--- a/driver.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/driver.c	Tue Nov 28 20:55:16 2006 +0000
@@ -206,18 +206,18 @@
 }
 
 
-char *GetDriverList(char* p)
+char *GetDriverList(char* p, const char *last)
 {
 	const DriverClass* dc;
 
 	for (dc = _driver_classes; dc != endof(_driver_classes); dc++) {
 		const DriverDesc* dd;
 
-		p += sprintf(p, "List of %s drivers:\n", dc->name);
+		p += snprintf(p, last - p, "List of %s drivers:\n", dc->name);
 		for (dd = dc->descs; dd->name != NULL; dd++) {
-			p += sprintf(p, "%10s: %s\n", dd->name, dd->longname);
+			p += snprintf(p, last - p, "%10s: %s\n", dd->name, dd->longname);
 		}
-		p += sprintf(p, "\n");
+		p = strecpy(p, "\n", last);
 	}
 
 	return p;

--- a/driver.h	Tue Nov 28 20:01:46 2006 +0000
+++ b/driver.h	Tue Nov 28 20:55:16 2006 +0000
@@ -8,6 +8,6 @@
 bool GetDriverParamBool(const char* const* parm, const char* name);
 int GetDriverParamInt(const char* const* parm, const char* name, int def);
 
-char *GetDriverList(char* p);
+char *GetDriverList(char *p, const char *last);
 
 #endif /* DRIVER_H */

--- a/fileio.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/fileio.c	Tue Nov 28 20:55:16 2006 +0000
@@ -117,7 +117,7 @@
 	FILE *f;
 	char buf[MAX_PATH];
 
-	sprintf(buf, "%s%s", _path.data_dir, filename);
+	snprintf(buf, lengthof(buf), "%s%s", _path.data_dir, filename);
 
 	f = fopen(buf, "rb");
 #if !defined(WIN32)
@@ -128,7 +128,7 @@
 #if defined SECOND_DATA_DIR
 		// tries in the 2nd data directory
 		if (f == NULL) {
-			sprintf(buf, "%s%s", _path.second_data_dir, filename);
+			snprintf(buf, lengthof(buf), "%s%s", _path.second_data_dir, filename);
 			strtolower(buf + strlen(_path.second_data_dir) - 1);
 			f = fopen(buf, "rb");
 		}

--- a/gfxinit.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/gfxinit.c	Tue Nov 28 20:55:16 2006 +0000
@@ -111,7 +111,7 @@
 	char buf[MAX_PATH];
 
 	// open file
-	sprintf(buf, "%s%s", _path.data_dir, file.filename);
+	snprintf(buf, lengthof(buf), "%s%s", _path.data_dir, file.filename);
 	f = fopen(buf, "rb");
 
 #if !defined(WIN32)

--- a/map.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/map.c	Tue Nov 28 20:55:16 2006 +0000
@@ -67,7 +67,7 @@
 	if (x >= MapSizeX() || y >= MapSizeY()) {
 		char buf[512];
 
-		sprintf(buf, "TILE_ADD(%s) when adding 0x%.4X and 0x%.4X failed",
+		snprintf(buf, lengthof(buf), "TILE_ADD(%s) when adding 0x%.4X and 0x%.4X failed",
 			exp, tile, add);
 #if !defined(_MSC_VER)
 		fprintf(stderr, "%s:%d %s\n", file, line, buf);

--- a/network_client.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/network_client.c	Tue Nov 28 20:55:16 2006 +0000
@@ -457,7 +457,7 @@
 	// First packet, init some stuff
 	if (maptype == MAP_PACKET_START) {
 		// The name for the temp-map
-		sprintf(filename, "%s%snetwork_client.tmp",  _path.autosave_dir, PATHSEP);
+		snprintf(filename, lengthof(filename), "%s%snetwork_client.tmp",  _path.autosave_dir, PATHSEP);
 
 		file_pointer = fopen(filename, "wb");
 		if (file_pointer == NULL) {

--- a/network_server.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/network_server.c	Tue Nov 28 20:55:16 2006 +0000
@@ -281,7 +281,7 @@
 		Packet *p;
 
 		// Make a dump of the current game
-		sprintf(filename, "%s%snetwork_server.tmp",  _path.autosave_dir, PATHSEP);
+		snprintf(filename, lengthof(filename), "%s%snetwork_server.tmp",  _path.autosave_dir, PATHSEP);
 		if (SaveOrLoad(filename, SL_SAVE) != SL_OK) error("network savedump failed");
 
 		file_pointer = fopen(filename, "rb");

--- a/openttd.c	Tue Nov 28 20:01:46 2006 +0000
+++ b/openttd.c	Tue Nov 28 20:55:16 2006 +0000
@@ -78,7 +78,7 @@
 	char buf[512];
 
 	va_start(va, s);
-	vsprintf(buf, s, va);
+	vsnprintf(buf, lengthof(buf), s, va);
 	va_end(va);
 
 	ShowOSErrorBox(buf);
@@ -93,7 +93,7 @@
 	va_list va;
 	char buf[1024];
 	va_start(va, str);
-	vsprintf(buf, str, va);
+	vsnprintf(buf, lengthof(buf), str, va);
 	va_end(va);
 	ShowInfo(buf);
 }
@@ -132,10 +132,10 @@
 	extern const char _openttd_revision[];
 	char buf[4096], *p;
 
-	p    = buf;
+	p = buf;
 
-	p += sprintf(p, "OpenTTD %s\n", _openttd_revision);
-	p += sprintf(p,
+	p += snprintf(p, lengthof(buf), "OpenTTD %s\n", _openttd_revision);
+	p = strecpy(p,
 		"\n"
 		"\n"
 		"Command line options:\n"
@@ -157,10 +157,11 @@
 		"  -i                  = Force to use the DOS palette\n"
 		"                          (use this if you see a lot of pink)\n"
 		"  -c config_file      = Use 'config_file' instead of 'openttd.cfg'\n"
-		"\n"
+		"\n",
+		lastof(buf)
 	);
 
-	p = GetDriverList(p);
+	p = GetDriverList(p, lastof(buf));
 
 	ShowInfo(buf);
 }
@@ -286,10 +287,10 @@
 	SetupColorsAndInitialWindow();
 
 	// Generate a world.
-	sprintf(filename, "%sopntitle.dat",  _path.data_dir);
+	snprintf(filename, lengthof(filename), "%sopntitle.dat",  _path.data_dir);
 #if defined SECOND_DATA_DIR
 	if (SaveOrLoad(filename, SL_LOAD) != SL_OK) {
-		sprintf(filename, "%sopntitle.dat",  _path.second_data_dir);
+		snprintf(filename, lengthof(filename), "%sopntitle.dat",  _path.second_data_dir);
 	}
 #endif
 	if (SaveOrLoad(filename, SL_LOAD) != SL_OK) {