[125678kqv][cl]: fix sprint() and strcpy() buffer overflows

31 files changed, 784 insertions, 850 deletions

diff --git a/sys/src/cmd/1c/list.c b/sys/src/cmd/1c/list.c
index f6bc2e620..ef2edb00b 100644
--- a/sys/src/cmd/1c/list.c
+++ b/sys/src/cmd/1c/list.c
@@ -20,20 +20,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%ld", var[i].offset);
+			snprint(ss, sizeof ss, "$%ld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -42,15 +40,13 @@ Bconv(Fmt *fp)
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], s[20];
+	char str[STRINGSZ];
 	Prog *p;
 
 	p = va_arg(fp->args, Prog*);
-	sprint(str, "	%A	%D,%D", p->as, &p->from, &p->to);
-	if(p->from.field) {
-		sprint(s, ",%d,%d", p->to.field, p->from.field);
-		strcat(str, s);
-	}
+	snprint(str, sizeof str, "	%A	%D,%D", p->as, &p->from, &p->to);
+	if(p->from.field)
+		return fmtprint(fp, "%s,%d,%d", str, p->to.field, p->from.field);
 	return fmtstrcpy(fp, str);
 }
 
@@ -66,7 +62,7 @@ Aconv(Fmt *fp)
 int
 Dconv(Fmt *fp)
 {
-	char str[40], s[20];
+	char str[40];
 	Adr *a;
 	int i, j;
 	long d;
@@ -80,26 +76,26 @@ Dconv(Fmt *fp)
 		a->offset = 0;
 		switch(j) {
 		case I_INDINC:
-			sprint(str, "(%D)+", a);
+			snprint(str, sizeof str, "(%D)+", a);
 			break;
 
 		case I_INDDEC:
-			sprint(str, "-(%D)", a);
+			snprint(str, sizeof str, "-(%D)", a);
 			break;
 
 		case I_INDIR:
 			if(a->type == D_CONST)
-				sprint(str, "%ld", d);
+				snprint(str, sizeof str, "%ld", d);
 			else
 			if(d)
-				sprint(str, "%ld(%D)", d, a);
+				snprint(str, sizeof str, "%ld(%D)", d, a);
 			else
-				sprint(str, "(%D)", a);
+				snprint(str, sizeof str, "(%D)", a);
 			break;
 
 		case I_ADDR:
 			a->offset = d;
-			sprint(str, "$%D", a);
+			snprint(str, sizeof str, "$%D", a);
 			break;
 		}
 		a->type = i;
@@ -109,7 +105,7 @@ Dconv(Fmt *fp)
 	switch(i) {
 
 	default:
-		sprint(str, "%R", i);
+		snprint(str, sizeof str, "%R", i);
 		break;
 
 	case D_NONE:
@@ -117,45 +113,43 @@ Dconv(Fmt *fp)
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%ld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%ld(PC)", a->offset-pc);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", a->sym->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", a->sym->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", a->sym->name, a->offset);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%ld", a->offset);
+		snprint(str, sizeof str, "$%ld", a->offset);
 		break;
 
 	case D_STACK:
-		sprint(str, "TOS+%ld", a->offset);
+		snprint(str, sizeof str, "TOS+%ld", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%.17e", a->dval);
+		snprint(str, sizeof str, "$%.17e", a->dval);
 		goto out;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		goto out;
 	}
-	if(a->displace) {
-		sprint(s, "/%ld", a->displace);
-		strcat(str, s);
-	}
+	if(a->displace)
+		return fmtprint(fp, "%s/%ld", str, a->displace);
 out:
 	return fmtstrcpy(fp, str);
 }
@@ -168,113 +162,113 @@ Rconv(Fmt *fp)
 
 	r = va_arg(fp->args, int);
 	if(r >= D_R0 && r < D_R0+NREG)
-		sprint(str, "R%d", r-D_R0);
+		snprint(str, sizeof str, "R%d", r-D_R0);
 	else
 	if(r >= D_A0 && r < D_A0+NREG)
-		sprint(str, "A%d", r-D_A0);
+		snprint(str, sizeof str, "A%d", r-D_A0);
 	else
 	if(r >= D_F0 && r < D_F0+NREG)
-		sprint(str, "F%d", r-D_F0);
+		snprint(str, sizeof str, "F%d", r-D_F0);
 	else
 	switch(r) {
 
 	default:
-		sprint(str, "gok(%d)", r);
+		snprint(str, sizeof str, "gok(%d)", r);
 		break;
 
 	case D_NONE:
-		sprint(str, "NONE");
+		snprint(str, sizeof str, "NONE");
 		break;
 
 	case D_TOS:
-		sprint(str, "TOS");
+		snprint(str, sizeof str, "TOS");
 		break;
 
 	case D_CCR:
-		sprint(str, "CCR");
+		snprint(str, sizeof str, "CCR");
 		break;
 
 	case D_SR:
-		sprint(str, "SR");
+		snprint(str, sizeof str, "SR");
 		break;
 
 	case D_SFC:
-		sprint(str, "SFC");
+		snprint(str, sizeof str, "SFC");
 		break;
 
 	case D_DFC:
-		sprint(str, "DFC");
+		snprint(str, sizeof str, "DFC");
 		break;
 
 	case D_CACR:
-		sprint(str, "CACR");
+		snprint(str, sizeof str, "CACR");
 		break;
 
 	case D_USP:
-		sprint(str, "USP");
+		snprint(str, sizeof str, "USP");
 		break;
 
 	case D_VBR:
-		sprint(str, "VBR");
+		snprint(str, sizeof str, "VBR");
 		break;
 
 	case D_CAAR:
-		sprint(str, "CAAR");
+		snprint(str, sizeof str, "CAAR");
 		break;
 
 	case D_MSP:
-		sprint(str, "MSP");
+		snprint(str, sizeof str, "MSP");
 		break;
 
 	case D_ISP:
-		sprint(str, "ISP");
+		snprint(str, sizeof str, "ISP");
 		break;
 
 	case D_TREE:
-		sprint(str, "TREE");
+		snprint(str, sizeof str, "TREE");
 		break;
 
 	case D_FPCR:
-		sprint(str, "FPCR");
+		snprint(str, sizeof str, "FPCR");
 		break;
 
 	case D_FPSR:
-		sprint(str, "FPSR");
+		snprint(str, sizeof str, "FPSR");
 		break;
 
 	case D_FPIAR:
-		sprint(str, "FPIAR");
+		snprint(str, sizeof str, "FPIAR");
 		break;
 
 	case D_TC:
-		sprint(str, "TC");
+		snprint(str, sizeof str, "TC");
 		break;
 
 	case D_ITT0:
-		sprint(str, "ITT0");
+		snprint(str, sizeof str, "ITT0");
 		break;
 
 	case D_ITT1:
-		sprint(str, "ITT1");
+		snprint(str, sizeof str, "ITT1");
 		break;
 
 	case D_DTT0:
-		sprint(str, "DTT0");
+		snprint(str, sizeof str, "DTT0");
 		break;
 
 	case D_DTT1:
-		sprint(str, "DTT1");
+		snprint(str, sizeof str, "DTT1");
 		break;
 
 	case D_MMUSR:
-		sprint(str, "MMUSR");
+		snprint(str, sizeof str, "MMUSR");
 		break;
 	case D_URP:
-		sprint(str, "URP");
+		snprint(str, sizeof str, "URP");
 		break;
 
 	case D_SRP:
-		sprint(str, "SRP");
+		snprint(str, sizeof str, "SRP");
 		break;
 	}
 	return fmtstrcpy(fp, str);
diff --git a/sys/src/cmd/1l/list.c b/sys/src/cmd/1l/list.c
index f02c3efa7..2086d9c82 100644
--- a/sys/src/cmd/1l/list.c
+++ b/sys/src/cmd/1l/list.c
@@ -16,17 +16,15 @@ static	Prog	*bigP;
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], s[20];
+	char str[STRINGSZ];
 	Prog *p;
 
 	p = va_arg(fp->args, Prog*);
 	bigP = p;
-	sprint(str, "(%ld)	%A	%D,%D",
+	snprint(str, sizeof str, "(%ld)	%A	%D,%D",
 		p->line, p->as, &p->from, &p->to);
-	if(p->from.field) {
-		sprint(s, ",%d,%d", p->to.field, p->from.field);
-		strcat(str, s);
-	}
+	if(p->from.field)
+		return fmtprint(fp, "%s,%d,%d", str, p->to.field, p->from.field);
 	bigP = P;
 	return fmtstrcpy(fp, str);
 }
@@ -34,14 +32,13 @@ Pconv(Fmt *fp)
 int
 Aconv(Fmt *fp)
 {
-
 	return fmtstrcpy(fp, anames[va_arg(fp->args, int)]);
 }
 
 int
 Dconv(Fmt *fp)
 {
-	char str[40], s[20];
+	char str[40];
 	Adr *a;
 	int i, j;
 	long d;
@@ -55,23 +52,23 @@ Dconv(Fmt *fp)
 		a->offset = 0;
 		switch(j) {
 		case I_INDINC:
-			sprint(str, "(%D)+", a);
+			snprint(str, sizeof str, "(%D)+", a);
 			break;
 
 		case I_INDDEC:
-			sprint(str, "-(%D)", a);
+			snprint(str, sizeof str, "-(%D)", a);
 			break;
 
 		case I_INDIR:
 			if(d)
-				sprint(str, "%ld(%D)", d, a);
+				snprint(str, sizeof str, "%ld(%D)", d, a);
 			else
-				sprint(str, "(%D)", a);
+				snprint(str, sizeof str, "(%D)", a);
 			break;
 
 		case I_ADDR:
 			a->offset = d;
-			sprint(str, "$%D", a);
+			snprint(str, sizeof str, "$%D", a);
 			break;
 		}
 		a->type = i;
@@ -81,7 +78,7 @@ Dconv(Fmt *fp)
 	switch(i) {
 
 	default:
-		sprint(str, "%R", i);
+		snprint(str, sizeof str, "%R", i);
 		break;
 
 	case D_NONE:
@@ -91,58 +88,56 @@ Dconv(Fmt *fp)
 	case D_BRANCH:
 		if(bigP != P && bigP->pcond != P)
 			if(a->sym != S)
-				sprint(str, "%lux+%s", bigP->pcond->pc,
+				snprint(str, sizeof str, "%lux+%s", bigP->pcond->pc,
 					a->sym->name);
 			else
-				sprint(str, "%lux", bigP->pcond->pc);
+				snprint(str, sizeof str, "%lux", bigP->pcond->pc);
 		else
-			sprint(str, "%ld(PC)", a->offset);
+			snprint(str, sizeof str, "%ld(PC)", a->offset);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<%d>+%ld(SB)", a->sym->name,
+		snprint(str, sizeof str, "%s<%d>+%ld(SB)", a->sym->name,
 			a->sym->version, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s+%ld(SP)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SP)", a->sym->name, a->offset);
 		break;
 
 	case D_PARAM:
 		if(a->sym)
-			sprint(str, "%s+%ld(FP)", a->sym->name, a->offset);
+			snprint(str, sizeof str, "%s+%ld(FP)", a->sym->name, a->offset);
 		else
-			sprint(str, "%ld(FP)", a->offset);
+			snprint(str, sizeof str, "%ld(FP)", a->offset);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%ld", a->offset);
+		snprint(str, sizeof str, "$%ld", a->offset);
 		break;
 
 	case D_STACK:
-		sprint(str, "TOS+%ld", a->offset);
+		snprint(str, sizeof str, "TOS+%ld", a->offset);
 		break;
 
 	case D_QUICK:
-		sprint(str, "$Q%ld", a->offset);
+		snprint(str, sizeof str, "$Q%ld", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$(%.8lux,%.8lux)", a->ieee.h, a->ieee.l);
+		snprint(str, sizeof str, "$(%.8lux,%.8lux)", a->ieee.h, a->ieee.l);
 		goto out;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->scon);
+		snprint(str, sizeof str, "$\"%S\"", a->scon);
 		goto out;
 	}
-	if(a->displace) {
-		sprint(s, "/%ld", a->displace);
-		strcat(str, s);
-	}
+	if(a->displace)
+		return fmtprint(fp, "%s/%ld", str, a->displace);
 out:
 	return fmtstrcpy(fp, str);
 }
@@ -155,113 +150,113 @@ Rconv(Fmt *fp)
 
 	r = va_arg(fp->args, int);
 	if(r >= D_R0 && r < D_R0+NREG)
-		sprint(str, "R%d", r-D_R0);
+		snprint(str, sizeof str, "R%d", r-D_R0);
 	else
 	if(r >= D_A0 && r < D_A0+NREG)
-		sprint(str, "A%d", r-D_A0);
+		snprint(str, sizeof str, "A%d", r-D_A0);
 	else
 	if(r >= D_F0 && r < D_F0+NREG)
-		sprint(str, "F%d", r-D_F0);
+		snprint(str, sizeof str, "F%d", r-D_F0);
 	else
 	switch(r) {
 
