diff --git a/manifest b/manifest
index ba3e556ae2..01b0d927b8 100644
--- a/manifest
+++ b/manifest
@@ -1,5 +1,5 @@
-C Test\scases\sand\scorrections\sto\sIO\sand\smalloc()\serror\shandling\sin\sincremental\sblob\sIO\sfunctions.\s(CVS\s3915)
-D 2007-05-04T12:05:56
+C Eliminate\sall\suses\sof\ssprintf()\sand\sstrcpy().\s\sThese\swere\snot\sbeing\nmisused.\s\sBut\sgetting\srid\sof\sthem\sremoves\sa\slibrary\sdependency.\s\sAnd\nit\savoids\swarnings\sfrom\sthe\sOpenBSD\scompiler.\s\sTicket\s#2336.\s(CVS\s3916)
+D 2007-05-04T13:15:56
 F Makefile.in 8cab54f7c9f5af8f22fd97ddf1ecfd1e1860de62
 F Makefile.linux-gcc 2d8574d1ba75f129aba2019f0b959db380a90935
 F README 9c4e2d6706bdcc3efdd773ce752a8cdab4f90028
@@ -57,22 +57,22 @@ F sqlite3.def a96c1d0d39362b763d2ddba220a32da41a15c4b4
 F sqlite3.pc.in 985b9bf34192a549d7d370e0f0b6b34a4f61369a
 F src/alter.c 2c79ec40f65e33deaf90ca493422c74586e481a3
 F src/analyze.c 4bbf5ddf9680587c6d4917e02e378b6037be3651
-F src/attach.c a16ada4a4654a0d126b8223ec9494ebb81bc5c3c
+F src/attach.c f088f8155541ff75542239ec40cf05f3d81390ba
 F src/auth.c 902f4722661c796b97f007d9606bd7529c02597f
-F src/btree.c a47fe8172eb62468f78a2fe4904d2e6b050038fb
+F src/btree.c ebf16f19fc9e732c93b98083c4dfdbadad247e5c
 F src/btree.h 2c187d60cf76d74c2b4767294d6b5fa267037ff0
-F src/build.c 02e01ec7907c7d947ab3041fda0e81eaed05db42
+F src/build.c 05ef6d80d957d17f6458afc04b81aa00cb4cb093
 F src/callback.c 6414ed32d55859d0f65067aa5b88d2da27b3af9e
 F src/complete.c 7d1a44be8f37de125fcafd3d3a018690b3799675
-F src/date.c 94a6777df13d2aaacd19de080d9e8d3444364133
+F src/date.c c34a9c86ffd6da4cb3903ea038d977ec539d07e2
 F src/delete.c 5c0d89b3ef7d48fe1f5124bfe8341f982747fe29
 F src/experimental.c 1b2d1a6cd62ecc39610e97670332ca073c50792b
 F src/expr.c 2f0f9f89efe9170e5e6ca5d5e93a9d5896fff5ac
-F src/func.c a4bc09fe4fdf3cbab8840ae8d8b76ca1f338de22
+F src/func.c 9445a7e20cfc1a04aa5e8c982b36e39cef851ff9
 F src/hash.c 67b23e14f0257b69a3e8aa663e4eeadc1a2b6fd5
 F src/hash.h 1b3f7e2609141fd571f62199fc38687d262e9564
-F src/insert.c 413cc06990cb3c401e64e596776c1e43934f8841
-F src/legacy.c c05a599a37f703ed1e66fdb5df60c2db65f29e71
+F src/insert.c e595ca26805dfb3a9ebaabc28e7947c479f3b14d
+F src/legacy.c 388c71ad7fbcd898ba1bcbfc98a3ac954bfa5d01
 F src/loadext.c afe4f4755dc49c36ef505748bbdddecb9f1d02a2
 F src/main.c e6eb036c3580ba9116fedfe4a8b58ed63d5abb37
 F src/md5.c c5fdfa5c2593eaee2e32a5ce6c6927c986eaf217
@@ -83,25 +83,25 @@ F src/os_os2.c 2ce97909b926a598823f97338027dbec1dcf4165
 F src/os_os2.h e5f17dd69333632bbc3112881ea407c37d245eb3
 F src/os_test.c 49833426101f99aee4bb5f6a44b7c4b2029fda1c
 F src/os_test.h 903c93554c23d88f34f667f1979e4a1cee792af3
