diff -ru webalizer-2.01.10/graphs.c webalizer-2.01.10-new/graphs.c
--- webalizer-2.01.10/graphs.c	2001-06-15 11:34:24.000000000 +0300
+++ webalizer-2.01.10-new/graphs.c	2002-10-24 06:20:27.000000000 +0300
@@ -654,7 +654,7 @@
          gdImageLine(im, CX, CY, gdata.x, gdata.y, black);
          gdImageFill(im, gdata.mx, gdata.my, i+4);
 
-         sprintf(buffer,"%s (%d%%)",legend[i], percent);
+         snprintf(buffer,sizeof(buffer),"%s (%d%%)",legend[i], percent);
          x=480-(strlen(buffer)*7);
          gdImageString(im,gdFontMediumBold, x+1, y+1, buffer, black);
          gdImageString(im,gdFontMediumBold, x, y, buffer, i+4);
@@ -667,7 +667,8 @@
       gdata=*calc_arc(s_arc,1.0);
 
       gdImageFill(im, gdata.mx, gdata.my, white);
-      sprintf(buffer,"%s (%d%%)",msg_h_other,100-(int)(s_arc*100));
+      snprintf(buffer,sizeof(buffer),"%s (%d%%)",
+	       msg_h_other,100-(int)(s_arc*100));
       x=480-(strlen(buffer)*7);
       gdImageString(im,gdFontMediumBold, x+1, y+1, buffer, black);
       gdImageString(im,gdFontMediumBold, x, y, buffer, white);
diff -ru webalizer-2.01.10/output.c webalizer-2.01.10-new/output.c
--- webalizer-2.01.10/output.c	2001-06-15 11:34:24.000000000 +0300
+++ webalizer-2.01.10-new/output.c	2002-10-24 06:29:56.000000000 +0300
@@ -295,14 +295,16 @@
    hist_lday[i]  =  l_day;
 
    /* fill in filenames */
-   sprintf(html_fname,"usage_%04d%02d.%s",cur_year,cur_month,html_ext);
+   snprintf(html_fname,sizeof(html_fname),"usage_%04d%02d.%s",
+            cur_year,cur_month,html_ext);
    sprintf(png1_fname,"daily_usage_%04d%02d.png",cur_year,cur_month);
    sprintf(png2_fname,"hourly_usage_%04d%02d.png",cur_year,cur_month);
 
    /* create PNG images for web page */
    if (daily_graph)
    {
-      sprintf(dtitle,"%s %s %d",msg_hmth_du,l_month[cur_month-1],cur_year);
+      snprintf(dtitle,sizeof(dtitle),"%s %s %d",
+               msg_hmth_du,l_month[cur_month-1],cur_year);
       month_graph6 (  png1_fname,          /* filename          */
                       dtitle,              /* graph title       */
                       cur_month,           /* graph month       */
@@ -317,7 +319,8 @@
 
    if (hourly_graph)
    {
-      sprintf(htitle,"%s %s %d",msg_hmth_hu,l_month[cur_month-1],cur_year);
+      snprintf(htitle,sizeof(htitle),"%s %s %d",
+               msg_hmth_hu,l_month[cur_month-1],cur_year);
       day_graph3(    png2_fname,
                      htitle,
                      th_hit,
@@ -329,7 +332,7 @@
    /* first, open the file */
    if ( (out_fp=open_out_file(html_fname))==NULL ) return 1;
 
-   sprintf(buffer,"%s %d",l_month[cur_month-1],cur_year);
+   snprintf(buffer,sizeof(buffer),"%s %d",l_month[cur_month-1],cur_year);
    write_html_head(buffer, out_fp);
    month_links();
    month_total_table();
@@ -938,12 +941,14 @@
    int      i=(h_grp)?1:0;
 
    /* generate file name */
-   sprintf(site_fname,"site_%04d%02d.%s",cur_year,cur_month,html_ext);
+   snprintf(site_fname,sizeof(site_fname),"site_%04d%02d.%s",
+            cur_year,cur_month,html_ext);
 
    /* open file */
    if ( (out_fp=open_out_file(site_fname))==NULL ) return 0;
 
-   sprintf(buffer,"%s %d - %s",l_month[cur_month-1],cur_year,msg_h_sites);
+   snprintf(buffer,sizeof(buffer),"%s %d - %s",
+            l_month[cur_month-1],cur_year,msg_h_sites);
    write_html_head(buffer, out_fp);
 
    fprintf(out_fp,"<FONT SIZE=\"-1\"></CENTER><PRE>\n");
@@ -1143,12 +1148,14 @@
    int      i=(u_grp)?1:0;
 
