*: remove more sprintf()

Should be just a couple non-development, non-test occurrences of this
function left now.

Signed-off-by: Quentin Young <qlyoung@qlyoung.net>

17 files changed, 143 insertions, 100 deletions

diff --git a/bgpd/bgp_mpath.c b/bgpd/bgp_mpath.c
index ff5cfe05fb..37639f4bce 100644
--- a/bgpd/bgp_mpath.c
+++ b/bgpd/bgp_mpath.c
@@ -616,7 +616,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
 					all_paths_lb = false;
 				if (debug) {
 					bgp_path_info_path_with_addpath_rx_str(
-						cur_mpath, path_buf);
+						cur_mpath, path_buf,
+						sizeof(path_buf));
 					zlog_debug(
 						"%pRN: %s is still multipath, cur count %d",
 						bgp_dest_to_rnode(dest),
@@ -626,7 +627,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
 				mpath_changed = 1;
 				if (debug) {
 					bgp_path_info_path_with_addpath_rx_str(
-						cur_mpath, path_buf);
+						cur_mpath, path_buf,
+						sizeof(path_buf));
 					zlog_debug(
 						"%pRN: remove mpath %s nexthop %s, cur count %d",
 						bgp_dest_to_rnode(dest),
@@ -660,7 +662,7 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
 			mpath_changed = 1;
 			if (debug) {
 				bgp_path_info_path_with_addpath_rx_str(
-					cur_mpath, path_buf);
+					cur_mpath, path_buf, sizeof(path_buf));
 				zlog_debug(
 					"%pRN: remove mpath %s nexthop %s, cur count %d",
 					bgp_dest_to_rnode(dest), path_buf,
@@ -710,7 +712,8 @@ void bgp_path_info_mpath_update(struct bgp_dest *dest,
 					all_paths_lb = false;
 				if (debug) {
 					bgp_path_info_path_with_addpath_rx_str(
-						new_mpath, path_buf);
+						new_mpath, path_buf,
+						sizeof(path_buf));
 					zlog_debug(
 						"%pRN: add mpath %s nexthop %s, cur count %d",
 						bgp_dest_to_rnode(dest),
diff --git a/bgpd/bgp_route.c b/bgpd/bgp_route.c
index 0ac9a42dc5..1953b769d2 100644
--- a/bgpd/bgp_route.c
+++ b/bgpd/bgp_route.c
@@ -519,13 +519,14 @@ static uint32_t bgp_med_value(struct attr *attr, struct bgp *bgp)
 	}
 }
 
-void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi, char *buf)
+void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi, char *buf,
+					    size_t buf_len)
 {
 	if (pi->addpath_rx_id)
-		sprintf(buf, "path %s (addpath rxid %d)", pi->peer->host,
-			pi->addpath_rx_id);
+		snprintf(buf, buf_len, "path %s (addpath rxid %d)",
+			 pi->peer->host, pi->addpath_rx_id);
 	else
-		sprintf(buf, "path %s", pi->peer->host);
+		snprintf(buf, buf_len, "path %s", pi->peer->host);
 }
 
 /* Compare two bgp route entity.  If 'new' is preferable over 'exist' return 1.
@@ -576,7 +577,8 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new,
 	}
 
 	if (debug)
-		bgp_path_info_path_with_addpath_rx_str(new, new_buf);
+		bgp_path_info_path_with_addpath_rx_str(new, new_buf,
+						       sizeof(new_buf));
 
 	if (exist == NULL) {
 		*reason = bgp_path_selection_first;
@@ -587,7 +589,8 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new,
 	}
 
 	if (debug) {
-		bgp_path_info_path_with_addpath_rx_str(exist, exist_buf);
+		bgp_path_info_path_with_addpath_rx_str(exist, exist_buf,
+						       sizeof(exist_buf));
 		zlog_debug("%s: Comparing %s flags 0x%x with %s flags 0x%x",
 			   pfx_buf, new_buf, new->flags, exist_buf,
 			   exist->flags);
@@ -615,10 +618,10 @@ static int bgp_path_info_cmp(struct bgp *bgp, struct bgp_path_info *new,
 				prefix2str(
 					bgp_dest_get_prefix(new->net), pfx_buf,
 					sizeof(*pfx_buf) * PREFIX2STR_BUFFER);
-				bgp_path_info_path_with_addpath_rx_str(new,
-								       new_buf);
 				bgp_path_info_path_with_addpath_rx_str(
-					exist, exist_buf);
+					new, new_buf, sizeof(new_buf));
+				bgp_path_info_path_with_addpath_rx_str(
+					exist, exist_buf, sizeof(exist_buf));
 			}
 
