Index: trunk/i386/libsaio/nbp.c
===================================================================
--- trunk/i386/libsaio/nbp.c	(revision 2610)
+++ trunk/i386/libsaio/nbp.c	(revision 2611)
@@ -107,7 +107,7 @@
 
 static void NBPGetDescription(CICell ih, char * str, long strMaxLen)
 {
-    sprintf( str, "Ethernet PXE Client" );
+    snprintf( str, strMaxLen, "Ethernet PXE Client" );
 }
 
 //==========================================================================
Index: trunk/i386/libsaio/disk.c
===================================================================
--- trunk/i386/libsaio/disk.c	(revision 2610)
+++ trunk/i386/libsaio/disk.c	(revision 2611)
@@ -263,7 +263,7 @@
 		return errname;
 	}
 
-	sprintf(errorstr, "Error 0x%02x", errnum);
+	snprintf(errorstr, sizeof(errorstr), "Error 0x%02x", errnum);
 	return errorstr; // No string, print error code only
 }
 
@@ -1725,7 +1725,7 @@
 	if (!valid)
 	{
 		// OS X Standard
-		sprintf(dirSpec, "hd(%d,%d)/System/Library/CoreServices/SystemVersion.plist", BIOS_DEV_UNIT(bvr), bvr->part_no);
+		snprintf(dirSpec, sizeof(dirSpec), "hd(%d,%d)/System/Library/CoreServices/SystemVersion.plist", BIOS_DEV_UNIT(bvr), bvr->part_no);
 
 		if (!loadConfigFile(dirSpec, &systemVersion))
 		{
@@ -1735,7 +1735,7 @@
 		else
 		{
 			// OS X Server
-			sprintf(dirSpec, "hd(%d,%d)/System/Library/CoreServices/ServerVersion.plist", BIOS_DEV_UNIT(bvr), bvr->part_no);
+			snprintf(dirSpec, sizeof(dirSpec), "hd(%d,%d)/System/Library/CoreServices/ServerVersion.plist", BIOS_DEV_UNIT(bvr), bvr->part_no);
 
 			if (!loadConfigFile(dirSpec, &systemVersion))
 			{
@@ -1744,7 +1744,7 @@
 			}
 /*			else
 			{
-				sprintf(dirSpec, "hd(%d,%d)/.IAProductInfo", BIOS_DEV_UNIT(bvr), bvr->part_no);
+				snprintf(dirSpec, sizeof(dirSpec), "hd(%d,%d)/.IAProductInfo", BIOS_DEV_UNIT(bvr), bvr->part_no);
 
 				if (!loadConfigFile(dirSpec, &systemVersion))
 				{
@@ -1784,7 +1784,7 @@
 	if(!valid)
 	{
 		int fh = -1;
-		sprintf(dirSpec, "hd(%d,%d)/.PhysicalMediaInstall", BIOS_DEV_UNIT(bvr), bvr->part_no);
+		snprintf(dirSpec, sizeof(dirSpec), "hd(%d,%d)/.PhysicalMediaInstall", BIOS_DEV_UNIT(bvr), bvr->part_no);
 		fh = open(dirSpec, 0);
 
 		if (fh >= 0)
@@ -1796,7 +1796,7 @@
 		}
 		else
 		{
-			sprintf(dirSpec, "hd(%d,%d)/.IAPhysicalMedia", BIOS_DEV_UNIT(bvr), bvr->part_no);
+			snprintf(dirSpec, sizeof(dirSpec), "hd(%d,%d)/.IAPhysicalMedia", BIOS_DEV_UNIT(bvr), bvr->part_no);
 			fh = open(dirSpec, 0);
 
 			if (fh >= 0)
@@ -1836,7 +1836,7 @@
 		//
 		if (bvr->flags & kBVFlagBooter)
 		{
-			sprintf(dirSpec, "hd(%d,%d)/System/Library/CoreServices/", BIOS_DEV_UNIT(bvr), bvr->part_no);
+			snprintf(dirSpec, sizeof(dirSpec), "hd(%d,%d)/System/Library/CoreServices/", BIOS_DEV_UNIT(bvr), bvr->part_no);
 			strcpy(fileSpec, ".disk_label.contentDetails");
 			ret = GetFileInfo(dirSpec, fileSpec, &flags, &time);
 			if (!ret)
@@ -2191,7 +2191,7 @@
 	}
 
 	// Try to match hd(x,y) first.
-	sprintf(testStr, "hd(%d,%d)", BIOS_DEV_UNIT(bvr), bvr->part_no);
+	snprintf(testStr, sizeof(testStr), "hd(%d,%d)", BIOS_DEV_UNIT(bvr), bvr->part_no);
 	if ( matchLen ? !strncmp(match, testStr, matchLen) : !strcmp(match, testStr) )
 	{
 		return true;
@@ -2341,7 +2341,7 @@
 
 		if (name == NULL)
 		{
-			sprintf(p, "TYPE %02X", type);
+			snprintf(p, strMaxLen, "TYPE %02X", type);
 		}
 		else
 		{
@@ -2350,7 +2350,7 @@
 	}
 
 	// Set the devices label
-	sprintf(bvr->label, p);
+	snprintf(bvr->label, sizeof(bvr->label), p);
 }
 
 
Index: trunk/i386/modules/Keylayout/Keylayout.c
===================================================================
--- trunk/i386/modules/Keylayout/Keylayout.c	(revision 2610)
+++ trunk/i386/modules/Keylayout/Keylayout.c	(revision 2611)
@@ -138,7 +138,7 @@
 
 	if (getValueForKey("KeyLayout", &val, &len, &bootInfo->chameleonConfig))
 	{
-		sprintf(layoutPath, "/Extra/Keymaps/%s", val);
+		snprintf(layoutPath, sizeof(layoutPath),"/Extra/Keymaps/%s", val);
 		// Add the extension if needed
 		if (len <= 4 || strcmp(val+len-4,".lyt") != 0)
 			strncat(layoutPath, ".lyt", sizeof(layoutPath) - strlen(layoutPath) - 1);