh->endgamble && bh->endgamble - now < 3600) {
-	    sprintf(t, "«Ê½L­Ë¼Æ %d ¬í", (int)(bh->endgamble - now));
+	snprintf(genbuf, sizeof(genbuf), "%s ½ä½L", bh->brdname);
+	if (bh->endgamble && now < bh->endgamble &&
+	    bh->endgamble - now < 3600) {
+	    snprintf(t, sizeof(t),
+		     "«Ê½L­Ë¼Æ %d ¬í", (int)(bh->endgamble - now));
 	    showtitle(genbuf, t);
 	} else
 	    showtitle(genbuf, BBSNAME);
     } else
 	showtitle("Ptt½ä½L", BBSNAME);
     move(2, 0);
-    sprintf(genbuf, "%s/" FN_TICKET_ITEMS, direct);
+    snprintf(genbuf, sizeof(genbuf), "%s/" FN_TICKET_ITEMS, direct);
     if (!(fp = fopen(genbuf, "r"))) {
 	prints("\n¥Ø«e¨Ã¨S¦³Á|¿ì½ä½L\n");
-	sprintf(genbuf, "%s/" FN_TICKET_OUTCOME, direct);
+	snprintf(genbuf, sizeof(genbuf), "%s/" FN_TICKET_OUTCOME, direct);
 	if (more(genbuf, NA));
 	return 0;
     }
@@ -121,9 +123,9 @@ show_ticket_data(char *direct, int *price, boardheader_t * bh)
 	   bh ? "ªO¥D¦Û­q³W«h¤Î»¡©ú" : "«e´X¦¸¶}¼úµ²ªG");
 
 
-    sprintf(genbuf, "%s/" FN_TICKET, direct);
+    snprintf(genbuf, sizeof(genbuf), "%s/" FN_TICKET, direct);
     if (!dashf(genbuf)) {
-	sprintf(genbuf, "%s/" FN_TICKET_END, direct);
+	snprintf(genbuf, sizeof(genbuf), "%s/" FN_TICKET_END, direct);
 	end = 1;
     }
     show_file(genbuf, 8, -1, NO_RELOAD);
@@ -152,7 +154,7 @@ append_ticket_record(char *direct, int ch, int n, int count)
     FILE           *fp;
     int             ticket[8] = {0, 0, 0, 0, 0, 0, 0, 0}, i;
     char            genbuf[256];
-    sprintf(genbuf, "%s/" FN_TICKET_USER, direct);
+    snprintf(genbuf, sizeof(genbuf), "%s/" FN_TICKET_USER, direct);
 
     if ((fp = fopen(genbuf, "a"))) {
 	fprintf(fp, "%s %d %d\n", cuser.userid, ch, n);
@@ -160,7 +162,7 @@ append_ticket_record(char *direct, int ch, int n, int count)
     }
     load_ticket_record(direct, ticket);
     ticket[ch] += n;
-    sprintf(genbuf, "%s/" FN_TICKET_RECORD, direct);
+    snprintf(genbuf, sizeof(genbuf), "%s/" FN_TICKET_RECORD, direct);
     if ((fp = fopen(genbuf, "w"))) {
 	for (i = 0; i < count; i++)
 	    fprintf(fp, "%d ", ticket[i]);
@@ -343,11 +345,12 @@ openticket(int bid)
 	    if (bet == 98 && mybet >= 0 && mybet < count) {
 		fprintf(fp, "%s ¶R¤F %d ±i %s, °h¦^ %d ªT¢Þ¹ô\n"
 			,userid, i, betname[mybet], money);
-		sprintf(buf, "%s ½ä³õ°h¿ú! $ %d", bh->brdname, money * i);
+		snprintf(buf, sizeof(buf),
+			 "%s ½ä³õ°h¿ú! $ %d", bh->brdname, money * i);
 	    } else if (mybet == bet) {
 		fprintf(fp, "®¥³ß %s ¶R¤F%d ±i %s, Àò±o %d ªT¢Þ¹ô\n"
 			,userid, i, betname[mybet], money);
-		sprintf(buf, "%s ¤¤¼ú«¨! $ %d", bh->brdname, money * i);
+		snprintf(buf, sizeof(buf), "%s ¤¤¼ú«¨! $ %d", bh->brdname, money * i);
 	    } else
 		continue;
 	    if ((uid = searchuser(userid)) == 0)
@@ -360,9 +363,9 @@ openticket(int bid)
     fclose(fp);
 
     if (bet != 98)
-	sprintf(buf, "[¤½§i] %s ½ä½L¶}¼ú", bh->brdname);
+	snprintf(buf, sizeof(buf), "[¤½§i] %s ½ä½L¶}¼ú", bh->brdname);
     else
-	sprintf(buf, "[¤½§i] %s ½ä½L¨ú®ø", bh->brdname);
+	snprintf(buf, sizeof(buf), "[¤½§i] %s ½ä½L¨ú®ø", bh->brdname);
     post_file(bh->brdname, buf, outcome, "[½ä¯«]");
     post_file("Record", buf + 7, outcome, "[°¨¸ô±´¤l]");
 
diff --git a/mbbsd/gomo.c b/mbbsd/gomo.c
index c6870e3f..7822b090 100644
--- a/mbbsd/gomo.c
+++ b/mbbsd/gomo.c
@@ -1,4 +1,4 @@
-/* $Id: gomo.c,v 1.8 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: gomo.c,v 1.9 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 static char    *chess[] = {"¡´", "¡³"};
@@ -53,8 +53,8 @@ HO_log(char *user)
     Horder_t       *ptr = pool;
     fileheader_t    mymail;
 
-    sprintf(buf, "home/%c/%s/F.%d", cuser.userid[0], cuser.userid,
-	    rand() & 65535);
+    snprintf(buf, sizeof(buf), "home/%c/%s/F.%d",
+	     cuser.userid[0], cuser.userid,  rand() & 65535);
     log = fopen(buf, "w");
 
     for (i = 1; i < 17; i++)
@@ -73,8 +73,8 @@ HO_log(char *user)
 
     mymail.filemode = FILE_READ | FILE_HOLD;
     strlcpy(mymail.owner, "[³Æ.§Ñ.¿ý]", sizeof(mymail.owner));
-    sprintf(mymail.title, "\033[37;41m´ÑÃÐ\033[m %s VS %s",
-	    cuser.userid, user);
+    snprintf(mymail.title, sizeof(mymail.title),
+	     "\033[37;41m´ÑÃÐ\033[m %s VS %s", cuser.userid, user);
     sethomedir(title, cuser.userid);
     Rename(buf, buf1);
     append_record(title, &mymail, sizeof(mymail));
diff --git a/mbbsd/guess.c b/mbbsd/guess.c
index 654f45dc..0d655108 100644
--- a/mbbsd/guess.c
+++ b/mbbsd/guess.c
@@ -1,4 +1,4 @@
-/* $Id: guess.c,v 1.5 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: guess.c,v 1.6 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 #define LOGPASS BBSHOME "/etc/winguess.log"
 
@@ -116,8 +116,8 @@ result(int correct, int number)
     char            a = 0, b = 0, i, j;
     char            n1[5], n2[5];
 
-    sprintf(n1, "%04d", correct);
-    sprintf(n2, "%04d", number);
+    snprintf(n1, sizeof(n1), "%04d", correct);
+    snprintf(n2, sizeof(n2), "%04d", number);
     for (i = 0; i < 4; i++)
 	for (j = 0; j < 4; j++)
 	    if (n1[(int)i] == n2[(int)j])
@@ -136,7 +136,7 @@ legal(int number)
     char            i, j;
     char            temp[5];
 
-    sprintf(temp, "%04d", number);
+    snprintf(temp, sizeof(temp), "%04d", number);
     for (i = 0; i < 4; i++)
 	for (j = i + 1; j < 4; j++)
 	    if (temp[(int)i] == temp[(int)j])
@@ -173,12 +173,12 @@ computer(int correct, int total, char flag[], int n[])
     k = result(correct, guess);
     if (k == 40) {
 	move(total + 8, 25);
-	sprintf(data, "%04d", guess);
+	snprintf(data, sizeof(data), "%04d", guess);
 	prints("%s => ²q¤¤¤F!!", data);
 	return 1;
     } else {
 	move(total + 8, 25);
-	sprintf(data, "%04d", guess);
+	snprintf(data, sizeof(data), "%04d", guess);
 	prints("%s => \033[1;32m%dA %dB\033[m", data, k / 10, k % 10);
     }
     j = 0;
diff --git a/mbbsd/indict.c b/mbbsd/indict.c
index 13030880..7eed0828 100644
--- a/mbbsd/indict.c
+++ b/mbbsd/indict.c
@@ -1,4 +1,4 @@
-/* $Id: indict.c,v 1.7 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: indict.c,v 1.8 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define REFER "etc/dicts"
@@ -19,7 +19,7 @@ addword(char word[])
 	clear();
 	move(4, 0);
 	outs(" \033[31mĵ§i\033[m:­Y»W·N¶ñ¼g°²¸ê®Æ±N\033[36m¬åid\033[m³B¥÷\n");
-	sprintf(temp, "\n¿é¤J½d§Q\n:\033[33m%s\033[m", buf);
+	snprintf(temp, sizeof(temp), "\n¿é¤J½d§Q\n:\033[33m%s\033[m", buf);
 	outs(temp);
 	outs("\n½Ð¨Ì¤W¦C½d¨Ò¿é¤J¤@¦æ¸ê®Æ(ª½±µenter©ñ±ó)\n");
 	getdata(10, 0, ":", buf, 65, DOECHO);
@@ -47,7 +47,7 @@ choose_dict(void)
 
     if ((fp = fopen(REFER, "r"))) {
 	for (c = 0; fscanf(fp, "%s %s", buf[c], data[c]) != EOF; c++) {
-	    sprintf(cho, "\n                     "
+	    snprintf(cho, sizeof(cho), "\n                     "
 		    "(\033[36m%d\033[m) %-20s¤j¦r¨å", c + 1, buf[c]);
 	    outs(cho);
 	}
@@ -94,15 +94,18 @@ use_dict()
 
     clear();
 
-    sprintf(buf, "\033[45m                           ¡´\033[1;44;33m"
-	    "  %-14s\033[3;45m ¡´                              ", dict);
+    snprintf(buf, sizeof(buf),
+	     "\033[45m                           ¡´\033[1;44;33m"
+	     "  %-14s\033[3;45m ¡´                              ", dict);
     strlcpy(&buf[100], "\033[m\n", sizeof(buf) - 100);
     for (;;) {
 	move(0, 0);
-	sprintf(lang, "  ½Ð¿é¤JÃöÁä¦r¦ê(%s) ©Î«ü¥O(h,t,a)\n", dict);
+	snprintf(lang, sizeof(lang),
+		 "  ½Ð¿é¤JÃöÁä¦r¦ê(%s) ©Î«ü¥O(h,t,a)\n", dict);
 	outs(lang);
-	sprintf(lang, "[\033[32m<ÃöÁä¦r>\033[m|\033[32mh\033[m:help|\033[32m"
-		"t\033[m:©Ò¦³¸ê®Æ|\033[32ma\033[m:·s¼W¸ê®Æ%s]\n:", sys);
+	snprintf(lang, sizeof(lang),
+		 "[\033[32m<ÃöÁä¦r>\033[m|\033[32mh\033[m:help|\033[32m"
+		 "t\033[m:©Ò¦³¸ê®Æ|\033[32ma\033[m:·s¼W¸ê®Æ%s]\n:", sys);
 	outs(lang);
 	getdata(2, 0, ":", word, 18, DOECHO);
 	outs("¸ê®Æ·j´M¤¤½Ðµy­Ô....");
diff --git a/mbbsd/io.c b/mbbsd/io.c
index 1e748cc6..721b54a2 100644
--- a/mbbsd/io.c
+++ b/mbbsd/io.c
@@ -1,4 +1,4 @@
-/* $Id: io.c,v 1.21 2002/07/21 20:39:34 kcwu Exp $ */
+/* $Id: io.c,v 1.22 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #if defined(linux)
@@ -474,7 +474,7 @@ oldgetdata(int line, int col, char *prompt, char *buf, int len, int echo)
 	buf[0] = ch | 32;
 #ifdef SUPPORT_GB
     if (echo == DOECHO && current_font_type == TYPE_GB) {
-	strlcpy(buf, hc_convert_str(buf, HC_GBtoBIG, HC_DO_SINGLE), SIZEOF(buf));
+	strcpy(buf, hc_convert_str(buf, HC_GBtoBIG, HC_DO_SINGLE));
     }
 #endif
     return clen;
diff --git a/mbbsd/kaede.c b/mbbsd/kaede.c
index 41b927c1..b5c1a25e 100644
--- a/mbbsd/kaede.c
+++ b/mbbsd/kaede.c
@@ -1,4 +1,4 @@
-/* $Id: kaede.c,v 1.11 2002/07/21 09:33:34 in2 Exp $ */
+/* $Id: kaede.c,v 1.12 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 char           *
@@ -67,7 +67,7 @@ Rename(char *src, char *dst)
     if (!strchr(src, ';') && !strchr(dst, ';'))
 	//Ptt ¨ ¾¤£¥¿±`«ü¥O
     {
-	sprintf(buf, "/bin/mv %s %s", src, dst);
+	snprintf(buf, sizeof(buf), "/bin/mv %s %s", src, dst);
 	system(buf);
     }
     return -1;
@@ -83,7 +83,7 @@ Link(char *src, char *dst)
     if (symlink(dst, src) == 0)
 	return 0;
 
-    sprintf(cmd, "/bin/cp -R %s %s", src, dst);
+    snprintf(cmd, sizeof(cmd), "/bin/cp -R %s %s", src, dst);
     return system(cmd);
 }
 
@@ -94,7 +94,8 @@ my_ctime(const time_t * t)
     static char     ans[100];
 
     tp = localtime(t);
-    sprintf(ans, "%02d/%02d/%02d %02d:%02d:%02d", (tp->tm_year % 100),
-	  tp->tm_mon + 1, tp->tm_mday, tp->tm_hour, tp->tm_min, tp->tm_sec);
+    snprintf(ans, sizeof(ans),
+	     "%02d/%02d/%02d %02d:%02d:%02d", (tp->tm_year % 100),
+	     tp->tm_mon + 1, tp->tm_mday, tp->tm_hour, tp->tm_min, tp->tm_sec);
     return ans;
 }
diff --git a/mbbsd/lovepaper.c b/mbbsd/lovepaper.c
index 0ab78aa4..47370524 100644
--- a/mbbsd/lovepaper.c
+++ b/mbbsd/lovepaper.c
@@ -1,4 +1,4 @@
-/* $Id: lovepaper.c,v 1.9 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: lovepaper.c,v 1.10 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 #define DATA "etc/lovepaper.dat"
 