 			if (newattr->sticky && !existattr->sticky) {
@@ -2342,7 +2345,7 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest,
 
 			if (debug) {
 				bgp_path_info_path_with_addpath_rx_str(
-					new_select, path_buf);
+					new_select, path_buf, sizeof(path_buf));
 				zlog_debug(
 					"%pBD: %s is the bestpath from AS %u",
 					dest, path_buf,
@@ -2416,8 +2419,8 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest,
 	 */
 	if (debug) {
 		if (new_select)
-			bgp_path_info_path_with_addpath_rx_str(new_select,
-							       path_buf);
+			bgp_path_info_path_with_addpath_rx_str(
+				new_select, path_buf, sizeof(path_buf));
 		else
 			snprintf(path_buf, sizeof(path_buf), "NONE");
 		zlog_debug(
@@ -2432,7 +2435,7 @@ void bgp_best_selection(struct bgp *bgp, struct bgp_dest *dest,
 
 			if (debug)
 				bgp_path_info_path_with_addpath_rx_str(
-					pi, path_buf);
+					pi, path_buf, sizeof(path_buf));
 
 			if (pi == new_select) {
 				if (debug)
@@ -6383,7 +6386,8 @@ DEFPY_YANG (bgp_network, bgp_network_cmd,
 		int ret;
 
 		ret = netmask_str2prefix_str(address_str, netmask_str,
-					     addr_prefix_str);
+					     addr_prefix_str,
+					     sizeof(addr_prefix_str));
 		if (!ret) {
 			vty_out(vty, "%% Inconsistent address and mask\n");
 			return CMD_WARNING_CONFIG_FAILED;
@@ -7774,7 +7778,8 @@ DEFPY_YANG(
 	char prefix_buf[PREFIX2STR_BUFFER];
 
 	if (addr_str) {
-		if (netmask_str2prefix_str(addr_str, mask_str, prefix_buf)
+		if (netmask_str2prefix_str(addr_str, mask_str, prefix_buf,
+					   sizeof(prefix_buf))
 		    == 0) {
 			vty_out(vty, "%% Inconsistent address and mask\n");
 			return CMD_WARNING_CONFIG_FAILED;
@@ -14291,7 +14296,7 @@ DEFUN (clear_ip_bgp_dampening_address_mask,
 	char prefix_str[BUFSIZ];
 
 	ret = netmask_str2prefix_str(argv[idx_ipv4]->arg, argv[idx_ipv4_2]->arg,
-				     prefix_str);
+				     prefix_str, sizeof(prefix_str));
 	if (!ret) {
 		vty_out(vty, "%% Inconsistent address and mask\n");
 		return CMD_WARNING;
diff --git a/bgpd/bgp_route.h b/bgpd/bgp_route.h
index 1060d2e60d..766e5ade92 100644
--- a/bgpd/bgp_route.h
+++ b/bgpd/bgp_route.h
@@ -598,7 +598,7 @@ extern void bgp_path_info_set_flag(struct bgp_dest *dest,
 extern void bgp_path_info_unset_flag(struct bgp_dest *dest,
 				     struct bgp_path_info *path, uint32_t flag);
 extern void bgp_path_info_path_with_addpath_rx_str(struct bgp_path_info *pi,
-						   char *buf);
+						   char *buf, size_t buf_len);
 
 extern int bgp_nlri_parse_ip(struct peer *, struct attr *, struct bgp_nlri *);
 
