Merge pull request #25815 from vespa-engine/toregge/use-snprintf-instead-of-sprintf

Use snprintf instead of sprintf.

23 files changed, 58 insertions, 50 deletions

diff --git a/fastos/src/tests/thread_joinwait_test.cpp b/fastos/src/tests/thread_joinwait_test.cpp
index a26501fef01..6c7e8a7dc3c 100644
--- a/fastos/src/tests/thread_joinwait_test.cpp
+++ b/fastos/src/tests/thread_joinwait_test.cpp
@@ -14,7 +14,7 @@ class Thread_JoinWait_Test : public ThreadTestBase
 
       char testName[300];
 
-      sprintf(testName, "Single Thread Join Wait Multiple Test %d", variant);
+      snprintf(testName, sizeof(testName), "Single Thread Join Wait Multiple Test %d", variant);
       TestHeader(testName);
 
       FastOS_ThreadPool pool;
diff --git a/fastos/src/tests/threadtest.cpp b/fastos/src/tests/threadtest.cpp
index 34723e4edce..563b41ac229 100644
--- a/fastos/src/tests/threadtest.cpp
+++ b/fastos/src/tests/threadtest.cpp
@@ -18,6 +18,7 @@ class ThreadTest : public ThreadTestBase
    void TooManyThreadsTest ()
    {
       TestHeader("Too Many Threads Test");
+      static constexpr size_t message_size = 100;
 
       FastOS_ThreadPool *pool = new FastOS_ThreadPool(MAX_THREADS);
 
@@ -27,11 +28,11 @@ class ThreadTest : public ThreadTestBase
 
          for (i=0; i<MAX_THREADS+1; i++) {
             jobs[i].code = WAIT_FOR_BREAK_FLAG;
-            jobs[i].message = static_cast<char *>(malloc(100));
+            jobs[i].message = static_cast<char *>(malloc(message_size));
             if (jobs[i].message == nullptr) {
                 abort(); // GCC may infer that a potentially null ptr is passed to sprintf
             }
-            sprintf(jobs[i].message, "Thread %d invocation", i+1);
+            snprintf(jobs[i].message, message_size, "Thread %d invocation", i+1);
          }
 
          for (i=0; i<MAX_THREADS+1; i++) {
diff --git a/fbench/src/fbench/client.cpp b/fbench/src/fbench/client.cpp
index 5c064159c65..e058ded2195 100644
--- a/fbench/src/fbench/client.cpp
+++ b/fbench/src/fbench/client.cpp
@@ -251,8 +251,9 @@ Client::run()
                                           strlen("\nFBENCH: URL FETCH FAILED!\n"));
                     _output->write(&FBENCH_DELIMITER[1], strlen(FBENCH_DELIMITER) - 1);
                 } else {
-                    sprintf(timestr, "\nTIME USED: %0.4f s\n",
-                            _reqTimer->GetTimespan() / 1000.0);
+                    snprintf(timestr, sizeof(timestr),
+                             "\nTIME USED: %0.4f s\n",
+                             _reqTimer->GetTimespan() / 1000.0);
                     _output->write(timestr, strlen(timestr));
                     _output->write(&FBENCH_DELIMITER[1], strlen(FBENCH_DELIMITER) - 1);
                 }
diff --git a/fnet/src/tests/info/info.cpp b/fnet/src/tests/info/info.cpp
index 4271546e647..00075cb75dd 100644
--- a/fnet/src/tests/info/info.cpp
+++ b/fnet/src/tests/info/info.cpp
@@ -44,7 +44,7 @@ TEST("info") {
     char spec[64];
     rpc.Init(&orb);
     ASSERT_TRUE(orb.Listen("tcp/0"));
-    sprintf(spec, "tcp/localhost:%d", orb.GetListenPort());
+    snprintf(spec, sizeof(spec), "tcp/localhost:%d", orb.GetListenPort());
 