@@ -14,7 +14,7 @@ x_love()
 
     setutmpmode(LOVE);
     gtime = localtime(&now);
-    sprintf(buf1, "%c/%s/love%d%d",
+    snprintf(buf1, sizeof(buf1), "%c/%s/love%d%d",
 	    cuser.userid[0], cuser.userid, gtime->tm_sec, gtime->tm_min);
     strcat(path, buf1);
     move(1, 0);
diff --git a/mbbsd/mail.c b/mbbsd/mail.c
index d5426163..786d3151 100644
--- a/mbbsd/mail.c
+++ b/mbbsd/mail.c
@@ -1,4 +1,4 @@
-/* $Id: mail.c,v 1.21 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: mail.c,v 1.22 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 char            currmaildir[32];
 static char     msg_cc[] = "\033[32m[¸s²Õ¦W³æ]\033[m\n";
@@ -52,8 +52,9 @@ built_mail_index()
     if (genbuf[0] != 'y')
 	return 0;
 
-    sprintf(genbuf, BBSHOME "/bin/buildir " BBSHOME "/home/%c/%s",
-	    cuser.userid[0], cuser.userid);
+    snprintf(genbuf, sizeof(genbuf),
+	     BBSHOME "/bin/buildir " BBSHOME "/home/%c/%s",
+	     cuser.userid[0], cuser.userid);
     move(22, 0);
     prints("\033[1;31m¤w¸g³B²z§¹²¦!! ½Ñ¦h¤£«K ·q½Ð­ì½Ì~\033[m");
     pressanykey();
@@ -198,7 +199,7 @@ do_hold_mail(char *fpath, char *receiver, char *holder)
     mymail.filemode = FILE_READ | FILE_HOLD;
     strlcpy(mymail.owner, "[³Æ.§Ñ.¿ý]", sizeof(mymail.owner));
     if (receiver) {
-	sprintf(title, "(%s) %s", receiver, save_title);
+	snprintf(title, sizeof(title), "(%s) %s", receiver, save_title);
 	strncpy(mymail.title, title, TTLEN);
     } else
 	strlcpy(mymail.title, save_title, sizeof(mymail.title));
@@ -463,7 +464,7 @@ multi_send(char *title)
 	    do_reply_title(2, title);
 	else {
 	    getdata(2, 0, "¥DÃD¡G", fpath, sizeof(fpath), DOECHO);
-	    sprintf(save_title, "[³q§i] %s", fpath);
+	    snprintf(save_title, sizeof(save_title), "[³q§i] %s", fpath);
 	}
 
 	setuserfile(fpath, fn_notes);
@@ -569,7 +570,8 @@ mail_all()
     stand_title("µ¹©Ò¦³¨Ï¥ÎªÌªº¨t²Î³q§i");
     setutmpmode(SMAIL);
     getdata(2, 0, "¥DÃD¡G", fpath, sizeof(fpath), DOECHO);
-    sprintf(save_title, "[¨t²Î³q§i]\033[1;32m %s\033[m", fpath);
+    snprintf(save_title, sizeof(save_title),
+	     "[¨t²Î³q§i]\033[1;32m %s\033[m", fpath);
 
     setuserfile(fpath, fn_notes);
 
@@ -627,7 +629,8 @@ mail_all()
 	    sethomedir(genbuf, userid);
 	    if (append_record(genbuf, &mymail, sizeof(mymail)) == -1)
 		outs(err_uid);
-	    sprintf(genbuf, "%*s %5d / %5d", IDLEN + 1, userid, i + 1, unum);
+	    snprintf(genbuf, sizeof(genbuf),
+		     "%*s %5d / %5d", IDLEN + 1, userid, i + 1, unum);
 	    outmsg(genbuf);
 	    refresh();
 	}
@@ -641,8 +644,8 @@ mail_mbox()
     char            cmd[100];
     fileheader_t    fhdr;
 
-    sprintf(cmd, "/tmp/%s.uu", cuser.userid);
-    sprintf(fhdr.title, "%s ¨p¤H¸ê®Æ", cuser.userid);
+    snprintf(cmd, sizeof(cmd), "/tmp/%s.uu", cuser.userid);
+    snprintf(fhdr.title, sizeof(fhdr.title), "%s ¨p¤H¸ê®Æ", cuser.userid);
     doforward(cmd, &fhdr, 'Z');
     return 0;
 }
@@ -659,7 +662,7 @@ m_forward(int ent, fileheader_t * fhdr, char *direct)
 
     strlcpy(quote_user, fhdr->owner, sizeof(quote_user));
     setuserfile(quote_file, fhdr->filename);
-    sprintf(save_title, "%.64s (fwd)", fhdr->title);
+    snprintf(save_title, sizeof(save_title), "%.64s (fwd)", fhdr->title);
     move(1, 0);
     clrtobot();
     prints("Âà«Hµ¹: %s\n¼Ð  ÃD: %s\n", uid, save_title);
@@ -805,17 +808,19 @@ mailtitle()
     char            buf[256] = "";
 
     showtitle("\0¶l¥ó¿ï³æ", BBSName);
-    sprintf(buf, "[¡ö]Â÷¶}[¡ô¡õ]¿ï¾Ü[¡÷]¾\\Ū«H¥ó [R]¦^«H [x]Âà¹F "
-	    "[y]¸s²Õ¦^«H [O]¯¸¥~«H:%s [h]¨D§U\n\033[7m"
-	    "½s¸¹   ¤é ´Á  §@ ªÌ          «H  ¥ó  ¼Ð  ÃD     \033[32m",
-	    HAS_PERM(PERM_NOOUTMAIL) ? "\033[31mÃö\033[m" : "¶}");
+    snprintf(buf, sizeof(buf),
+	     "[¡ö]Â÷¶}[¡ô¡õ]¿ï¾Ü[¡÷]¾\\Ū«H¥ó [R]¦^«H [x]Âà¹F "
+	     "[y]¸s²Õ¦^«H [O]¯¸¥~«H:%s [h]¨D§U\n\033[7m"
+	     "½s¸¹   ¤é ´Á  §@ ªÌ          «H  ¥ó  ¼Ð  ÃD     \033[32m",
+	     HAS_PERM(PERM_NOOUTMAIL) ? "\033[31mÃö\033[m" : "¶}");
     outs(buf);
     buf[0] = 0;
     if (mailsumlimit) {
-	sprintf(buf, "(®e¶q:%d/%dk %d/%d½g)", mailsum, mailsumlimit,
-		mailkeep, mailmaxkeep);
+	snprintf(buf, sizeof(buf),
+		 "(®e¶q:%d/%dk %d/%d½g)", mailsum, mailsumlimit,
+		 mailkeep, mailmaxkeep);
     }
-    sprintf(buf, "%s%*s\033[m", buf, 29 - (int)strlen(buf), "");
+    snprintf(buf, sizeof(buf), "%s%*s\033[m", buf, 29 - (int)strlen(buf), "");
     outs(buf);
 }
 
@@ -1134,11 +1139,11 @@ mail_cross_post(int ent, fileheader_t * fhdr, char *direct)
 	}
     }
     if (ent)
-	sprintf(xtitle, "[Âà¿ý]%.66s", fhdr->title);
+	snprintf(xtitle, sizeof(xtitle), "[Âà¿ý]%.66s", fhdr->title);
     else
 	strlcpy(xtitle, fhdr->title, sizeof(xtitle));
 
-    sprintf(genbuf, "±Ä¥Î­ì¼ÐÃD¡m%.60s¡n¶Ü?[Y] ", xtitle);
+    snprintf(genbuf, sizeof(genbuf), "±Ä¥Î­ì¼ÐÃD¡m%.60s¡n¶Ü?[Y] ", xtitle);
     getdata(2, 0, genbuf, genbuf2, sizeof(genbuf2), LCECHO);
     if (*genbuf2 == 'n')
 	if (getdata(2, 0, "¼ÐÃD¡G", genbuf, TTLEN, DOECHO))
@@ -1202,7 +1207,7 @@ mail_man()
 	int             stat0 = currstat;
 
 	sethomeman(buf, cuser.userid);
-	sprintf(buf1, "%s ªº«H¥ó§¨", cuser.userid);
+	snprintf(buf1, sizeof(buf1), "%s ªº«H¥ó§¨", cuser.userid);
 	a_menu(buf1, buf, 1);
 	currutmp->mode = mode0;
 	currstat = stat0;
@@ -1294,7 +1299,7 @@ mail_waterball(int ent, fileheader_t * fhdr, char *direct)
 	 "¨t²Î±N·|«ö·Ó©M¤£¦P¤H¥áªº¤ô²y¦U¦Û¿W¥ß\n"
 	 "©ó¾ãÂIªº®É­Ô (¦y¾W®É¬q°£¥~) ±N¸ê®Æ¾ã²z¦n±H°eµ¹±z\n\n\n");
     if (address[0]) {
-	sprintf(genbuf, "±Hµ¹ [%s] ¶Ü(Y/N/Q)¡H[Y] ", address);
+	snprintf(genbuf, sizeof(genbuf), "±Hµ¹ [%s] ¶Ü(Y/N/Q)¡H[Y] ", address);
 	getdata(b_lines - 5, 0, genbuf, fname, 3, LCECHO);
 	if (fname[0] == 'q') {
 	    outmsg("¨ú®ø³B²z");
@@ -1315,7 +1320,7 @@ mail_waterball(int ent, fileheader_t * fhdr, char *direct)
     if (invalidaddr(address))
 	return -2;
 
-    //sprintf(fname, "%d\n", cmode);
+    //snprintf(fname, sizeof(fname), "%d\n", cmode);
     move(b_lines - 4, 0);
     outs("¨t²Î´£¨Ñ¨âºØ¼Ò¦¡: \n"
 	 "¼Ò¦¡ 0: ºë²¼Ò¦¡, ±N¤£§tÃC¦â±±¨î½X, ¤è«K¥H¯Â¤å¦r½s¿è¾¹¾ã²z¦¬ÂÃ\n"
@@ -1327,14 +1332,14 @@ mail_waterball(int ent, fileheader_t * fhdr, char *direct)
     }
     cmode = (fname[0] != '0' && fname[0] != '1') ? 1 : fname[0] - '0';
 
-    sprintf(fname, BBSHOME "/jobspool/water.src.%s-%d",
-	    cuser.userid, (int)now);
-    sprintf(genbuf, "cp " BBSHOME "/home/%c/%s/%s %s",
-	    cuser.userid[0], cuser.userid, fhdr->filename, fname);
+    snprintf(fname, sizeof(fname), BBSHOME "/jobspool/water.src.%s-%d",
+	     cuser.userid, (int)now);
+    snprintf(genbuf, sizeof(genbuf), "cp " BBSHOME "/home/%c/%s/%s %s",
+	     cuser.userid[0], cuser.userid, fhdr->filename, fname);
     system(genbuf);
     /* dirty code ;x */
-    sprintf(fname, BBSHOME "/jobspool/water.des.%s-%d",
-	    cuser.userid, (int)now);
+    snprintf(fname, sizeof(fname), BBSHOME "/jobspool/water.des.%s-%d",
+	     cuser.userid, (int)now);
     fp = fopen(fname, "wt");
     fprintf(fp, "%s\n%s\n%d\n", cuser.userid, address, cmode);
     fclose(fp);
@@ -1458,11 +1463,13 @@ bbs_sendmail(char *fpath, char *title, char *receiver)
     }
     /* Running the sendmail */
     if (fpath == NULL) {
-	sprintf(genbuf, "/usr/sbin/sendmail %s > /dev/null", receiver);
+	snprintf(genbuf, sizeof(genbuf),
+		 "/usr/sbin/sendmail %s > /dev/null", receiver);
 	fin = fopen("etc/confirm", "r");
     } else {
-	sprintf(genbuf, "/usr/sbin/sendmail -f %s%s %s > /dev/null",
-		cuser.userid, str_mail_address, receiver);
+	snprintf(genbuf, sizeof(genbuf),
+		 "/usr/sbin/sendmail -f %s%s %s > /dev/null",
+		 cuser.userid, str_mail_address, receiver);
 	fin = fopen(fpath, "r");
     }
     fout = popen(genbuf, "w");
@@ -1514,7 +1521,7 @@ bsmtp(char *fpath, char *title, char *rcpt, int method)
 	/* stamp the queue file */
 	strlcpy(buf, "out/", sizeof(buf));
 	for (;;) {
-	    sprintf(buf + 4, "M.%ld.A", ++chrono);
+	    snprintf(buf + 4, sizeof(buf) - 4, "M.%ld.A", ++chrono);
 	    if (!dashf(buf)) {
 		Link(fpath, buf);
 		break;
@@ -1550,7 +1557,8 @@ doforward(char *direct, fileheader_t * fh, int mode)
 	strlcpy(address, cuser.email, sizeof(address));
 
     if (address[0]) {
-	sprintf(genbuf, "½T©wÂà±Hµ¹ [%s] ¶Ü(Y/N/Q)¡H[Y] ", address);
+	snprintf(genbuf, sizeof(genbuf),
+		 "½T©wÂà±Hµ¹ [%s] ¶Ü(Y/N/Q)¡H[Y] ", address);
 	getdata(b_lines - 1, 0, genbuf, fname, 3, LCECHO);
 
 	if (fname[0] == 'q') {
@@ -1567,7 +1575,8 @@ doforward(char *direct, fileheader_t * fh, int mode)
 		if (strchr(fname, '.'))
 		    strlcpy(address, fname, sizeof(address));
 		else
-		    sprintf(address, "%s.bbs@%s", fname, MYHOSTNAME);
+		    snprintf(address, sizeof(address),
+			     "%s.bbs@%s", fname, MYHOSTNAME);
 	    } else {
 		outmsg("¨ú®øÂà±H");
 		return 1;
@@ -1577,7 +1586,7 @@ doforward(char *direct, fileheader_t * fh, int mode)
     if (invalidaddr(address))
 	return -2;
 
-    sprintf(fname, "¥¿Âà±Hµ¹ %s, ½Ðµy­Ô...", address);
+    snprintf(fname, sizeof(fname), "¥¿Âà±Hµ¹ %s, ½Ðµy­Ô...", address);
     outmsg(fname);
     move(b_lines - 1, 0);
     refresh();
@@ -1586,19 +1595,20 @@ doforward(char *direct, fileheader_t * fh, int mode)
     if (HAS_PERM(PERM_LOGUSER)) {
 	char            msg[200];
 
-	sprintf(msg, "%s mailforward to %s at %s",
-		cuser.userid, address, Cdate(&now));
+	snprintf(msg, sizeof(msg), "%s mailforward to %s at %s",
+		 cuser.userid, address, Cdate(&now));
 	log_user(msg);
     }
     if (mode == 'Z') {
-	sprintf(fname, TAR_PATH " cfz /tmp/home.%s.tgz home/%c/%s; "
-	  MUTT_PATH " -a /tmp/home.%s.tgz -s 'home.%s.tgz' '%s' </dev/null;"
-		"rm /tmp/home.%s.tgz",
-		cuser.userid, cuser.userid[0], cuser.userid,
-		cuser.userid, cuser.userid, address, cuser.userid);
+	snprintf(fname, sizeof(fname),
+		 TAR_PATH " cfz /tmp/home.%s.tgz home/%c/%s; "
+		 MUTT_PATH " -a /tmp/home.%s.tgz -s 'home.%s.tgz' '%s' </dev/null;"
+		 "rm /tmp/home.%s.tgz",
+		 cuser.userid, cuser.userid[0], cuser.userid,
+		 cuser.userid, cuser.userid, address, cuser.userid);
 	system(fname);
 	return 0;
-	sprintf(fname, TAR_PATH " cfz - home/%c/%s | "
+	snprintf(fname, sizeof(fname), TAR_PATH " cfz - home/%c/%s | "
 		"/usr/bin/uuencode %s.tgz > %s",
 		cuser.userid[0], cuser.userid, cuser.userid, direct);
 	system(fname);
@@ -1606,15 +1616,17 @@ doforward(char *direct, fileheader_t * fh, int mode)
     } else if (mode == 'U') {
 	char            tmp_buf[128];
 