diff --git a/bgpd/bgp_routemap.c b/bgpd/bgp_routemap.c
index 3dc2cfbd5c..b7f3289ffc 100644
--- a/bgpd/bgp_routemap.c
+++ b/bgpd/bgp_routemap.c
@@ -4315,13 +4315,15 @@ DEFUN (match_community,
 	int idx_comm_list = 2;
 	int ret;
 	char *argstr;
+	size_t argstr_len;
 
 	if (argc == 4) {
-		argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-				 strlen(argv[idx_comm_list]->arg)
-					 + strlen("exact-match") + 2);
+		argstr_len = strlen(argv[idx_comm_list]->arg)
+			     + strlen("exact-match") + 2;
+		argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-		sprintf(argstr, "%s exact-match", argv[idx_comm_list]->arg);
+		snprintf(argstr, argstr_len, "%s exact-match",
+			 argv[idx_comm_list]->arg);
 	} else
 		argstr = argv[idx_comm_list]->arg;
 
@@ -4362,13 +4364,15 @@ DEFUN (match_lcommunity,
 	int idx_lcomm_list = 2;
 	int ret;
 	char *argstr;
+	size_t argstr_len;
 
 	if (argc == 4) {
-		argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-				strlen(argv[idx_lcomm_list]->arg)
-				+ strlen("exact-match") + 2);
+		argstr_len = strlen(argv[idx_lcomm_list]->arg)
+			     + strlen("exact-match") + 2;
+		argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-		sprintf(argstr, "%s exact-match", argv[idx_lcomm_list]->arg);
+		snprintf(argstr, argstr_len, "%s exact-match",
+			 argv[idx_lcomm_list]->arg);
 	} else
 		argstr = argv[idx_lcomm_list]->arg;
 
@@ -5252,6 +5256,7 @@ DEFUN (set_aggregator_as,
 	int ret;
 	struct in_addr address;
 	char *argstr;
+	size_t argstr_len;
 
 	ret = inet_aton(argv[idx_ipv4]->arg, &address);
 	if (ret == 0) {
@@ -5259,11 +5264,12 @@ DEFUN (set_aggregator_as,
 		return CMD_WARNING_CONFIG_FAILED;
 	}
 
-	argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-			 strlen(argv[idx_number]->arg)
-				 + strlen(argv[idx_ipv4]->arg) + 2);
+	argstr_len =
+		strlen(argv[idx_number]->arg) + strlen(argv[idx_ipv4]->arg) + 2;
+	argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-	sprintf(argstr, "%s %s", argv[idx_number]->arg, argv[idx_ipv4]->arg);
+	snprintf(argstr, argstr_len, "%s %s", argv[idx_number]->arg,
+		 argv[idx_ipv4]->arg);
 
 	ret = generic_set_add(vty, VTY_GET_CONTEXT(route_map_index),
 			      "aggregator as", argstr);
@@ -5289,6 +5295,7 @@ DEFUN (no_set_aggregator_as,
 	int ret;
 	struct in_addr address;
 	char *argstr;
+	size_t argstr_len;
 
 	if (argc <= idx_asn)
 		return generic_set_delete(vty, VTY_GET_CONTEXT(route_map_index),
@@ -5300,11 +5307,11 @@ DEFUN (no_set_aggregator_as,
 		return CMD_WARNING_CONFIG_FAILED;
 	}
 
-	argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED,
-			 strlen(argv[idx_asn]->arg) + strlen(argv[idx_ip]->arg)
-				 + 2);
+	argstr_len = strlen(argv[idx_asn]->arg) + strlen(argv[idx_ip]->arg) + 2;
+	argstr = XMALLOC(MTYPE_ROUTE_MAP_COMPILED, argstr_len);
 
-	sprintf(argstr, "%s %s", argv[idx_asn]->arg, argv[idx_ip]->arg);
+	snprintf(argstr, argstr_len, "%s %s", argv[idx_asn]->arg,
+		 argv[idx_ip]->arg);
 
 	ret = generic_set_delete(vty, VTY_GET_CONTEXT(route_map_index),
 				 "aggregator as", argstr);
diff --git a/doc/developer/workflow.rst b/doc/developer/workflow.rst
index 861d87b998..71e2b00448 100644
--- a/doc/developer/workflow.rst
+++ b/doc/developer/workflow.rst
@@ -563,7 +563,7 @@ In general, code submitted into FRR will be rejected if it uses unsafe
 programming practices.  While there is no enforced overall ruleset, the
 following requirements have achieved consensus:
 