     FRT_Target     *target      = orb.GetTarget(spec);
     FRT_RPCRequest *local_info  = orb.AllocRPCRequest();
diff --git a/fnet/src/vespa/fnet/frt/supervisor.cpp b/fnet/src/vespa/fnet/frt/supervisor.cpp
index 6ba9ff8ad77..b08516c5009 100644
--- a/fnet/src/vespa/fnet/frt/supervisor.cpp
+++ b/fnet/src/vespa/fnet/frt/supervisor.cpp
@@ -53,7 +53,7 @@ bool
 FRT_Supervisor::Listen(int port)
 {
     char spec[32];
-    sprintf(spec, "tcp/%d", port);
+    snprintf(spec, sizeof(spec), "tcp/%d", port);
     return Listen(spec);
 }
 
@@ -88,7 +88,7 @@ FRT_Target *
 FRT_Supervisor::GetTarget(int port)
 {
     char spec[64];
-    sprintf(spec, "tcp/localhost:%d", port);
+    snprintf(spec, sizeof(spec), "tcp/localhost:%d", port);
     return GetTarget(spec);
 }
 
diff --git a/logd/src/tests/rotate/dummyserver.cpp b/logd/src/tests/rotate/dummyserver.cpp
index 3aaf2c7133e..e23e8ba0c53 100644
--- a/logd/src/tests/rotate/dummyserver.cpp
+++ b/logd/src/tests/rotate/dummyserver.cpp
@@ -28,7 +28,7 @@ int main(int /*argc*/, char ** /*argv*/)
     int fd = open("logserver.port", O_CREAT | O_WRONLY,
                   S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH);
     char out[6];
-    sprintf(out, "%d\n", portno);
+    snprintf(out, sizeof(out), "%d\n", portno);
     ssize_t writeRes = write(fd, out, sizeof(out));
     close(fd);
     if (writeRes != sizeof(out)) {
diff --git a/searchlib/src/tests/attribute/enumstore/enumstore_test.cpp b/searchlib/src/tests/attribute/enumstore/enumstore_test.cpp
index 4b35d0fcdf7..b3c7516777c 100644
--- a/searchlib/src/tests/attribute/enumstore/enumstore_test.cpp
+++ b/searchlib/src/tests/attribute/enumstore/enumstore_test.cpp
@@ -280,14 +280,14 @@ TEST(EnumStoreTest, test_hold_lists_and_generation)
     uniques.reserve(100);
     for (uint32_t i = 0; i < 100; ++i) {
         char tmp[16];
-        sprintf(tmp, i < 10 ? "enum0%u" : "enum%u", i);
+        snprintf(tmp, sizeof(tmp), i < 10 ? "enum0%u" : "enum%u", i);
         uniques.emplace_back(tmp);
     }
     StringVector newUniques;
     newUniques.reserve(100);
     for (uint32_t i = 0; i < 100; ++i) {
         char tmp[16];
-        sprintf(tmp, i < 10 ? "unique0%u" : "unique%u", i);
+        snprintf(tmp, sizeof(tmp), i < 10 ? "unique0%u" : "unique%u", i);
         newUniques.emplace_back(tmp);
     }
     uint32_t generation = 0;
diff --git a/searchlib/src/tests/attribute/stringattribute/stringattribute_test.cpp b/searchlib/src/tests/attribute/stringattribute/stringattribute_test.cpp
index 4bcba209c13..20373fbb3a9 100644
--- a/searchlib/src/tests/attribute/stringattribute/stringattribute_test.cpp
+++ b/searchlib/src/tests/attribute/stringattribute/stringattribute_test.cpp
@@ -80,7 +80,7 @@ testMultiValue(Attribute & attr, uint32_t numDocs)
     uniqueStrings.reserve(numDocs - 1);
     for (uint32_t i = 0; i < numDocs - 1; ++i) {
         char unique[16];
-        sprintf(unique, i < 10 ? "enum0%u" : "enum%u", i);
+        snprintf(unique, sizeof(unique), i < 10 ? "enum0%u" : "enum%u", i);
         uniqueStrings.emplace_back(unique);
     }
     ASSERT_TRUE(std::is_sorted(uniqueStrings.begin(), uniqueStrings.end()));
@@ -89,7 +89,7 @@ testMultiValue(Attribute & attr, uint32_t numDocs)
     newUniques.reserve(numDocs - 1);
     for (uint32_t i = 0; i < numDocs - 1; ++i) {
         char unique[16];
-        sprintf(unique, i < 10 ? "unique0%u" : "unique%u", i);
+        snprintf(unique, sizeof(unique), i < 10 ? "unique0%u" : "unique%u", i);
         newUniques.emplace_back(unique);
     }
 