-	sprintf(fname, "/tmp/bbs.uu%05d", currpid);
-	sprintf(tmp_buf, "/usr/bin/uuencode %s/%s uu.%05d > %s",
-		direct, fh->filename, currpid, fname);
+	snprintf(fname, sizeof(fname), "/tmp/bbs.uu%05d", currpid);
+	snprintf(tmp_buf, sizeof(tmp_buf),
+		 "/usr/bin/uuencode %s/%s uu.%05d > %s",
+		 direct, fh->filename, currpid, fname);
 	system(tmp_buf);
     } else if (mode == 'F') {
 	char            tmp_buf[128];
 
-	sprintf(fname, "/tmp/bbs.f%05d", currpid);
-	sprintf(tmp_buf, "cp %s/%s %s", direct, fh->filename, fname);
+	snprintf(fname, sizeof(fname), "/tmp/bbs.f%05d", currpid);
+	snprintf(tmp_buf, sizeof(tmp_buf),
+		 "cp %s/%s %s", direct, fh->filename, fname);
 	system(tmp_buf);
     } else
 	return -1;
@@ -1693,7 +1705,7 @@ mail_justify(userec_t muser)
 	    checksum = (checksum << 1) ^ ch;
 	}
 
-	sprintf(title, "[PTT BBS]To %s(%d:%d) [User Justify]",
+	snprintf(title, sizeof(title), "[PTT BBS]To %s(%d:%d) [User Justify]",
 		muser.userid, getuser(muser.userid) + MAGIC_KEY, checksum);
 	if (
 #ifndef USE_BSMTP
diff --git a/mbbsd/mbbsd.c b/mbbsd/mbbsd.c
index 6b3e15f3..9a3eeb8a 100644
--- a/mbbsd/mbbsd.c
+++ b/mbbsd/mbbsd.c
@@ -1,4 +1,4 @@
-/* $Id: mbbsd.c,v 1.43 2002/07/21 20:39:34 kcwu Exp $ */
+/* $Id: mbbsd.c,v 1.44 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define SOCKET_QLEN 4
@@ -118,8 +118,8 @@ log_user(char *msg)
 {
     char            filename[200];
 
-    sprintf(filename, BBSHOME "/home/%c/%s/USERLOG",
-	    cuser.userid[0], cuser.userid);
+    snprintf(filename, sizeof(filename), BBSHOME "/home/%c/%s/USERLOG",
+	     cuser.userid[0], cuser.userid);
     log_file(filename, msg);
 }
 
@@ -130,13 +130,15 @@ log_usies(char *mode, char *mesg)
     char            genbuf[200];
 
     if (!mesg)
-	sprintf(genbuf, cuser.userid[0] ? "%s %s %-12s Stay:%d (%s)" :
-		"%s %s %s Stay:%d (%s)",
-		Cdate(&now), mode, cuser.userid,
-		(int)(now - login_start_time) / 60, cuser.username);
+	snprintf(genbuf, sizeof(genbuf),
+		 cuser.userid[0] ? "%s %s %-12s Stay:%d (%s)" :
+		 "%s %s %s Stay:%d (%s)",
+		 Cdate(&now), mode, cuser.userid,
+		 (int)(now - login_start_time) / 60, cuser.username);
     else
-	sprintf(genbuf, cuser.userid[0] ? "%s %s %-12s %s" : "%s %s %s%s",
-		Cdate(&now), mode, cuser.userid, mesg);
+	snprintf(genbuf, sizeof(genbuf),
+		 cuser.userid[0] ? "%s %s %-12s %s" : "%s %s %s%s",
+		 Cdate(&now), mode, cuser.userid, mesg);
     log_file(FN_USIES, genbuf);
 
     /* °lÂÜ¨Ï¥ÎªÌ */
@@ -252,10 +254,11 @@ talk_request(int sig)
 	char            buf[200];
 	time_t          now = time(0);
 
-	sprintf(buf, "\033[33;41m¡¹%s\033[34;47m [%s] %s \033[0m",
-		SHM->uinfo[currutmp->destuip].userid, my_ctime(&now),
-	     (currutmp->sig == 2) ? "­«­n®ø®§¼s¼½¡I(½ÐCtrl-U,l¬d¬Ý¼ö°T°O¿ý)"
-		: "©I¥s¡B©I¥s¡AÅ¥¨ì½Ð¦^µª");
+	snprintf(buf, sizeof(buf),
+		 "\033[33;41m¡¹%s\033[34;47m [%s] %s \033[0m",
+		 SHM->uinfo[currutmp->destuip].userid, my_ctime(&now),
+		 (currutmp->sig == 2) ? "­«­n®ø®§¼s¼½¡I(½ÐCtrl-U,l¬d¬Ý¼ö°T°O¿ý)"
+		 : "©I¥s¡B©I¥s¡AÅ¥¨ì½Ð¦^µª");
 	move(0, 0);
 	clrtoeol();
 	outs(buf);
@@ -281,8 +284,8 @@ void
 show_call_in(int save, int which)
 {
     char            buf[200];
-    sprintf(buf, "\033[1;33;46m¡¹%s\033[37;45m %s \033[m",
-	  currutmp->msgs[which].userid, currutmp->msgs[which].last_call_in);
+    snprintf(buf, sizeof(buf), "\033[1;33;46m¡¹%s\033[37;45m %s \033[m",
+	     currutmp->msgs[which].userid, currutmp->msgs[which].last_call_in);
     move(b_lines, 0);
     clrtoeol();
     refresh();
@@ -485,7 +488,7 @@ logattempt(char *uid, char type)
     int             fd, len;
     char            genbuf[200];
 
-    sprintf(genbuf, "%c%-12s[%s] %s@%s\n", type, uid,
+    snprintf(genbuf, sizeof(genbuf), "%c%-12s[%s] %s@%s\n", type, uid,
 	    Cdate(&login_start_time), remoteusername, fromhost);
     len = strlen(genbuf);
     if ((fd = open(str_badlogin, O_WRONLY | O_CREAT | O_APPEND, 0644)) > 0) {
@@ -493,7 +496,8 @@ logattempt(char *uid, char type)
 	close(fd);
     }
     if (type == '-') {
-	sprintf(genbuf, "[%s] %s\n", Cdate(&login_start_time), fromhost);
+	snprintf(genbuf, sizeof(genbuf),
+		 "[%s] %s\n", Cdate(&login_start_time), fromhost);
 	len = strlen(genbuf);
 	sethomefile(fname, uid, str_badlogin);
 	if ((fd = open(fname, O_WRONLY | O_CREAT | O_APPEND, 0644)) > 0) {
@@ -733,7 +737,7 @@ setup_utmp(int mode)
 #ifndef FAST_LOGIN
     setuserfile(buf, "remoteuser");
 
-    strlcpy(remotebuf, fromhost, SIZEOF(remotebuf));
+    strlcpy(remotebuf, fromhost, sizeof(fromhost));
     strcat(remotebuf, ctime(&now));
     remotebuf[strlen(remotebuf) - 1] = 0;
     add_distinct(buf, remotebuf);
@@ -794,7 +798,7 @@ user_login()
 	char            buf[80];
 	int             nScreens;
 	for (nScreens = 0; nScreens < 10; ++nScreens) {
-	    sprintf(buf, "etc/Welcome_login.%d", nScreens);
+	    snprintf(buf, sizeof(buf), "etc/Welcome_login.%d", nScreens);
 	    if (access(buf, 0) < 0)
 		break;
 	}
@@ -803,7 +807,7 @@ user_login()
 	    //multi screen error ?
 		more("etc/Welcome_login", NA);
 	} else {
-	    sprintf(buf, "etc/Welcome_login.%d", (int)login_start_time % nScreens);
+	    snprintf(buf, sizeof(buf), "etc/Welcome_login.%d", (int)login_start_time % nScreens);
 	    more(buf, NA);
 	}
 #else
@@ -856,11 +860,14 @@ user_login()
 	    "·R¤§¨ý", "¤Ñ¤W", "ÂŦâ¬À·äÁG"
 	};
 	i = login_start_time % 13;
-	sprintf(cuser.username, "®üÃäº}¨Óªº%s", nick[(int)i]);
-	sprintf(currutmp->username, cuser.username);
-	sprintf(cuser.realname, name[(int)i]);
-	sprintf(currutmp->realname, cuser.realname);
-	sprintf(cuser.address, addr[(int)i]);
+	snprintf(cuser.username, sizeof(cuser.username),
+		 "®üÃäº}¨Óªº%s", nick[(int)i]);
+	strlcpy(currutmp->username, cuser.username,
+		sizeof(currutmp->username));
+	strlcpy(cuser.realname, name[(int)i], sizeof(cuser.realname));
+	strlcpy(currutmp->realname, cuser.realname,
+		sizeof(currutmp->realname));
+	strlcpy(cuser.address, addr[(int)i], sizeof(cuser.address));
 	cuser.sex = i % 8;
 	currutmp->pager = 2;
 	pressanykey();
@@ -886,7 +893,7 @@ do_aloha(char *hello)
 
     setuserfile(genbuf, "aloha");
     if ((fp = fopen(genbuf, "r"))) {
-	sprintf(genbuf, hello);
+	snprintf(genbuf, sizeof(genbuf), hello);
 	while (fgets(userid, 80, fp)) {
 	    userinfo_t     *uentp;
 	    int             tuid;
@@ -1114,7 +1121,7 @@ getremotename(struct sockaddr_in * from, char *rhost, char *rname)
 		 */
 		if ((cp = (char *)strchr(user, '\r')))
 		    *cp = 0;
-		strlcpy(rname, user, SIZEOF(rname));
+		strlcpy(rname, user, sizeof(user));
 	    }
 	}
 	alarm(0);
@@ -1231,7 +1238,7 @@ daemon_login(int argc, char *argv[], char *envp[])
     else if (argc >= 2)
 	listen_port = atoi(argv[1]);
 
-    sprintf(margs, "%s %d ", argv[0], listen_port);
+    snprintf(margs, sizeof(margs), "%s %d ", argv[0], listen_port);
 
     /* port binding */
     xsin.sin_family = AF_INET;
@@ -1248,7 +1255,7 @@ daemon_login(int argc, char *argv[], char *envp[])
     setuid(BBSUID);
     chdir(BBSHOME);
 
-    sprintf(buf, "run/mbbsd.%d.pid", listen_port);
+    snprintf(buf, sizeof(buf), "run/mbbsd.%d.pid", listen_port);
     if ((fp = fopen(buf, "w"))) {
 	fprintf(fp, "%d\n", getpid());
 	fclose(fp);
diff --git a/mbbsd/menu.c b/mbbsd/menu.c
index d51dd01e..08efc53d 100644
--- a/mbbsd/menu.c
+++ b/mbbsd/menu.c
@@ -1,4 +1,4 @@
-/* $Id: menu.c,v 1.15 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: menu.c,v 1.16 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 /* help & menu processring */
@@ -41,8 +41,9 @@ showtitle(char *title, char *mid)
 	title++;
 #ifdef DEBUG
     else {
-	sprintf(numreg, "\033[41;5m  current pid: %6d  " TITLE_COLOR,
-		getpid());
+	snprintf(numreg, sizeof(numreg),
+		 "\033[41;5m  current pid: %6d  " TITLE_COLOR,
+		 getpid());
 	mid = numreg;
 	spc = 22;
     }
@@ -51,9 +52,9 @@ showtitle(char *title, char *mid)
 	mid = "\033[41;5m   ¶l®t¨Ó«ö¹aÅo   " TITLE_COLOR;
 	spc = 22;
     } else if (HAS_PERM(PERM_SYSOP) && (nreg = dashs(fn_register) / 163) > 10) {
-	sprintf(numreg, "\033[41;5m  ¦³%03d/%03d¥¼¼f®Ö  " TITLE_COLOR,
-		nreg,
-		(int)dashs("register.new.tmp") / 163);
+	snprintf(numreg, sizeof(numreg),
+		 "\033[41;5m  ¦³%03d/%03d¥¼¼f®Ö  " TITLE_COLOR,
+		 nreg, (int)dashs("register.new.tmp") / 163);
 	mid = numreg;
 	spc = 22;
     }
@@ -141,13 +142,14 @@ movie(int i)
 	outs(reset_color);
     }
     i = ptime->tm_wday << 1;
-    sprintf(mystatus, "\033[34;46m[%d/%d ¬P´Á%c%c %d:%02d]\033[1;33;45m%-14s"
-	    "\033[30;47m ¥Ø«e§{¸Ì¦³ \033[31m%d\033[30m¤H, §Ú¬O\033[31m%-12s"
-	    "\033[30m[¦©¾÷]\033[31m%s\033[0m",
-	    ptime->tm_mon + 1, ptime->tm_mday, myweek[i], myweek[i + 1],
-	    ptime->tm_hour, ptime->tm_min, currutmp->birth ?
-	    "¥Í¤é­n½Ð«È­ò" : SHM->today_is,
-	    SHM->UTMPnumber, cuser.userid, msgs[currutmp->pager]);
+    snprintf(mystatus, sizeof(mystatus),
+	     "\033[34;46m[%d/%d ¬P´Á%c%c %d:%02d]\033[1;33;45m%-14s"
+	     "\033[30;47m ¥Ø«e§{¸Ì¦³ \033[31m%d\033[30m¤H, §Ú¬O\033[31m%-12s"
+	     "\033[30m[¦©¾÷]\033[31m%s\033[0m",
+	     ptime->tm_mon + 1, ptime->tm_mday, myweek[i], myweek[i + 1],
+	     ptime->tm_hour, ptime->tm_min, currutmp->birth ?
+	     "¥Í¤é­n½Ð«È­ò" : SHM->today_is,
+	     SHM->UTMPnumber, cuser.userid, msgs[currutmp->pager]);
     outmsg(mystatus);
     refresh();
 }
@@ -165,7 +167,7 @@ show_menu(commands_t * p)
     move(menu_row, 0);
     while ((s = p[n].desc)) {
 	if (HAS_PERM(p[n].level)) {
-	    sprintf(buf, s + 2, state[cuser.proverb % 4]);
+	    snprintf(buf, sizeof(buf), s + 2, state[cuser.proverb % 4]);
 	    prints("%*s  (\033[1;36m%c\033[0m)%s\n", menu_column, "", s[1],
 		   buf);
 	}
diff --git a/mbbsd/more.c b/mbbsd/more.c
index 33c6e1b3..2acf144d 100644
--- a/mbbsd/more.c
+++ b/mbbsd/more.c
@@ -1,4 +1,4 @@
-/* $Id: more.c,v 1.17 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: more.c,v 1.18 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 #define MORE_BUFSIZE	4096
 #define MORE_WINSIZE	4096
@@ -246,12 +246,14 @@ more(char *fpath, int promptend)
 		    strncpy(SearchStr, pos, strlen(search_str));
 		    SearchStr[strlen(search_str)] = 0;
 		    searching = 0;
-		    sprintf(msg, "%.*s\033[7m%s\033[m", pos - buf, buf,
-			    SearchStr);
+		    snprintf(msg, sizeof(msg),
+			     "%.*s\033[7m%s\033[m", pos - buf, buf,
+			     SearchStr);
 		    while ((pos = fptr(pos1 = pos + strlen(search_str),
 				       search_str))) {
-			sprintf(buf1, "%.*s\033[7m%s\033[m", pos - pos1,
-				pos1, SearchStr);
+			snprintf(buf1, sizeof(buf1),
+				 "%.*s\033[7m%s\033[m", pos - pos1,
+				 pos1, SearchStr);
 			strcat(msg, buf1);
 		    }
 		    strcat(msg, pos1);
@@ -497,7 +499,8 @@ more(char *fpath, int promptend)
 			char            tmpbuf[128];
 