-- ``strcpy``, ``strcat`` and ``sprintf`` are inacceptable without exception.
+- ``strcpy``, ``strcat`` and ``sprintf`` are unacceptable without exception.
   Use ``strlcpy``, ``strlcat`` and ``snprintf`` instead.  (Rationale:  even if
   you know the operation cannot overflow the buffer, a future code change may
   inadvertedly introduce an overflow.)
diff --git a/isisd/isis_lsp.c b/isisd/isis_lsp.c
index 6d2303817b..a17d9a6ae2 100644
--- a/isisd/isis_lsp.c
+++ b/isisd/isis_lsp.c
@@ -691,8 +691,8 @@ static void lsp_set_time(struct isis_lsp *lsp)
 		stream_putw_at(lsp->pdu, 10, lsp->hdr.rem_lifetime);
 }
 
-void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag,
-		 struct isis *isis)
+void lspid_print(uint8_t *lsp_id, char *dest, size_t dest_len, char dynhost,
+		 char frag, struct isis *isis)
 {
 	struct isis_dynhn *dyn = NULL;
 	char id[SYSID_STRLEN];
@@ -710,10 +710,10 @@ void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag,
 		memcpy(id, sysid_print(lsp_id), 15);
 
 	if (frag)
-		sprintf(dest, "%s.%02x-%02x", id, LSP_PSEUDO_ID(lsp_id),
-			LSP_FRAGMENT(lsp_id));
+		snprintf(dest, dest_len, "%s.%02x-%02x", id,
+			 LSP_PSEUDO_ID(lsp_id), LSP_FRAGMENT(lsp_id));
 	else
-		sprintf(dest, "%s.%02x", id, LSP_PSEUDO_ID(lsp_id));
+		snprintf(dest, dest_len, "%s.%02x", id, LSP_PSEUDO_ID(lsp_id));
 }
 
 /* Convert the lsp attribute bits to attribute string */
@@ -747,7 +747,7 @@ void lsp_print(struct isis_lsp *lsp, struct vty *vty, char dynhost,
 	char age_out[8];
 	char b[200];
 
-	lspid_print(lsp->hdr.lsp_id, LSPid, dynhost, 1, isis);
+	lspid_print(lsp->hdr.lsp_id, LSPid, sizeof(LSPid), dynhost, 1, isis);
 	vty_out(vty, "%-21s%c  ", LSPid, lsp->own_lsp ? '*' : ' ');
 	vty_out(vty, "%5hu   ", lsp->hdr.pdu_len);
 	vty_out(vty, "0x%08x  ", lsp->hdr.seqno);
diff --git a/isisd/isis_lsp.h b/isisd/isis_lsp.h
index 0783036e49..896d957607 100644
--- a/isisd/isis_lsp.h
+++ b/isisd/isis_lsp.h
@@ -116,8 +116,8 @@ void lsp_update(struct isis_lsp *lsp, struct isis_lsp_hdr *hdr,
 		struct isis_tlvs *tlvs, struct stream *stream,
 		struct isis_area *area, int level, bool confusion);
 void lsp_inc_seqno(struct isis_lsp *lsp, uint32_t seqno);
-void lspid_print(uint8_t *lsp_id, char *dest, char dynhost, char frag,
-		 struct isis *isis);
+void lspid_print(uint8_t *lsp_id, char *dest, size_t dest_len, char dynhost,
+		 char frag, struct isis *isis);
 void lsp_print(struct isis_lsp *lsp, struct vty *vty, char dynhost,
 	       struct isis *isis);
 void lsp_print_detail(struct isis_lsp *lsp, struct vty *vty, char dynhost,
diff --git a/isisd/isis_misc.c b/isisd/isis_misc.c
index 6e9cbaf98e..d3d081d376 100644
--- a/isisd/isis_misc.c
+++ b/isisd/isis_misc.c
@@ -59,27 +59,30 @@ char nlpidstring[30];
 const char *isonet_print(const uint8_t *from, int len)
 {
 	int i = 0;
-	char *pos = isonet;
+	char tbuf[4];
+	isonet[0] = '\0';
 