    /* generate file name */
-   sprintf(url_fname,"url_%04d%02d.%s",cur_year,cur_month,html_ext);
+   snprintf(url_fname,sizeof(url_fname),"url_%04d%02d.%s",
+            cur_year,cur_month,html_ext);
 
    /* open file */
    if ( (out_fp=open_out_file(url_fname))==NULL ) return 0;
 
-   sprintf(buffer,"%s %d - %s",l_month[cur_month-1],cur_year,msg_h_url);
+   snprintf(buffer,sizeof(buffer),"%s %d - %s",
+            l_month[cur_month-1],cur_year,msg_h_url);
    write_html_head(buffer, out_fp);
 
    fprintf(out_fp,"<FONT SIZE=\"-1\"></CENTER><PRE>\n");
@@ -1414,12 +1421,14 @@
    int      i=(r_grp)?1:0;
 
    /* generate file name */
-   sprintf(ref_fname,"ref_%04d%02d.%s",cur_year,cur_month,html_ext);
+   snprintf(ref_fname,sizeof(ref_fname),"ref_%04d%02d.%s",
+            cur_year,cur_month,html_ext);
 
    /* open file */
    if ( (out_fp=open_out_file(ref_fname))==NULL ) return 0;
 
-   sprintf(buffer,"%s %d - %s",l_month[cur_month-1],cur_year,msg_h_ref);
+   snprintf(buffer,sizeof(buffer),"%s %d - %s",
+            l_month[cur_month-1],cur_year,msg_h_ref);
    write_html_head(buffer, out_fp);
 
    fprintf(out_fp,"<FONT SIZE=\"-1\"></CENTER><PRE>\n");
@@ -1566,12 +1575,14 @@
    int      i=(a_grp)?1:0;
 
    /* generate file name */
-   sprintf(agent_fname,"agent_%04d%02d.%s",cur_year,cur_month,html_ext);
+   snprintf(agent_fname,sizeof(agent_fname),"agent_%04d%02d.%s",
+            cur_year,cur_month,html_ext);
 
    /* open file */
    if ( (out_fp=open_out_file(agent_fname))==NULL ) return 0;
 
-   sprintf(buffer,"%s %d - %s",l_month[cur_month-1],cur_year,msg_h_agent);
+   snprintf(buffer,sizeof(buffer),"%s %d - %s",
+            l_month[cur_month-1],cur_year,msg_h_agent);
    write_html_head(buffer, out_fp);
 
    fprintf(out_fp,"<FONT SIZE=\"-1\"></CENTER><PRE>\n");
@@ -1700,12 +1711,14 @@
    if (!tot_num) return 0;
 
    /* generate file name */
-   sprintf(search_fname,"search_%04d%02d.%s",cur_year,cur_month,html_ext);
+   snprintf(search_fname,sizeof(search_fname),"search_%04d%02d.%s",
+            cur_year,cur_month,html_ext);
 
    /* open file */
    if ( (out_fp=open_out_file(search_fname))==NULL ) return 0;
 
-   sprintf(buffer,"%s %d - %s",l_month[cur_month-1],cur_year,msg_h_search);
+   snprintf(buffer,sizeof(buffer),"%s %d - %s",
+            l_month[cur_month-1],cur_year,msg_h_search);
    write_html_head(buffer, out_fp);
 
    fprintf(out_fp,"<FONT SIZE=\"-1\"></CENTER><PRE>\n");
@@ -1843,12 +1856,14 @@
    int      i=(i_grp)?1:0;
 
    /* generate file name */
-   sprintf(user_fname,"user_%04d%02d.%s",cur_year,cur_month,html_ext);
+   snprintf(user_fname,sizeof(user_fname),"user_%04d%02d.%s",
+            cur_year,cur_month,html_ext);
 
    /* open file */
    if ( (out_fp=open_out_file(user_fname))==NULL ) return 0;
 
-   sprintf(buffer,"%s %d - %s",l_month[cur_month-1],cur_year,msg_h_uname);
+   snprintf(buffer,sizeof(buffer),"%s %d - %s",
+            l_month[cur_month-1],cur_year,msg_h_uname);
    write_html_head(buffer, out_fp);
 
    fprintf(out_fp,"<FONT SIZE=\"-1\"></CENTER><PRE>\n");
@@ -1998,7 +2013,8 @@
          pie_data[i]=top_ctrys[i]->count;           /* load the array       */
          pie_legend[i]=top_ctrys[i]->desc;
       }
-      sprintf(pie_title,"%s %s %d",msg_ctry_use,l_month[cur_month-1],cur_year);
+      snprintf(pie_title,sizeof(pie_title),"%s %s %d",
+               msg_ctry_use,l_month[cur_month-1],cur_year);
       sprintf(pie_fname,"ctry_usage_%04d%02d.png",cur_year,cur_month);
 
       pie_chart(pie_fname,pie_title,t_hit,pie_data,pie_legend);  /* do it   */
@@ -2063,7 +2079,7 @@
    u_long   cnt=a_ctr;
 