 			setuserfile(tmpbuf, ask_tmpbuf(b_lines - 1));
-			sprintf(buf, "cp -f %s %s", fpath, tmpbuf);
+			snprintf(buf, sizeof(buf),
+				 "cp -f %s %s", fpath, tmpbuf);
 			system(buf);
 		    }
 		    if (pageno)
diff --git a/mbbsd/name.c b/mbbsd/name.c
index 72aba76c..cbd872d9 100644
--- a/mbbsd/name.c
+++ b/mbbsd/name.c
@@ -1,4 +1,4 @@
-/* $Id: name.c,v 1.13 2002/07/21 20:39:34 kcwu Exp $ */
+/* $Id: name.c,v 1.14 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 static word_t  *current = NULL;
@@ -37,7 +37,7 @@ UserSubArray(char cwbuf[][IDLEN + 1], char cwlist[][IDLEN + 1],
     for (n = 0; n < cwnum; n++) {
 	ch = cwlist[n][pos];
 	if (ch == key || ch == key2)
-	    strlcpy(cwbuf[num++], cwlist[n], SIZEOF(cwbuf[num]));
+	    strlcpy(cwbuf[num++], cwlist[n], sizeof(cwbuf[num]));
     }
     return num;
 }
diff --git a/mbbsd/osdep.c b/mbbsd/osdep.c
index f1b65242..6357a829 100644
--- a/mbbsd/osdep.c
+++ b/mbbsd/osdep.c
@@ -1,4 +1,4 @@
-/* $Id: osdep.c,v 1.5 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: osdep.c,v 1.6 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #if __FreeBSD__
@@ -57,7 +57,7 @@ cpuload(char *str)
     }
     if (str) {
 	if (l[0] != -1)
-	    sprintf(str, " %.2f %.2f %.2f", l[0], l[1], l[2]);
+	    snprintf(str, sizeof(str), " %.2f %.2f %.2f", l[0], l[1], l[2]);
 	else
 	    strcpy(str, " (unknown) ");
     }
diff --git a/mbbsd/page.c b/mbbsd/page.c
index 988b222b..e32b73f2 100644
--- a/mbbsd/page.c
+++ b/mbbsd/page.c
@@ -1,4 +1,4 @@
-/* $Id: page.c,v 1.8 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: page.c,v 1.9 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define hpressanykey(a) {move(22, 0); prints(a); pressanykey();}
@@ -8,7 +8,7 @@ filt_railway(char *fpath)
     char            buf[256], tmppath[32];
     FILE           *fp = fopen(fpath, "w"), *tp;
 
-    sprintf(tmppath, "%s.railway", fpath);
+    snprintf(tmppath, sizeof(tmppath), "%s.railway", fpath);
     if (!fp || !(tp = fopen(tmppath, "r")))
 	return;
 
@@ -104,7 +104,7 @@ main_railway()
     strlcpy(mhdr.owner, "Ptt·j´M¾¹", sizeof(mhdr.owner));
     strncpy(mhdr.title, "¤õ¨®®É¨è·j´Mµ²ªG", TTLEN);
 
-    sprintf(command, "echo \"from-station=%s&to-station=%s"
+    snprintf(command, sizeof(command), "echo \"from-station=%s&to-station=%s"
 	    "&from-time=%02d00&to-time=%02d00&tt=%s&type=%s\" | "
 	    "lynx -dump -post_data "
 	    "\"http://www.railway.gov.tw/cgi-bin/timetk.cgi\" > %s.railway",
diff --git a/mbbsd/read.c b/mbbsd/read.c
index 5a915d3b..f979e2dd 100644
--- a/mbbsd/read.c
+++ b/mbbsd/read.c
@@ -1,4 +1,4 @@
-/* $Id: read.c,v 1.10 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: read.c,v 1.11 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define MAXPATHLEN 256
@@ -76,7 +76,7 @@ Tagger(time_t chrono, int recno, int mode)
 void
 EnumTagName(char *fname, int locus)
 {
-    sprintf(fname, "M.%d.A", (int)TagList[locus].chrono);
+    snprintf(fname, sizeof(fname), "M.%d.A", (int)TagList[locus].chrono);
 }
 
 void
@@ -96,7 +96,7 @@ AskTag(char *msg)
     int             num;
 
     num = TagNum;
-    sprintf(buf, "¡» %s A)¤å³¹ T)¼Ð°O Q)uit?", msg);
+    snprintf(buf, sizeof(buf), "¡» %s A)¤å³¹ T)¼Ð°O Q)uit?", msg);
     switch (rget(b_lines - 1, buf)) {
     case 'q':
 	num = -1;
@@ -346,8 +346,9 @@ thread(keeploc_t * locmem, int stype)
 	    else if (*currauthor)
 		strlcpy(a_ans, currauthor, sizeof(a_ans));
 	}
-	sprintf(s_pmt, "%s·j´M%s [%s] ", (stype & RS_FORWARD) ? "©¹«á" : "©¹«e",
-		(stype & RS_TITLE) ? "¼ÐÃD" : "§@ªÌ", query);
+	snprintf(s_pmt, sizeof(s_pmt),
+		 "%s·j´M%s [%s] ", (stype & RS_FORWARD) ? "©¹«á" : "©¹«e",
+		 (stype & RS_TITLE) ? "¼ÐÃD" : "§@ªÌ", query);
 	getdata(b_lines - 1, 0, s_pmt, ans, sizeof(ans), DOECHO);
 	if (*ans)
 	    strcpy(query, ans);
@@ -471,8 +472,8 @@ select_read(keeploc_t * locmem, int sr_mode)
 	char            newdata[35];
 
 	query = (sr_mode == RS_RELATED) ? t_ans : a_ans;
-	sprintf(buff, "·j´M%s [%s] ",
-		(sr_mode == RS_RELATED) ? "¼ÐÃD" : "§@ªÌ", query);
+	snprintf(buff, sizeof(buff), "·j´M%s [%s] ",
+		 (sr_mode == RS_RELATED) ? "¼ÐÃD" : "§@ªÌ", query);
 	getdata(b_lines, 0, buff, newdata, sizeof(newdata), DOECHO);
 	if (newdata[0])
 	    strcpy(query, newdata);
@@ -481,7 +482,7 @@ select_read(keeploc_t * locmem, int sr_mode)
     }
 
     if ((fd = open(currdirect, O_RDONLY, 0)) != -1) {
-	sprintf(genbuf, "SR.%s", cuser.userid);
+	snprintf(genbuf, sizeof(genbuf), "SR.%s", cuser.userid);
 	if (currstat == RMAIL)
 	    sethomefile(fpath, cuser.userid, genbuf);
 	else
diff --git a/mbbsd/record.c b/mbbsd/record.c
index d8ce7aa2..bd0c5316 100644
--- a/mbbsd/record.c
+++ b/mbbsd/record.c
@@ -1,4 +1,4 @@
-/* $Id: record.c,v 1.9 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: record.c,v 1.10 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #undef  HAVE_MMAP
@@ -136,9 +136,9 @@ typedef struct nol_t {
 static void
 nolfilename(nol_t * n, char *fpath)
 {
-    sprintf(n->newfn, "%s.new", fpath);
-    sprintf(n->oldfn, "%s.old", fpath);
-    sprintf(n->lockfn, "%s.lock", fpath);
+    snprintf(n->newfn, sizeof(n->newfn), "%s.new", fpath);
+    snprintf(n->oldfn, sizeof(n->oldfn), "%s.old", fpath);
+    snprintf(n->lockfn, sizeof(n->lockfn), "%s.lock", fpath);
 }
 
 int
@@ -444,7 +444,8 @@ stampfile(char *fpath, fileheader_t * fh)
     memset(fh, 0, sizeof(fileheader_t));
     strlcpy(fh->filename, ip, sizeof(fh->filename));
     ptime = localtime(&dtime);
-    sprintf(fh->date, "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
+    snprintf(fh->date, sizeof(fh->date),
+	     "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
     return 0;
 }
 
@@ -466,7 +467,8 @@ stampdir(char *fpath, fileheader_t * fh)
     memset(fh, 0, sizeof(fileheader_t));
     strlcpy(fh->filename, ip, sizeof(fh->filename));
     ptime = localtime(&dtime);
-    sprintf(fh->date, "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
+    snprintf(fh->date, sizeof(fh->date),
+	     "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
 }
 
 void
@@ -487,7 +489,8 @@ stamplink(char *fpath, fileheader_t * fh)
     memset(fh, 0, sizeof(fileheader_t));
     strlcpy(fh->filename, ip, sizeof(fh->filename));
     ptime = localtime(&dtime);
-    sprintf(fh->date, "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
+    snprintf(fh->date, sizeof(fh->date),
+	     "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
 }
 
 int
diff --git a/mbbsd/register.c b/mbbsd/register.c
index 26204ce8..5ef02f4a 100644
--- a/mbbsd/register.c
+++ b/mbbsd/register.c
@@ -1,4 +1,4 @@
-/* $Id: register.c,v 1.8 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: register.c,v 1.9 2002/07/22 19:02:00 in2 Exp $ */
 #define _XOPEN_SOURCE
 
 #include "bbs.h"
@@ -104,18 +104,19 @@ check_and_expire_account(int uid, userec_t * urec)
     char            genbuf[200], genbuf2[200];
     int             val;
     if ((val = compute_user_value(urec, now)) < 0) {
-	sprintf(genbuf, "#%d %-12s %15.15s %d %d %d",
+	snprintf(genbuf, sizeof(genbuf), "#%d %-12s %15.15s %d %d %d",
 		uid, urec->userid, ctime(&(urec->lastlogin)) + 4,
 		urec->numlogins, urec->numposts, val);
 	if (val > -1 * 60 * 24 * 365) {
 	    memset(&zerorec, 0, sizeof(zerorec));
 	    log_usies("CLEAN", genbuf);
-	    sprintf(genbuf, "home/%c/%s", urec->userid[0],
+	    snprintf(genbuf, sizeof(genbuf), "home/%c/%s", urec->userid[0],
 		    urec->userid);
-	    sprintf(genbuf2, "tmp/%s", urec->userid);
+	    snprintf(genbuf2, sizeof(genbuf2), "tmp/%s", urec->userid);
 	    if (dashd(genbuf) && Rename(genbuf, genbuf2)) {
-		sprintf(genbuf, "/bin/rm -fr home/%c/%s >/dev/null 2>&1",
-			urec->userid[0], urec->userid);
+		snprintf(genbuf, sizeof(genbuf),
+			 "/bin/rm -fr home/%c/%s >/dev/null 2>&1",
+			 urec->userid[0], urec->userid);
 		system(genbuf);
 	    }
 	    passwd_update(uid, &zerorec);
@@ -174,7 +175,7 @@ getnewuserid()
 	safe_sleep(2);
 	exit(1);
     }
-    sprintf(genbuf, "uid %d", i);
+    snprintf(genbuf, sizeof(genbuf), "uid %d", i);
     log_usies("APPLY", genbuf);
 
     strlcpy(zerorec.userid, str_new, sizeof(zerorec.userid));
@@ -214,7 +215,8 @@ new_register()
 	    if (id == 999999)
 		outs("¦¹¥N¸¹¤w¸g¦³¤H¨Ï¥Î ¬O¤£¦º¤§¨­");
 	    else {
-		sprintf(passbuf, "¦¹¥N¸¹¤w¸g¦³¤H¨Ï¥Î ÁÙ¦³%d¤Ñ¤~¹L´Á \n", id / (60 * 24));
+		snprintf(passbuf, sizeof(passbuf),
+			 "¦¹¥N¸¹¤w¸g¦³¤H¨Ï¥Î ÁÙ¦³%d¤Ñ¤~¹L´Á \n", id / (60 * 24));
 		outs(passbuf);
 	    }
 	} else
diff --git a/mbbsd/screen.c b/mbbsd/screen.c
index 59032a85..a7f4526c 100644
--- a/mbbsd/screen.c
+++ b/mbbsd/screen.c
@@ -1,4 +1,4 @@
-/* $Id: screen.c,v 1.7 2002/07/21 20:39:34 kcwu Exp $ */
+/* $Id: screen.c,v 1.8 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #ifdef SUPPORT_GB
@@ -336,7 +336,7 @@ parsecolor(char *buf)
 	}
 	val = (char *)strtok(NULL, ";");
     }
-    strlcpy(buf, data, SIZEOF(buf));
+    strlcpy(buf, data, sizeof(data));
 }
 