 	if (!from)
 		return "unknown";
 
 	while (i < len) {
 		if (i & 1) {
-			sprintf(pos, "%02x", *(from + i));
-			pos += 2;
+			snprintf(tbuf, sizeof(tbuf), "%02x", *(from + i));
+			strlcat(isonet, tbuf, sizeof(isonet));
 		} else {
 			if (i == (len - 1)) { /* No dot at the end of address */
-				sprintf(pos, "%02x", *(from + i));
-				pos += 2;
+				snprintf(tbuf, sizeof(tbuf), "%02x",
+					 *(from + i));
+				strlcat(isonet, tbuf, sizeof(isonet));
 			} else {
-				sprintf(pos, "%02x.", *(from + i));
-				pos += 3;
+				snprintf(tbuf, sizeof(tbuf), "%02x.",
+					 *(from + i));
+				strlcat(isonet, tbuf, sizeof(isonet));
 			}
 		}
 		i++;
 	}
-	*(pos) = '\0';
+
 	return isonet;
 }
 
@@ -202,17 +205,18 @@ const char *nlpid2str(uint8_t nlpid)
 
 char *nlpid2string(struct nlpids *nlpids)
 {
-	char *pos = nlpidstring;
 	int i;
+	char tbuf[256];
+	nlpidstring[0] = '\0';
 
 	for (i = 0; i < nlpids->count; i++) {
-		pos += sprintf(pos, "%s", nlpid2str(nlpids->nlpids[i]));
+		snprintf(tbuf, sizeof(tbuf), "%s",
+			 nlpid2str(nlpids->nlpids[i]));
+		strlcat(nlpidstring, tbuf, sizeof(nlpidstring));
 		if (nlpids->count - i > 1)
-			pos += sprintf(pos, ", ");
+			strlcat(nlpidstring, ", ", sizeof(nlpidstring));
 	}
 
-	*(pos) = '\0';
-
 	return nlpidstring;
 }
 
@@ -359,34 +363,47 @@ const char *isis_format_id(const uint8_t *id, size_t len)
 
 const char *time2string(uint32_t time)
 {
-	char *pos = datestring;
 	uint32_t rest;
+	char tbuf[32];
+	datestring[0] = '\0';
 
 	if (time == 0)
 		return "-";
 
-	if (time / SECS_PER_YEAR)
-		pos += sprintf(pos, "%uY", time / SECS_PER_YEAR);
+	if (time / SECS_PER_YEAR) {
+		snprintf(tbuf, sizeof(tbuf), "%uY", time / SECS_PER_YEAR);
+		strlcat(datestring, tbuf, sizeof(datestring));
+	}
 	rest = time % SECS_PER_YEAR;
-	if (rest / SECS_PER_MONTH)
-		pos += sprintf(pos, "%uM", rest / SECS_PER_MONTH);
+	if (rest / SECS_PER_MONTH) {
+		snprintf(tbuf, sizeof(tbuf), "%uM", rest / SECS_PER_MONTH);
+		strlcat(datestring, tbuf, sizeof(datestring));
+	}
 	rest = rest % SECS_PER_MONTH;
-	if (rest / SECS_PER_WEEK)
-		pos += sprintf(pos, "%uw", rest / SECS_PER_WEEK);
+	if (rest / SECS_PER_WEEK) {
+		snprintf(tbuf, sizeof(tbuf), "%uw", rest / SECS_PER_WEEK);
+		strlcat(datestring, tbuf, sizeof(datestring));
+	}
 	rest = rest % SECS_PER_WEEK;
-	if (rest / SECS_PER_DAY)
-		pos += sprintf(pos, "%ud", rest / SECS_PER_DAY);
+	if (rest / SECS_PER_DAY) {
+		snprintf(tbuf, sizeof(tbuf), "%ud", rest / SECS_PER_DAY);
+		strlcat(datestring, tbuf, sizeof(datestring));
+	}
 	rest = rest % SECS_PER_DAY;
-	if (rest / SECS_PER_HOUR)
-		pos += sprintf(pos, "%uh", rest / SECS_PER_HOUR);
+	if (rest / SECS_PER_HOUR) {
+		snprintf(tbuf, sizeof(tbuf), "%uh", rest / SECS_PER_HOUR);
+		strlcat(datestring, tbuf, sizeof(datestring));
+	}
 	rest = rest % SECS_PER_HOUR;
-	if (rest / SECS_PER_MINUTE)
-		pos += sprintf(pos, "%um", rest / SECS_PER_MINUTE);
+	if (rest / SECS_PER_MINUTE) {
+		snprintf(tbuf, sizeof(tbuf), "%um", rest / SECS_PER_MINUTE);
+		strlcat(datestring, tbuf, sizeof(datestring));
+	}
 	rest = rest % SECS_PER_MINUTE;
-	if (rest)
-		pos += sprintf(pos, "%us", rest);
-
-	*(pos) = 0;
+	if (rest) {
+		snprintf(tbuf, sizeof(tbuf), "%us", rest);
+		strlcat(datestring, tbuf, sizeof(datestring));
+	}
 
