Index: qemu/monitor.c
===================================================================
--- qemu.orig/monitor.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/monitor.c	2008-08-15 19:31:36.000000000 +0000
@@ -2233,7 +2233,7 @@
                     goto fail;
                 }
                 str = qemu_malloc(strlen(buf) + 1);
-                strcpy(str, buf);
+                pstrcpy(str, sizeof(buf), buf);
                 str_allocated[nb_args] = str;
             add_str:
                 if (nb_args >= MAX_ARGS) {
@@ -2492,7 +2492,7 @@
     if (!p) {
         input_path_len = 0;
         pstrcpy(file_prefix, sizeof(file_prefix), input);
-        strcpy(path, ".");
+        pstrcpy(path, sizeof(path), ".");
     } else {
         input_path_len = p - input + 1;
         memcpy(path, input, input_path_len);
@@ -2514,13 +2514,15 @@
             break;
         if (strstart(d->d_name, file_prefix, NULL)) {
             memcpy(file, input, input_path_len);
-            strcpy(file + input_path_len, d->d_name);
+            if (input_path_len < sizeof(file))
+                pstrcpy(file + input_path_len, sizeof(file) - input_path_len,
+                        d->d_name);
             /* stat the file to find out if it's a directory.
              * In that case add a slash to speed up typing long paths
              */
             stat(file, &sb);
             if(S_ISDIR(sb.st_mode))
-                strcat(file, "/");
+                pstrcat(file, sizeof(file), "/");
             add_completion(file);
         }
     }
Index: qemu/vl.c
===================================================================
--- qemu.orig/vl.c	2008-08-15 18:31:36.000000000 +0000
+++ qemu/vl.c	2008-08-15 19:31:36.000000000 +0000
@@ -1915,11 +1915,12 @@
     char cbuf[50] = "\n\r";
 
     if (term_escape_char > 0 && term_escape_char < 26) {
-        sprintf(cbuf,"\n\r");
-        sprintf(ebuf,"C-%c", term_escape_char - 1 + 'a');
+        snprintf(cbuf, sizeof(cbuf), "\n\r");
+        snprintf(ebuf, sizeof(ebuf), "C-%c", term_escape_char - 1 + 'a');
     } else {
-        sprintf(cbuf,"\n\rEscape-Char set to Ascii: 0x%02x\n\r\n\r",
-            term_escape_char);
+        snprintf(cbuf, sizeof(cbuf),
+                 "\n\rEscape-Char set to Ascii: 0x%02x\n\r\n\r",
+                 term_escape_char);
     }
     chr->chr_write(chr, (uint8_t *)cbuf, strlen(cbuf));
     for (i = 0; mux_help[i] != NULL; i++) {
@@ -4385,7 +4386,7 @@
  * Allocate TAP device, returns opened fd.
  * Stores dev name in the first arg(must be large enough).
  */
-int tap_alloc(char *dev)
+int tap_alloc(char *dev, size_t dev_size)
 {
     int tap_fd, if_fd, ppa = -1;
     static int ip_fd = 0;
@@ -4498,7 +4499,7 @@
       syslog (LOG_ERR, "Can't set multiplexor id");
     }
 
-    sprintf(dev, "tap%d", ppa);
+    snprintf(dev, dev_size, "tap%d", ppa);
     return tap_fd;
 }
 
@@ -4506,7 +4507,7 @@
 {
     char  dev[10]="";
     int fd;
-    if( (fd = tap_alloc(dev)) < 0 ){
+    if( (fd = tap_alloc(dev, sizeof(dev))) < 0 ){
        fprintf(stderr, "Cannot allocate TAP device\n");
        return -1;
     }
@@ -5461,11 +5462,11 @@
         !strcmp(machine->name, "versatileab")) {
         type = IF_SCSI;
         max_devs = MAX_SCSI_DEVS;
-        strcpy(devname, "scsi");
+        pstrcpy(devname, sizeof(devname), "scsi");
     } else {
         type = IF_IDE;
         max_devs = MAX_IDE_DEVS;
-        strcpy(devname, "ide");
+        pstrcpy(devname, sizeof(devname), "ide");
     }
     media = MEDIA_DISK;
 