@@ -330,14 +330,14 @@ testSingleValue(Attribute & svsa, Config &cfg)
     std::map<vespalib::string, uint32_t> enums;
     // 10 unique strings
     for (uint32_t i = 0; i < numDocs; ++i) {
-        sprintf(tmp, "enum%u", i % 10);
+        snprintf(tmp,sizeof(tmp), "enum%u", i % 10);
         EXPECT_TRUE( v.update(i, tmp) );
         EXPECT_TRUE( v.getValueCount(i) == 1 );
         EXPECT_TRUE( ! IEnumStore::Index(EntryRef(v.getEnum(i))).valid() );
         if ((i % 10) == 9) {
             v.commit();
             for (uint32_t j = i - 9; j <= i; ++j) {
-                sprintf(tmp, "enum%u", j % 10);
+                snprintf(tmp, sizeof(tmp), "enum%u", j % 10);
                 EXPECT_TRUE( strcmp(t = v.get(j), tmp) == 0 );
                 e1 = v.getEnum(j);
                 EXPECT_TRUE( v.findEnum(t, e2) );
@@ -354,15 +354,15 @@ testSingleValue(Attribute & svsa, Config &cfg)
 
     // 1000 unique strings
     for (uint32_t i = 0; i < numDocs; ++i) {
-        sprintf(tmp, "unique%u", i);
+        snprintf(tmp, sizeof(tmp), "unique%u", i);
         EXPECT_TRUE( v.update(i, tmp) );
-        sprintf(tmp, "enum%u", i % 10);
+        snprintf(tmp, sizeof(tmp), "enum%u", i % 10);
         EXPECT_TRUE( strcmp(v.get(i), tmp) == 0 );
         if ((i % 10) == 9) {
             //LOG(info, "commit: i = %u", i);
             v.commit();
             for (uint32_t j = i - 9; j <= i; ++j) {
-                sprintf(tmp, "unique%u", j);
+                snprintf(tmp, sizeof(tmp), "unique%u", j);
                 EXPECT_TRUE( strcmp(t = v.get(j), tmp) == 0 );
                 e1 = v.getEnum(j);
                 EXPECT_TRUE( v.findEnum(t, e2) );
@@ -373,7 +373,7 @@ testSingleValue(Attribute & svsa, Config &cfg)
 
     // check that enumX strings are removed (
     for (uint32_t i = 0; i < 10; ++i) {
-        sprintf(tmp, "enum%u", i);
+        snprintf(tmp, sizeof(tmp), "enum%u", i);
         EXPECT_TRUE( !v.findEnum(tmp, e1) );
     }
 
diff --git a/searchlib/src/tests/memoryindex/datastore/word_store_test.cpp b/searchlib/src/tests/memoryindex/datastore/word_store_test.cpp
index 29c032664c0..1de7b4a3efd 100644
--- a/searchlib/src/tests/memoryindex/datastore/word_store_test.cpp
+++ b/searchlib/src/tests/memoryindex/datastore/word_store_test.cpp
@@ -43,7 +43,7 @@ TEST(WordStoreTest, add_word_triggers_change_of_buffer)
     uint32_t lastId = 0;
     char wordStr[10];
     for (;;++word) {
-        sprintf(wordStr, "%6zu", word);
+        snprintf(wordStr, sizeof(wordStr), "%6zu", word);
         // all words uses 12 bytes (include padding)
         EntryRef r = ws.addWord(std::string(wordStr));
         EXPECT_EQ(std::string(wordStr), ws.getWord(r));
diff --git a/searchlib/src/vespa/searchlib/predicate/predicate_range_term_expander.h b/searchlib/src/vespa/searchlib/predicate/predicate_range_term_expander.h
index 90792912e64..42de8646091 100644
--- a/searchlib/src/vespa/searchlib/predicate/predicate_range_term_expander.h
+++ b/searchlib/src/vespa/searchlib/predicate/predicate_range_term_expander.h
@@ -48,9 +48,10 @@ void PredicateRangeTermExpander::expand(const vespalib::string &key, int64_t sig
         vespalib::Issue::report("predicate_range_term_expander: Search outside bounds should have been rejected by ValidatePredicateSearcher.");
         return;
     }
-    char buffer[21 * 2 + 3 + key.size()];  // 2 numbers + punctuation + key
+    size_t buffer_size = 21 * 2 + 3 + key.size(); // 2 numbers + punctuation + key
+    char buffer[buffer_size];
     int size;
-    int prefix_size = sprintf(buffer, "%s=", key.c_str());
+    int prefix_size = snprintf(buffer, buffer_size, "%s=", key.c_str());
     bool negative = signed_value < 0;
     uint64_t value;
     int max_levels;
@@ -64,7 +65,7 @@ void PredicateRangeTermExpander::expand(const vespalib::string &key, int64_t sig
     }
 