 #define NORMAL (00)
@@ -483,7 +483,7 @@ prints(char *fmt,...)
     char            buff[1024];
 
     va_start(args, fmt);
-    vsprintf(buff, fmt, args);
+    vsnprintf(buff, sizeof(buff), fmt, args);
     va_end(args);
     outs(buff);
 }
diff --git a/mbbsd/stuff.c b/mbbsd/stuff.c
index d3297eda..76a3a032 100644
--- a/mbbsd/stuff.c
+++ b/mbbsd/stuff.c
@@ -1,4 +1,4 @@
-/* $Id: stuff.c,v 1.8 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: stuff.c,v 1.9 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 /* ----------------------------------------------------- */
@@ -337,19 +337,19 @@ gettime(int line, time_t dt)
     struct tm      *ptime = localtime(&dt), endtime;
 
     memcpy(&endtime, ptime, sizeof(struct tm));
-    sprintf(yn, "%4d", ptime->tm_year + 1900);
+    snprintf(yn, sizeof(yn), "%4d", ptime->tm_year + 1900);
     do {
 	getdata_buf(line, 0, "¦è¤¸¦~:", yn, 5, LCECHO);
     } while ((endtime.tm_year = atoi(yn) - 1900) < 0 || endtime.tm_year > 200);
-    sprintf(yn, "%d", ptime->tm_mon + 1);
+    snprintf(yn, sizeof(yn), "%d", ptime->tm_mon + 1);
     do {
 	getdata_buf(line, 13, "¤ë:", yn, 3, LCECHO);
     } while ((endtime.tm_mon = atoi(yn) - 1) < 0 || endtime.tm_mon > 11);
-    sprintf(yn, "%d", ptime->tm_mday);
+    snprintf(yn, sizeof(yn), "%d", ptime->tm_mday);
     do {
 	getdata_buf(line, 22, "¤é:", yn, 3, LCECHO);
     } while ((endtime.tm_mday = atoi(yn)) < 1 || endtime.tm_mday > 31);
-    sprintf(yn, "%d", ptime->tm_hour);
+    snprintf(yn, sizeof(yn), "%d", ptime->tm_hour);
     do {
 	getdata_buf(line, 31, "®É(0-23):", yn, 3, LCECHO);
     } while ((endtime.tm_hour = atoi(yn)) < 0 || endtime.tm_hour > 23);
@@ -434,7 +434,7 @@ vmsg(const char *fmt,...)
     int             ch;
 
     va_start(ap, fmt);
-    vsprintf(msg, fmt, ap);
+    vsnprintf(msg, sizeof(msg), fmt, ap);
     va_end(ap);
 
     move(b_lines, 0);
diff --git a/mbbsd/syspost.c b/mbbsd/syspost.c
index 965ce93b..0a527f22 100644
--- a/mbbsd/syspost.c
+++ b/mbbsd/syspost.c
@@ -1,4 +1,4 @@
-/* $Id: syspost.c,v 1.14 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: syspost.c,v 1.15 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 void
@@ -36,8 +36,9 @@ post_change_perm(int oldperm, int newperm, char *sysopid, char *userid)
 		cuser.userid, reason);
 	fclose(fp);
 
-	sprintf(fhdr.title, "[¤½¦w³ø§i] ¯¸ªø%s­×§ï%sÅv­­³ø§i",
-		cuser.userid, userid);
+	snprintf(fhdr.title, sizeof(fhdr.title),
+		 "[¤½¦w³ø§i] ¯¸ªø%s­×§ï%sÅv­­³ø§i",
+		 cuser.userid, userid);
 	strlcpy(fhdr.owner, "[¨t²Î¦w¥þ§½]", sizeof(fhdr.owner));
 	append_record("boards/S/Security/.DIR", &fhdr, sizeof(fhdr));
     }
@@ -60,7 +61,8 @@ post_violatelaw(char *crime, char *police, char *reason, char *result)
 	    "¦]\033[1;35m%s\033[m¦æ¬°¡A\n¹H¤Ï¥»¯¸¯¸³W¡A³B¥H\033[1;35m%s\033[m¡A¯S¦¹¤½§i",
 	    crime, ctime(&now), police, crime, reason, result);
     fclose(fp);
-    sprintf(fhdr.title, "[³ø§i] %-20s ¹Hªk§P¨M³ø§i", crime);
+    snprintf(fhdr.title, sizeof(fhdr.title),
+	     "[³ø§i] %-20s ¹Hªk§P¨M³ø§i", crime);
     strlcpy(fhdr.owner, "[Pttªk°|]", sizeof(fhdr.owner));
     append_record("boards/S/Security/.DIR", &fhdr, sizeof(fhdr));
 
@@ -75,7 +77,8 @@ post_violatelaw(char *crime, char *police, char *reason, char *result)
 	    "¦]\033[1;35m%s\033[m¦æ¬°¡A\n¹H¤Ï¥»¯¸¯¸³W¡A³B¥H\033[1;35m%s\033[m¡A¯S¦¹¤½§i",
 	    crime, ctime(&now), police, crime, reason, result);
     fclose(fp);
-    sprintf(fhdr.title, "[³ø§i] %-20s ¹Hªk§P¨M³ø§i", crime);
+    snprintf(fhdr.title, sizeof(fhdr.title),
+	     "[³ø§i] %-20s ¹Hªk§P¨M³ø§i", crime);
     strlcpy(fhdr.owner, "[Pttªk°|]", sizeof(fhdr.owner));
 
     append_record("boards/V/ViolateLaw/.DIR", &fhdr, sizeof(fhdr));
@@ -86,9 +89,10 @@ void
 post_newboard(char *bgroup, char *bname, char *bms)
 {
     char            genbuf[256], title[128];
-    sprintf(title, "[·sªO¦¨¥ß] %s", bname);
-    sprintf(genbuf, "%s ¶}¤F¤@­Ó·sªO %s : %s\n\n·s¥ôªO¥D¬° %s\n\n®¥³ß*^_^*\n",
-	    cuser.userid, bname, bgroup, bms);
+    snprintf(title, sizeof(title), "[·sªO¦¨¥ß] %s", bname);
+    snprintf(genbuf, sizeof(genbuf),
+	     "%s ¶}¤F¤@­Ó·sªO %s : %s\n\n·s¥ôªO¥D¬° %s\n\n®¥³ß*^_^*\n",
+	     cuser.userid, bname, bgroup, bms);
     post_msg("Record", title, genbuf, "[¨t²Î]");
 }
 
@@ -113,8 +117,8 @@ give_money_post(char *userid, int money)
 	    cuser.userid, userid, money);
 
     fclose(fp);
-    sprintf(fhdr.title, "[¤½¦w³ø§i] ¯¸ªø%s¨Ï¥Î¬õ¥]¾÷³ø§i",
-	    cuser.userid);
+    snprintf(fhdr.title, sizeof(fhdr.title), "[¤½¦w³ø§i] ¯¸ªø%s¨Ï¥Î¬õ¥]¾÷³ø§i",
+	     cuser.userid);
     strlcpy(fhdr.owner, "[¨t²Î¦w¥þ§½]", sizeof(fhdr.owner));
     append_record("boards/S/Security/.DIR", &fhdr, sizeof(fhdr));
 }
diff --git a/mbbsd/talk.c b/mbbsd/talk.c
index c78eb24e..56b2b88b 100644
--- a/mbbsd/talk.c
+++ b/mbbsd/talk.c
@@ -1,4 +1,4 @@
-/* $Id: talk.c,v 1.80 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: talk.c,v 1.81 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 #define QCAST   int (*)(const void *, const void *)
@@ -98,25 +98,27 @@ modestring(userinfo_t * uentp, int simple)
 	 !((fri_stat & HFM) && (fri_stat & HRM))))
 	return notonline;
     else if (mode == EDITING) {
-	sprintf(modestr, "E:%s",
+	snprintf(modestr, sizeof(modestr), "E:%s",
 		ModeTypeTable[uentp->destuid < EDITING ? uentp->destuid :
 			      EDITING]);
 	word = modestr;
     } else if (!mode && *uentp->chatid == 1) {
 	if (!simple)
-	    sprintf(modestr, "¦^À³ %s", getuserid(uentp->destuid));
+	    snprintf(modestr, sizeof(modestr),
+		     "¦^À³ %s", getuserid(uentp->destuid));
 	else
-	    sprintf(modestr, "¦^À³©I¥s");
+	    snprintf(modestr, sizeof(modestr), "¦^À³©I¥s");
     } else if (!mode && *uentp->chatid == 2)
 	if (uentp->msgcount < 10) {
 	    char           *cnum[10] =
 	    {"", "¤@", "¨â", "¤T", "¥|", "¤­", "¤»", "¤C",
 	    "¤K", "¤E"};
-	    sprintf(modestr, "¤¤%sÁû¤ô²y", cnum[uentp->msgcount]);
+	    snprintf(modestr, sizeof(modestr),
+		     "¤¤%sÁû¤ô²y", cnum[uentp->msgcount]);
 	} else
-	    sprintf(modestr, "¤£¦æ¤F @_@");
+	    snprintf(modestr, sizeof(modestr), "¤£¦æ¤F @_@");
     else if (!mode && *uentp->chatid == 3)
-	sprintf(modestr, "¤ô²y·Ç³Æ¤¤");
+	snprintf(modestr, sizeof(modestr), "¤ô²y·Ç³Æ¤¤");
     else if (!mode)
 	return (uentp->destuid == 6) ? uentp->chatid :
 	    IdleTypeTable[(0 <= uentp->destuid && uentp->destuid < 6) ?
@@ -124,27 +126,30 @@ modestring(userinfo_t * uentp, int simple)
     else if (simple)
 	return word;
     else if (uentp->in_chat && mode == CHATING)
-	sprintf(modestr, "%s (%s)", word, uentp->chatid);
+	snprintf(modestr, sizeof(modestr), "%s (%s)", word, uentp->chatid);
     else if (mode == TALK) {
 	if (!isvisible_uid(uentp->destuid))	/* Leeym ¹ï¤è(µµ¦â)Áô§Î */
-	    sprintf(modestr, "%s", "¥æ½Í ªÅ®ð");	/* Leeym
-							 * ¤j®a¦Û¤vµo´§§a¡I */
+	    snprintf(modestr, sizeof(modestr), "%s", "¥æ½Í ªÅ®ð");
+	/* Leeym * ¤j®a¦Û¤vµo´§§a¡I */
 	else
-	    sprintf(modestr, "%s %s", word, getuserid(uentp->destuid));
+	    snprintf(modestr, sizeof(modestr),
+		     "%s %s", word, getuserid(uentp->destuid));
     } else if (mode == M_FIVE) {
 	if (!isvisible_uid(uentp->destuid))
-	    sprintf(modestr, "%s", "¤­¤l´Ñ ªÅ®ð");
+	    snprintf(modestr, sizeof(modestr), "%s", "¤­¤l´Ñ ªÅ®ð");
 	else
-	    sprintf(modestr, "%s %s", word, getuserid(uentp->destuid));
+	    snprintf(modestr, sizeof(modestr), "%s %s", word, getuserid(uentp->destuid));
     } else if (mode == CHC) {
 	if (isvisible_uid(uentp->destuid))
-	    sprintf(modestr, "%s", "¤U¶H´Ñ");
+	    snprintf(modestr, sizeof(modestr), "%s", "¤U¶H´Ñ");
 	else
-	    sprintf(modestr, "¤U¶H´Ñ %s", getuserid(uentp->destuid));
+	    snprintf(modestr, sizeof(modestr),
+		     "¤U¶H´Ñ %s", getuserid(uentp->destuid));
     } else if (mode != PAGE && mode != TQUERY)
 	return word;
     else
-	sprintf(modestr, "%s %s", word, getuserid(uentp->destuid));
+	snprintf(modestr, sizeof(modestr),
+		 "%s %s", word, getuserid(uentp->destuid));
 
     return (modestr);
 }
@@ -301,7 +306,8 @@ my_kick(userinfo_t * uentp)
     getdata(1, 0, msg_sure_ny, genbuf, 4, LCECHO);
     clrtoeol();
     if (genbuf[0] == 'y') {
-	sprintf(genbuf, "%s (%s)", uentp->userid, uentp->username);
+	snprintf(genbuf, sizeof(genbuf),
+		 "%s (%s)", uentp->userid, uentp->username);
 	log_usies("KICK ", genbuf);
 	if ((uentp->pid <= 0 || kill(uentp->pid, SIGHUP) == -1) && (errno == ESRCH))
 	    purge_utmp(uentp);
@@ -321,13 +327,14 @@ chicken_query(char *userid)
 	    time_diff(&(xuser.mychicken));
 	    if (!isdeadth(&(xuser.mychicken))) {
 		show_chicken_data(&(xuser.mychicken), NULL);
-		sprintf(buf, "\n\n¥H¤W¬O %s ªºÃdª«¸ê®Æ..", userid);
+		snprintf(buf, sizeof(buf),
+			 "\n\n¥H¤W¬O %s ªºÃdª«¸ê®Æ..", userid);
 		outs(buf);
 	    }
 	} else {
 	    move(1, 0);
 	    clrtobot();
-	    sprintf(buf, "\n\n%s ¨Ã¨S¦³¾iÃdª«..", userid);
+	    snprintf(buf, sizeof(buf), "\n\n%s ¨Ã¨S¦³¾iÃdª«..", userid);
 	    outs(buf);
 	}
 	pressanykey();
@@ -525,7 +532,7 @@ my_write2(void)
 	    move(0, 0);
 	    prints("\033[m");
 	    clrtoeol();
-	    sprintf(genbuf, "§ðÀ» %s:", tw->userid);
+	    snprintf(genbuf, sizeof(genbuf), "§ðÀ» %s:", tw->userid);
 	    if (!oldgetdata(0, 0, genbuf, msg,
 			    80 - strlen(tw->userid) - 6, DOECHO))
 		break;
@@ -604,7 +611,7 @@ my_write(pid_t pid, char *prompt, char *id, int flag, userinfo_t * puin)
 
     strip_ansi(msg, msg, 0);
     if (uin && *uin->userid && (flag == 0 || flag == 4)) {
-	sprintf(buf, "¥áµ¹ %s : %s [Y/n]?", uin->userid, msg);
+	snprintf(buf, sizeof(buf), "¥áµ¹ %s : %s [Y/n]?", uin->userid, msg);
 	getdata(0, 0, buf, genbuf, 3, LCECHO);
 	if (genbuf[0] == 'n') {
 	    outmsg("\033[1;33;42mºâ¤F! ©ñ§A¤@°¨...\033[m");
@@ -976,7 +983,7 @@ do_talk(int fd)
     setutmpmode(TALK);
 
     ch = 58 - strlen(save_page_requestor);
-    sprintf(genbuf, "%s¡i%s", cuser.userid, cuser.username);
+    snprintf(genbuf, sizeof(genbuf), "%s¡i%s", cuser.userid, cuser.username);
     i = ch - strlen(genbuf);
     if (i >= 0)
 	i = (i >> 1) + 1;
@@ -987,8 +994,9 @@ do_talk(int fd)
     memset(data, ' ', i);
     data[i] = '\0';
 