Index: qemu/gdbstub.c
===================================================================
--- qemu.orig/gdbstub.c	2008-08-15 18:31:03.000000000 +0000
+++ qemu/gdbstub.c	2008-08-15 19:31:36.000000000 +0000
@@ -1173,10 +1173,10 @@
         /* parse any 'q' packets here */
         if (!strcmp(p,"qemu.sstepbits")) {
             /* Query Breakpoint bit definitions */
-            sprintf(buf,"ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
-                    SSTEP_ENABLE,
-                    SSTEP_NOIRQ,
-                    SSTEP_NOTIMER);
+            snprintf(buf, sizeof(buf), "ENABLE=%x,NOIRQ=%x,NOTIMER=%x",
+                     SSTEP_ENABLE,
+                     SSTEP_NOIRQ,
+                     SSTEP_NOTIMER);
             put_packet(s, buf);
             break;
         } else if (strncmp(p,"qemu.sstep",10) == 0) {
@@ -1184,7 +1184,7 @@
             p += 10;
             if (*p != '=') {
                 /* Display current setting */
-                sprintf(buf,"0x%x", sstep_flags);
+                snprintf(buf, sizeof(buf), "0x%x", sstep_flags);
                 put_packet(s, buf);
                 break;
             }
@@ -1198,12 +1198,12 @@
         else if (strncmp(p, "Offsets", 7) == 0) {
             TaskState *ts = env->opaque;
 
-            sprintf(buf,
-                    "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
-                    ";Bss=" TARGET_ABI_FMT_lx,
-                    ts->info->code_offset,
-                    ts->info->data_offset,
-                    ts->info->data_offset);
+            snprintf(buf, sizeof(buf),
+                     "Text=" TARGET_ABI_FMT_lx ";Data=" TARGET_ABI_FMT_lx
+                     ";Bss=" TARGET_ABI_FMT_lx,
+                     ts->info->code_offset,
+                     ts->info->data_offset,
+                     ts->info->data_offset);
             put_packet(s, buf);
             break;
         }
@@ -1286,17 +1286,18 @@
             switch (*fmt++) {
             case 'x':
                 addr = va_arg(va, target_ulong);
-                p += sprintf(p, TARGET_FMT_lx, addr);
+                p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx, addr);
                 break;
             case 'l':
                 if (*(fmt++) != 'x')
                     goto bad_format;
                 i64 = va_arg(va, uint64_t);
-                p += sprintf(p, "%" PRIx64, i64);
+                p += snprintf(p, &buf[sizeof(buf)] - p, "%" PRIx64, i64);
                 break;
             case 's':
                 addr = va_arg(va, target_ulong);
-                p += sprintf(p, TARGET_FMT_lx "/%x", addr, va_arg(va, int));
+                p += snprintf(p, &buf[sizeof(buf)] - p, TARGET_FMT_lx "/%x",
+                              addr, va_arg(va, int));
                 break;
             default:
             bad_format:
Index: qemu/hw/sun4m.c
===================================================================
--- qemu.orig/hw/sun4m.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/hw/sun4m.c	2008-08-15 19:31:36.000000000 +0000
@@ -159,7 +159,8 @@
     for (i = 0; i < sizeof(image); i++)
         image[i] = m48t59_read(nvram, i) & 0xff;
 
-    strcpy((char *)header->boot_devices, boot_device);
+    pstrcpy((char *)header->boot_devices, sizeof(header->boot_devices),
+            boot_device);
     header->nboot_devices = strlen(boot_device) & 0xff;
     header->crc = cpu_to_be16(OHW_compute_crc(header, 0x00, 0xF8));
 
@@ -187,17 +188,19 @@
     memset(image, '\0', sizeof(image));
 