 	return datestring;
 }
diff --git a/isisd/isis_vty_fabricd.c b/isisd/isis_vty_fabricd.c
index d0a411a8db..6055984195 100644
--- a/isisd/isis_vty_fabricd.c
+++ b/isisd/isis_vty_fabricd.c
@@ -118,7 +118,7 @@ static void lsp_print_flooding(struct vty *vty, struct isis_lsp *lsp,
 	char lspid[255];
 	char buf[MONOTIME_STRLEN];
 
-	lspid_print(lsp->hdr.lsp_id, lspid, true, true, isis);
+	lspid_print(lsp->hdr.lsp_id, lspid, sizeof(lspid), true, true, isis);
 	vty_out(vty, "Flooding information for %s\n", lspid);
 
 	if (!lsp->flooding_neighbors[TX_LSP_NORMAL]) {
diff --git a/lib/prefix.c b/lib/prefix.c
index 663a87afde..c98e0c1c72 100644
--- a/lib/prefix.c
+++ b/lib/prefix.c
@@ -1160,7 +1160,7 @@ in_addr_t ipv4_broadcast_addr(in_addr_t hostaddr, int masklen)
    ex.) "1.1.0.0" "255.255.0.0" => "1.1.0.0/16"
    ex.) "1.0.0.0" NULL => "1.0.0.0/8"                   */
 int netmask_str2prefix_str(const char *net_str, const char *mask_str,
-			   char *prefix_str)
+			   char *prefix_str, size_t prefix_str_len)
 {
 	struct in_addr network;
 	struct in_addr mask;
@@ -1193,7 +1193,7 @@ int netmask_str2prefix_str(const char *net_str, const char *mask_str,
 			return 0;
 	}
 
-	sprintf(prefix_str, "%s/%d", net_str, prefixlen);
+	snprintf(prefix_str, prefix_str_len, "%s/%d", net_str, prefixlen);
 
 	return 1;
 }
diff --git a/lib/prefix.h b/lib/prefix.h
index b7fdc26369..b2f3b0592f 100644
--- a/lib/prefix.h
+++ b/lib/prefix.h
@@ -491,7 +491,7 @@ extern void masklen2ip(const int, struct in_addr *);
  * special treatment for /31 according to RFC3021 section 3.3 */
 extern in_addr_t ipv4_broadcast_addr(in_addr_t hostaddr, int masklen);
 