 	default:
-		sprint(str, "gok(%d)", r);
+		snprint(str, sizeof str, "gok(%d)", r);
 		break;
 
 	case D_NONE:
-		sprint(str, "NONE");
+		snprint(str, sizeof str, "NONE");
 		break;
 
 	case D_TOS:
-		sprint(str, "TOS");
+		snprint(str, sizeof str, "TOS");
 		break;
 
 	case D_CCR:
-		sprint(str, "CCR");
+		snprint(str, sizeof str, "CCR");
 		break;
 
 	case D_SR:
-		sprint(str, "SR");
+		snprint(str, sizeof str, "SR");
 		break;
 
 	case D_SFC:
-		sprint(str, "SFC");
+		snprint(str, sizeof str, "SFC");
 		break;
 
 	case D_DFC:
-		sprint(str, "DFC");
+		snprint(str, sizeof str, "DFC");
 		break;
 
 	case D_CACR:
-		sprint(str, "CACR");
+		snprint(str, sizeof str, "CACR");
 		break;
 
 	case D_USP:
-		sprint(str, "USP");
+		snprint(str, sizeof str, "USP");
 		break;
 
 	case D_VBR:
-		sprint(str, "VBR");
+		snprint(str, sizeof str, "VBR");
 		break;
 
 	case D_CAAR:
-		sprint(str, "CAAR");
+		snprint(str, sizeof str, "CAAR");
 		break;
 
 	case D_MSP:
-		sprint(str, "MSP");
+		snprint(str, sizeof str, "MSP");
 		break;
 
 	case D_ISP:
-		sprint(str, "ISP");
+		snprint(str, sizeof str, "ISP");
 		break;
 
 	case D_FPCR:
-		sprint(str, "FPCR");
+		snprint(str, sizeof str, "FPCR");
 		break;
 
 	case D_FPSR:
-		sprint(str, "FPSR");
+		snprint(str, sizeof str, "FPSR");
 		break;
 
 	case D_FPIAR:
-		sprint(str, "FPIAR");
+		snprint(str, sizeof str, "FPIAR");
 		break;
 
 	case D_TREE:
-		sprint(str, "TREE");
+		snprint(str, sizeof str, "TREE");
 		break;
 
 	case D_TC:
-		sprint(str, "TC");
+		snprint(str, sizeof str, "TC");
 		break;
 
 	case D_ITT0:
-		sprint(str, "ITT0");
+		snprint(str, sizeof str, "ITT0");
 		break;
 
 	case D_ITT1:
-		sprint(str, "ITT1");
+		snprint(str, sizeof str, "ITT1");
 		break;
 
 	case D_DTT0:
-		sprint(str, "DTT0");
+		snprint(str, sizeof str, "DTT0");
 		break;
 
 	case D_DTT1:
-		sprint(str, "DTT1");
+		snprint(str, sizeof str, "DTT1");
 		break;
 
 	case D_MMUSR:
-		sprint(str, "MMUSR");
+		snprint(str, sizeof str, "MMUSR");
 		break;
 	case D_URP:
-		sprint(str, "URP");
+		snprint(str, sizeof str, "URP");
 		break;
 
 	case D_SRP:
-		sprint(str, "SRP");
+		snprint(str, sizeof str, "SRP");
 		break;
 	}
 	return fmtstrcpy(fp, str);
diff --git a/sys/src/cmd/1l/obj.c b/sys/src/cmd/1l/obj.c
index 0622ba37a..01fc3344a 100644
--- a/sys/src/cmd/1l/obj.c
+++ b/sys/src/cmd/1l/obj.c
@@ -304,9 +304,7 @@ objfile(char *file)
 	char *e, *start, *stop;
 
 	if(file[0] == '-' && file[1] == 'l') {
-		sprint(name, "/%s/lib/lib", thestring);
-		strcat(name, file+2);
-		strcat(name, ".a");
+		snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -364,7 +362,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -524,17 +522,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
diff --git a/sys/src/cmd/2c/list.c b/sys/src/cmd/2c/list.c
index 2b3cb4daf..8a11546a2 100644
--- a/sys/src/cmd/2c/list.c
+++ b/sys/src/cmd/2c/list.c
@@ -31,20 +31,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%ld", var[i].offset);
+			snprint(ss, sizeof ss, "$%ld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -53,15 +51,13 @@ Bconv(Fmt *fp)
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], s[20];
+	char str[STRINGSZ];
 	Prog *p;
 
 	p = va_arg(fp->args, Prog*);
-	sprint(str, "	%A	%D,%D", p->as, &p->from, &p->to);
-	if(p->from.field) {
-		sprint(s, ",%d,%d", p->to.field, p->from.field);
-		strcat(str, s);
-	}
+	snprint(str, sizeof str, "	%A	%D,%D", p->as, &p->from, &p->to);
+	if(p->from.field)
+		return fmtprint(fp, "%s,%d,%d", str, p->to.field, p->from.field);
 	return fmtstrcpy(fp, str);
 }
 
@@ -77,20 +73,16 @@ Aconv(Fmt *fp)
 int
 Xconv(Fmt *fp)
 {
-	char str[20], s[10];
+	char str[20];
 	Index x;
-	int i;
+	int i, j;
 
 	x = va_arg(fp->args, Index);
 	str[0] = 0;
 	i = x.o0 & D_MASK;
-	if(i != D_NONE) {
-		sprint(str, "(%R.", i);
-		i = x.o1;
-		sprint(s, "%c*%c)",
-			"WWWWLLLL"[i],
-			"12481248"[i]);
-		strcat(str, s);
+	if(i != D_NONE){
+		j = x.o1;
+		return fmtprint(fp, "(%R.%c*%c)", i, "WWWWLLLL"[j], "12481248"[j]);
 	}
 	return fmtstrcpy(fp, str);
 }
@@ -98,7 +90,7 @@ Xconv(Fmt *fp)
 int
 Dconv(Fmt *fp)
 {
-	char str[40], s[20];
+	char str[40];
 	Adr *a;
 	int i, j;
 	long d;
@@ -112,25 +104,25 @@ Dconv(Fmt *fp)
 		a->displace = 0;
 		switch(i & I_MASK) {
 		default:
-			sprint(str, "???%ld(%D%X)", d, a, indexv(i, j));
+			snprint(str, sizeof str, "???%ld(%D%X)", d, a, indexv(i, j));
 			break;
 
 		case I_INDEX1:
-			sprint(str, "%D%X", a, indexv(i, a->scale));
+			snprint(str, sizeof str, "%D%X", a, indexv(i, a->scale));
 			break;
 
 		case I_INDEX2:
 			if(d)
-				sprint(str, "%ld(%D)%X", d, a, indexv(i, j));
+				snprint(str, sizeof str, "%ld(%D)%X", d, a, indexv(i, j));
 			else
-				sprint(str, "(%D)%X", a, indexv(i, j));
+				snprint(str, sizeof str, "(%D)%X", a, indexv(i, j));
 			break;
 
 		case I_INDEX3:
 			if(d)
-				sprint(str, "%ld(%D%X)", d, a, indexv(i, j));
+				snprint(str, sizeof str, "%ld(%D%X)", d, a, indexv(i, j));
 			else
-				sprint(str, "(%D%X)", a, indexv(i, j));
+				snprint(str, sizeof str, "(%D%X)", a, indexv(i, j));
 			break;
 		}
 		a->displace = d;
@@ -145,26 +137,26 @@ Dconv(Fmt *fp)
 		a->offset = 0;
 		switch(j) {
 		case I_INDINC:
-			sprint(str, "(%D)+", a);
+			snprint(str, sizeof str, "(%D)+", a);
 			break;
 
 		case I_INDDEC:
-			sprint(str, "-(%D)", a);
+			snprint(str, sizeof str, "-(%D)", a);
 			break;
 
 		case I_INDIR:
 			if(a->type == D_CONST)
-				sprint(str, "%ld", d);
+				snprint(str, sizeof str, "%ld", d);
 			else
 			if(d)
-				sprint(str, "%ld(%D)", d, a);
+				snprint(str, sizeof str, "%ld(%D)", d, a);
 			else
-				sprint(str, "(%D)", a);
+				snprint(str, sizeof str, "(%D)", a);
 			break;
 
 		case I_ADDR:
 			a->offset = d;
-			sprint(str, "$%D", a);
+			snprint(str, sizeof str, "$%D", a);
 			break;
 		}
 		a->type = i;
@@ -174,7 +166,7 @@ Dconv(Fmt *fp)
 	switch(i) {
 
 	default:
-		sprint(str, "%R", i);
+		snprint(str, sizeof str, "%R", i);
 		break;
 
 	case D_NONE:
@@ -182,45 +174,43 @@ Dconv(Fmt *fp)
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%ld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%ld(PC)", a->offset-pc);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", a->sym->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", a->sym->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", a->sym->name, a->offset);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%ld", a->offset);
+		snprint(str, sizeof str, "$%ld", a->offset);
 		break;
 
 	case D_STACK:
-		sprint(str, "TOS+%ld", a->offset);
+		snprint(str, sizeof str, "TOS+%ld", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%.17e", a->dval);
+		snprint(str, sizeof str, "$%.17e", a->dval);
 		goto out;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		goto out;
 	}
-	if(a->displace) {
-		sprint(s, "/%ld", a->displace);
-		strcat(str, s);
-	}
+	if(a->displace)
+		return fmtprint(fp, "%s/%ld", str, a->displace);
 out:
 	return fmtstrcpy(fp, str);
 }
@@ -233,113 +223,113 @@ Rconv(Fmt *fp)
 
 	r = va_arg(fp->args, int);
 	if(r >= D_R0 && r < D_R0+NREG)
-		sprint(str, "R%d", r-D_R0);
+		snprint(str, sizeof str, "R%d", r-D_R0);
 	else
 	if(r >= D_A0 && r < D_A0+NREG)
-		sprint(str, "A%d", r-D_A0);
+		snprint(str, sizeof str, "A%d", r-D_A0);
 	else
 	if(r >= D_F0 && r < D_F0+NREG)
-		sprint(str, "F%d", r-D_F0);
+		snprint(str, sizeof str, "F%d", r-D_F0);
 	else
 	switch(r) {
 
 	default:
-		sprint(str, "gok(%d)", r);
+		snprint(str, sizeof str, "gok(%d)", r);
 		break;
 
 	case D_NONE:
-		sprint(str, "NONE");
+		snprint(str, sizeof str, "NONE");
 		break;
 
 	case D_TOS:
-		sprint(str, "TOS");
+		snprint(str, sizeof str, "TOS");
 		break;
 
 	case D_CCR:
-		sprint(str, "CCR");
+		snprint(str, sizeof str, "CCR");
 		break;
 
 	case D_SR:
-		sprint(str, "SR");
+		snprint(str, sizeof str, "SR");
 		break;
 
 	case D_SFC:
-		sprint(str, "SFC");
+		snprint(str, sizeof str, "SFC");
 		break;
 
 	case D_DFC:
-		sprint(str, "DFC");
+		snprint(str, sizeof str, "DFC");
 		break;
 
 	case D_CACR:
-		sprint(str, "CACR");
+		snprint(str, sizeof str, "CACR");
 		break;
 
 	case D_USP:
-		sprint(str, "USP");
+		snprint(str, sizeof str, "USP");
 		break;
 
 	case D_VBR:
-		sprint(str, "VBR");
+		snprint(str, sizeof str, "VBR");
 		break;
 
 	case D_CAAR:
-		sprint(str, "CAAR");
+		snprint(str, sizeof str, "CAAR");
 		break;
 
 	case D_MSP:
-		sprint(str, "MSP");
+		snprint(str, sizeof str, "MSP");
 		break;
 
 	case D_ISP:
-		sprint(str, "ISP");
+		snprint(str, sizeof str, "ISP");
 		break;
 
 	case D_TREE:
-		sprint(str, "TREE");
+		snprint(str, sizeof str, "TREE");
 		break;
 
 	case D_FPCR:
-		sprint(str, "FPCR");
+		snprint(str, sizeof str, "FPCR");
 		break;
 
 	case D_FPSR:
-		sprint(str, "FPSR");
+		snprint(str, sizeof str, "FPSR");
 		break;
 
 	case D_FPIAR:
-		sprint(str, "FPIAR");
+		snprint(str, sizeof str, "FPIAR");
 		break;
 
 	case D_TC:
-		sprint(str, "TC");
+		snprint(str, sizeof str, "TC");
 		break;
 
 	case D_ITT0:
-		sprint(str, "ITT0");
+		snprint(str, sizeof str, "ITT0");
 		break;
 
 	case D_ITT1:
-		sprint(str, "ITT1");
+		snprint(str, sizeof str, "ITT1");
 		break;
 
 	case D_DTT0:
-		sprint(str, "DTT0");
+		snprint(str, sizeof str, "DTT0");
 		break;
 
 	case D_DTT1:
-		sprint(str, "DTT1");
+		snprint(str, sizeof str, "DTT1");
 		break;
 