     // Try to match PPC NVRAM
-    strcpy((char *)header->struct_ident, "QEMU_BIOS");
+    pstrcpy((char *)header->struct_ident, sizeof(header->struct_ident),
+            "QEMU_BIOS");
     header->struct_version = cpu_to_be32(3); /* structure v3 */
 
     header->nvram_size = cpu_to_be16(0x2000);
     header->nvram_arch_ptr = cpu_to_be16(sizeof(ohwcfg_v3_t));
     header->nvram_arch_size = cpu_to_be16(sizeof(struct sparc_arch_cfg));
-    strcpy((char *)header->arch, arch);
+    pstrcpy((char *)header->arch, sizeof(header->arch), arch);
     header->nb_cpus = smp_cpus & 0xff;
     header->RAM0_base = 0;
     header->RAM0_size = cpu_to_be64((uint64_t)RAM_size);
-    strcpy((char *)header->boot_devices, boot_devices);
+    pstrcpy((char *)header->boot_devices, sizeof(header->boot_devices),
+            boot_devices);
     header->nboot_devices = strlen(boot_devices) & 0xff;
     header->kernel_image = cpu_to_be64((uint64_t)KERNEL_LOAD_ADDR);
     header->kernel_size = cpu_to_be64((uint64_t)kernel_size);
@@ -225,7 +228,7 @@
     // Variable partition
     part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
     part_header->signature = OPENBIOS_PART_SYSTEM;
-    strcpy(part_header->name, "system");
+    pstrcpy(part_header->name, sizeof(part_header->name), "system");
 
     end = start + sizeof(struct OpenBIOS_nvpart_v1);
     for (i = 0; i < nb_prom_envs; i++)
@@ -241,7 +244,7 @@
     start = end;
     part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
     part_header->signature = OPENBIOS_PART_FREE;
-    strcpy(part_header->name, "free");
+    pstrcpy(part_header->name, sizeof(part_header->name), "free");
 
     end = 0x1fd0;
     OpenBIOS_finish_partition(part_header, end - start);
Index: qemu/slirp/misc.c
===================================================================
--- qemu.orig/slirp/misc.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/slirp/misc.c	2008-08-15 19:31:36.000000000 +0000
@@ -417,8 +417,9 @@
 		  {
 			  char buff[256];
 
-			  sprintf(buff, "Error: execvp of %s failed: %s\n",
-				  argv[0], strerror(errno));
+			  snprintf(buff, sizeof(buff),
+                                   "Error: execvp of %s failed: %s\n",
+                                   argv[0], strerror(errno));
 			  write(2, buff, strlen(buff)+1);
 		  }
 		close(0); close(1); close(2); /* XXX */
Index: qemu/slirp/tcp_subr.c
===================================================================
--- qemu.orig/slirp/tcp_subr.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/slirp/tcp_subr.c	2008-08-15 19:31:36.000000000 +0000
@@ -629,7 +629,7 @@
 	struct mbuf *m;
 {
 	u_int n1, n2, n3, n4, n5, n6;
-	char buff[256];
+        char buff[257];
 	u_int32_t laddr;
 	u_int lport;
 	char *bptr;
@@ -673,7 +673,9 @@
 						}
 					}
 				}
-				so_rcv->sb_cc = sprintf(so_rcv->sb_data, "%d,%d\r\n", n1, n2);
+                                so_rcv->sb_cc = snprintf(so_rcv->sb_data,
+                                                         so_rcv->sb_datalen,
+                                                         "%d,%d\r\n", n1, n2);
 				so_rcv->sb_rptr = so_rcv->sb_data;
 				so_rcv->sb_wptr = so_rcv->sb_data + so_rcv->sb_cc;
 			}
@@ -1007,8 +1009,9 @@
 			n4 =  (laddr & 0xff);
 