     int64_t edge_interval = (value / _arity) * _arity;
-    size = sprintf(buffer + prefix_size, "%" PRIu64, edge_interval);
+    size = snprintf(buffer + prefix_size, buffer_size - prefix_size, "%" PRIu64, edge_interval);
     handler.handleEdge(vespalib::stringref(buffer, prefix_size + size),
                        value - edge_interval);
 
@@ -75,13 +76,15 @@ void PredicateRangeTermExpander::expand(const vespalib::string &key, int64_t sig
             if (start + level_size - 1 > (uint64_t(0)-LLONG_MIN)) {
                 break;
             }
-            size = sprintf(buffer + prefix_size, "%" PRIu64 "-%" PRIu64,
-                           start + level_size - 1, start);
+            size = snprintf(buffer + prefix_size, buffer_size - prefix_size,
+                            "%" PRIu64 "-%" PRIu64,
+                            start + level_size - 1, start);
         } else {
             if (start + level_size - 1 > LLONG_MAX) {
                 break;
             }
-            size = sprintf(buffer + prefix_size, "%" PRIu64 "-%" PRIu64,
+            size = snprintf(buffer + prefix_size, buffer_size - prefix_size,
+                            "%" PRIu64 "-%" PRIu64,
                            start, start + level_size - 1);
         }
         handler.handleRange(vespalib::stringref(buffer, prefix_size + size));
diff --git a/searchlib/src/vespa/searchlib/transactionlog/translogserver.cpp b/searchlib/src/vespa/searchlib/transactionlog/translogserver.cpp
index c6ae9c00e49..98a9568e4e8 100644
--- a/searchlib/src/vespa/searchlib/transactionlog/translogserver.cpp
+++ b/searchlib/src/vespa/searchlib/transactionlog/translogserver.cpp
@@ -124,7 +124,7 @@ TransLogServer::TransLogServer(FNET_Transport & transport, const vespalib::strin
             }
             exportRPC(*_supervisor);
             char listenSpec[32];
-            sprintf(listenSpec, "tcp/%d", listenPort);
+            snprintf(listenSpec, sizeof(listenSpec), "tcp/%d", listenPort);
             bool listenOk(false);
             for (int i(600); !listenOk && i; i--) {
                 if (_supervisor->Listen(listenSpec)) {
diff --git a/searchsummary/src/vespa/juniper/Matcher.cpp b/searchsummary/src/vespa/juniper/Matcher.cpp
index 9f7db56823a..22d1bbc7e96 100644
--- a/searchsummary/src/vespa/juniper/Matcher.cpp
+++ b/searchsummary/src/vespa/juniper/Matcher.cpp
@@ -375,8 +375,9 @@ void Matcher::log_matches(int printcount)
     _log_text.append("<table>");
     if (m.size() > 0) {
         _log_text.append("<tr class=shade>");
-        sprintf(buf, "<td colspan=%d align=center><b>Topmost %zu matches out of %zu",
-                nterms+2, std::min(static_cast<size_t>(printcount), m.size()),m.size());
+        snprintf(buf, sizeof(buf),
+                 "<td colspan=%d align=center><b>Topmost %zu matches out of %zu",
+                 nterms+2, std::min(static_cast<size_t>(printcount), m.size()),m.size());
         _log_text.append(buf);
         _log_text.append("</b></td></tr>");
     }
@@ -399,12 +400,14 @@ void Matcher::log_matches(int printcount)
         }
     }
     _log_text.append("<tr class=shadehead>");
-    sprintf(buf, "<td colspan=%d align=center><b>Total(exact) keyword hits</b></td>",
-            nterms);
+    snprintf(buf, sizeof(buf),
+             "<td colspan=%d align=center><b>Total(exact) keyword hits</b></td>",
+             nterms);
     _log_text.append(buf);
     _log_text.append("</tr><tr class=shade>");
     for (i = 0; i < nterms; i++) {
-        sprintf(buf, "<td>%d(%d)</td>", TotalMatchCnt(i), ExactMatchCnt(i));
+        snprintf(buf, sizeof(buf),
+                 "<td>%d(%d)</td>", TotalMatchCnt(i), ExactMatchCnt(i));
         _log_text.append(buf);
     }
     _log_text.append("</tr></table>");
diff --git a/searchsummary/src/vespa/juniper/mcand.cpp b/searchsummary/src/vespa/juniper/mcand.cpp
index f67788d59ed..e30a0f42d1d 100644
--- a/searchsummary/src/vespa/juniper/mcand.cpp
+++ b/searchsummary/src/vespa/juniper/mcand.cpp
@@ -159,14 +159,14 @@ void MatchCandidate::log(std::string& logobj)
     {
         if (element[i])
         {
-            sprintf(buf, "<td align=left>%" PRId64 "</td>",
-                    static_cast<int64_t>(element[i]->starttoken()));
+            snprintf(buf, sizeof(buf), "<td align=left>%" PRId64 "</td>",
+                     static_cast<int64_t>(element[i]->starttoken()));
             logobj.append(buf);
         }
         else
             logobj.append("<td></td>");
     }
-    sprintf(buf, "<td align=right>%d</td><td align=right>%d</td>", word_distance(),rank());
+    snprintf(buf, sizeof(buf), "<td align=right>%d</td><td align=right>%d</td>", word_distance(),rank());
     logobj.append(buf);
 }
 