 	case D_MMUSR:
-		sprint(str, "MMUSR");
+		snprint(str, sizeof str, "MMUSR");
 		break;
 	case D_URP:
-		sprint(str, "URP");
+		snprint(str, sizeof str, "URP");
 		break;
 
 	case D_SRP:
-		sprint(str, "SRP");
+		snprint(str, sizeof str, "SRP");
 		break;
 	}
 	return fmtstrcpy(fp, str);
diff --git a/sys/src/cmd/2l/list.c b/sys/src/cmd/2l/list.c
index 1ebf488ed..3d24ece20 100644
--- a/sys/src/cmd/2l/list.c
+++ b/sys/src/cmd/2l/list.c
@@ -16,17 +16,15 @@ static	Prog	*bigP;
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], s[20];
+	char str[STRINGSZ];
 	Prog *p;
 
 	p = va_arg(fp->args, Prog*);
 	bigP = p;
-	sprint(str, "(%ld)	%A	%D,%D",
+	snprint(str, sizeof str, "(%ld)	%A	%D,%D",
 		p->line, p->as, &p->from, &p->to);
-	if(p->from.field) {
-		sprint(s, ",%d,%d", p->to.field, p->from.field);
-		strcat(str, s);
-	}
+	if(p->from.field)
+		return fmtprint(fp, "%s,%d,%d", str, p->to.field, p->from.field);
 	bigP = P;
 	return fmtstrcpy(fp, str);
 }
@@ -34,26 +32,20 @@ Pconv(Fmt *fp)
 int
 Aconv(Fmt *fp)
 {
-
 	return fmtstrcpy(fp, anames[va_arg(fp->args, int)]);
 }
 
 int
 Xconv(Fmt *fp)
 {
-	char str[20], s[10];
+	char str[30];
 	int i0, i1;
 
 	str[0] = 0;
 	i0 = va_arg(fp->args, int) & D_MASK;
 	i1 = va_arg(fp->args, int);
-	if(i0 != D_NONE) {
-		sprint(str, "(%R.", i0);
-		sprint(s, "%c*%c)",
-			"WWWWLLLL"[i1],
-			"12481248"[i1]);
-		strcat(str, s);
-	}
+	if(i0 != D_NONE)
+		snprint(str, sizeof str, "(%R.%c*%c)", i0, "WWWWLLLL"[i1], "12481248"[i1]);
 	return fmtstrcpy(fp, str);
 }
 
@@ -73,37 +65,38 @@ Dconv(Fmt *fp)
 		a->displace = 0;
 		switch(i & I_MASK) {
 		default:
-			sprint(str, "???%ld(%D)", d, a);
+			snprint(str, sizeof str, "???%ld(%D)", d, a);
 			break;
 
 		case I_INDEX1:
-			sprint(str, "%D", a);
+			snprint(str, sizeof str, "%D", a);
 			break;
 
 		case I_INDEX2:
 			if(d)
-				sprint(str, "%ld(%D)", d, a);
+				snprint(str, sizeof str, "%ld(%D)", d, a);
 			else
-				sprint(str, "(%D)", a);
+				snprint(str, sizeof str, "(%D)", a);
 			break;
 
 		case I_INDEX3:
 			if(d)
-				sprint(str, "%ld(%D", d, a);
+				snprint(str, sizeof str, "%ld(%D", d, a);
 			else
-				sprint(str, "(%D", a);
+				snprint(str, sizeof str, "(%D", a);
 			break;
 		}
 
 		if(i != D_NONE) {
 			j = a->scale & 7;
-			sprint(strchr(str,0), "(%R.", i);
-			sprint(strchr(str,0), "%c*%c)",
-				"WWWWLLLL"[j],
-				"12481248"[j]);
+			snprint(s, sizeof s, "(%R.%c*%c)", i, "WWWWLLLL"[j], "12481248"[j]);
+			strncat(str, s, sizeof str - 1);
+			str[sizeof str - 1] = 0;
+		}
+		if((i & I_MASK) == I_INDEX3){
+			strncat(str, ")", sizeof str - 1);
+			str[sizeof str - 1] = 0;
 		}
-		if((i & I_MASK) == I_INDEX3)
-			strcat(str, ")");
 		a->displace = d;
 		a->index = i;
 		goto out;
@@ -116,23 +109,23 @@ Dconv(Fmt *fp)
 		a->offset = 0;
 		switch(j) {
 		case I_INDINC:
-			sprint(str, "(%D)+", a);
+			snprint(str, sizeof str, "(%D)+", a);
 			break;
 
 		case I_INDDEC:
-			sprint(str, "-(%D)", a);
+			snprint(str, sizeof str, "-(%D)", a);
 			break;
 
 		case I_INDIR:
 			if(d)
-				sprint(str, "%ld(%D)", d, a);
+				snprint(str, sizeof str, "%ld(%D)", d, a);
 			else
-				sprint(str, "(%D)", a);
+				snprint(str, sizeof str, "(%D)", a);
 			break;
 
 		case I_ADDR:
 			a->offset = d;
-			sprint(str, "$%D", a);
+			snprint(str, sizeof str, "$%D", a);
 			break;
 		}
 		a->type = i;
@@ -142,7 +135,7 @@ Dconv(Fmt *fp)
 	switch(i) {
 
 	default:
-		sprint(str, "%R", i);
+		snprint(str, sizeof str, "%R", i);
 		break;
 
 	case D_NONE:
@@ -152,58 +145,56 @@ Dconv(Fmt *fp)
 	case D_BRANCH:
 		if(bigP != P && bigP->pcond != P)
 			if(a->sym != S)
-				sprint(str, "%lux+%s", bigP->pcond->pc,
+				snprint(str, sizeof str, "%lux+%s", bigP->pcond->pc,
 					a->sym->name);
 			else
-				sprint(str, "%lux", bigP->pcond->pc);
+				snprint(str, sizeof str, "%lux", bigP->pcond->pc);
 		else
-			sprint(str, "%ld(PC)", a->offset);
+			snprint(str, sizeof str, "%ld(PC)", a->offset);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<%d>+%ld(SB)", a->sym->name,
+		snprint(str, sizeof str, "%s<%d>+%ld(SB)", a->sym->name,
 			a->sym->version, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s+%ld(SP)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SP)", a->sym->name, a->offset);
 		break;
 
 	case D_PARAM:
 		if(a->sym)
-			sprint(str, "%s+%ld(FP)", a->sym->name, a->offset);
+			snprint(str, sizeof str, "%s+%ld(FP)", a->sym->name, a->offset);
 		else
-			sprint(str, "%ld(FP)", a->offset);
+			snprint(str, sizeof str, "%ld(FP)", a->offset);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%ld", a->offset);
+		snprint(str, sizeof str, "$%ld", a->offset);
 		break;
 
 	case D_STACK:
-		sprint(str, "TOS+%ld", a->offset);
+		snprint(str, sizeof str, "TOS+%ld", a->offset);
 		break;
 
 	case D_QUICK:
-		sprint(str, "$Q%ld", a->offset);
+		snprint(str, sizeof str, "$Q%ld", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$(%.8lux,%.8lux)", a->ieee.h, a->ieee.l);
+		snprint(str, sizeof str, "$(%.8lux,%.8lux)", a->ieee.h, a->ieee.l);
 		goto out;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->scon);
+		snprint(str, sizeof str, "$\"%S\"", a->scon);
 		goto out;
 	}
-	if(a->displace) {
-		sprint(s, "/%ld", a->displace);
-		strcat(str, s);
-	}
+	if(a->displace)
+		return fmtprint(fp, "%s/%ld", str, a->displace);
 out:
 	return fmtstrcpy(fp, str);
 }
@@ -216,113 +207,113 @@ Rconv(Fmt *fp)
 
 	r = va_arg(fp->args, int);
 	if(r >= D_R0 && r < D_R0+NREG)
-		sprint(str, "R%d", r-D_R0);
+		snprint(str, sizeof str, "R%d", r-D_R0);
 	else
 	if(r >= D_A0 && r < D_A0+NREG)
-		sprint(str, "A%d", r-D_A0);
+		snprint(str, sizeof str, "A%d", r-D_A0);
 	else
 	if(r >= D_F0 && r < D_F0+NREG)
-		sprint(str, "F%d", r-D_F0);
+		snprint(str, sizeof str, "F%d", r-D_F0);
 	else
 	switch(r) {
 
 	default:
-		sprint(str, "gok(%d)", r);
+		snprint(str, sizeof str, "gok(%d)", r);
 		break;
 
 	case D_NONE:
-		sprint(str, "NONE");
+		snprint(str, sizeof str, "NONE");
 		break;
 
 	case D_TOS:
-		sprint(str, "TOS");
+		snprint(str, sizeof str, "TOS");
 		break;
 
 	case D_CCR:
-		sprint(str, "CCR");
+		snprint(str, sizeof str, "CCR");
 		break;
 
 	case D_SR:
-		sprint(str, "SR");
+		snprint(str, sizeof str, "SR");
 		break;
 
 	case D_SFC:
-		sprint(str, "SFC");
+		snprint(str, sizeof str, "SFC");
 		break;
 
 	case D_DFC:
-		sprint(str, "DFC");
+		snprint(str, sizeof str, "DFC");
 		break;
 
 	case D_CACR:
-		sprint(str, "CACR");
+		snprint(str, sizeof str, "CACR");
 		break;
 
 	case D_USP:
-		sprint(str, "USP");
+		snprint(str, sizeof str, "USP");
 		break;
 
 	case D_VBR:
-		sprint(str, "VBR");
+		snprint(str, sizeof str, "VBR");
 		break;
 
 	case D_CAAR:
-		sprint(str, "CAAR");
+		snprint(str, sizeof str, "CAAR");
 		break;
 
 	case D_MSP:
-		sprint(str, "MSP");
+		snprint(str, sizeof str, "MSP");
 		break;
 
 	case D_ISP:
-		sprint(str, "ISP");
+		snprint(str, sizeof str, "ISP");
 		break;
 
 	case D_FPCR:
-		sprint(str, "FPCR");
+		snprint(str, sizeof str, "FPCR");
 		break;
 
 	case D_FPSR:
-		sprint(str, "FPSR");
+		snprint(str, sizeof str, "FPSR");
 		break;
 
 	case D_FPIAR:
-		sprint(str, "FPIAR");
+		snprint(str, sizeof str, "FPIAR");
 		break;
 
 	case D_TREE:
-		sprint(str, "TREE");
+		snprint(str, sizeof str, "TREE");
 		break;
 
 	case D_TC:
-		sprint(str, "TC");
+		snprint(str, sizeof str, "TC");
 		break;
 
 	case D_ITT0:
-		sprint(str, "ITT0");
+		snprint(str, sizeof str, "ITT0");
 		break;
 
 	case D_ITT1:
-		sprint(str, "ITT1");
+		snprint(str, sizeof str, "ITT1");
 		break;
 
 	case D_DTT0:
-		sprint(str, "DTT0");
+		snprint(str, sizeof str, "DTT0");
 		break;
 
 	case D_DTT1:
-		sprint(str, "DTT1");
+		snprint(str, sizeof str, "DTT1");
 		break;
 
 	case D_MMUSR:
-		sprint(str, "MMUSR");
+		snprint(str, sizeof str, "MMUSR");
 		break;
 	case D_URP:
-		sprint(str, "URP");
+		snprint(str, sizeof str, "URP");
 		break;
 
 	case D_SRP:
-		sprint(str, "SRP");
+		snprint(str, sizeof str, "SRP");
 		break;
 	}
 	return fmtstrcpy(fp, str);
diff --git a/sys/src/cmd/2l/obj.c b/sys/src/cmd/2l/obj.c
index cd67ce9e8..70f8f1502 100644
--- a/sys/src/cmd/2l/obj.c
+++ b/sys/src/cmd/2l/obj.c
@@ -308,11 +308,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -370,7 +368,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -539,17 +537,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
diff --git a/sys/src/cmd/5c/list.c b/sys/src/cmd/5c/list.c
index d50f07db6..9aa4d312a 100644
--- a/sys/src/cmd/5c/list.c
+++ b/sys/src/cmd/5c/list.c
@@ -21,20 +21,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%ld", var[i].offset);
+			snprint(ss, sizeof ss, "$%ld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -68,26 +66,26 @@ Pconv(Fmt *fp)
 		strcat(sc, ".U");
 	if(a == AMOVM) {
 		if(p->from.type == D_CONST)
-			sprint(str, "	%A%s	%R,%D", a, sc, &p->from, &p->to);
+			snprint(str, sizeof str, "	%A%s	%R,%D", a, sc, &p->from, &p->to);
 		else
 		if(p->to.type == D_CONST)
-			sprint(str, "	%A%s	%D,%R", a, sc, &p->from, &p->to);
+			snprint(str, sizeof str, "	%A%s	%D,%R", a, sc, &p->from, &p->to);
 		else
-			sprint(str, "	%A%s	%D,%D", a, sc, &p->from, &p->to);
+			snprint(str, sizeof str, "	%A%s	%D,%D", a, sc, &p->from, &p->to);
 	} else
 	if(a == ADATA)
-		sprint(str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->as == ATEXT)
-		sprint(str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->reg == NREG)
-		sprint(str, "	%A%s	%D,%D", a, sc, &p->from, &p->to);
+		snprint(str, sizeof str, "	%A%s	%D,%D", a, sc, &p->from, &p->to);
 	else
 	if(p->from.type != D_FREG)
-		sprint(str, "	%A%s	%D,R%d,%D", a, sc, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A%s	%D,R%d,%D", a, sc, &p->from, p->reg, &p->to);
 	else
-		sprint(str, "	%A%s	%D,F%d,%D", a, sc, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A%s	%D,F%d,%D", a, sc, &p->from, p->reg, &p->to);
 	return fmtstrcpy(fp, str);
 }
 