 			m->m_len = bptr - m->m_data; /* Adjust length */
-			m->m_len += sprintf(bptr,"ORT %d,%d,%d,%d,%d,%d\r\n%s",
-					    n1, n2, n3, n4, n5, n6, x==7?buff:"");
+                        m->m_len += snprintf(bptr, m->m_hdr.mh_size - m->m_len,
+                                             "ORT %d,%d,%d,%d,%d,%d\r\n%s",
+                                             n1, n2, n3, n4, n5, n6, x==7?buff:"");
 			return 1;
 		} else if ((bptr = (char *)strstr(m->m_data, "27 Entering")) != NULL) {
 			/*
@@ -1038,8 +1041,9 @@
 			n4 =  (laddr & 0xff);
 
 			m->m_len = bptr - m->m_data; /* Adjust length */
-			m->m_len += sprintf(bptr,"27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
-					    n1, n2, n3, n4, n5, n6, x==7?buff:"");
+			m->m_len += snprintf(bptr, m->m_hdr.mh_size - m->m_len,
+                                             "27 Entering Passive Mode (%d,%d,%d,%d,%d,%d)\r\n%s",
+                                             n1, n2, n3, n4, n5, n6, x==7?buff:"");
 
 			return 1;
 		}
@@ -1062,7 +1066,8 @@
 		}
 		if (m->m_data[m->m_len-1] == '\0' && lport != 0 &&
 		    (so = solisten(0, so->so_laddr.s_addr, htons(lport), SS_FACCEPTONCE)) != NULL)
-			m->m_len = sprintf(m->m_data, "%d", ntohs(so->so_fport))+1;
+                    m->m_len = snprintf(m->m_data, m->m_hdr.mh_size, "%d",
+                                        ntohs(so->so_fport)) + 1;
 		return 1;
 
 	 case EMU_IRC:
@@ -1079,25 +1084,28 @@
 				return 1;
 
 			m->m_len = bptr - m->m_data; /* Adjust length */
-			m->m_len += sprintf(bptr, "DCC CHAT chat %lu %u%c\n",
-			     (unsigned long)ntohl(so->so_faddr.s_addr),
-			     ntohs(so->so_fport), 1);
+                        m->m_len += snprintf(bptr, m->m_hdr.mh_size,
+                                             "DCC CHAT chat %lu %u%c\n",
+                                             (unsigned long)ntohl(so->so_faddr.s_addr),
+                                             ntohs(so->so_fport), 1);
 		} else if (sscanf(bptr, "DCC SEND %256s %u %u %u", buff, &laddr, &lport, &n1) == 4) {
 			if ((so = solisten(0, htonl(laddr), htons(lport), SS_FACCEPTONCE)) == NULL)
 				return 1;
 
 			m->m_len = bptr - m->m_data; /* Adjust length */
-			m->m_len += sprintf(bptr, "DCC SEND %s %lu %u %u%c\n",
-			      buff, (unsigned long)ntohl(so->so_faddr.s_addr),
-			      ntohs(so->so_fport), n1, 1);
+                        m->m_len += snprintf(bptr, m->m_hdr.mh_size,
+                                             "DCC SEND %s %lu %u %u%c\n", buff,
+                                             (unsigned long)ntohl(so->so_faddr.s_addr),
+                                             ntohs(so->so_fport), n1, 1);
 		} else if (sscanf(bptr, "DCC MOVE %256s %u %u %u", buff, &laddr, &lport, &n1) == 4) {
 			if ((so = solisten(0, htonl(laddr), htons(lport), SS_FACCEPTONCE)) == NULL)
 				return 1;
 
 			m->m_len = bptr - m->m_data; /* Adjust length */
-			m->m_len += sprintf(bptr, "DCC MOVE %s %lu %u %u%c\n",
-			      buff, (unsigned long)ntohl(so->so_faddr.s_addr),
-			      ntohs(so->so_fport), n1, 1);
+                        m->m_len += snprintf(bptr, m->m_hdr.mh_size,
+                                             "DCC MOVE %s %lu %u %u%c\n", buff,
+                                             (unsigned long)ntohl(so->so_faddr.s_addr),
+                                             ntohs(so->so_fport), n1, 1);
 		}
 		return 1;
 