-F src/os_unix.c 426b4c03c304ad78746d65d9ba101e0b72e18e23
+F src/os_unix.c cb1fb044b84870c7b1b8b2902e9d7be779f8b7ce
 F src/os_unix.h 5768d56d28240d3fe4537fac08cc85e4fb52279e
-F src/os_win.c e94903c7dc1c0599c8ddce42efa0b6928068ddc5
+F src/os_win.c 5e9e3d2aeed4d6f1b6ae81e866919f4f43b4a23d
 F src/os_win.h 41a946bea10f61c158ce8645e7646b29d44f122b
-F src/pager.c 680e42a6e0306f43b3e52127324a7bcc8d3ce65b
+F src/pager.c f01e0e577b7b54c3cdba24a30ecc585a805f23fa
 F src/pager.h d652ddf092d2318d00e41f8539760fe8e57c157c
 F src/parse.y a3940369e12c69c4968aa580cdc74cf73a664980
 F src/pragma.c 4fdefc03c3fd0ee87f8aad82bf80ba9bf1cdf416
 F src/prepare.c 03277063bc4f5860efbf23548fa0123ac0f6eaec
 F src/printf.c 0c6f40648770831341ac45ab32423a80b4c87f05
 F src/random.c 6119474a6f6917f708c1dee25b9a8e519a620e88
-F src/select.c 3c8f3bc7fd823abb8af30ec89ba6bcc515923fa1
+F src/select.c e6a2546de63cd9cdad2499e224f8535743b99f1a
 F src/server.c 087b92a39d883e3fa113cae259d64e4c7438bc96
-F src/shell.c 762c81655da0f01067514924a5ba8f47a47ada1d
+F src/shell.c d07ae326b3815d80f71c69b3c7584382e47f6447
 F src/sqlite.h.in a666300976897eced975b448f722a722b362c6b1
 F src/sqlite3ext.h 7d0d363ea7327e817ef0dfe1b7eee1f171b72890
 F src/sqliteInt.h 5a8c0221a4f11998f46aa76364a9559af8d7c1f7
-F src/table.c 6d0da66dde26ee75614ed8f584a1996467088d06
-F src/tclsqlite.c 0906902b96e4b292ba98499dd380e22d3322f817
+F src/table.c a8de75bcedf84d4060d804264b067ab3b1a3561d
+F src/tclsqlite.c cd87bbaffd115ded71b4b9c03be7b5b213c4ba7a
 F src/test1.c 29a39fdde51f4612082ecf3f5af54dac93766f87
 F src/test2.c 24458b17ab2f3c90cbc1c8446bd7ffe69be62f88
 F src/test3.c 946ea9d1a8c928656e3c70f0a2fcb8e733a15e86
@@ -123,18 +123,18 @@ F src/tokenize.c 7d611fc942ca0b12514eea2e1fbb148a65af23f2
 F src/trigger.c 420192efe3e6f03addf7897c60c3c8bf913d3493
 F src/update.c 3359041db390a8f856d67272f299600e2104f350
 F src/utf.c e64a48bc21aa973eb622dd47da87d56a4cdcf528
-F src/util.c b6344325378e75b9e18175d8b6aed1723d73dad9
+F src/util.c 9f9fec5dc7ffab8ff982508d03af37269a59ff91
 F src/vacuum.c 8bd895d29e7074e78d4e80f948e35ddc9cf2beef
-F src/vdbe.c a4abf744b5376372a9be30f02ab4b231f353cab1
+F src/vdbe.c 74f348b125187f4bebd8bbba381e9be7de0a2bcf
 F src/vdbe.h 0025259af1939fb264a545816c69e4b5b8d52691
 F src/vdbeInt.h cb02cbbceddf3b40d49012e9f41576f17bcbec97
 F src/vdbeapi.c 37d793559390bec8a00c556f651f21b5f9e589af
-F src/vdbeaux.c 966d166f9d4079552c7cb48855afe8c1aa331556
-F src/vdbeblob.c 58b3f68f6bc18b58aeab3a31cff083cb4127292f
+F src/vdbeaux.c c432e17fef6efaf102d507e979cee4e47f6ceac4
+F src/vdbeblob.c 2944bca84a40c093d442a06ad7835cb00a6b1c0a
 F src/vdbefifo.c 3ca8049c561d5d67cbcb94dc909ae9bb68c0bf8f
 F src/vdbemem.c ba98f8572ec4609846b368fa7580db178022f1bb