-extern int netmask_str2prefix_str(const char *, const char *, char *);
+extern int netmask_str2prefix_str(const char *, const char *, char *, size_t);
 
 extern struct prefix_ipv6 *prefix_ipv6_new(void);
 extern void prefix_ipv6_free(struct prefix_ipv6 **p);
diff --git a/lib/vty.c b/lib/vty.c
index 4062b183e7..66b607861c 100644
--- a/lib/vty.c
+++ b/lib/vty.c
@@ -2414,9 +2414,9 @@ bool vty_read_config(struct nb_config *config, const char *config_file,
 					__func__, errno);
 				goto tmp_free_and_out;
 			}
-			tmp = XMALLOC(MTYPE_TMP,
-				      strlen(cwd) + strlen(config_file) + 2);
-			sprintf(tmp, "%s/%s", cwd, config_file);
+			size_t tmp_len = strlen(cwd) + strlen(config_file) + 2;
+			tmp = XMALLOC(MTYPE_TMP, tmp_len);
+			snprintf(tmp, tmp_len, "%s/%s", cwd, config_file);
 			fullpath = tmp;
 		} else
 			fullpath = config_file;
diff --git a/ospf6d/ospf6_abr.c b/ospf6d/ospf6_abr.c
index 7bd51138b3..465f0291f4 100644
--- a/ospf6d/ospf6_abr.c
+++ b/ospf6d/ospf6_abr.c
@@ -1265,6 +1265,7 @@ static char *ospf6_inter_area_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
 {
 	struct ospf6_inter_prefix_lsa *prefix_lsa;
 	struct in6_addr in6;
+	char tbuf[16];
 
 	if (lsa != NULL) {
 		prefix_lsa =
@@ -1274,8 +1275,9 @@ static char *ospf6_inter_area_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
 		ospf6_prefix_in6_addr(&in6, prefix_lsa, &prefix_lsa->prefix);
 		if (buf) {
 			inet_ntop(AF_INET6, &in6, buf, buflen);
-			sprintf(&buf[strlen(buf)], "/%d",
-				prefix_lsa->prefix.prefix_length);
+			snprintf(tbuf, sizeof(tbuf), "/%d",
+				 prefix_lsa->prefix.prefix_length);
+			strlcat(buf, tbuf, buflen);
 		}
 	}
 
diff --git a/ospf6d/ospf6_asbr.c b/ospf6d/ospf6_asbr.c
index 3449f48267..d0c93dd577 100644
--- a/ospf6d/ospf6_asbr.c
+++ b/ospf6d/ospf6_asbr.c
@@ -1865,6 +1865,7 @@ static char *ospf6_as_external_lsa_get_prefix_str(struct ospf6_lsa *lsa,
 	struct ospf6_as_external_lsa *external;
 	struct in6_addr in6;
 	int prefix_length = 0;
+	char tbuf[16];
 
 	if (lsa) {
 		external = (struct ospf6_as_external_lsa *)OSPF6_LSA_HEADER_END(
@@ -1885,9 +1886,11 @@ static char *ospf6_as_external_lsa_get_prefix_str(struct ospf6_lsa *lsa,
 		}
 		if (buf) {
 			inet_ntop(AF_INET6, &in6, buf, buflen);
-			if (prefix_length)
-				sprintf(&buf[strlen(buf)], "/%d",
-					prefix_length);
+			if (prefix_length) {
+				snprintf(tbuf, sizeof(tbuf), "/%d",
+					 prefix_length);
+				strlcat(buf, tbuf, buflen);
+			}
 		}
 	}
 	return (buf);
diff --git a/ospf6d/ospf6_intra.c b/ospf6d/ospf6_intra.c
index fd154e7ee5..1a81d50b68 100644
--- a/ospf6d/ospf6_intra.c
+++ b/ospf6d/ospf6_intra.c
@@ -83,7 +83,7 @@ static char *ospf6_router_lsa_get_nbr_id(struct ospf6_lsa *lsa, char *buf,
 					  sizeof(buf1));
 				inet_ntop(AF_INET, &lsdesc->neighbor_router_id,
 					  buf2, sizeof(buf2));
-				sprintf(buf, "%s/%s", buf2, buf1);
+				snprintf(buf, buflen, "%s/%s", buf2, buf1);
 
 				return buf;
 			}
@@ -865,6 +865,7 @@ static char *ospf6_intra_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
 	struct in6_addr in6;
 	int prefixnum, cnt = 0;
 	struct ospf6_prefix *prefix;
+	char tbuf[16];
 