-    sprintf(mid_line, "\033[1;46;37m  ½Í¤Ñ»¡¦a  \033[45m%s%s¡j"
-	    " »P  %s%s\033[0m", data, genbuf, save_page_requestor, data);
+    snprintf(mid_line, sizeof(mid_line),
+	     "\033[1;46;37m  ½Í¤Ñ»¡¦a  \033[45m%s%s¡j"
+	     " »P  %s%s\033[0m", data, genbuf, save_page_requestor, data);
 
     memset(&mywin, 0, sizeof(mywin));
     memset(&itswin, 0, sizeof(itswin));
@@ -1076,8 +1084,9 @@ do_talk(int fd)
 	    stampfile(genbuf, &mymail);
 	    mymail.filemode = FILE_READ | FILE_HOLD;
 	    strlcpy(mymail.owner, "[³Æ.§Ñ.¿ý]", sizeof(mymail.owner));
-	    sprintf(mymail.title, "¹ï¸Ü°O¿ý \033[1;36m(%s)\033[m",
-		    getuserid(currutmp->destuid));
+	    snprintf(mymail.title, sizeof(mymail.title),
+		     "¹ï¸Ü°O¿ý \033[1;36m(%s)\033[m",
+		     getuserid(currutmp->destuid));
 	    sethomedir(title, cuser.userid);
 	    Rename(fpath, genbuf);
 	    append_record(title, &mymail, sizeof(mymail));
@@ -1269,8 +1278,8 @@ my_talk(userinfo_t * uin, int fri_stat)
 	read(msgsock, &c, sizeof c);
 
 	if (c == 'y') {
-	    sprintf(save_page_requestor, "%s (%s)",
-		    uin->userid, uin->username);
+	    snprintf(save_page_requestor, sizeof(save_page_requestor),
+		     "%s (%s)", uin->userid, uin->username);
 	    /* gomo */
 	    switch (uin->sig) {
 	    case SIG_DARK:
@@ -1399,7 +1408,7 @@ friend_descript(char *uident)
     setuserfile(fpath, friend_file[0]);
 
     if ((fp = fopen(fpath, "r"))) {
-	sprintf(name, "%s ", uident);
+	snprintf(name, sizeof(name), "%s ", uident);
 	len = strlen(name);
 	desc = genbuf + 13;
 
@@ -1439,8 +1448,9 @@ descript(int show_mode, userinfo_t * uentp, time_t diff)
 #endif
 		: "*");
     case 2:
-	sprintf(description, "%3d/%3d/%3d", uentp->five_win,
-		uentp->five_lose, uentp->five_tie);
+	snprintf(description, sizeof(description),
+		 "%3d/%3d/%3d", uentp->five_win,
+		 uentp->five_lose, uentp->five_tie);
 	description[20] = 0;
 	return description;
     default:
@@ -1671,11 +1681,11 @@ draw_pickup(int drawall, pickup_t * pickup, int pickup_way,
 	if (idletime > 86400)
 	    strlcpy(idlestr, " -----", sizeof(idlestr));
 	else if (idletime >= 3600)
-	    sprintf(idlestr, "%3dh%02d",
-		    idletime / 3600, (idletime / 60) % 60);
+	    snprintf(idlestr, sizeof(idlestr), "%3dh%02d",
+		     idletime / 3600, (idletime / 60) % 60);
 	else if (idletime > 0)
-	    sprintf(idlestr, "%3d'%02d",
-		    idletime / 60, idletime % 60);
+	    snprintf(idlestr, sizeof(idlestr), "%3d'%02d",
+		     idletime / 60, idletime % 60);
 	else
 	    strlcpy(idlestr, "      ", sizeof(idlestr));
 #endif
@@ -1743,7 +1753,7 @@ call_in(userinfo_t * uentp, int fri_stat)
 {
     if (iswritable_stat(uentp, fri_stat)) {
 	char            genbuf[60];
-	sprintf(genbuf, "Call-In %s ¡G", uentp->userid);
+	snprintf(genbuf, sizeof(genbuf), "Call-In %s ¡G", uentp->userid);
 	my_write(uentp->pid, genbuf, uentp->userid, 0, NULL);
 	return 1;
     }
@@ -1857,7 +1867,8 @@ userlist(void)
 	    case 'D':
 		if (HAS_PERM(PERM_SYSOP)) {
 		    char            buf[100];
-		    sprintf(buf, "¥N¸¹ [%s]¡G", currutmp->userid);
+		    snprintf(buf, sizeof(buf),
+			     "¥N¸¹ [%s]¡G", currutmp->userid);
 		    if (!getdata(1, 0, buf, currutmp->userid,
 				 sizeof(buf), DOECHO))
 			strlcpy(currutmp->userid, cuser.userid, sizeof(currutmp->userid));
@@ -1869,7 +1880,7 @@ userlist(void)
 		if (HAS_PERM(PERM_SYSOP)) {
 		    char            buf[100];
 
-		    sprintf(buf, "¬G¶m [%s]¡G", currutmp->from);
+		    snprintf(buf, sizeof(buf), "¬G¶m [%s]¡G", currutmp->from);
 		    if (!getdata(1, 0, buf, currutmp->from,
 				 sizeof(currutmp->from), DOECHO))
 			strncpy(currutmp->from, fromhost, 23);
@@ -2171,7 +2182,8 @@ userlist(void)
 		if (HAS_PERM(PERM_LOGINOK) &&
 		    strcmp(uentp->userid, cuser.userid) != 0) {
 		    move(b_lines - 2, 0);
-		    sprintf(genbuf, "­nµ¹ %s ¦h¤Ö¿ú©O?  ", uentp->userid);
+		    snprintf(genbuf, sizeof(genbuf),
+			     "­nµ¹ %s ¦h¤Ö¿ú©O?  ", uentp->userid);
 		    outs(genbuf);
 		    if (getdata(b_lines - 1, 0, "[»È¦æÂà±b]: ",
 				genbuf, 7, LCECHO)) {
@@ -2184,12 +2196,14 @@ userlist(void)
 			    outs("\033[41m ²{ª÷¤£¨¬~~\033[m");
 			else {
 			    deumoney(uentp->uid, ch - give_tax(ch));
-			    sprintf(genbuf, "\033[44m ¶â..ÁٳѤU %d ¿ú.."
-				    "\033[m", demoney(-ch));
+			    snprintf(genbuf, sizeof(genbuf),
+				     "\033[44m ¶â..ÁٳѤU %d ¿ú.."
+				     "\033[m", demoney(-ch));
 			    outs(genbuf);
-			    sprintf(genbuf, "%s\tµ¹%s\t%d\t%s", cuser.userid,
-				    uentp->userid, ch,
-				    ctime(&currutmp->lastact));
+			    snprintf(genbuf, sizeof(genbuf),
+				     "%s\tµ¹%s\t%d\t%s", cuser.userid,
+				     uentp->userid, ch,
+				     ctime(&currutmp->lastact));
 			    log_file(FN_MONEY, genbuf);
 			    mail_redenvelop(cuser.userid, uentp->userid,
 					    ch - give_tax(ch), 'Y');
@@ -2326,8 +2340,9 @@ t_idle(void)
     do {
 	move(b_lines - 2, 0);
 	clrtoeol();
-	sprintf(buf, "(Âê©w¿Ã¹õ)µo§b­ì¦]: %s", (currutmp->destuid != 6) ?
-		IdleTypeTable[currutmp->destuid] : currutmp->chatid);
+	snprintf(buf, sizeof(buf),
+		 "(Âê©w¿Ã¹õ)µo§b­ì¦]: %s", (currutmp->destuid != 6) ?
+		 IdleTypeTable[currutmp->destuid] : currutmp->chatid);
 	outs(buf);
 	refresh();
 	getdata(b_lines - 1, 0, MSG_PASSWD, passbuf, sizeof(passbuf), NOECHO);
@@ -2427,7 +2442,8 @@ talkreply(void)
 
     talkrequest = NA;
     uip = &SHM->uinfo[currutmp->destuip];
-    sprintf(page_requestor, "%s (%s)", uip->userid, uip->username);
+    snprintf(page_requestor, sizeof(page_requestor),
+	     "%s (%s)", uip->userid, uip->username);
     currutmp->destuid = uip->uid;
     currstat = XMODE;		/* ÁקK¥X²{°Êµe */
 
@@ -2456,12 +2472,14 @@ talkreply(void)
     showplans(uip->userid);
     show_call_in(0, 0);
 
-    sprintf(genbuf, "§A·Q¸ò %s %s°Ú¡H½Ð¿ï¾Ü(Y/N/A/B/C/D/E/F/1/2)[N] ",
-	    page_requestor, sig_des[sig]);
+    snprintf(genbuf, sizeof(genbuf),
+	     "§A·Q¸ò %s %s°Ú¡H½Ð¿ï¾Ü(Y/N/A/B/C/D/E/F/1/2)[N] ",
+	     page_requestor, sig_des[sig]);
     getdata(0, 0, genbuf, buf, sizeof(buf), LCECHO);
 
     if (uip->mode != PAGE) {
-	sprintf(genbuf, "%s¤w°±¤î©I¥s¡A«öEnterÄ~Äò...", page_requestor);
+	snprintf(genbuf, sizeof(genbuf),
+		 "%s¤w°±¤î©I¥s¡A«öEnterÄ~Äò...", page_requestor);
 	getdata(0, 0, genbuf, buf, sizeof(buf), LCECHO);
 	return;
     }
diff --git a/mbbsd/term.c b/mbbsd/term.c
index ced6b1c4..9694add2 100644
--- a/mbbsd/term.c
+++ b/mbbsd/term.c
@@ -1,4 +1,4 @@
-/* $Id: term.c,v 1.5 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: term.c,v 1.6 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 int             tgetent(const char *bp, char *name);
@@ -91,7 +91,7 @@ do_move(int destcol, int destline)
 {
     char            buf[16], *p;
 
-    sprintf(buf, "\33[%d;%dH", destline + 1, destcol + 1);
+    snprintf(buf, sizeof(buf), "\33[%d;%dH", destline + 1, destcol + 1);
     for (p = buf; *p; p++)
 	ochar(*p);
 }
@@ -115,7 +115,7 @@ change_scroll_range(int top, int bottom)
 {
     char            buf[16], *p;
 
-    sprintf(buf, "\33[%d;%dr", top + 1, bottom + 1);
+    snprintf(buf, sizeof(buf), "\33[%d;%dr", top + 1, bottom + 1);
     for (p = buf; *p; p++)
 	ochar(*p);
 }
diff --git a/mbbsd/user.c b/mbbsd/user.c
index b830fe5c..d6dd4b20 100644
--- a/mbbsd/user.c
+++ b/mbbsd/user.c
@@ -1,4 +1,4 @@
-/* $Id: user.c,v 1.32 2002/07/21 10:11:13 in2 Exp $ */
+/* $Id: user.c,v 1.33 2002/07/22 19:02:00 in2 Exp $ */
 #include "bbs.h"
 
 static char    *sex[8] = {
@@ -122,7 +122,7 @@ mail_violatelaw(char *crime, char *police, char *reason, char *result)
     char            genbuf[200];
     fileheader_t    fhdr;
     FILE           *fp;
-    sprintf(genbuf, "home/%c/%s", crime[0], crime);
+    snprintf(genbuf, sizeof(genbuf), "home/%c/%s", crime[0], crime);
     stampfile(genbuf, &fhdr);
     if (!(fp = fopen(genbuf, "w")))
 	return;
@@ -134,9 +134,9 @@ mail_violatelaw(char *crime, char *police, char *reason, char *result)
 	"\n½Ð¨ì PttLaw ¬d¸ß¬ÛÃöªk³W¸ê°T¡A¨Ã¨ì Play-Pay-ViolateLaw ú¥æ»@³æ",
 	    ctime(&now), police, crime, reason, result);
     fclose(fp);
-    sprintf(fhdr.title, "[³ø§i] ¹Hªk§P¨M³ø§i");
+    snprintf(fhdr.title, sizeof(fhdr.title), "[³ø§i] ¹Hªk§P¨M³ø§i");
     strlcpy(fhdr.owner, "[Pttªk°|]", sizeof(fhdr.owner));
-    sprintf(genbuf, "home/%c/%s/.DIR", crime[0], crime);
+    snprintf(genbuf, sizeof(genbuf), "home/%c/%s/.DIR", crime[0], crime);
     append_record(genbuf, &fhdr, sizeof(fhdr));
 }
 
@@ -153,13 +153,13 @@ violate_law(userec_t * u, int unum)
     getdata(5, 0, "(0)µ²§ô", ans, sizeof(ans), DOECHO);
     switch (ans[0]) {
     case '1':
-	sprintf(reason, "%s", "Cross-post");
+	snprintf(reason, sizeof(reason), "%s", "Cross-post");
 	break;
     case '2':
-	sprintf(reason, "%s", "¶Ãµo¼s§i«H");
+	snprintf(reason, sizeof(reason), "%s", "¶Ãµo¼s§i«H");
 	break;
     case '3':
-	sprintf(reason, "%s", "¶Ãµo³sÂê«H");
+	snprintf(reason, sizeof(reason), "%s", "¶Ãµo³sÂê«H");
 	break;
     case '4':
 	while (!getdata(7, 0, "½Ð¿é¤J³QÀËÁ|²z¥Ñ¥H¥Ü­t³d¡G", reason, 50, DOECHO));
@@ -177,8 +177,8 @@ violate_law(userec_t * u, int unum)
 	return;
     if (ans[0] == '9') {
 	char            src[STRLEN], dst[STRLEN];
-	sprintf(src, "home/%c/%s", u->userid[0], u->userid);
-	sprintf(dst, "tmp/%s", u->userid);
+	snprintf(src, sizeof(src), "home/%c/%s", u->userid[0], u->userid);
+	snprintf(dst, sizeof(dst), "tmp/%s", u->userid);
 	Rename(src, dst);
 	log_usies("KILL", u->userid);
 	post_violatelaw(u->userid, cuser.userid, reason, "¬å°£ ID");
@@ -247,7 +247,7 @@ uinfo_query(userec_t * u, int real, int unum)
 	    getdata_buf(i++, 0, "©~¦í¦a§}¡G",
 			x.address, sizeof(x.address), DOECHO);
 	}
-	sprintf(buf, "%010d", x.mobile);
+	snprintf(buf, sizeof(buf), "%010d", x.mobile);
 	getdata_buf(i++, 0, "¤â¾÷¸¹½X¡G", buf, 11, LCECHO);
 	x.mobile = atoi(buf);
 	getdata_str(i++, 0, "¹q¤l«H½c[ÅÜ°Ê­n­«·s»{ÃÒ]¡G", buf, 50, DOECHO,
@@ -256,7 +256,7 @@ uinfo_query(userec_t * u, int real, int unum)
 	    strlcpy(x.email, buf, sizeof(x.email));
 	    mail_changed = 1 - real;
 	}
-	sprintf(genbuf, "%i", (u->sex + 1) % 8);
+	snprintf(genbuf, sizeof(genbuf), "%i", (u->sex + 1) % 8);
 	getdata_str(i++, 0, "©Ê§O (1)¸¯®æ (2)©j±µ (3)©³­} (4)¬ü¬Ü (5)Á¦¨û "
 		    "(6)ªü«¼ (7)´Óª« (8)Äqª«¡G",
 		    buf, 3, DOECHO, genbuf);
@@ -268,8 +268,8 @@ uinfo_query(userec_t * u, int real, int unum)
 	while (1) {
 	    int             len;
 