@@ -1285,8 +1293,8 @@
 
 		/* FALLTHROUGH */
 	case CTL_ALIAS:
-	  sb->sb_cc = sprintf(sb->sb_wptr,
-			      "Error: No application configured.\r\n");
+          sb->sb_cc = snprintf(sb->sb_wptr, sb->sb_datalen - (sb->sb_wptr - sb->sb_data),
+                               "Error: No application configured.\r\n");
 	  sb->sb_wptr += sb->sb_cc;
 	  return(0);
 
Index: qemu/block-vmdk.c
===================================================================
--- qemu.orig/block-vmdk.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/block-vmdk.c	2008-08-15 19:31:36.000000000 +0000
@@ -153,11 +153,11 @@
         return -1;
 
     tmp_str = strstr(desc,"parentCID");
-    strcpy(tmp_desc, tmp_str);
+    pstrcpy(tmp_desc, sizeof(tmp_desc), tmp_str);
     if ((p_name = strstr(desc,"CID")) != 0) {
         p_name += sizeof("CID");
-        sprintf(p_name,"%x\n",cid);
-        strcat(desc,tmp_desc);
+        snprintf(p_name, sizeof(desc) - (p_name - desc), "%x\n", cid);
+        pstrcat(desc, sizeof(desc), tmp_desc);
     }
 
     if (bdrv_pwrite(s->hd, 0x200, desc, DESC_SIZE) != DESC_SIZE)
@@ -252,8 +252,8 @@
     if ((temp_str = strrchr(real_filename, ':')) != NULL)
         real_filename = temp_str + 1;
 
-    sprintf(s_desc, desc_template, p_cid, p_cid, backing_file
-            , (uint32_t)header.capacity, real_filename);
+    snprintf(s_desc, sizeof(s_desc), desc_template, p_cid, p_cid, backing_file,
+             (uint32_t)header.capacity, real_filename);
 
     /* write the descriptor */
     if (lseek(snp_fd, 0x200, SEEK_SET) == -1)
@@ -349,7 +349,8 @@
             path_combine(parent_img_name, sizeof(parent_img_name),
                          filename, s->hd->backing_file);
         } else {
-            strcpy(parent_img_name, s->hd->backing_file);
+            pstrcpy(parent_img_name, sizeof(parent_img_name),
+                    s->hd->backing_file);
         }
 
         s->hd->backing_hd = bdrv_new("");
@@ -791,8 +792,8 @@
         real_filename = temp_str + 1;
     if ((temp_str = strrchr(real_filename, ':')) != NULL)
         real_filename = temp_str + 1;
-    sprintf(desc, desc_template, time(NULL), (unsigned long)total_size,
-            real_filename, (flags & BLOCK_FLAG_COMPAT6 ? 6 : 4), total_size / (63 * 16));
+    snprintf(desc, sizeof(desc), desc_template, time(NULL), (unsigned long)total_size,
+             real_filename, (flags & BLOCK_FLAG_COMPAT6 ? 6 : 4), total_size / (63 * 16));
 
     /* write the descriptor */
     lseek(fd, le64_to_cpu(header.desc_offset) << 9, SEEK_SET);
Index: qemu/qemu-malloc.c
===================================================================
--- qemu.orig/qemu-malloc.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/qemu-malloc.c	2008-08-15 19:31:36.000000000 +0000
@@ -56,9 +56,10 @@
 char *qemu_strdup(const char *str)
 {
     char *ptr;
-    ptr = qemu_malloc(strlen(str) + 1);
+    size_t len = strlen(str);
+    ptr = qemu_malloc(len + 1);
     if (!ptr)
         return NULL;
-    strcpy(ptr, str);
+    pstrcpy(ptr, len, str);
     return ptr;
 }
Index: qemu/block-vvfat.c
===================================================================
--- qemu.orig/block-vvfat.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/block-vvfat.c	2008-08-15 19:31:36.000000000 +0000
@@ -1733,7 +1733,7 @@
     char path2[PATH_MAX];
 
     assert(path_len < PATH_MAX); /* len was tested before! */
-    strcpy(path2, path);
+    pstrcpy(path2, sizeof(path2), path);
     path2[path_len] = '/';
     path2[path_len + 1] = '\0';
 