diff --git a/slobrok/src/tests/mirrorapi/mirrorapi.cpp b/slobrok/src/tests/mirrorapi/mirrorapi.cpp
index 85ef56aeb1b..58af7cd7f78 100644
--- a/slobrok/src/tests/mirrorapi/mirrorapi.cpp
+++ b/slobrok/src/tests/mirrorapi/mirrorapi.cpp
@@ -57,7 +57,7 @@ void
 Server::reg()
 {
     char spec[64];
-    sprintf(spec, "tcp/localhost:%d", _server.supervisor().GetListenPort());
+    snprintf(spec, sizeof(spec), "tcp/localhost:%d", _server.supervisor().GetListenPort());
 
     FRT_RPCRequest *req = _server.supervisor().AllocRPCRequest();
     req->SetMethodName("slobrok.registerRpcServer");
diff --git a/streamingvisitors/src/vespa/vsm/searcher/fieldsearcher.cpp b/streamingvisitors/src/vespa/vsm/searcher/fieldsearcher.cpp
index 6f8a5978583..aad4f9d5aa2 100644
--- a/streamingvisitors/src/vespa/vsm/searcher/fieldsearcher.cpp
+++ b/streamingvisitors/src/vespa/vsm/searcher/fieldsearcher.cpp
@@ -247,7 +247,7 @@ void FieldIdTSearcherMap::prepare(const DocumentTypeIndexFieldMapT & difm, const
         (*it)->prepare(onlyInIndex, searcherBuf);
         if (LOG_WOULD_LOG(spam)) {
             char tmpBuf[16];
-            sprintf(tmpBuf,"%d", fid);
+            snprintf(tmpBuf, sizeof(tmpBuf), "%d", fid);
             tmp += tmpBuf;
             tmp += ", ";
         }
diff --git a/vdstestlib/src/vespa/vdstestlib/config/dirconfig.cpp b/vdstestlib/src/vespa/vdstestlib/config/dirconfig.cpp
index daab92b3a59..cdfa1de789c 100644
--- a/vdstestlib/src/vespa/vdstestlib/config/dirconfig.cpp
+++ b/vdstestlib/src/vespa/vdstestlib/config/dirconfig.cpp
@@ -24,7 +24,7 @@ public:
         _nextDir(0)
     {
         memset(_dirname, 0, sizeof(_dirname));
-        sprintf(_dirname, "dirconfig.tmp.XXXXXX");
+        snprintf(_dirname, sizeof(_dirname), "dirconfig.tmp.XXXXXX");
         char * realName = mkdtemp(_dirname);
         assert(realName == _dirname);
         assert(strlen(realName) < sizeof(_dirname));
@@ -39,7 +39,7 @@ public:
     std::string nextDir() {
         char name[64];
         uint32_t id = _nextDir++;
-        sprintf(name, "%s/%u", _dirname, id);
+        snprintf(name, sizeof(name), "%s/%u", _dirname, id);
         return name;
     }
 private:
diff --git a/vespalib/src/tests/sequencedtaskexecutor/adaptive_sequenced_executor_test.cpp b/vespalib/src/tests/sequencedtaskexecutor/adaptive_sequenced_executor_test.cpp
index 1a458f86232..627452e3760 100644
--- a/vespalib/src/tests/sequencedtaskexecutor/adaptive_sequenced_executor_test.cpp
+++ b/vespalib/src/tests/sequencedtaskexecutor/adaptive_sequenced_executor_test.cpp
@@ -160,7 +160,7 @@ vespalib::string makeAltComponentId(Fixture &f)
     char altComponentId[20];
     ISequencedTaskExecutor::ExecutorId executorId0 = f._threads.getExecutorIdFromName(ZERO);
     for (tryCnt = 1; tryCnt < 100; ++tryCnt) {
-        sprintf(altComponentId, "%d", tryCnt);
+        snprintf(altComponentId, sizeof(altComponentId), "%d", tryCnt);
         if (f._threads.getExecutorIdFromName(altComponentId) == executorId0) {
             break;
         }
diff --git a/vespalib/src/tests/sequencedtaskexecutor/sequencedtaskexecutor_test.cpp b/vespalib/src/tests/sequencedtaskexecutor/sequencedtaskexecutor_test.cpp