@@ -116,68 +114,68 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_SHIFT:
 		v = a->offset;
 		op = "<<>>->@>" + (((v>>5) & 3) << 1);
 		if(v & (1<<4))
-			sprint(str, "R%d%c%cR%d", v&15, op[0], op[1], (v>>8)&15);
+			snprint(str, sizeof str, "R%d%c%cR%d", v&15, op[0], op[1], (v>>8)&15);
 		else
-			sprint(str, "R%d%c%c%d", v&15, op[0], op[1], (v>>7)&31);
+			snprint(str, sizeof str, "R%d%c%c%d", v&15, op[0], op[1], (v>>7)&31);
 		if(a->reg != NREG)
-			sprint(str+strlen(str), "(R%d)", a->reg);
+			snprint(str+strlen(str), sizeof(str)-strlen(str), "(R%d)", a->reg);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_PSR:
-		sprint(str, "PSR");
+		snprint(str, sizeof str, "PSR");
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(PSR)(REG)", a);
+			snprint(str, sizeof str, "%N(PSR)(REG)", a);
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%ld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%ld(PC)", a->offset-pc);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%.17e", a->dval);
+		snprint(str, sizeof str, "$%.17e", a->dval);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -191,7 +189,7 @@ Rconv(Fmt *fp)
 	int i, v;
 
 	a = va_arg(fp->args, Adr*);
-	sprint(str, "GOK-reglist");
+	snprint(str, sizeof str, "GOK-reglist");
 	switch(a->type) {
 	case D_CONST:
 		if(a->reg != NREG)
@@ -199,17 +197,17 @@ Rconv(Fmt *fp)
 		if(a->sym != S)
 			break;
 		v = a->offset;
-		strcpy(str, "");
+		memset(str, 0, sizeof str);
 		for(i=0; i<NREG; i++) {
 			if(v & (1<<i)) {
 				if(str[0] == 0)
-					strcat(str, "[R");
+					strncat(str, "[R", sizeof str - 1);
 				else
-					strcat(str, ",R");
-				sprint(strchr(str, 0), "%d", i);
+					strncat(str, ",R", sizeof str - 1);
+				snprint(str+strlen(str), sizeof(str)-strlen(str), "%d", i);
 			}
 		}
-		strcat(str, "]");
+		strncat(str, "]", sizeof str - 1);
 	}
 	return fmtstrcpy(fp, str);
 }
@@ -271,32 +269,32 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_NONE:
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/5l/list.c b/sys/src/cmd/5l/list.c
index 1a3a4527c..2422bcc0f 100644
--- a/sys/src/cmd/5l/list.c
+++ b/sys/src/cmd/5l/list.c
@@ -21,7 +21,7 @@ prasm(Prog *p)
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], *s;
+	char str[STRINGSZ];
 	Prog *p;
 	int a;
 
@@ -30,30 +30,28 @@ Pconv(Fmt *fp)
 	a = p->as;
 	switch(a) {
 	default:
-		s = str;
-		s += sprint(s, "(%ld)", p->line);
 		if(p->reg == NREG)
-			sprint(s, "	%A%C	%D,%D",
-				a, p->scond, &p->from, &p->to);
+			snprint(str, sizeof str, "(%ld)	%A%C	%D,%D",
+				p->line, a, p->scond, &p->from, &p->to);
 		else
 		if(p->from.type != D_FREG)
-			sprint(s, "	%A%C	%D,R%d,%D",
-				a, p->scond, &p->from, p->reg, &p->to);
+			snprint(str, sizeof str, "(%ld)	%A%C	%D,R%d,%D",
+				p->line, a, p->scond, &p->from, p->reg, &p->to);
 		else
-			sprint(s, "	%A%C	%D,F%d,%D",
-				a, p->scond, &p->from, p->reg, &p->to);
+			snprint(str, sizeof str, "(%ld)	%A%C	%D,F%d,%D",
+				p->line, a, p->scond, &p->from, p->reg, &p->to);
 		break;
 
 	case ASWPW:
 	case ASWPBU:
-		sprint(str, "(%ld)	%A%C	R%d,%D,%D",
+		snprint(str, sizeof str, "(%ld)	%A%C	R%d,%D,%D",
 			p->line, a, p->scond, p->reg, &p->from, &p->to);
 		break;
 
 	case ADATA:
 	case AINIT:
 	case ADYNT:
-		sprint(str, "(%ld)	%A%C	%D/%d,%D",
+		snprint(str, sizeof str, "(%ld)	%A%C	%D/%d,%D",
 			p->line, a, p->scond, &p->from, p->reg, &p->to);
 		break;
 	}
@@ -124,94 +122,94 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg == NREG)
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		else
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		break;
 
 	case D_SHIFT:
 		v = a->offset;
 		op = "<<>>->@>" + (((v>>5) & 3) << 1);
 		if(v & (1<<4))
-			sprint(str, "R%ld%c%cR%ld", v&15, op[0], op[1], (v>>8)&15);
+			snprint(str, sizeof str, "R%ld%c%cR%ld", v&15, op[0], op[1], (v>>8)&15);
 		else
-			sprint(str, "R%ld%c%c%ld", v&15, op[0], op[1], (v>>7)&31);
+			snprint(str, sizeof str, "R%ld%c%c%ld", v&15, op[0], op[1], (v>>7)&31);
 		if(a->reg != NREG)
-			sprint(str+strlen(str), "(R%d)", a->reg);
+			snprint(str+strlen(str), sizeof(str)-strlen(str), "(R%d)", a->reg);
 		break;
 
 	case D_OCONST:
-		sprint(str, "$*$%N", a);
+		snprint(str, sizeof str, "$*$%N", a);
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)(CONST)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(CONST)", a, a->reg);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_REGREG:
-		sprint(str, "(R%d,R%d)", a->reg, (int)a->offset);
+		snprint(str, sizeof str, "(R%d,R%d)", a->reg, (int)a->offset);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_PSR:
 		switch(a->reg) {
 		case 0:
-			sprint(str, "CPSR");
+			snprint(str, sizeof str, "CPSR");
 			break;
 		case 1:
-			sprint(str, "SPSR");
+			snprint(str, sizeof str, "SPSR");
 			break;
 		default:
-			sprint(str, "PSR%d", a->reg);
+			snprint(str, sizeof str, "PSR%d", a->reg);
 			break;
 		}
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(PSR%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(PSR%d)(REG)", a, a->reg);
 		break;
 
 	case D_FPCR:
 		switch(a->reg){
 		case 0:
-			sprint(str, "FPSR");
+			snprint(str, sizeof str, "FPSR");
 			break;
 		case 1:
-			sprint(str, "FPCR");
+			snprint(str, sizeof str, "FPCR");
 			break;
 		default:
-			sprint(str, "FCR%d", a->reg);
+			snprint(str, sizeof str, "FCR%d", a->reg);
 			break;
 		}
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(FCR%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(FCR%d)(REG)", a, a->reg);
 
 		break;
 
@@ -219,22 +217,22 @@ Dconv(Fmt *fp)
 		if(curp->cond != P) {
 			v = curp->cond->pc;
 			if(a->sym != S)
-				sprint(str, "%s+%.5lux(BRANCH)", a->sym->name, v);
+				snprint(str, sizeof str, "%s+%.5lux(BRANCH)", a->sym->name, v);
 			else
-				sprint(str, "%.5lux(BRANCH)", v);
+				snprint(str, sizeof str, "%.5lux(BRANCH)", v);
 		} else
 			if(a->sym != S)
-				sprint(str, "%s+%ld(APC)", a->sym->name, a->offset);
+				snprint(str, sizeof str, "%s+%ld(APC)", a->sym->name, a->offset);
 			else
-				sprint(str, "%ld(APC)", a->offset);
+				snprint(str, sizeof str, "%ld(APC)", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%e", ieeedtod(a->ieee));
+		snprint(str, sizeof str, "$%e", ieeedtod(a->ieee));
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -251,39 +249,39 @@ Nconv(Fmt *fp)
 	s = a->sym;
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_NONE:
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		break;
 
 	case D_EXTERN:
 		if(s == S)
-			sprint(str, "%ld(SB)", a->offset);
+			snprint(str, sizeof str, "%ld(SB)", a->offset);
 		else
-			sprint(str, "%s+%ld(SB)", s->name, a->offset);
+			snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
 		if(s == S)
-			sprint(str, "<>+%ld(SB)", a->offset);
+			snprint(str, sizeof str, "<>+%ld(SB)", a->offset);
 		else
-			sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+			snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
 		if(s == S)
-			sprint(str, "%ld(SP)", a->offset);
+			snprint(str, sizeof str, "%ld(SP)", a->offset);
 		else
-			sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+			snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
 		if(s == S)
-			sprint(str, "%ld(FP)", a->offset);
+			snprint(str, sizeof str, "%ld(FP)", a->offset);
 		else
-			sprint(str, "%s+%ld(FP)", s->name, a->offset);
+			snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 	return fmtstrcpy(fp, str);
diff --git a/sys/src/cmd/5l/obj.c b/sys/src/cmd/5l/obj.c
index f7096a1d7..218579230 100644
--- a/sys/src/cmd/5l/obj.c
+++ b/sys/src/cmd/5l/obj.c
@@ -335,11 +335,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -399,7 +397,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -550,17 +548,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
@@ -1009,7 +1007,7 @@ loop:
 
 		if(p->from.type == D_FCONST && chipfloat(p->from.ieee) < 0) {
 			/* size sb 9 max */
-			sprint(literal, "$%lux", ieeedtof(p->from.ieee));
+			snprint(literal, sizeof literal, "$%lux", ieeedtof(p->from.ieee));
 			s = lookup(literal, 0);
 			if(s->type == 0) {
 				s->type = SBSS;
@@ -1038,7 +1036,7 @@ loop:
 
 		if(p->from.type == D_FCONST && chipfloat(p->from.ieee) < 0) {
 			/* size sb 18 max */
-			sprint(literal, "$%lux.%lux",
+			snprint(literal, sizeof literal, "$%lux.%lux",
 				p->from.ieee->l, p->from.ieee->h);
 			s = lookup(literal, 0);
 			if(s->type == 0) {
diff --git a/sys/src/cmd/6c/list.c b/sys/src/cmd/6c/list.c
index 73efdf139..08b926754 100644
--- a/sys/src/cmd/6c/list.c
+++ b/sys/src/cmd/6c/list.c
@@ -20,20 +20,17 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%lld", var[i].offset);
+			snprint(ss, sizeof ss, "$%lld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -47,13 +44,13 @@ Pconv(Fmt *fp)
 
 	p = va_arg(fp->args, Prog*);
 	if(p->as == ADATA)
-		sprint(str, "	%A	%D/%d,%D",
+		snprint(str, sizeof str, "	%A	%D/%d,%D",
 			p->as, &p->from, p->from.scale, &p->to);
 	else if(p->as == ATEXT)
-		sprint(str, "	%A	%D,%d,%D",
+		snprint(str, sizeof str, "	%A	%D,%d,%D",
 			p->as, &p->from, p->from.scale, &p->to);
 	else
-		sprint(str, "	%A	%D,%D",
+		snprint(str, sizeof str, "	%A	%D,%D",
 			p->as, &p->from, &p->to);
 	return fmtstrcpy(fp, str);
 }
@@ -70,7 +67,7 @@ Aconv(Fmt *fp)
 int
 Dconv(Fmt *fp)
 {
-	char str[40], s[20];
+	char str[40];
 	Adr *a;
 	int i;
 