-	    sprintf(genbuf, "%02i/%02i/%02i",
-		    u->month, u->day, u->year % 100);
+	    snprintf(genbuf, sizeof(genbuf), "%02i/%02i/%02i",
+		     u->month, u->day, u->year % 100);
 	    len = getdata_str(i, 0, "¥Í¤é ¤ë¤ë/¤é¤é/¦è¤¸¡G", buf, 9,
 			      DOECHO, genbuf);
 	    if (len && len != 8)
@@ -293,7 +293,7 @@ uinfo_query(userec_t * u, int real, int unum)
 	if (real) {
 	    unsigned long int l;
 	    if (HAS_PERM(PERM_BBSADM)) {
-		sprintf(genbuf, "%d", x.money);
+		snprintf(genbuf, sizeof(genbuf), "%d", x.money);
 		if (getdata_str(i++, 0, "»È¦æ±b¤á¡G", buf, 10, DOECHO, genbuf))
 		    if ((l = atol(buf)) != 0) {
 			if (l != x.money) {
@@ -303,7 +303,7 @@ uinfo_query(userec_t * u, int real, int unum)
 			}
 		    }
 	    }
-	    sprintf(genbuf, "%d", x.exmailbox);
+	    snprintf(genbuf, sizeof(genbuf), "%d", x.exmailbox);
 	    if (getdata_str(i++, 0, "ÁʶR«H½c¼Æ¡G", buf, 4, DOECHO, genbuf))
 		if ((l = atol(buf)) != 0)
 		    x.exmailbox = (int)l;
@@ -313,22 +313,22 @@ uinfo_query(userec_t * u, int real, int unum)
 	    getdata_buf(i++, 0, "³Ìªñ¥úÁ{¾÷¾¹¡G",
 			x.lasthost, sizeof(x.lasthost), DOECHO);
 
-	    sprintf(genbuf, "%d", x.numlogins);
+	    snprintf(genbuf, sizeof(genbuf), "%d", x.numlogins);
 	    if (getdata_str(i++, 0, "¤W½u¦¸¼Æ¡G", buf, 10, DOECHO, genbuf))
 		if ((fail = atoi(buf)) >= 0)
 		    x.numlogins = fail;
 
-	    sprintf(genbuf, "%d", u->numposts);
+	    snprintf(genbuf, sizeof(genbuf), "%d", u->numposts);
 	    if (getdata_str(i++, 0, "¤å³¹¼Æ¥Ø¡G", buf, 10, DOECHO, genbuf))
 		if ((fail = atoi(buf)) >= 0)
 		    x.numposts = fail;
-	    sprintf(genbuf, "%d", u->vl_count);
+	    snprintf(genbuf, sizeof(genbuf), "%d", u->vl_count);
 	    if (getdata_str(i++, 0, "¹Hªk°O¿ý¡G", buf, 10, DOECHO, genbuf))
 		if ((fail = atoi(buf)) >= 0)
 		    x.vl_count = fail;
 
-	    sprintf(genbuf, "%d/%d/%d", u->five_win, u->five_lose,
-		    u->five_tie);
+	    snprintf(genbuf, sizeof(genbuf),
+		     "%d/%d/%d", u->five_win, u->five_lose, u->five_tie);
 	    if (getdata_str(i++, 0, "¤­¤l´Ñ¾ÔÁZ ³Ó/±Ñ/©M¡G", buf, 16, DOECHO,
 			    genbuf))
 		while (1) {
@@ -346,7 +346,8 @@ uinfo_query(userec_t * u, int real, int unum)
 		    x.five_tie = atoi(p);
 		    break;
 		}
-	    sprintf(genbuf, "%d/%d/%d", u->chc_win, u->chc_lose, u->chc_tie);
+	    snprintf(genbuf, sizeof(genbuf),
+		     "%d/%d/%d", u->chc_win, u->chc_lose, u->chc_tie);
 	    if (getdata_str(i++, 0, "¶H´Ñ¾ÔÁZ ³Ó/±Ñ/©M¡G", buf, 16, DOECHO,
 			    genbuf))
 		while (1) {
@@ -484,10 +485,11 @@ uinfo_query(userec_t * u, int real, int unum)
 	if (i == QUIT) {
 	    char            src[STRLEN], dst[STRLEN];
 
-	    sprintf(src, "home/%c/%s", x.userid[0], x.userid);
-	    sprintf(dst, "tmp/%s", x.userid);
+	    snprintf(src, sizeof(src), "home/%c/%s", x.userid[0], x.userid);
+	    snprintf(dst, sizeof(dst), "tmp/%s", x.userid);
 	    if (Rename(src, dst)) {
-		sprintf(genbuf, "/bin/rm -fr %s >/dev/null 2>&1", src);
+		snprintf(genbuf, sizeof(genbuf),
+			 "/bin/rm -fr %s >/dev/null 2>&1", src);
 		/*
 		 * do not remove system(genbuf);
 		 */
@@ -521,8 +523,9 @@ uinfo_query(userec_t * u, int real, int unum)
 	    fprintf(fp, "\n   \033[1;37m¯¸ªø%s­×§ï¿ú²z¥Ñ¬O¡G%s\033[m",
 		    cuser.userid, reason);
 	    fclose(fp);
-	    sprintf(fhdr.title, "[¤½¦w³ø§i] ¯¸ªø%s­×§ï%s¿ú³ø§i", cuser.userid,
-		    x.userid);
+	    snprintf(fhdr.title, sizeof(fhdr.title),
+		     "[¤½¦w³ø§i] ¯¸ªø%s­×§ï%s¿ú³ø§i", cuser.userid,
+		     x.userid);
 	    strlcpy(fhdr.owner, "[¨t²Î¦w¥þ§½]", sizeof(fhdr.owner));
 	    append_record("boards/S/Security/.DIR", &fhdr, sizeof(fhdr));
 	}
@@ -723,10 +726,10 @@ getfield(int line, char *info, char *desc, char *buf, int len)
     char            prompt[STRLEN];
     char            genbuf[200];
 
-    sprintf(genbuf, "­ì¥ý³]©w¡G%-30.30s (%s)", buf, info);
+    snprintf(genbuf, sizeof(genbuf), "­ì¥ý³]©w¡G%-30.30s (%s)", buf, info);
     move(line, 2);
     outs(genbuf);
-    sprintf(prompt, "%s¡G", desc);
+    snprintf(prompt, sizeof(prompt), "%s¡G", desc);
     if (getdata_str(line + 1, 2, prompt, genbuf, len, DOECHO, buf))
 	strcpy(buf, genbuf);
     move(line, 2);
@@ -899,14 +902,17 @@ toregister(char *email, char *genbuf, char *phone, char *career,
 	if (phone != NULL) {
 #ifdef HAVEMOBILE
 	    if (strcmp(email, "m") == 0 || strcmp(email, "M") == 0)
-		sprintf(genbuf, "%s:%s:<Mobile>", phone, career);
+		sprintf(genbuf, sizeof(genbuf),
+			"%s:%s:<Mobile>", phone, career);
 	    else
 #endif
-		sprintf(genbuf, "%s:%s:<Email>", phone, career);
+		snprintf(genbuf, sizeof(genbuf),
+			 "%s:%s:<Email>", phone, career);
 	    strncpy(cuser.justify, genbuf, REGLEN);
 	    sethomefile(buf, cuser.userid, "justify");
 	}
-	sprintf(buf, "±z¦b " BBSNAME " ªº»{ÃÒ½X: %s", getregcode(genbuf));
+	snprintf(buf, sizeof(buf),
+		 "±z¦b " BBSNAME " ªº»{ÃÒ½X: %s", getregcode(genbuf));
 	strlcpy(tmp, cuser.userid, sizeof(tmp));
 	strlcpy(cuser.userid, "SYSOP", sizeof(cuser.userid));
 #ifdef HAVEMOBILE
@@ -956,12 +962,12 @@ u_register(void)
     strlcpy(rname, cuser.realname, sizeof(rname));
     strlcpy(addr, cuser.address, sizeof(addr));
     strlcpy(email, cuser.email, sizeof(email));
-    sprintf(mobile, "0%09d", cuser.mobile);
+    snprintf(mobile, sizeof(mobile), "0%09d", cuser.mobile);
     if (cuser.month == 0 && cuser.day && cuser.year == 0)
 	birthday[0] = 0;
     else
-	sprintf(birthday, "%02i/%02i/%02i",
-		cuser.month, cuser.day, cuser.year % 100);
+	snprintf(birthday, sizeof(birthday), "%02i/%02i/%02i",
+		 cuser.month, cuser.day, cuser.year % 100);
     sex_is[0] = (cuser.sex % 8) + '1';
     sex_is[1] = 0;
     career[0] = phone[0] = '\0';
@@ -1091,8 +1097,8 @@ u_register(void)
 	    getfield(15, "¤ë¤ë/¤é¤é/¦è¤¸ ¦p:09/27/76", "¥Í¤é", birthday, 9);
 	    len = strlen(birthday);
 	    if (!len) {
-		sprintf(birthday, "%02i/%02i/%02i",
-			cuser.month, cuser.day, cuser.year % 100);
+		snprintf(birthday, sizeof(birthday), "%02i/%02i/%02i",
+			 cuser.month, cuser.day, cuser.year % 100);
 		mon = cuser.month;
 		day = cuser.day;
 		year = cuser.year;
diff --git a/mbbsd/vice.c b/mbbsd/vice.c
index 35a5641f..acc653fa 100644
--- a/mbbsd/vice.c
+++ b/mbbsd/vice.c
@@ -1,4 +1,4 @@
-/* $Id: vice.c,v 1.5 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: vice.c,v 1.6 2002/07/22 19:02:01 in2 Exp $ */
 #include "bbs.h"
 
 #define VICE_PLAY   BBSHOME "/etc/vice/vice.play"
@@ -54,7 +54,7 @@ ran_showfile(int y, int x, char *filename, int maxnum)
     char            buf[512];
 
     bzero(buf, sizeof(char) * 512);
-    sprintf(buf, "%s%d", filename, rand() % maxnum + 1);
+    snprintf(buf, sizeof(buf), "%s%d", filename, rand() % maxnum + 1);
     if (!(fs = fopen(buf, "r"))) {
 	move(10, 10);
 	prints("can't open file: %s", buf);
@@ -74,7 +74,7 @@ ran_showmfile(char *filename, int maxnum)
 {
     char            buf[256];
 
-    sprintf(buf, "%s%d", filename, rand() % maxnum + 1);
+    snprintf(buf, sizeof(buf), "%s%d", filename, rand() % maxnum + 1);
     return more(buf, YEA);
 }
 
diff --git a/mbbsd/vote.c b/mbbsd/vote.c
index fb1c40e9..48afafd1 100644
--- a/mbbsd/vote.c
+++ b/mbbsd/vote.c
@@ -1,4 +1,4 @@
-/* $Id: vote.c,v 1.14 2002/07/21 20:43:35 kcwu Exp $ */
+/* $Id: vote.c,v 1.15 2002/07/22 19:02:01 in2 Exp $ */
 #include "bbs.h"
 
 static int      total;
@@ -136,11 +136,12 @@ vote_report(char *bname, char *fname, char *fpath)
 
     memset(&header, 0, sizeof(fileheader_t));
     strlcpy(header.owner, "[°¨¸ô±´¤l]", sizeof(header.owner));
-    sprintf(header.title, "[%s] ¬ÝªO ¿ï±¡³ø¾É", bname);
+    snprintf(header.title, sizeof(header.title), "[%s] ¬ÝªO ¿ï±¡³ø¾É", bname);
     {
 	register struct tm *ptime = localtime(&dtime);
 
-	sprintf(header.date, "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
+	snprintf(header.date, sizeof(header.date),
+		 "%2d/%02d", ptime->tm_mon + 1, ptime->tm_mday);
     }
     strlcpy(header.filename, ip, sizeof(header.filename));
 
@@ -261,10 +262,10 @@ b_result_one(boardheader_t * fh, int ind)
 	b_suckinfile(frp, b_newresults);
 	fclose(frp);
     }
-    sprintf(inbuf, "boards/%c/%s", bname[0], bname);
+    snprintf(inbuf, sizeof(inbuf), "boards/%c/%s", bname[0], bname);
     vote_report(bname, b_report, inbuf);
     if (!(fh->brdattr & BRD_NOCOUNT)) {
-	sprintf(inbuf, "boards/%c/%s", 'R', "Record");
+	snprintf(inbuf, sizeof(inbuf), "boards/%c/%s", 'R', "Record");
 	vote_report(bname, b_report, inbuf);
     }
     unlink(b_report);
@@ -493,8 +494,10 @@ vote_view_all(char *bname)
 	fclose(xfp);
     }
     for (i = 1; i < 20; i++) {
-	sprintf(STR_new_control, "%s%d", STR_bv_control, i);
-	sprintf(STR_new_title, "%s%d", STR_bv_title, i);
+	snprintf(STR_new_control, sizeof(STR_new_control),
+		 "%s%d", STR_bv_control, i);
+	snprintf(STR_new_title, sizeof(STR_new_title),
+		 "%s%d", STR_bv_title, i);
 	setbfile(buf, bname, STR_new_control);
 	if ((fp = fopen(buf, "r"))) {
 	    prints("(%d) ", i);
@@ -513,15 +516,16 @@ vote_view_all(char *bname)
 
     if (x < 0)
 	return FULLUPDATE;
-    sprintf(buf, "­n¬Ý´X¸¹§ë²¼ [%d] ", x);
+    snprintf(buf, sizeof(buf), "­n¬Ý´X¸¹§ë²¼ [%d] ", x);
 
     getdata(b_lines - 1, 0, buf, genbuf, 4, LCECHO);
 
 
     if (atoi(genbuf) < 0 || atoi(genbuf) > 20)
-	sprintf(genbuf, "%d", x);
+	snprintf(genbuf, sizeof(genbuf), "%d", x);
     if (genbuf[0] != '0')
-	sprintf(STR_new_control, "%s%d", STR_bv_control, atoi(genbuf));
+	snprintf(STR_new_control, sizeof(STR_new_control),
+		 "%s%d", STR_bv_control, atoi(genbuf));
     else
 	strlcpy(STR_new_control, STR_bv_control, sizeof(STR_new_control));
 