index 705d6346e8c..4c547acc25f 100644
--- a/vespalib/src/tests/sequencedtaskexecutor/sequencedtaskexecutor_test.cpp
+++ b/vespalib/src/tests/sequencedtaskexecutor/sequencedtaskexecutor_test.cpp
@@ -187,7 +187,7 @@ makeAltComponentId(Fixture &f)
     char altComponentId[20];
     ISequencedTaskExecutor::ExecutorId executorId0 = f._threads->getExecutorIdFromName(ZERO);
     for (tryCnt = 1; tryCnt < 100; ++tryCnt) {
-        sprintf(altComponentId, "%d", tryCnt);
+        snprintf(altComponentId, sizeof(altComponentId), "%d", tryCnt);
         if (f._threads->getExecutorIdFromName(altComponentId) == executorId0) {
             break;
         }
diff --git a/vespalib/src/vespa/fastlib/io/bufferedfile.cpp b/vespalib/src/vespa/fastlib/io/bufferedfile.cpp
index fa55d0be812..31ca735a0bb 100644
--- a/vespalib/src/vespa/fastlib/io/bufferedfile.cpp
+++ b/vespalib/src/vespa/fastlib/io/bufferedfile.cpp
@@ -185,8 +185,8 @@ Fast_BufferedFile::SetPosition(const int64_t s)
             }
             diff = _filepos - s;
             if ( !(((diff > 0l) || ((diff == 0l) && (_fileleft == 0l))) && (diff <= static_cast<int64_t>(_buf.size())))) {
-                char tmp[8196];
-                sprintf(tmp, "diff %" PRId64 " _fileleft=%" PRId64 " _buflen=%zu", diff, _fileleft, _buf.size());
+                char tmp[64];
+                snprintf(tmp, sizeof(tmp), "diff %" PRId64 " _fileleft=%" PRId64 " _buflen=%zu", diff, _fileleft, _buf.size());
                 abort();
             }
         }
diff --git a/vespalog/src/logger/runserver.cpp b/vespalog/src/logger/runserver.cpp
index 7cec2be6f3f..d9e048588b2 100644
--- a/vespalog/src/logger/runserver.cpp
+++ b/vespalog/src/logger/runserver.cpp
@@ -110,7 +110,7 @@ PidFile::writePid()
         std::_Exit(1);
     }
     char buf[100];
-    sprintf(buf, "%d\n", getpid());
+    snprintf(buf, sizeof(buf), "%d\n", getpid());
     int l = strlen(buf);
     ssize_t didw = write(_fd, buf, l);
     if (didw != l) {
@@ -211,7 +211,7 @@ int loop(const char *svc, char * const * run)
     {
         torun += " (pid ";
         char buf[20];
-        sprintf(buf, "%d", (int)child);
+        snprintf(buf, sizeof(buf), "%d", (int)child);
         torun += buf;
         torun += ")";
     }
@@ -318,8 +318,8 @@ int loop(const char *svc, char * const * run)
         if (unhandledsig && child != 0) {
             LOG(debug, "got signal %d, sending to pid %d",
                 (int)lastsig, (int)child);
-            char why[256];
-            sprintf(why, "got signal %d", (int)lastsig);
+            char why[32];
+            snprintf(why, sizeof(why), "got signal %d", (int)lastsig);
             EV_STOPPING(torun.c_str(), why);
             kill(child, lastsig);
             unhandledsig = 0;
diff --git a/vespalog/src/test/threads/testthreads.cpp b/vespalog/src/test/threads/testthreads.cpp
index 8fab6bcd638..ed2683b5c35 100644
--- a/vespalog/src/test/threads/testthreads.cpp
+++ b/vespalog/src/test/threads/testthreads.cpp
@@ -103,7 +103,7 @@ ThreadTester::Main()
 