 	if (lsa) {
 		intra_prefix_lsa =
@@ -897,8 +898,9 @@ static char *ospf6_intra_prefix_lsa_get_prefix_str(struct ospf6_lsa *lsa,
 				       OSPF6_PREFIX_SPACE(
 					       prefix->prefix_length));
 				inet_ntop(AF_INET6, &in6, buf, buflen);
-				sprintf(&buf[strlen(buf)], "/%d",
-					prefix->prefix_length);
+				snprintf(tbuf, sizeof(tbuf), "/%d",
+					 prefix->prefix_length);
+				strlcat(buf, tbuf, buflen);
 				return (buf);
 			}
 		} while (current <= end);
diff --git a/zebra/irdp_interface.c b/zebra/irdp_interface.c
index 2ab5fd3a4c..5352c6214d 100644
--- a/zebra/irdp_interface.c
+++ b/zebra/irdp_interface.c
@@ -93,10 +93,10 @@ static int irdp_if_delete(struct interface *ifp)
 	return 0;
 }
 
-static const char *inet_2a(uint32_t a, char *b)
+static const char *inet_2a(uint32_t a, char *b, size_t b_len)
 {
-	sprintf(b, "%u.%u.%u.%u", (a)&0xFF, (a >> 8) & 0xFF, (a >> 16) & 0xFF,
-		(a >> 24) & 0xFF);
+	snprintf(b, b_len, "%u.%u.%u.%u", (a)&0xFF, (a >> 8) & 0xFF,
+		 (a >> 16) & 0xFF, (a >> 24) & 0xFF);
 	return b;
 }
 
@@ -140,7 +140,8 @@ static int if_group(struct interface *ifp, int sock, uint32_t group,
 		flog_err_sys(EC_LIB_SOCKET, "IRDP: %s can't setsockopt %s: %s",
 			     add_leave == IP_ADD_MEMBERSHIP ? "join group"
 							    : "leave group",
-			     inet_2a(group, b1), safe_strerror(errno));
+			     inet_2a(group, b1, sizeof(b1)),
+			     safe_strerror(errno));
 
 	return ret;
 }
@@ -162,7 +163,8 @@ static int if_add_group(struct interface *ifp)
 
 	if (irdp->flags & IF_DEBUG_MISC)
 		zlog_debug("IRDP: Adding group %s for %s",
-			   inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1), ifp->name);
+			   inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1, sizeof(b1)),
+			   ifp->name);
 	return 0;
 }
 
@@ -183,7 +185,8 @@ static int if_drop_group(struct interface *ifp)
 
 	if (irdp->flags & IF_DEBUG_MISC)
 		zlog_debug("IRDP: Leaving group %s for %s",
-			   inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1), ifp->name);
+			   inet_2a(htonl(INADDR_ALLRTRS_GROUP), b1, sizeof(b1)),
+			   ifp->name);
 	return 0;
 }
 
@@ -383,7 +386,8 @@ int irdp_config_write(struct vty *vty, struct interface *ifp)
 
 		for (ALL_LIST_ELEMENTS_RO(irdp->AdvPrefList, node, adv))
 			vty_out(vty, " ip irdp address %s preference %d\n",
-				inet_2a(adv->ip.s_addr, b1), adv->pref);
+				inet_2a(adv->ip.s_addr, b1, sizeof(b1)),
+				adv->pref);
 
 		vty_out(vty, " ip irdp holdtime %d\n", irdp->Lifetime);
 
diff --git a/zebra/rt_netlink.c b/zebra/rt_netlink.c
index 3af3586d31..04b6b379a9 100644
--- a/zebra/rt_netlink.c
+++ b/zebra/rt_netlink.c
@@ -1132,8 +1132,8 @@ static int build_label_stack(struct mpls_label_stack *nh_label,
 
 		if (IS_ZEBRA_DEBUG_KERNEL) {
 			if (!num_labels)
-				sprintf(label_buf, "label %u",
-					nh_label->label[i]);
+				snprintf(label_buf, label_buf_size, "label %u",
+					 nh_label->label[i]);
 			else {
 				snprintf(label_buf1, sizeof(label_buf1), "/%u",
 					 nh_label->label[i]);