@@ -78,18 +75,18 @@ Dconv(Fmt *fp)
 	i = a->type;
 	if(i >= D_INDIR) {
 		if(a->offset)
-			sprint(str, "%lld(%R)", a->offset, i-D_INDIR);
+			snprint(str, sizeof str, "%lld(%R)", a->offset, i-D_INDIR);
 		else
-			sprint(str, "(%R)", i-D_INDIR);
+			snprint(str, sizeof str, "(%R)", i-D_INDIR);
 		goto brk;
 	}
 	switch(i) {
 
 	default:
 		if(a->offset)
-			sprint(str, "$%lld,%R", a->offset, i);
+			snprint(str, sizeof str, "$%lld,%R", a->offset, i);
 		else
-			sprint(str, "%R", i);
+			snprint(str, sizeof str, "%R", i);
 		break;
 
 	case D_NONE:
@@ -97,54 +94,51 @@ Dconv(Fmt *fp)
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%lld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%lld(PC)", a->offset-pc);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%lld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%lld(SB)", a->sym->name,
-			a->offset);
+		snprint(str, sizeof str, "%s<>+%lld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s+%lld(SP)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(SP)", a->sym->name, a->offset);
 		break;
 
 	case D_PARAM:
 		if(a->sym)
-			sprint(str, "%s+%lld(FP)", a->sym->name, a->offset);
+			snprint(str, sizeof str, "%s+%lld(FP)", a->sym->name, a->offset);
 		else
-			sprint(str, "%lld(FP)", a->offset);
+			snprint(str, sizeof str, "%lld(FP)", a->offset);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%lld", a->offset);
+		snprint(str, sizeof str, "$%lld", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$(%.17e)", a->dval);
+		snprint(str, sizeof str, "$(%.17e)", a->dval);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 
 	case D_ADDR:
 		a->type = a->index;
 		a->index = D_NONE;
-		sprint(str, "$%D", a);
+		snprint(str, sizeof str, "$%D", a);
 		a->index = a->type;
 		a->type = D_ADDR;
 		goto conv;
 	}
 brk:
-	if(a->index != D_NONE) {
-		sprint(s, "(%R*%d)", (int)a->index, (int)a->scale);
-		strcat(str, s);
-	}
+	if(a->index != D_NONE) 
+		return fmtprint(fp, "%s(%R*%d)", str, (int)a->index, (int)a->scale);
 conv:
 	return fmtstrcpy(fp, str);
 }
@@ -284,9 +278,9 @@ Rconv(Fmt *fp)
 
 	r = va_arg(fp->args, int);
 	if(r >= D_AL && r <= D_NONE)
-		sprint(str, "%s", regstr[r-D_AL]);
+		snprint(str, sizeof str, "%s", regstr[r-D_AL]);
 	else
-		sprint(str, "gok(%d)", r);
+		snprint(str, sizeof str, "gok(%d)", r);
 
 	return fmtstrcpy(fp, str);
 }
diff --git a/sys/src/cmd/6l/list.c b/sys/src/cmd/6l/list.c
index 1109b02f6..6aefc0e15 100644
--- a/sys/src/cmd/6l/list.c
+++ b/sys/src/cmd/6l/list.c
@@ -24,18 +24,18 @@ Pconv(Fmt *fp)
 	switch(p->as) {
 	case ATEXT:
 		if(p->from.scale) {
-			sprint(str, "(%ld)	%A	%D,%d,%D",
+			snprint(str, sizeof str, "(%ld)	%A	%D,%d,%D",
 				p->line, p->as, &p->from, p->from.scale, &p->to);
 			break;
 		}
 	default:
-		sprint(str, "(%ld)	%A	%D,%D",
+		snprint(str, sizeof str, "(%ld)	%A	%D,%D",
 			p->line, p->as, &p->from, &p->to);
 		break;
 	case ADATA:
 	case AINIT:
 	case ADYNT:
-		sprint(str, "(%ld)	%A	%D/%d,%D",
+		snprint(str, sizeof str, "(%ld)	%A	%D/%d,%D",
 			p->line, p->as, &p->from, p->from.scale, &p->to);
 		break;
 	}
@@ -55,7 +55,7 @@ Aconv(Fmt *fp)
 int
 Dconv(Fmt *fp)
 {
-	char str[40], s[20];
+	char str[40];
 	Adr *a;
 	int i;
 
@@ -63,18 +63,18 @@ Dconv(Fmt *fp)
 	i = a->type;
 	if(i >= D_INDIR) {
 		if(a->offset)
-			sprint(str, "%lld(%R)", a->offset, i-D_INDIR);
+			snprint(str, sizeof str, "%lld(%R)", a->offset, i-D_INDIR);
 		else
-			sprint(str, "(%R)", i-D_INDIR);
+			snprint(str, sizeof str, "(%R)", i-D_INDIR);
 		goto brk;
 	}
 	switch(i) {
 
 	default:
 		if(a->offset)
-			sprint(str, "$%lld,%R", a->offset, i);
+			snprint(str, sizeof str, "$%lld,%R", a->offset, i);
 		else
-			sprint(str, "%R", i);
+			snprint(str, sizeof str, "%R", i);
 		break;
 
 	case D_NONE:
@@ -84,59 +84,57 @@ Dconv(Fmt *fp)
 	case D_BRANCH:
 		if(bigP != P && bigP->pcond != P)
 			if(a->sym != S)
-				sprint(str, "%llux+%s", bigP->pcond->pc,
+				snprint(str, sizeof str, "%llux+%s", bigP->pcond->pc,
 					a->sym->name);
 			else
-				sprint(str, "%llux", bigP->pcond->pc);
+				snprint(str, sizeof str, "%llux", bigP->pcond->pc);
 		else
-			sprint(str, "%lld(PC)", a->offset);
+			snprint(str, sizeof str, "%lld(PC)", a->offset);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%lld(SB)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<%d>+%lld(SB)", a->sym->name,
+		snprint(str, sizeof str, "%s<%d>+%lld(SB)", a->sym->name,
 			a->sym->version, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s+%lld(SP)", a->sym->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(SP)", a->sym->name, a->offset);
 		break;
 
 	case D_PARAM:
 		if(a->sym)
-			sprint(str, "%s+%lld(%s)", a->sym->name, a->offset, paramspace);
+			snprint(str, sizeof str, "%s+%lld(%s)", a->sym->name, a->offset, paramspace);
 		else
-			sprint(str, "%lld(%s)", a->offset, paramspace);
+			snprint(str, sizeof str, "%lld(%s)", a->offset, paramspace);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%lld", a->offset);
+		snprint(str, sizeof str, "$%lld", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$(%.8lux,%.8lux)", a->ieee.h, a->ieee.l);
+		snprint(str, sizeof str, "$(%.8lux,%.8lux)", a->ieee.h, a->ieee.l);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->scon);
+		snprint(str, sizeof str, "$\"%S\"", a->scon);
 		break;
 
 	case D_ADDR:
 		a->type = a->index;
 		a->index = D_NONE;
-		sprint(str, "$%D", a);
+		snprint(str, sizeof str, "$%D", a);
 		a->index = a->type;
 		a->type = D_ADDR;
 		goto conv;
 	}
 brk:
-	if(a->index != D_NONE) {
-		sprint(s, "(%R*%d)", a->index, a->scale);
-		strcat(str, s);
-	}
+	if(a->index != D_NONE)
+		return fmtprint(fp, "%s(%R*%d)", str, a->index, a->scale);
 conv:
 	return fmtstrcpy(fp, str);
 }
@@ -276,9 +274,9 @@ Rconv(Fmt *fp)
 
 	r = va_arg(fp->args, int);
 	if(r >= D_AL && r <= D_NONE)
-		sprint(str, "%s", regstr[r-D_AL]);
+		snprint(str, sizeof str, "%s", regstr[r-D_AL]);
 	else
-		sprint(str, "gok(%d)", r);
+		snprint(str, sizeof str, "gok(%d)", r);
 
 	return fmtstrcpy(fp, str);
 }
diff --git a/sys/src/cmd/6l/obj.c b/sys/src/cmd/6l/obj.c
index 210e4ab2a..8035ae1e9 100644
--- a/sys/src/cmd/6l/obj.c
+++ b/sys/src/cmd/6l/obj.c
@@ -396,11 +396,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -458,7 +456,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -586,17 +584,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
@@ -1036,7 +1034,7 @@ loop:
 			goto casdef;
 		if(p->from.type == D_FCONST) {
 			/* size sb 9 max */
-			sprint(literal, "$%lux", ieeedtof(&p->from.ieee));
+			snprint(literal, sizeof literal, "$%lux", ieeedtof(&p->from.ieee));
 			s = lookup(literal, 0);
 			if(s->type == 0) {
 				s->type = SBSS;
@@ -1081,7 +1079,7 @@ loop:
 			goto casdef;
 		if(p->from.type == D_FCONST) {
 			/* size sb 18 max */
-			sprint(literal, "$%lux.%lux",
+			snprint(literal, sizeof literal, "$%lux.%lux",
 				p->from.ieee.l, p->from.ieee.h);
 			s = lookup(literal, 0);
 			if(s->type == 0) {
diff --git a/sys/src/cmd/7c/list.c b/sys/src/cmd/7c/list.c
index 465f5d0ca..c2ebdbf1f 100644
--- a/sys/src/cmd/7c/list.c
+++ b/sys/src/cmd/7c/list.c
@@ -20,20 +20,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%lld", var[i].offset);
+			snprint(ss, sizeof ss, "$%lld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -49,18 +47,18 @@ Pconv(Fmt *fp)
 	p = va_arg(fp->args, Prog*);
 	a = p->as;
 	if(a == ADATA)
-		sprint(str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->as == ATEXT)
-		sprint(str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->reg == NREG)
-		sprint(str, "	%A	%D,%D", a, &p->from, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%D", a, &p->from, &p->to);
 	else
 	if(p->from.type != D_FREG)
-		sprint(str, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
 	else
-		sprint(str, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
 	return fmtstrcpy(fp, str);
 }
 
@@ -87,57 +85,57 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FCREG:
-		sprint(str, "FPCR");
+		snprint(str, sizeof str, "FPCR");
 		if(a->reg != 0 || a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(FPCR%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(FPCR%d)(REG)", a, a->reg);
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%lld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%lld(PC)", a->offset-pc);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%.17e", a->dval);
+		snprint(str, sizeof str, "$%.17e", a->dval);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -200,32 +198,32 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%lld", a->offset);
+		snprint(str, sizeof str, "%lld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_NONE:
-		sprint(str, "%lld", a->offset);
+		snprint(str, sizeof str, "%lld", a->offset);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%lld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%lld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%lld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%lld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%lld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%lld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/7l/list.c b/sys/src/cmd/7l/list.c
index c1e5b7d9e..c2dc9da3f 100644
--- a/sys/src/cmd/7l/list.c
+++ b/sys/src/cmd/7l/list.c
@@ -28,18 +28,18 @@ Pconv(Fmt *fp)
 	curp = p;
 	a = p->as;
 	if(a == ADATA)
-		sprint(str, "(%ld)	%A	%D/%d,%D",
+		snprint(str, sizeof str, "(%ld)	%A	%D/%d,%D",
 			p->line, a, &p->from, p->reg, &p->to);
 	else
 	if(p->reg == NREG)
-		sprint(str, "(%ld)	%A	%D,%D",
+		snprint(str, sizeof str, "(%ld)	%A	%D,%D",
 			p->line, a, &p->from, &p->to);
 	else
 	if(p->from.type != D_FREG)
-		sprint(str, "(%ld)	%A	%D,R%d,%D",
+		snprint(str, sizeof str, "(%ld)	%A	%D,R%d,%D",
 			p->line, a, &p->from, p->reg, &p->to);
 	else
-		sprint(str, "(%ld)	%A	%D,F%d,%D",
+		snprint(str, sizeof str, "(%ld)	%A	%D,F%d,%D",
 			p->line, a, &p->from, p->reg, &p->to);
 	return fmtstrcpy(fp, str);
 }
@@ -68,50 +68,50 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%N", a);
+		snprint(str, sizeof str, "$%N", a);
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)(CONST)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(CONST)", a, a->reg);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_PREG:
-		sprint(str, "P%d", a->reg & 255);
+		snprint(str, sizeof str, "P%d", a->reg & 255);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(PREG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(PREG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(FREG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(FREG)", a, a->reg);
 		break;
 
 	case D_FCREG:
-		sprint(str, "FPCR");
+		snprint(str, sizeof str, "FPCR");
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(FCREG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(FCREG)", a, a->reg);
 		break;
 
 	case D_BRANCH:	/* botch */
@@ -120,22 +120,22 @@ Dconv(Fmt *fp)
 			if(v >= INITTEXT)
 				v -= INITTEXT-HEADR;
 			if(a->sym != S)
-				sprint(str, "%s+%.5lux(BRANCH)", a->sym->name, v);
+				snprint(str, sizeof str, "%s+%.5lux(BRANCH)", a->sym->name, v);
 			else
-				sprint(str, "%.5lux(BRANCH)", v);
+				snprint(str, sizeof str, "%.5lux(BRANCH)", v);
 		} else
 			if(a->sym != S)
-				sprint(str, "%s+%lld(APC)", a->sym->name, a->offset);
+				snprint(str, sizeof str, "%s+%lld(APC)", a->sym->name, a->offset);
 			else
-				sprint(str, "%lld(APC)", a->offset);
+				snprint(str, sizeof str, "%lld(APC)", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%e", ieeedtod(a->ieee));
+		snprint(str, sizeof str, "$%e", ieeedtod(a->ieee));
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -151,32 +151,32 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%lld", a->offset);
+		snprint(str, sizeof str, "%lld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_NONE:
-		sprint(str, "%lld", a->offset);
+		snprint(str, sizeof str, "%lld", a->offset);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%lld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%lld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%lld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%lld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%lld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%lld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%lld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/7l/obj.c b/sys/src/cmd/7l/obj.c
index deda6a509..793e5825e 100644
--- a/sys/src/cmd/7l/obj.c
+++ b/sys/src/cmd/7l/obj.c
@@ -253,11 +253,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -317,7 +315,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -464,17 +462,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
@@ -878,7 +876,7 @@ loop:
 