     for (int i = 0; i < numWriters; i++) {
         char filename[100];
-        sprintf(filename, "empty.%d", i);
+        snprintf(filename, sizeof(filename), "empty.%d", i);
         writers[i] = std::make_unique<FileThread>(filename);
         pool.NewThread(writers[i].get());
     }
diff --git a/vespalog/src/vespa/log/control-file.cpp b/vespalog/src/vespa/log/control-file.cpp
index d37f122ddda..bae60b68ba7 100644
--- a/vespalog/src/vespa/log/control-file.cpp
+++ b/vespalog/src/vespa/log/control-file.cpp
@@ -201,7 +201,7 @@ ControlFile::setPrefix(const char *prefix)
 {
     if (prefix && !hasPrefix() && _prefix) {
         char buf[_maxPrefix + 1];
-        sprintf(buf, "%.*s\n", _maxPrefix - 1, prefix);
+        snprintf(buf, _maxPrefix + 1, "%.*s\n", _maxPrefix - 1, prefix);
         memcpy(_prefix, buf, strlen(buf));
         msync(_mapBase, pageAlign(1), MS_ASYNC | MS_INVALIDATE);
     }
diff --git a/vespalog/src/vespa/log/log.cpp b/vespalog/src/vespa/log/log.cpp
index 69d69b97874..7430815122d 100644
--- a/vespalog/src/vespa/log/log.cpp
+++ b/vespalog/src/vespa/log/log.cpp
@@ -208,7 +208,7 @@ Logger::setRcsId(const char *id)
     }
 
     assert(size_t(len + 8) < sizeof(_rcsId));
-    sprintf(_rcsId, "(%.*s): ", (int)(end - start), start);
+    snprintf(_rcsId, sizeof(_rcsId), "(%.*s): ", (int)(end - start), start);
     LOG(spam, "rcs id was set to '%s'", _rcsId);
     return 0;
 }