@@ -576,13 +580,20 @@ vote_maintain(char *bname)
 	    unlink(buf);
 
 	    for (i = 1; i < 20; i++) {
-		sprintf(STR_new_ballots, "%s%d", STR_bv_ballots, i);
-		sprintf(STR_new_control, "%s%d", STR_bv_control, i);
-		sprintf(STR_new_desc, "%s%d", STR_bv_desc, i);
-		sprintf(STR_new_flags, "%s%d", STR_bv_flags, i);
-		sprintf(STR_new_comments, "%s%d", STR_bv_comments, i);
-		sprintf(STR_new_limited, "%s%d", STR_bv_limited, i);
-		sprintf(STR_new_title, "%s%d", STR_bv_title, i);
+		snprintf(STR_new_ballots, sizeof(STR_new_ballots),
+			 "%s%d", STR_bv_ballots, i);
+		snprintf(STR_new_control, sizeof(STR_new_control),
+			 "%s%d", STR_bv_control, i);
+		snprintf(STR_new_desc, sizeof(STR_new_desc),
+			 "%s%d", STR_bv_desc, i);
+		snprintf(STR_new_flags, sizeof(STR_new_flags),
+			 "%s%d", STR_bv_flags, i);
+		snprintf(STR_new_comments, sizeof(STR_new_comments),
+			 "%s%d", STR_bv_comments, i);
+		snprintf(STR_new_limited, sizeof(STR_new_limited),
+			 "%s%d", STR_bv_limited, i);
+		snprintf(STR_new_title, sizeof(STR_new_title),
+			 "%s%d", STR_bv_title, i);
 
 		setbfile(buf, bname, STR_new_control);
 		unlink(buf);
@@ -610,7 +621,8 @@ vote_maintain(char *bname)
     while (x < 20 && (fp = fopen(buf, "r")) != NULL) {
 	fclose(fp);
 	x++;
-	sprintf(STR_new_control, "%s%d", STR_bv_control, x);
+	snprintf(STR_new_control, sizeof(STR_new_control),
+		 "%s%d", STR_bv_control, x);
 	setbfile(buf, bname, STR_new_control);
     }
     if (fp)
@@ -689,7 +701,7 @@ vote_maintain(char *bname)
     outs("\n½Ð¨Ì§Ç¿é¤J¿ï¶µ, «ö ENTER §¹¦¨³]©w");
     num = 0;
     while (!aborted) {
-	sprintf(buf, "%c) ", num + 'A');
+	snprintf(buf, sizeof(buf), "%c) ", num + 'A');
 	getdata((num % 15) + 2, (num / 15) * 40, buf,
 		inbuf, 50, DOECHO);
 	if (*inbuf) {
@@ -699,7 +711,7 @@ vote_maintain(char *bname)
 	if ((*inbuf == '\0' && num >= 1) || num == 30)
 	    aborted = 1;
     }
-    sprintf(buf, "½Ð°Ý¨C¤H³Ì¦h¥i§ë´X²¼¡H([1]¡ã%d): ", num);
+    snprintf(buf, sizeof(buf), "½Ð°Ý¨C¤H³Ì¦h¥i§ë´X²¼¡H([1]¡ã%d): ", num);
 
     getdata(t_lines - 3, 0, buf, inbuf, 3, DOECHO);
 
@@ -990,8 +1002,10 @@ user_vote(char *bname)
 	fclose(xfp);
     }
     for (i = 1; i < 20; i++) {
-	sprintf(STR_new_control, "%s%d", STR_bv_control, i);
-	sprintf(STR_new_title, "%s%d", STR_bv_title, i);
+	snprintf(STR_new_control, sizeof(STR_new_control),
+		 "%s%d", STR_bv_control, i);
+	snprintf(STR_new_title, sizeof(STR_new_title),
+		 "%s%d", STR_bv_title, i);
 	setbfile(buf, bname, STR_new_control);
 	if ((fp = fopen(buf, "r"))) {
 	    prints("(%d) ", i);
@@ -1011,15 +1025,16 @@ user_vote(char *bname)
     if (x < 0)
 	return FULLUPDATE;
 
-    sprintf(buf, "­n§ë´X¸¹§ë²¼ [%d] ", x);
+    snprintf(buf, sizeof(buf), "­n§ë´X¸¹§ë²¼ [%d] ", x);
 
     getdata(b_lines - 1, 0, buf, genbuf, 4, LCECHO);
 
     if (atoi(genbuf) < 0 || atoi(genbuf) > 20)
-	sprintf(genbuf, "%d", x);
+	snprintf(genbuf, sizeof(genbuf), "%d", x);
 
     if (genbuf[0] != '0')
-	sprintf(STR_new_control, "%s%d", STR_bv_control, atoi(genbuf));
+	snprintf(STR_new_control, sizeof(STR_new_control),
+		 "%s%d", STR_bv_control, atoi(genbuf));
     else
 	strlcpy(STR_new_control, STR_bv_control, sizeof(STR_new_control));
 
diff --git a/mbbsd/voteboard.c b/mbbsd/voteboard.c
index 6a7d7b87..27ca0bd3 100644
--- a/mbbsd/voteboard.c
+++ b/mbbsd/voteboard.c
@@ -1,4 +1,4 @@
-/* $Id: voteboard.c,v 1.12 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: voteboard.c,v 1.13 2002/07/22 19:02:01 in2 Exp $ */
 #include "bbs.h"
 
 #define VOTEBOARD "NewBoard"
@@ -225,8 +225,9 @@ do_voteboard()
 	    else
 		break;
 	} while (temp > 0);
-	sprintf(title, "[¥Ó½Ð·sªO] %s", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n%s", "¥Ó½Ð·sªO", "­^¤å¦WºÙ: ", topic, "¤¤¤å¦WºÙ: ");
+	snprintf(title, sizeof(title), "[¥Ó½Ð·sªO] %s", topic);
+	snprintf(genbuf, sizeof(genbuf),
+		 "%s\n\n%s%s\n%s", "¥Ó½Ð·sªO", "­^¤å¦WºÙ: ", topic, "¤¤¤å¦WºÙ: ");
 
 	if (!getdata(5, 0, "½Ð¿é¤J¬ÝªO¤¤¤å¦WºÙ¡G", topic, 20, DOECHO))
 	    return FULLUPDATE;
@@ -258,8 +259,9 @@ do_voteboard()
 	    else
 		break;
 	} while (temp > 0);
-	sprintf(title, "[¼o°£ÂªO] %s", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n", "¼o°£ÂªO", "­^¤å¦WºÙ: ", topic);
+	snprintf(title, sizeof(title), "[¼o°£ÂªO] %s", topic);
+	snprintf(genbuf, sizeof(genbuf),
+		 "%s\n\n%s%s\n", "¼o°£ÂªO", "­^¤å¦WºÙ: ", topic);
 	strcat(genbuf, "\n¼o°£­ì¦]: \n");
 	outs("½Ð¿é¤J¼o°£­ì¦](¦Ü¦h¤­¦æ)¡A­n²M·¡¶ñ¼g¤£µM¤£·|®Ö­ã³á");
 	for (i = 8; i < 13; i++) {
@@ -281,8 +283,8 @@ do_voteboard()
 	    else
 		break;
 	} while (temp > 0);
-	sprintf(title, "[³s¸pªO¥D] %s", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n%s%s", "³s¸pªO¥D", "­^¤å¦WºÙ: ", topic, "¥Ó½Ð ID : ", cuser.userid);
+	snprintf(title, sizeof(title), "[³s¸pªO¥D] %s", topic);
+	snprintf(genbuf, sizeof(genbuf), "%s\n\n%s%s\n%s%s", "³s¸pªO¥D", "­^¤å¦WºÙ: ", topic, "¥Ó½Ð ID : ", cuser.userid);
 	strcat(genbuf, "\n¥Ó½Ð¬F¨£: \n");
 	outs("½Ð¿é¤J¥Ó½Ð¬F¨£(¦Ü¦h¤­¦æ)¡A­n²M·¡¶ñ¼g¤£µM¤£·|®Ö­ã³á");
 	for (i = 8; i < 13; i++) {
@@ -303,8 +305,10 @@ do_voteboard()
 	    else
 		break;
 	} while (temp > 0);
-	sprintf(title, "[½}§KªO¥D] %s", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n%s", "½}§KªO¥D", "­^¤å¦WºÙ: ", topic, "ªO¥D ID : ");
+	snprintf(title, sizeof(title), "[½}§KªO¥D] %s", topic);
+	snprintf(genbuf, sizeof(genbuf),
+		 "%s\n\n%s%s\n%s", "½}§KªO¥D", "­^¤å¦WºÙ: ",
+		 topic, "ªO¥D ID : ");
 	do {
 	    if (!getdata(6, 0, "½Ð¿é¤JªO¥DID¡G", topic, IDLEN + 1, DOECHO))
 		return FULLUPDATE;
@@ -328,8 +332,10 @@ do_voteboard()
     case 5:
 	if (!getdata(4, 0, "½Ð¿é¤J¤p²Õ¤¤­^¤å¦WºÙ¡G", topic, 30, DOECHO))
 	    return FULLUPDATE;
-	sprintf(title, "[³s¸p¤p²Õªø] %s", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n%s%s", "³s¸p¤p²Õªø", "¤p²Õ¦WºÙ: ", topic, "¥Ó½Ð ID : ", cuser.userid);
+	snprintf(title, sizeof(title), "[³s¸p¤p²Õªø] %s", topic);
+	snprintf(genbuf, sizeof(genbuf),
+		 "%s\n\n%s%s\n%s%s", "³s¸p¤p²Õªø", "¤p²Õ¦WºÙ: ",
+		 topic, "¥Ó½Ð ID : ", cuser.userid);
 	strcat(genbuf, "\n¥Ó½Ð¬F¨£: \n");
 	outs("½Ð¿é¤J¥Ó½Ð¬F¨£(¦Ü¦h¤­¦æ)¡A­n²M·¡¶ñ¼g¤£µM¤£·|®Ö­ã³á");
 	for (i = 8; i < 13; i++) {
@@ -345,8 +351,9 @@ do_voteboard()
 
 	if (!getdata(4, 0, "½Ð¿é¤J¤p²Õ¤¤­^¤å¦WºÙ¡G", topic, 30, DOECHO))
 	    return FULLUPDATE;
-	sprintf(title, "[½}§K¤p²Õªø] %s", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n%s", "½}§K¤p²Õªø", "¤p²Õ¦WºÙ: ", topic, "¤p²Õªø ID : ");
+	snprintf(title, sizeof(title), "[½}§K¤p²Õªø] %s", topic);
+	snprintf(genbuf, sizeof(genbuf), "%s\n\n%s%s\n%s",
+		 "½}§K¤p²Õªø", "¤p²Õ¦WºÙ: ", topic, "¤p²Õªø ID : ");
 	if (!getdata(6, 0, "½Ð¿é¤J¤p²ÕªøID¡G", topic, IDLEN + 1, DOECHO))
 	    return FULLUPDATE;
 	strcat(genbuf, topic);
@@ -366,8 +373,9 @@ do_voteboard()
 	    return FULLUPDATE;
 	if (!getdata(4, 0, "½Ð¿é¤J¤½§ë¥DÃD¡G", topic, 30, DOECHO))
 	    return FULLUPDATE;
-	sprintf(title, "%s %s", "[¯¸¥Á¤½§ë]", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n", "¯¸¥Á¤½§ë", "¤½§ë¥DÃD: ", topic);
+	snprintf(title, sizeof(title), "%s %s", "[¯¸¥Á¤½§ë]", topic);
+	snprintf(genbuf, sizeof(genbuf),
+		 "%s\n\n%s%s\n", "¯¸¥Á¤½§ë", "¤½§ë¥DÃD: ", topic);
 	strcat(genbuf, "\n¤½§ë­ì¦]: \n");
 	outs("½Ð¿é¤J¤½§ë­ì¦](¦Ü¦h¤­¦æ)¡A­n²M·¡¶ñ¼g¤£µM¤£·|®Ö­ã³á");
 	for (i = 8; i < 13; i++) {
@@ -382,8 +390,9 @@ do_voteboard()
     case 8:
 	if (!getdata(4, 0, "½Ð¿é¤J¸s²Õ¤¤­^¤å¦WºÙ¡G", topic, 30, DOECHO))
 	    return FULLUPDATE;
-	sprintf(title, "[¥Ó½Ð·s¸s²Õ] %s", topic);
-	sprintf(genbuf, "%s\n\n%s%s\n%s%s", "¥Ó½Ð¸s²Õ", "¸s²Õ¦WºÙ: ", topic, "¥Ó½Ð ID : ", cuser.userid);
+	snprintf(title, sizeof(title), "[¥Ó½Ð·s¸s²Õ] %s", topic);
+	snprintf(genbuf, sizeof(genbuf), "%s\n\n%s%s\n%s%s",
+		 "¥Ó½Ð¸s²Õ", "¸s²Õ¦WºÙ: ", topic, "¥Ó½Ð ID : ", cuser.userid);
 	strcat(genbuf, "\n¥Ó½Ð¬F¨£: \n");
 	outs("½Ð¿é¤J¥Ó½Ð¬F¨£(¦Ü¦h¤­¦æ)¡A­n²M·¡¶ñ¼g¤£µM¤£·|®Ö­ã³á");
 	for (i = 8; i < 13; i++) {
@@ -400,7 +409,7 @@ do_voteboard()
     }
     strcat(genbuf, "³s¸pµ²§ô®É¶¡: ");
     now += 14 * 24 * 60 * 60;
-    sprintf(topic, "(%ld)", now);
+    snprintf(topic, sizeof(topic), "(%ld)", now);
     strcat(genbuf, topic);
     strcat(genbuf, ctime(&now));
     now -= 14 * 24 * 60 * 60;
diff --git a/mbbsd/xyz.c b/mbbsd/xyz.c
index e277421d..dba8ad13 100644
--- a/mbbsd/xyz.c
+++ b/mbbsd/xyz.c
@@ -1,4 +1,4 @@
-/* $Id: xyz.c,v 1.11 2002/07/21 09:26:02 in2 Exp $ */
+/* $Id: xyz.c,v 1.12 2002/07/22 19:02:01 in2 Exp $ */
 #include "bbs.h"
 
 /* ¦UºØ²Î­p¤Î¬ÛÃö¸ê°T¦Cªí */
@@ -230,13 +230,13 @@ note()
     collect = 1;
 
     while (total) {
-	sprintf(buf, "\033[1;31m¢~¢t\033[32m %s \033[37m(%s)",
+	snprintf(buf, sizeof(buf), "\033[1;31m¢~¢t\033[32m %s \033[37m(%s)",
 		myitem.userid, myitem.username);
 	len = strlen(buf);
 
 	for (i = len; i < 73; i++)
 	    strcat(buf, " ");
-	sprintf(buf2, " \033[1;36m%.14s\033[31m   ¢u¢¡\033[m\n",
+	snprintf(buf2, sizeof(buf2), " \033[1;36m%.14s\033[31m   ¢u¢¡\033[m\n",
 		Cdate(&(myitem.date)));
 	strcat(buf, buf2);
 	fputs(buf, fp);
@@ -444,7 +444,7 @@ x_archie()
     exec_cmd(ARCHIE, YEA, "bin/archie.sh", ARCHIE);
     log_usies("ARCHIE", "");
     strcpy(genbuf1, buf);
-    sprintf(buf, BBSHOME "/tmp/archie.%s", cuser.userid);
+    snprintf(buf, sizeof(buf), BBSHOME "/tmp/archie.%s", cuser.userid);
     if (dashf(buf)) {
 	getdata(0, 0, "­n±Nµ²ªG±H¦^«H½c¶Ü(Y/N)¡H[N]",
 		ans, sizeof(ans), DOECHO, 0);
@@ -456,7 +456,8 @@ x_archie()
 	    sethomepath(buf1, cuser.userid);
 	    stampfile(buf1, &mhdr);
 	    strcpy(mhdr.owner, cuser.userid);
-	    sprintf(genbuf2, "Archie ·j´MÀÉ®×: %s µ²ªG", genbuf1);
+	    sprintf(genbuf2, sizeof(genbuf2),
+		    "Archie ·j´MÀÉ®×: %s µ²ªG", genbuf1);
 	    strcpy(mhdr.title, genbuf2);
 	    mhdr.filemode = 0;
 	    sethomedir(title, cuser.userid);