 		if(p->from.type == D_FCONST) {
 			/* size sb 9 max */
-			sprint(literal, "$%lux", ieeedtof(p->from.ieee));
+			snprint(literal, sizeof literal, "$%lux", ieeedtof(p->from.ieee));
 			s = lookup(literal, 0);
 			if(s->type == 0) {
 				s->type = SBSS;
@@ -907,7 +905,7 @@ loop:
 
 		if(p->from.type == D_FCONST) {
 			/* size sb 18 max */
-			sprint(literal, "$%lux.%lux",
+			snprint(literal, sizeof literal, "$%lux.%lux",
 				p->from.ieee->l, p->from.ieee->h);
 			s = lookup(literal, 0);
 			if(s->type == 0) {
diff --git a/sys/src/cmd/7l/pass.c b/sys/src/cmd/7l/pass.c
index acf4080e3..e0451b532 100644
--- a/sys/src/cmd/7l/pass.c
+++ b/sys/src/cmd/7l/pass.c
@@ -130,9 +130,9 @@ dodata(void)
 				continue;
 			/* size should be 19 max */
 			if(strlen(s->name) >= 10)	/* has loader address */ 
-				sprint(literal, "$%p.%llux", s, p->from.offset);
+				snprint(literal, sizeof literal, "$%p.%llux", s, p->from.offset);
 			else
-				sprint(literal, "$%s.%d.%llux", s->name, s->version, p->from.offset);
+				snprint(literal, sizeof literal, "$%s.%d.%llux", s->name, s->version, p->from.offset);
 		} else {
 			if(p->from.name != D_NONE)
 				continue;
@@ -147,7 +147,7 @@ dodata(void)
 			if (vv <= 0x7FFFFFFFLL && vv >= -0x80000000LL)
 				size = 4;
 			/* size should be 17 max */
-			sprint(literal, "$%llux", vv);
+			snprint(literal, sizeof literal, "$%llux", vv);
 		}
 		s = lookup(literal, 0);
 		if(s->type == 0) {
diff --git a/sys/src/cmd/8c/list.c b/sys/src/cmd/8c/list.c
index 4251a3874..c321d54a3 100644
--- a/sys/src/cmd/8c/list.c
+++ b/sys/src/cmd/8c/list.c
@@ -20,20 +20,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
 			snprint(ss, sizeof(ss), "$%ld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -70,7 +68,7 @@ Aconv(Fmt *fp)
 int
 Dconv(Fmt *fp)
 {
-	char str[40], s[20];
+	char str[40];
 	Adr *a;
 	int i;
 
@@ -105,8 +103,7 @@ Dconv(Fmt *fp)
 		break;
 
 	case D_STATIC:
-		snprint(str, sizeof(str), "%s<>+%ld(SB)", a->sym->name,
-			a->offset);
+		snprint(str, sizeof(str), "%s<>+%ld(SB)", a->sym->name, a->offset);
 		break;
 
 	case D_AUTO:
@@ -141,11 +138,8 @@ Dconv(Fmt *fp)
 		goto conv;
 	}
 brk:
-	if(a->index != D_NONE) {
-		fmtstrcpy(fp, str);
-		snprint(s, sizeof(s), "(%R*%d)", (int)a->index, (int)a->scale);
-		return fmtstrcpy(fp, s);
-	}
+	if(a->index != D_NONE)
+		return fmtprint(fp, "%s(%R*%d)", str, (int)a->index, (int)a->scale);
 conv:
 	return fmtstrcpy(fp, str);
 }
diff --git a/sys/src/cmd/8l/list.c b/sys/src/cmd/8l/list.c
index f726a4e8c..212b8ad3c 100644
--- a/sys/src/cmd/8l/list.c
+++ b/sys/src/cmd/8l/list.c
@@ -55,7 +55,7 @@ Aconv(Fmt *fp)
 int
 Dconv(Fmt *fp)
 {
-	char str[STRINGSZ+40], s[20];
+	char str[STRINGSZ+40];
 	Adr *a;
 	int i;
 
@@ -130,10 +130,8 @@ Dconv(Fmt *fp)
 		goto conv;
 	}
 brk:
-	if(a->index != D_NONE) {
-		snprint(s, sizeof(s), "(%R*%d)", a->index, a->scale);
-		strcat(str, s);
-	}
+	if(a->index != D_NONE)
+		return fmtprint(fp, "%s(%R*%d)", str, a->index, a->scale);
 conv:
 	return fmtstrcpy(fp, str);
 }
diff --git a/sys/src/cmd/8l/obj.c b/sys/src/cmd/8l/obj.c
index a6aec8d85..2aeee6811 100644
--- a/sys/src/cmd/8l/obj.c
+++ b/sys/src/cmd/8l/obj.c
@@ -393,11 +393,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -455,7 +453,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -574,17 +572,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
@@ -1012,7 +1010,7 @@ loop:
 			goto casdef;
 		if(p->from.type == D_FCONST) {
 			/* size sb 9 max */
-			sprint(literal, "$%lux", ieeedtof(&p->from.ieee));
+			snprint(literal, sizeof literal, "$%lux", ieeedtof(&p->from.ieee));
 			s = lookup(literal, 0);
 			if(s->type == 0) {
 				s->type = SBSS;
@@ -1057,7 +1055,7 @@ loop:
 			goto casdef;
 		if(p->from.type == D_FCONST) {
 			/* size sb 18 max */
-			sprint(literal, "$%lux.%lux",
+			snprint(literal, sizeof literal, "$%lux.%lux",
 				p->from.ieee.l, p->from.ieee.h);
 			s = lookup(literal, 0);
 			if(s->type == 0) {
diff --git a/sys/src/cmd/kc/list.c b/sys/src/cmd/kc/list.c
index 3538c6210..7e5c5dd72 100644
--- a/sys/src/cmd/kc/list.c
+++ b/sys/src/cmd/kc/list.c
@@ -20,20 +20,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%ld", var[i].offset);
+			snprint(ss, sizeof ss, "$%ld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -49,18 +47,18 @@ Pconv(Fmt *fp)
 	p = va_arg(fp->args, Prog*);
 	a = p->as;
 	if(a == ADATA)
-		sprint(str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->as == ATEXT)
-		sprint(str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->reg == NREG)
-		sprint(str, "	%A	%D,%D", a, &p->from, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%D", a, &p->from, &p->to);
 	else
 	if(p->from.type != D_FREG)
-		sprint(str, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
 	else
-		sprint(str, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
 	return fmtstrcpy(fp, str);
 }
 
@@ -87,57 +85,57 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(F%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(F%d)(REG)", a, a->reg);
 		break;
 
 	case D_CREG:
-		sprint(str, "C%d", a->reg);
+		snprint(str, sizeof str, "C%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(C%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(C%d)(REG)", a, a->reg);
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%ld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%ld(PC)", a->offset-pc);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%.17e", a->dval);
+		snprint(str, sizeof str, "$%.17e", a->dval);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -200,28 +198,28 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/kl/list.c b/sys/src/cmd/kl/list.c
index 00fcb7ee4..b389ab2f5 100644
--- a/sys/src/cmd/kl/list.c
+++ b/sys/src/cmd/kl/list.c
@@ -20,7 +20,7 @@ prasm(Prog *p)
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], *s;
+	char str[STRINGSZ];
 	Prog *p;
 	int a;
 
@@ -28,26 +28,31 @@ Pconv(Fmt *fp)
 	curp = p;
 	a = p->as;
 	if(a == ADATA || a == AINIT || a == ADYNT)
-		sprint(str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
 	else{
-		s = str;
-		if(p->mark & NOSCHED)
-			s += sprint(s, "*");
 		if(p->reg == NREG)
-			sprint(s, "	%A	%D,%D", a, &p->from, &p->to);
+			snprint(str, sizeof str, "%s	%A	%D,%D",
+				p->mark & NOSCHED ? "*" : "", a, 
+				&p->from, &p->to);
 		else
 		if(p->from.type == D_OREG) {
-			sprint(s, "	%A	%ld(R%d+R%d),%D", a,
+			snprint(str, sizeof str, "%s	%A	%ld(R%d+R%d),%D",
+				p->mark & NOSCHED ? "*" : "", a, 
 				p->from.offset, p->from.reg, p->reg, &p->to);
 		} else
 		if(p->to.type == D_OREG) {
-			sprint(s, "	%A	%D,%ld(R%d+R%d)", a,
+			snprint(str, sizeof str, "%s	%A	%D,%ld(R%d+R%d)",
+				p->mark & NOSCHED ? "*" : "", a, 
 				&p->from, p->to.offset, p->to.reg, p->reg);
 		} else
 		if(p->from.type == D_FREG)
-			sprint(s, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
+			snprint(str, sizeof str, "%s	%A	%D,F%d,%D",
+				p->mark & NOSCHED ? "*" : "", a, 
+				&p->from, p->reg, &p->to);
 		else
-			sprint(s, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
+			snprint(str, sizeof str, "%s	%A	%D,R%d,%D",
+				p->mark & NOSCHED ? "*" : "", a, 
+				&p->from, p->reg, &p->to);
 	}
 	return fmtstrcpy(fp, str);
 }
@@ -76,58 +81,58 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_ASI:
 		if(a->reg != NREG)
-			sprint(str, "(R%d,%ld)", a->reg, a->offset);
+			snprint(str, sizeof str, "(R%d,%ld)", a->reg, a->offset);
 		else
-			sprint(str, "(R%d,%ld)", 0, a->offset);
+			snprint(str, sizeof str, "(R%d,%ld)", 0, a->offset);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(F%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(F%d)(REG)", a, a->reg);
 		break;
 
 	case D_CREG:
-		sprint(str, "C%d", a->reg);
+		snprint(str, sizeof str, "C%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(C%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(C%d)(REG)", a, a->reg);
 		break;
 
 	case D_PREG:
-		sprint(str, "P%d", a->reg);
+		snprint(str, sizeof str, "P%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(P%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(P%d)(REG)", a, a->reg);
 		break;
 
 	case D_BRANCH:
@@ -136,22 +141,22 @@ Dconv(Fmt *fp)
 			if(v >= INITTEXT)
 				v -= INITTEXT-HEADR;
 			if(a->sym != S)
-				sprint(str, "%s+%.5lux(BRANCH)", a->sym->name, v);
+				snprint(str, sizeof str, "%s+%.5lux(BRANCH)", a->sym->name, v);
 			else
-				sprint(str, "%.5lux(BRANCH)", v);
+				snprint(str, sizeof str, "%.5lux(BRANCH)", v);
 		} else
 			if(a->sym != S)
-				sprint(str, "%s+%ld(APC)", a->sym->name, a->offset);
+				snprint(str, sizeof str, "%s+%ld(APC)", a->sym->name, a->offset);
 			else
-				sprint(str, "%ld(APC)", a->offset);
+				snprint(str, sizeof str, "%ld(APC)", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%lux-%lux", a->ieee.h, a->ieee.l);
+		snprint(str, sizeof str, "$%lux-%lux", a->ieee.h, a->ieee.l);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -167,28 +172,28 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/kl/obj.c b/sys/src/cmd/kl/obj.c
index 76a2b79fd..2608349b4 100644
--- a/sys/src/cmd/kl/obj.c
+++ b/sys/src/cmd/kl/obj.c
@@ -248,11 +248,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -310,7 +308,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -440,17 +438,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
@@ -849,7 +847,7 @@ loop:
 