    /* generate file name */
-   sprintf(filename,"%s/site_%04d%02d.%s",
+   snprintf(filename,sizeof(filename),"%s/site_%04d%02d.%s",
       (dump_path)?dump_path:".",cur_year,cur_month,dump_ext);
 
    /* open file */
@@ -2106,7 +2122,7 @@
    u_long   cnt=a_ctr;
 
    /* generate file name */
-   sprintf(filename,"%s/url_%04d%02d.%s",
+   snprintf(filename,sizeof(filename),"%s/url_%04d%02d.%s",
       (dump_path)?dump_path:".",cur_year,cur_month,dump_ext);
 
    /* open file */
@@ -2146,7 +2162,7 @@
    u_long   cnt=a_ctr;
 
    /* generate file name */
-   sprintf(filename,"%s/ref_%04d%02d.%s",
+   snprintf(filename,sizeof(filename),"%s/ref_%04d%02d.%s",
       (dump_path)?dump_path:".",cur_year,cur_month,dump_ext);
 
    /* open file */
@@ -2185,7 +2201,7 @@
    u_char   cnt=a_ctr;
 
    /* generate file name */
-   sprintf(filename,"%s/agent_%04d%02d.%s",
+   snprintf(filename,sizeof(filename),"%s/agent_%04d%02d.%s",
       (dump_path)?dump_path:".",cur_year,cur_month,dump_ext);
 
    /* open file */
@@ -2224,7 +2240,7 @@
    u_long   cnt=a_ctr;
 
    /* generate file name */
-   sprintf(filename,"%s/user_%04d%02d.%s",
+   snprintf(filename,sizeof(filename),"%s/user_%04d%02d.%s",
       (dump_path)?dump_path:".",cur_year,cur_month,dump_ext);
 
    /* open file */
@@ -2267,7 +2283,7 @@
    u_char   cnt=a_ctr;
 
    /* generate file name */
-   sprintf(filename,"%s/search_%04d%02d.%s",
+   snprintf(filename,sizeof(filename),"%s/search_%04d%02d.%s",
       (dump_path)?dump_path:".",cur_year,cur_month,dump_ext);
 
    /* open file */
@@ -2312,7 +2328,7 @@
 
    if (verbose>1) printf("%s\n",msg_gen_sum);
 
-   sprintf(buffer,"%s %s",msg_main_us,hname);
+   snprintf(buffer,sizeof(buffer),"%s %s",msg_main_us,hname);
 
    for (i=0;i<12;i++)                   /* get last month in history */
    {
@@ -2338,7 +2354,7 @@
                    hist_visit);         /* data set 6        */
 
    /* now do html stuff... */
-   sprintf(index_fname,"index.%s",html_ext);
+   snprintf(index_fname,sizeof(index_fname),"index.%s",html_ext);
 
    if ( (out_fp=fopen(index_fname,"w")) == NULL)
    {
diff -ru webalizer-2.01.10/parser.c webalizer-2.01.10-new/parser.c
--- webalizer-2.01.10/parser.c	2001-06-15 11:34:24.000000000 +0300
+++ webalizer-2.01.10-new/parser.c	2002-10-24 06:12:34.000000000 +0300
@@ -162,7 +162,8 @@
    if (i<1 || i>31) return 0;
 
    /* format date/time field         */
-   sprintf(log_rec.datetime,"[%02d/%s/%4d:%s -0000]",i,cpx,j,cpy);
+   snprintf(log_rec.datetime,sizeof(log_rec.datetime),
+	    "[%02d/%s/%4d:%s -0000]",i,cpx,j,cpy);
 
    /* skip seconds... */
    while (*cp1!=0 && cp1<eob) cp1++;
@@ -196,8 +197,10 @@
    while (*cp1==0) cp1++;
 
    /* fabricate an appropriate request string based on direction */
-   if (*cp1=='i') sprintf(log_rec.url,"\"POST %s HTTP/1.0\"",cpx);
-      else        sprintf(log_rec.url,"\"GET %s HTTP/1.0\"",cpx);
+   if (*cp1=='i')
+      snprintf(log_rec.url,sizeof(log_rec.url),"\"POST %s HTTP/1.0\"",cpx);
+   else
+      snprintf(log_rec.url,sizeof(log_rec.url),"\"GET %s HTTP/1.0\"",cpx);
 
    if (cp1<eob) cp1++;
    if (cp1<eob) cp1++;
diff -ru webalizer-2.01.10/preserve.c webalizer-2.01.10-new/preserve.c
--- webalizer-2.01.10/preserve.c	2001-10-24 09:22:42.000000000 +0300
+++ webalizer-2.01.10-new/preserve.c	2002-10-24 06:16:02.000000000 +0300
@@ -203,7 +203,7 @@
 