@@ -1807,7 +1807,8 @@
 		fprintf(stderr, "Name too long: %s/%s\n", path, lfn.name);
 		goto fail;
 	    }
-	    strcpy(path2 + path_len + 1, (char*)lfn.name);
+            pstrcpy(path2 + path_len + 1, sizeof(path2) - path_len - 1,
+                    (char*)lfn.name);
 
 	    if (is_directory(direntries + i)) {
 		if (begin_of_direntry(direntries + i) == 0) {
@@ -2372,8 +2373,9 @@
 
 			    assert(!strncmp(m->path, mapping->path, l2));
 
-			    strcpy(new_path, mapping->path);
-			    strcpy(new_path + l1, m->path + l2);
+                            pstrcpy(new_path, l + diff + 1, mapping->path);
+                            pstrcpy(new_path + l1, l + diff + 1 - l1,
+                                    m->path + l2);
 
 			    schedule_rename(s, m->begin, new_path);
 			}
Index: qemu/hw/sun4u.c
===================================================================
--- qemu.orig/hw/sun4u.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/hw/sun4u.c	2008-08-15 19:31:36.000000000 +0000
@@ -82,7 +82,8 @@
     for (i = 0; i < sizeof(image); i++)
         image[i] = m48t59_read(nvram, i) & 0xff;
 
-    strcpy((char *)header->boot_devices, boot_device);
+    pstrcpy((char *)header->boot_devices, sizeof(header->boot_devices),
+            boot_device);
     header->nboot_devices = strlen(boot_device) & 0xff;
     header->crc = cpu_to_be16(OHW_compute_crc(header, 0x00, 0xF8));
 
@@ -115,17 +116,19 @@
     memset(image, '\0', sizeof(image));
 
     // Try to match PPC NVRAM
-    strcpy((char *)header->struct_ident, "QEMU_BIOS");
+    pstrcpy((char *)header->struct_ident, sizeof(header->struct_ident),
+            "QEMU_BIOS");
     header->struct_version = cpu_to_be32(3); /* structure v3 */
 
     header->nvram_size = cpu_to_be16(NVRAM_size);
     header->nvram_arch_ptr = cpu_to_be16(sizeof(ohwcfg_v3_t));
     header->nvram_arch_size = cpu_to_be16(sizeof(struct sparc_arch_cfg));
-    strcpy((char *)header->arch, arch);
+    pstrcpy((char *)header->arch, sizeof(header->arch), arch);
     header->nb_cpus = smp_cpus & 0xff;
     header->RAM0_base = 0;
     header->RAM0_size = cpu_to_be64((uint64_t)RAM_size);
-    strcpy((char *)header->boot_devices, boot_devices);
+    pstrcpy((char *)header->boot_devices, sizeof(header->boot_devices),
+            boot_devices);
     header->nboot_devices = strlen(boot_devices) & 0xff;
     header->kernel_image = cpu_to_be64((uint64_t)kernel_image);
     header->kernel_size = cpu_to_be64((uint64_t)kernel_size);
@@ -156,7 +159,7 @@
     // Variable partition
     part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
     part_header->signature = OPENBIOS_PART_SYSTEM;
-    strcpy(part_header->name, "system");
+    pstrcpy(part_header->name, sizeof(part_header->name), "system");
 
     end = start + sizeof(struct OpenBIOS_nvpart_v1);
     for (i = 0; i < nb_prom_envs; i++)
@@ -172,7 +175,7 @@
     start = end;
     part_header = (struct OpenBIOS_nvpart_v1 *)&image[start];
     part_header->signature = OPENBIOS_PART_FREE;
-    strcpy(part_header->name, "free");
+    pstrcpy(part_header->name, sizeof(part_header->name), "free");
 
     end = 0x1fd0;
     OpenBIOS_finish_partition(part_header, end - start);
Index: qemu/hw/usb-net.c
===================================================================
--- qemu.orig/hw/usb-net.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/hw/usb-net.c	2008-08-15 19:31:36.000000000 +0000
@@ -625,7 +625,8 @@
 } USBNetState;
 
 static int ndis_query(USBNetState *s, uint32_t oid,
-                uint8_t *inbuf, unsigned int inlen, uint8_t *outbuf)
+                      uint8_t *inbuf, unsigned int inlen, uint8_t *outbuf,
+                      size_t outlen)
 {
     unsigned int i, count;
 