 		if(p->from.type == D_FCONST) {
 			/* size sb 9 max */
-			sprint(literal, "$%lux", ieeedtof(&p->from.ieee));
+			snprint(literal, sizeof literal, "$%lux", ieeedtof(&p->from.ieee));
 			s = lookup(literal, 0);
 			if(s->type == 0) {
 				s->type = SBSS;
@@ -877,7 +875,7 @@ loop:
 			goto casedef;
 		if(p->from.type == D_FCONST) {
 			/* size sb 18 max */
-			sprint(literal, "$%lux.%lux",
+			snprint(literal, sizeof literal, "$%lux.%lux",
 				p->from.ieee.l, p->from.ieee.h);
 			s = lookup(literal, 0);
 			if(s->type == 0) {
diff --git a/sys/src/cmd/kl/pass.c b/sys/src/cmd/kl/pass.c
index 6c8fb5269..d96cea436 100644
--- a/sys/src/cmd/kl/pass.c
+++ b/sys/src/cmd/kl/pass.c
@@ -131,9 +131,9 @@ dodata(void)
 				continue;
 			/* size should be 19 max */
 			if(strlen(s->name) >= 10)	/* has loader address */ 
-				sprint(literal, "$%p.%lux", s, p->from.offset);
+				snprint(literal, sizeof literal, "$%p.%lux", s, p->from.offset);
 			else
-				sprint(literal, "$%s.%d.%lux", s->name, s->version, p->from.offset);
+				snprint(literal, sizeof literal, "$%s.%d.%lux", s->name, s->version, p->from.offset);
 		} else {
 			if(p->from.name != D_NONE)
 				continue;
@@ -145,7 +145,7 @@ dodata(void)
 			if(!(v & 0xffff))
 				continue;
 			/* size should be 9 max */
-			sprint(literal, "$%lux", v);
+			snprint(literal, sizeof literal, "$%lux", v);
 		}
 		s = lookup(literal, 0);
 		if(s->type == 0) {
diff --git a/sys/src/cmd/qc/list.c b/sys/src/cmd/qc/list.c
index f0f98a132..5ff999fea 100644
--- a/sys/src/cmd/qc/list.c
+++ b/sys/src/cmd/qc/list.c
@@ -20,20 +20,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%ld", var[i].offset);
+			snprint(ss, sizeof ss, "$%ld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -49,9 +47,9 @@ Pconv(Fmt *fp)
 	p = va_arg(fp->args, Prog*);
 	a = p->as;
 	if(a == ADATA)
-		sprint(str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
 	else if(p->as == ATEXT)
-		sprint(str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
 	else {
 		s = seprint(str, str+sizeof(str), "	%A	%D", a, &p->from);
 		if(p->reg != NREG)
@@ -86,57 +84,57 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(F%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(F%d)(REG)", a, a->reg);
 		break;
 
 	case D_CREG:
-		sprint(str, "C%d", a->reg);
+		snprint(str, sizeof str, "C%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(C%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(C%d)(REG)", a, a->reg);
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%ld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%ld(PC)", a->offset-pc);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%.17e", a->dval);
+		snprint(str, sizeof str, "$%.17e", a->dval);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -210,32 +208,32 @@ Nconv(Fmt *fp)
 				l = b;
 			}
 			if(n < 2) {
-				sprint(str, "%#lux", a->offset);
+				snprint(str, sizeof str, "%#lux", a->offset);
 				goto out;
 			}
 		}
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/ql/list.c b/sys/src/cmd/ql/list.c
index 04139dfc0..ca0de6a7b 100644
--- a/sys/src/cmd/ql/list.c
+++ b/sys/src/cmd/ql/list.c
@@ -21,7 +21,7 @@ prasm(Prog *p)
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], *s;
+	char str[STRINGSZ];
 	Prog *p;
 	int a;
 
@@ -29,28 +29,34 @@ Pconv(Fmt *fp)
 	curp = p;
 	a = p->as;
 	if(a == ADATA || a == AINIT || a == ADYNT)
-		sprint(str, "(%d)	%A	%D/%d,%D", p->line, a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "(%d)	%A	%D/%d,%D", p->line, a, &p->from, p->reg, &p->to);
 	else {
-		s = str;
-		if(p->mark & NOSCHED)
-			s += sprint(s, "*");
 		if(p->reg == NREG && p->from3.type == D_NONE)
-			sprint(s, "(%d)	%A	%D,%D", p->line, a, &p->from, &p->to);
+			snprint(str, sizeof str, "%s(%d)	%A	%D,%D", 
+				p->mark & NOSCHED ? "*" : "", p->line, a, 
+				&p->from, &p->to);
 		else
 		if(a != ATEXT && p->from.type == D_OREG) {
-			sprint(s, "(%d)	%A	%ld(R%d+R%d),%D", p->line, a,
+			snprint(str, sizeof str, "%s(%d)	%A	%ld(R%d+R%d),%D",
+				p->mark & NOSCHED ? "*" : "", p->line, a, 
 				p->from.offset, p->from.reg, p->reg, &p->to);
 		} else
 		if(p->to.type == D_OREG) {
-			sprint(s, "(%d)	%A	%D,%ld(R%d+R%d)", p->line, a,
-					&p->from, p->to.offset, p->to.reg, p->reg);
+			snprint(str, sizeof str, "%s(%d)	%A	%D,%ld(R%d+R%d)",
+				p->mark & NOSCHED ? "*" : "", p->line, a, 
+				&p->from, p->to.offset, p->to.reg, p->reg);
 		} else {
-			s += sprint(s, "(%d)	%A	%D", p->line, a, &p->from);
+			snprint(str, sizeof str, "%s(%d)	%A	%D", 
+				p->mark & NOSCHED ? "*" : "", p->line, a, 
+				&p->from);
 			if(p->reg != NREG)
-				s += sprint(s, ",%c%d", p->from.type==D_FREG?'F':'R', p->reg);
+				snprint(str + strlen(str), sizeof(str) - strlen(str),
+					",%c%d", p->from.type==D_FREG?'F':'R', p->reg);
 			if(p->from3.type != D_NONE)
-				s += sprint(s, ",%D", &p->from3);
-			sprint(s, ",%D", &p->to);
+				snprint(str + strlen(str), sizeof(str) - strlen(str),
+					",%D", &p->from3);
+			snprint(str + strlen(str), sizeof(str) - strlen(str),
+				",%D", &p->to);
 		}
 	}
 	return fmtstrcpy(fp, str);
@@ -80,97 +86,97 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(F%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(F%d)(REG)", a, a->reg);
 		break;
 
 	case D_CREG:
 		if(a->reg == NREG)
 			strcpy(str, "CR");
 		else
-			sprint(str, "CR%d", a->reg);
+			snprint(str, sizeof str, "CR%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(C%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(C%d)(REG)", a, a->reg);
 		break;
 
 	case D_SPR:
 		if(a->name == D_NONE && a->sym == S) {
 			switch(a->offset) {
-			case D_XER: sprint(str, "XER"); break;
-			case D_LR: sprint(str, "LR"); break;
-			case D_CTR: sprint(str, "CTR"); break;
-			default: sprint(str, "SPR(%ld)", a->offset); break;
+			case D_XER: snprint(str, sizeof str, "XER"); break;
+			case D_LR: snprint(str, sizeof str, "LR"); break;
+			case D_CTR: snprint(str, sizeof str, "CTR"); break;
+			default: snprint(str, sizeof str, "SPR(%ld)", a->offset); break;
 			}
 			break;
 		}
-		sprint(str, "SPR-GOK(%d)", a->reg);
+		snprint(str, sizeof str, "SPR-GOK(%d)", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(SPR-GOK%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(SPR-GOK%d)(REG)", a, a->reg);
 		break;
 
 	case D_DCR:
 		if(a->name == D_NONE && a->sym == S) {
 			if(a->reg == NREG)
-				sprint(str, "DCR(%ld)", a->offset);
+				snprint(str, sizeof str, "DCR(%ld)", a->offset);
 			else
-				sprint(str, "DCR(R%d)", a->reg);
+				snprint(str, sizeof str, "DCR(R%d)", a->reg);
 			break;
 		}
-		sprint(str, "DCR-GOK(%d)", a->reg);
+		snprint(str, sizeof str, "DCR-GOK(%d)", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(DCR-GOK%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(DCR-GOK%d)(REG)", a, a->reg);
 		break;
 
 	case D_OPT:
-		sprint(str, "OPT(%d)", a->reg);
+		snprint(str, sizeof str, "OPT(%d)", a->reg);
 		break;
 
 	case D_FPSCR:
 		if(a->reg == NREG)
 			strcpy(str, "FPSCR");
 		else
-			sprint(str, "FPSCR(%d)", a->reg);
+			snprint(str, sizeof str, "FPSCR(%d)", a->reg);
 		break;
 
 	case D_MSR:
-		sprint(str, "MSR");
+		snprint(str, sizeof str, "MSR");
 		break;
 
 	case D_SREG:
-		sprint(str, "SREG(%d)", a->reg);
+		snprint(str, sizeof str, "SREG(%d)", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(SREG%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(SREG%d)(REG)", a, a->reg);
 		break;
 
 	case D_BRANCH:
@@ -179,22 +185,22 @@ Dconv(Fmt *fp)
 			if(v >= INITTEXT)
 				v -= INITTEXT-HEADR;
 			if(a->sym != S)
-				sprint(str, "%s+%.5lux(BRANCH)", a->sym->name, v);
+				snprint(str, sizeof str, "%s+%.5lux(BRANCH)", a->sym->name, v);
 			else
-				sprint(str, "%.5lux(BRANCH)", v);
+				snprint(str, sizeof str, "%.5lux(BRANCH)", v);
 		} else
 			if(a->sym != S)
-				sprint(str, "%s+%ld(APC)", a->sym->name, a->offset);
+				snprint(str, sizeof str, "%s+%ld(APC)", a->sym->name, a->offset);
 			else
-				sprint(str, "%ld(APC)", a->offset);
+				snprint(str, sizeof str, "%ld(APC)", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%lux-%lux", a->ieee.h, a->ieee.l);
+		snprint(str, sizeof str, "$%lux-%lux", a->ieee.h, a->ieee.l);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -210,28 +216,28 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/ql/obj.c b/sys/src/cmd/ql/obj.c
index 8026a0def..9e4dcf02e 100644
--- a/sys/src/cmd/ql/obj.c
+++ b/sys/src/cmd/ql/obj.c
@@ -327,11 +327,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -389,7 +387,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -523,17 +521,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
@@ -961,7 +959,7 @@ loop:
 
 		if(p->from.type == D_FCONST) {
 			/* size sb 9 max */
-			sprint(literal, "$%lux", ieeedtof(&p->from.ieee));
+			snprint(literal, sizeof literal, "$%lux", ieeedtof(&p->from.ieee));
 			s = lookup(literal, 0);
 			if(s->type == 0) {
 				s->type = SBSS;
@@ -989,7 +987,7 @@ loop:
 			goto casedef;
 		if(p->from.type == D_FCONST) {
 			/* size sb 18 max */
-			sprint(literal, "$%lux.%lux",
+			snprint(literal, sizeof literal, "$%lux.%lux",
 				p->from.ieee.l, p->from.ieee.h);
 			s = lookup(literal, 0);
 			if(s->type == 0) {
diff --git a/sys/src/cmd/ql/pass.c b/sys/src/cmd/ql/pass.c
index 1a4fc7b0b..70b3aab09 100644
--- a/sys/src/cmd/ql/pass.c
+++ b/sys/src/cmd/ql/pass.c
@@ -131,9 +131,9 @@ dodata(void)
 				continue;
 			/* size should be 19 max */
 			if(strlen(s->name) >= 10)	/* has loader address */ 
-				sprint(literal, "$%p.%lux", s, p->from.offset);
+				snprint(literal, sizeof literal, "$%p.%lux", s, p->from.offset);
 			else
-				sprint(literal, "$%s.%d.%lux", s->name, s->version, p->from.offset);
+				snprint(literal, sizeof literal, "$%s.%d.%lux", s->name, s->version, p->from.offset);
 		} else {
 			if(p->from.name != D_NONE)
 				continue;
@@ -147,7 +147,7 @@ dodata(void)
 			if(v)
 				continue;	/* quicker to build it than load it */
 			/* size should be 9 max */
-			sprint(literal, "$%lux", v);
+			snprint(literal, sizeof literal, "$%lux", v);
 		}
 		s = lookup(literal, 0);
 		if(s->type == 0) {
diff --git a/sys/src/cmd/vc/list.c b/sys/src/cmd/vc/list.c
index f89b17caa..8e9c85064 100644
--- a/sys/src/cmd/vc/list.c
+++ b/sys/src/cmd/vc/list.c
@@ -19,20 +19,18 @@ Bconv(Fmt *fp)
 	Bits bits;
 	int i;
 
-	str[0] = 0;
+	memset(str, 0, sizeof str);
 	bits = va_arg(fp->args, Bits);
 	while(bany(&bits)) {
 		i = bnum(bits);
 		if(str[0])
-			strcat(str, " ");
+			strncat(str, " ", sizeof str - 1);
 		if(var[i].sym == S) {
-			sprint(ss, "$%ld", var[i].offset);
+			snprint(ss, sizeof ss, "$%ld", var[i].offset);
 			s = ss;
 		} else
 			s = var[i].sym->name;
-		if(strlen(str) + strlen(s) + 1 >= STRINGSZ)
-			break;
-		strcat(str, s);
+		strncat(str, s, sizeof str - 1);
 		bits.b[i/32] &= ~(1L << (i%32));
 	}
 	return fmtstrcpy(fp, str);
@@ -48,18 +46,18 @@ Pconv(Fmt *fp)
 	p = va_arg(fp->args, Prog*);
 	a = p->as;
 	if(a == ADATA)
-		sprint(str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D/%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->as == ATEXT)
-		sprint(str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%d,%D", a, &p->from, p->reg, &p->to);
 	else
 	if(p->reg == NREG)
-		sprint(str, "	%A	%D,%D", a, &p->from, &p->to);
+		snprint(str, sizeof str, "	%A	%D,%D", a, &p->from, &p->to);
 	else
 	if(p->from.type != D_FREG)
-		sprint(str, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,R%d,%D", a, &p->from, p->reg, &p->to);
 	else
-		sprint(str, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
+		snprint(str, sizeof str, "	%A	%D,F%d,%D", a, &p->from, p->reg, &p->to);
 	return fmtstrcpy(fp, str);
 }
 