    /* first, save the easy stuff */
    /* Header record */
-   sprintf(buffer,
+   snprintf(buffer,sizeof(buffer),
      "# Webalizer V%s-%s Incremental Data - %02d/%02d/%04d %02d:%02d:%02d\n",
       version,editlvl,cur_month,cur_day,cur_year,cur_hour,cur_min,cur_sec);
    if (fputs(buffer,fp)==EOF) return 1;  /* error exit */
@@ -255,8 +255,8 @@
       uptr=um_htab[i];
       while (uptr!=NULL)
       {
-         sprintf(buffer,"%s\n%d %lu %lu %.0f %lu %lu\n", uptr->string,
-              uptr->flag, uptr->count, uptr->files, uptr->xfer,
+         snprintf(buffer,sizeof(buffer),"%s\n%d %lu %lu %.0f %lu %lu\n",
+	      uptr->string, uptr->flag, uptr->count, uptr->files, uptr->xfer,
               uptr->entry, uptr->exit);
          if (fputs(buffer,fp)==EOF) return 1;
          uptr=uptr->next;
@@ -272,7 +272,7 @@
       hptr=sm_htab[i];
       while (hptr!=NULL)
       {
-         sprintf(buffer,"%s\n%d %lu %lu %.0f %lu %lu\n%s\n",
+         snprintf(buffer,sizeof(buffer),"%s\n%d %lu %lu %.0f %lu %lu\n%s\n",
               hptr->string,
               hptr->flag,
               hptr->count,
@@ -294,7 +294,7 @@
       hptr=sd_htab[i];
       while (hptr!=NULL)
       {
-         sprintf(buffer,"%s\n%d %lu %lu %.0f %lu %lu\n%s\n",
+         snprintf(buffer,sizeof(buffer),"%s\n%d %lu %lu %.0f %lu %lu\n%s\n",
               hptr->string,
               hptr->flag,
               hptr->count,
@@ -318,7 +318,7 @@
          rptr=rm_htab[i];
          while (rptr!=NULL)
          {
-            sprintf(buffer,"%s\n%d %lu\n", rptr->string,
+            snprintf(buffer,sizeof(buffer),"%s\n%d %lu\n", rptr->string,
                  rptr->flag, rptr->count);
             if (fputs(buffer,fp)==EOF) return 1;  /* error exit */
             rptr=rptr->next;
@@ -336,7 +336,7 @@
          aptr=am_htab[i];
          while (aptr!=NULL)
          {
-            sprintf(buffer,"%s\n%d %lu\n", aptr->string,
+            snprintf(buffer,sizeof(buffer),"%s\n%d %lu\n", aptr->string,
                  aptr->flag, aptr->count);
             if (fputs(buffer,fp)==EOF) return 1;  /* error exit */
             aptr=aptr->next;
@@ -352,7 +352,7 @@
       sptr=sr_htab[i];
       while (sptr!=NULL)
       {
-         sprintf(buffer,"%s\n%lu\n", sptr->string,sptr->count);
+         snprintf(buffer,sizeof(buffer),"%s\n%lu\n", sptr->string,sptr->count);
          if (fputs(buffer,fp)==EOF) return 1;  /* error exit */
          sptr=sptr->next;
       }
@@ -367,7 +367,7 @@
       iptr=im_htab[i];
       while (iptr!=NULL)
       {
-         sprintf(buffer,"%s\n%d %lu %lu %.0f %lu %lu\n",
+         snprintf(buffer,sizeof(buffer),"%s\n%d %lu %lu %.0f %lu %lu\n",
               iptr->string,
               iptr->flag,
               iptr->count,
diff -ru webalizer-2.01.10/webalizer.c webalizer-2.01.10-new/webalizer.c
--- webalizer-2.01.10/webalizer.c	2002-04-17 01:11:31.000000000 +0300
+++ webalizer-2.01.10-new/webalizer.c	2002-10-24 06:42:00.000000000 +0300
@@ -1809,7 +1809,8 @@
    if ( (cps=isinglist(search_list,log_rec.refer))==NULL) return; 
 
    /* Try to find query variable */
-   srch[0]='?'; strcpy(&srch[1],cps);              /* First, try "?..."      */
+   srch[0]='?'; srch[sizeof(srch)-1] = '\0';
+   strncpy(&srch[1],cps,sizeof(srch)-2);           /* First, try "?...   "   */
    if ((cp1=strstr(ptr,srch))==NULL)
    {
       srch[0]='&';                                 /* Next, try "&..."       */