@@ -680,7 +681,7 @@
 
     /* mandatory */
     case OID_GEN_VENDOR_DESCRIPTION:
-        strcpy(outbuf, "QEMU USB RNDIS Net");
+        pstrcpy(outbuf, outlen, "QEMU USB RNDIS Net");
         return strlen(outbuf) + 1;
 
     case OID_GEN_VENDOR_DRIVER_VERSION:
@@ -882,7 +883,8 @@
         return USB_RET_STALL;
 
     infobuflen = ndis_query(s, le32_to_cpu(buf->OID),
-                    bufoffs + (uint8_t *) buf, buflen, infobuf);
+                            bufoffs + (uint8_t *) buf, buflen, infobuf,
+                            sizeof(infobuf));
     resplen = sizeof(rndis_query_cmplt_type) +
             ((infobuflen < 0) ? 0 : infobuflen);
     resp = rndis_queue_response(s, resplen);
Index: qemu/hw/vga.c
===================================================================
--- qemu.orig/hw/vga.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/hw/vga.c	2008-08-15 19:31:36.000000000 +0000
@@ -1726,7 +1726,8 @@
             if (!full_update)
                 return;
 
-            sprintf(msg_buffer, "%i x %i Text mode", width, height);
+            snprintf(msg_buffer, sizeof(msg_buffer), "%i x %i Text mode",
+                     width, height);
             break;
         }
 
@@ -1799,14 +1800,15 @@
             return;
 
         s->get_resolution(s, &width, &height);
-        sprintf(msg_buffer, "%i x %i Graphic mode", width, height);
+        snprintf(msg_buffer, sizeof(msg_buffer), "%i x %i Graphic mode",
+                 width, height);
         break;
     case GMODE_BLANK:
     default:
         if (!full_update)
             return;
 
-        sprintf(msg_buffer, "VGA Blank mode");
+        snprintf(msg_buffer, sizeof(msg_buffer), "VGA Blank mode");
         break;
     }
 
Index: qemu/slirp/tftp.c
===================================================================
--- qemu.orig/slirp/tftp.c	2008-08-15 18:31:04.000000000 +0000
+++ qemu/slirp/tftp.c	2008-08-15 19:31:36.000000000 +0000
@@ -23,6 +23,7 @@
  */
 
 #include <slirp.h>
+#include "qemu-common.h" // for pstrcpy
 
 struct tftp_session {
     int in_use;
@@ -148,8 +149,8 @@
     m->m_data += sizeof(struct udpiphdr);
 
     tp->tp_op = htons(TFTP_OACK);
-    n += sprintf(tp->x.tp_buf + n, "%s", key) + 1;
-    n += sprintf(tp->x.tp_buf + n, "%u", value) + 1;
+    n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%s", key) + 1;
+    n += snprintf(tp->x.tp_buf + n, sizeof(tp->x.tp_buf) - n, "%u", value) + 1;
 
     saddr.sin_addr = recv_tp->ip.ip_dst;
     saddr.sin_port = recv_tp->udp.uh_dport;
@@ -189,7 +190,7 @@
 
   tp->tp_op = htons(TFTP_ERROR);
   tp->x.tp_error.tp_error_code = htons(errorcode);
-  strcpy(tp->x.tp_error.tp_msg, msg);
+  pstrcpy(tp->x.tp_error.tp_msg, sizeof(tp->x.tp_error.tp_msg), msg);
 
   saddr.sin_addr = recv_tp->ip.ip_dst;
   saddr.sin_port = recv_tp->udp.uh_dport;