@@ -86,69 +84,69 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
 		if(a->reg != NREG)
-			sprint(str, "$%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "$%N(R%d)", a, a->reg);
 		else
-			sprint(str, "$%N", a);
+			snprint(str, sizeof str, "$%N", a);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FCREG:
-		sprint(str, "FCR%d", a->reg);
+		snprint(str, sizeof str, "FCR%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_LO:
-		sprint(str, "LO");
+		snprint(str, sizeof str, "LO");
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(LO)(REG)", a);
+			snprint(str, sizeof str, "%N(LO)(REG)", a);
 		break;
 
 	case D_HI:
-		sprint(str, "HI");
+		snprint(str, sizeof str, "HI");
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(HI)(REG)", a);
+			snprint(str, sizeof str, "%N(HI)(REG)", a);
 		break;
 
 	case D_BRANCH:
-		sprint(str, "%ld(PC)", a->offset-pc);
+		snprint(str, sizeof str, "%ld(PC)", a->offset-pc);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%.17e", a->dval);
+		snprint(str, sizeof str, "$%.17e", a->dval);
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -211,32 +209,32 @@ Nconv(Fmt *fp)
 	a = va_arg(fp->args, Adr*);
 	s = a->sym;
 	if(s == S) {
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		goto out;
 	}
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_NONE:
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		break;
 
 	case D_EXTERN:
-		sprint(str, "%s+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
-		sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+		snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
-		sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+		snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
-		sprint(str, "%s+%ld(FP)", s->name, a->offset);
+		snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 out:
diff --git a/sys/src/cmd/vl/list.c b/sys/src/cmd/vl/list.c
index 9261bc8e1..75ced908e 100644
--- a/sys/src/cmd/vl/list.c
+++ b/sys/src/cmd/vl/list.c
@@ -20,7 +20,7 @@ prasm(Prog *p)
 int
 Pconv(Fmt *fp)
 {
-	char str[STRINGSZ], *s;
+	char str[STRINGSZ];
 	Prog *p;
 	int a;
 
@@ -28,22 +28,21 @@ Pconv(Fmt *fp)
 	curp = p;
 	a = p->as;
 	if(a == ADATA || a == ADYNT || a == AINIT)
-		sprint(str, "(%ld)	%A	%D/%d,%D",
+		snprint(str, sizeof str, "(%ld)	%A	%D/%d,%D",
 			p->line, a, &p->from, p->reg, &p->to);
 	else{
-		s = str;
-		s += sprint(s, "(%ld)", p->line);
-		if(p->mark & NOSCHED)
-			s += sprint(s, "*");
 		if(p->reg == NREG)
-			sprint(s, "	%A	%D,%D",
+			snprint(str, sizeof str, "(%ld)%s	%A	%D,%D",
+				p->line, p->mark & NOSCHED ? "*" : "",
 				a, &p->from, &p->to);
 		else
 		if(p->from.type != D_FREG)
-			sprint(s, "	%A	%D,R%d,%D",
+			snprint(str, sizeof str, "(%ld)%s	%A	%D,R%d,%D",
+				p->line, p->mark & NOSCHED ? "*" : "",
 				a, &p->from, p->reg, &p->to);
 		else
-			sprint(s, "	%A	%D,F%d,%D",
+			snprint(str, sizeof str, "(%ld)%s	%A	%D,F%d,%D",
+				p->line, p->mark & NOSCHED ? "*" : "",
 				a, &p->from, p->reg, &p->to);
 	}
 	return fmtstrcpy(fp, str);
@@ -73,68 +72,68 @@ Dconv(Fmt *fp)
 	switch(a->type) {
 
 	default:
-		sprint(str, "GOK-type(%d)", a->type);
+		snprint(str, sizeof str, "GOK-type(%d)", a->type);
 		break;
 
 	case D_NONE:
 		str[0] = 0;
 		if(a->name != D_NONE || a->reg != NREG || a->sym != S)
-			sprint(str, "%N(R%d)(NONE)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(NONE)", a, a->reg);
 		break;
 
 	case D_CONST:
-		sprint(str, "$%N", a);
+		snprint(str, sizeof str, "$%N", a);
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)(CONST)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(CONST)", a, a->reg);
 		break;
 
 	case D_OCONST:
-		sprint(str, "$*$%N", a);
+		snprint(str, sizeof str, "$*$%N", a);
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)(CONST)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(CONST)", a, a->reg);
 		break;
 
 	case D_OREG:
 		if(a->reg != NREG)
-			sprint(str, "%N(R%d)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)", a, a->reg);
 		else
-			sprint(str, "%N", a);
+			snprint(str, sizeof str, "%N", a);
 		break;
 
 	case D_REG:
-		sprint(str, "R%d", a->reg);
+		snprint(str, sizeof str, "R%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_MREG:
-		sprint(str, "M%d", a->reg);
+		snprint(str, sizeof str, "M%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FREG:
-		sprint(str, "F%d", a->reg);
+		snprint(str, sizeof str, "F%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_FCREG:
-		sprint(str, "FC%d", a->reg);
+		snprint(str, sizeof str, "FC%d", a->reg);
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(R%d)(REG)", a, a->reg);
+			snprint(str, sizeof str, "%N(R%d)(REG)", a, a->reg);
 		break;
 
 	case D_LO:
-		sprint(str, "LO");
+		snprint(str, sizeof str, "LO");
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(LO)(REG)", a);
+			snprint(str, sizeof str, "%N(LO)(REG)", a);
 		break;
 
 	case D_HI:
-		sprint(str, "HI");
+		snprint(str, sizeof str, "HI");
 		if(a->name != D_NONE || a->sym != S)
-			sprint(str, "%N(HI)(REG)", a);
+			snprint(str, sizeof str, "%N(HI)(REG)", a);
 		break;
 
 	case D_BRANCH:	/* botch */
@@ -143,22 +142,22 @@ Dconv(Fmt *fp)
 			if(v >= INITTEXT)
 				v -= INITTEXT-HEADR;
 			if(a->sym != S)
-				sprint(str, "%s+%.5lux(BRANCH)", a->sym->name, v);
+				snprint(str, sizeof str, "%s+%.5lux(BRANCH)", a->sym->name, v);
 			else
-				sprint(str, "%.5lux(BRANCH)", v);
+				snprint(str, sizeof str, "%.5lux(BRANCH)", v);
 		} else
 			if(a->sym != S)
-				sprint(str, "%s+%ld(APC)", a->sym->name, a->offset);
+				snprint(str, sizeof str, "%s+%ld(APC)", a->sym->name, a->offset);
 			else
-				sprint(str, "%ld(APC)", a->offset);
+				snprint(str, sizeof str, "%ld(APC)", a->offset);
 		break;
 
 	case D_FCONST:
-		sprint(str, "$%e", ieeedtod(a->ieee));
+		snprint(str, sizeof str, "$%e", ieeedtod(a->ieee));
 		break;
 
 	case D_SCONST:
-		sprint(str, "$\"%S\"", a->sval);
+		snprint(str, sizeof str, "$\"%S\"", a->sval);
 		break;
 	}
 	return fmtstrcpy(fp, str);
@@ -175,39 +174,39 @@ Nconv(Fmt *fp)
 	s = a->sym;
 	switch(a->name) {
 	default:
-		sprint(str, "GOK-name(%d)", a->name);
+		snprint(str, sizeof str, "GOK-name(%d)", a->name);
 		break;
 
 	case D_NONE:
-		sprint(str, "%ld", a->offset);
+		snprint(str, sizeof str, "%ld", a->offset);
 		break;
 
 	case D_EXTERN:
 		if(s == S)
-			sprint(str, "%ld(SB)", a->offset);
+			snprint(str, sizeof str, "%ld(SB)", a->offset);
 		else
-			sprint(str, "%s+%ld(SB)", s->name, a->offset);
+			snprint(str, sizeof str, "%s+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_STATIC:
 		if(s == S)
-			sprint(str, "<>+%ld(SB)", a->offset);
+			snprint(str, sizeof str, "<>+%ld(SB)", a->offset);
 		else
-			sprint(str, "%s<>+%ld(SB)", s->name, a->offset);
+			snprint(str, sizeof str, "%s<>+%ld(SB)", s->name, a->offset);
 		break;
 
 	case D_AUTO:
 		if(s == S)
-			sprint(str, "%ld(SP)", a->offset);
+			snprint(str, sizeof str, "%ld(SP)", a->offset);
 		else
-			sprint(str, "%s-%ld(SP)", s->name, -a->offset);
+			snprint(str, sizeof str, "%s-%ld(SP)", s->name, -a->offset);
 		break;
 
 	case D_PARAM:
 		if(s == S)
-			sprint(str, "%ld(FP)", a->offset);
+			snprint(str, sizeof str, "%ld(FP)", a->offset);
 		else
-			sprint(str, "%s+%ld(FP)", s->name, a->offset);
+			snprint(str, sizeof str, "%s+%ld(FP)", s->name, a->offset);
 		break;
 	}
 
diff --git a/sys/src/cmd/vl/obj.c b/sys/src/cmd/vl/obj.c
index 8289c5884..4404f682f 100644
--- a/sys/src/cmd/vl/obj.c
+++ b/sys/src/cmd/vl/obj.c
@@ -294,11 +294,9 @@ objfile(char *file)
 
 	if(file[0] == '-' && file[1] == 'l') {
 		if(debug['9'])
-			sprint(name, "/%s/lib/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib/lib%s.a", thestring, file+2);
 		else
-			sprint(name, "/usr/%clib/lib", thechar);
-		strcat(name, file+2);
-		strcat(name, ".a");
+			snprint(name, sizeof name, "/usr/%clib/lib%s.a", thechar, file+2);
 		file = name;
 	}
 	if(debug['v'])
@@ -358,7 +356,7 @@ objfile(char *file)
 			s = lookup(e+5, 0);
 			if(s->type != SXREF)
 				continue;
-			sprint(pname, "%s(%s)", file, s->name);
+			snprint(pname, sizeof pname, "%s(%s)", file, s->name);
 			if(debug['v'])
 				Bprint(&bso, "%5.2f library: %s\n", cputime(), pname);
 			Bflush(&bso);
@@ -505,17 +503,17 @@ addlib(char *obj)
 		return;
 
 	if(histfrog[0]->name[1] == '/') {
-		sprint(name, "");
+		name[0] = 0;
 		i = 1;
 	} else
 	if(histfrog[0]->name[1] == '.') {
-		sprint(name, ".");
+		snprint(name, sizeof name, ".");
 		i = 0;
 	} else {
 		if(debug['9'])
-			sprint(name, "/%s/lib", thestring);
+			snprint(name, sizeof name, "/%s/lib", thestring);
 		else
-			sprint(name, "/usr/%clib", thechar);
+			snprint(name, sizeof name, "/usr/%clib", thechar);
 		i = 0;
 	}
 
@@ -933,7 +931,7 @@ loop:
 
 		if(p->from.type == D_FCONST) {
 			/* size sb 9 max */
-			sprint(literal, "$%lux", ieeedtof(p->from.ieee));
+			snprint(literal, sizeof literal, "$%lux", ieeedtof(p->from.ieee));
 			s = lookup(literal, 0);
 			if(s->type == 0) {
 				s->type = SBSS;
@@ -962,7 +960,7 @@ loop:
 
 		if(p->from.type == D_FCONST) {
 			/* size sb 18 max */
-			sprint(literal, "$%lux.%lux",
+			snprint(literal, sizeof literal, "$%lux.%lux",
 				p->from.ieee->l, p->from.ieee->h);
 			s = lookup(literal, 0);
 			if(s->type == 0) {
diff --git a/sys/src/cmd/vl/pass.c b/sys/src/cmd/vl/pass.c
index 7abe22d4f..d16409ca1 100644
--- a/sys/src/cmd/vl/pass.c
+++ b/sys/src/cmd/vl/pass.c
@@ -133,9 +133,9 @@ dodata(void)
 				continue;
 			/* size should be 19 max */
 			if(strlen(s->name) >= 10)	/* has loader address */ 
-				sprint(literal, "$%p.%lux", s, p->from.offset);
+				snprint(literal, sizeof literal, "$%p.%lux", s, p->from.offset);
 			else
-				sprint(literal, "$%s.%d.%lux", s->name, s->version, p->from.offset);
+				snprint(literal, sizeof literal, "$%s.%d.%lux", s->name, s->version, p->from.offset);
 		} else {
 			if(p->from.name != D_NONE)
 				continue;
@@ -147,7 +147,7 @@ dodata(void)
 			if(!(v & 0xffff))
 				continue;
 			/* size should be 9 max */
-			sprint(literal, "$%lux", v);
+			snprint(literal, sizeof literal, "$%lux", v);
 		}
 		s = lookup(literal, 0);
 		if(s->type == 0) {