-F src/vtab.c 89a0d5f39c1beba65a77fdb4d507b831fc5e6baf
-F src/where.c 0f17b7bed2ce50ba450e8f436d5ec8b420c4ab3f
+F src/vtab.c c5ebebf615b2f29499fbe97a584c4bb342632aa0
+F src/where.c f3920748cc650fc25ac916215500bdb90dee568e
 F tclinstaller.tcl 4356d9d94d2b5ed5e68f9f0c80c4df3048dd7617
 F test/aggerror.test a867e273ef9e3d7919f03ef4f0e8c0d2767944f2
 F test/all.test a8dca528354b70a52f130e1bb33dedc6848862a1
@@ -194,7 +194,7 @@ F test/crash.test 167eb4652eccbedb199b6f21850346c3f5d779fb
 F test/crash2.test 423c6ec404d15b7d7d0e40aef0a26740cce6075f
 F test/crashtest1.c 09c1c7d728ccf4feb9e481671e29dda5669bbcc2
 F test/createtab.test 9f122ca39bae0decf59416779d4d7d1eeb26e18f
-F test/date.test 09786cf0145147014867d822224b9bced2012b61
+F test/date.test 4834d022b2fa5982cafed20938f7523a7475e4cd
 F test/default.test 252298e42a680146b1dd64f563b95bdf088d94fb
 F test/delete.test 525a6953bc3978780cae35f3eaf1027cf4ce887d
 F test/delete2.test c06be3806ba804bc8c6f134476816080280b40e3
@@ -474,7 +474,7 @@ F www/tclsqlite.tcl bb0d1357328a42b1993d78573e587c6dcbc964b9
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl fc46eae081251c3c181bd79c5faef8195d7991a5
-P 2d37687a08a7b6b3a7f77f55a7c2e29a1f8731a8
-R 631ed7d60317b63e0f0649096fcada2a
-U danielk1977
-Z dfc7741fad7b57c2866d720631f3b47d
+P 641e55284e1ba6070073c83ac6ed78ffb29f7e60
+R 4cdecc280e220d3e1cee8e04f6997968
+U drh
+Z 99090230812abe75d62b878273731ef5
diff --git a/manifest.uuid b/manifest.uuid
index f9069a3c1f..946bfb5dec 100644
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-641e55284e1ba6070073c83ac6ed78ffb29f7e60
\ No newline at end of file
+ba4845b32bdf38e623c4f7246e6e327715bbba4b
\ No newline at end of file
diff --git a/src/attach.c b/src/attach.c
index 41bf90b33b..b25eed250c 100644
--- a/src/attach.c
+++ b/src/attach.c
@@ -11,7 +11,7 @@
 *************************************************************************
 ** This file contains code used to implement the ATTACH and DETACH commands.
 **
-** $Id: attach.c,v 1.57 2007/03/27 21:47:07 drh Exp $
+** $Id: attach.c,v 1.58 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 
@@ -90,7 +90,8 @@ static void attachFunc(
     goto attach_error;
   }
   if( !db->autoCommit ){
-    strcpy(zErr, "cannot ATTACH database within transaction");
+    sqlite3_snprintf(sizeof(zErr), zErr,
+                     "cannot ATTACH database within transaction");
     goto attach_error;
   }
   for(i=0; i<db->nDb; i++){
@@ -130,7 +131,7 @@ static void attachFunc(
     if( !aNew->pSchema ){
       rc = SQLITE_NOMEM;
     }else if( aNew->pSchema->file_format && aNew->pSchema->enc!=ENC(db) ){
-      strcpy(zErr, 
+      sqlite3_snprintf(sizeof(zErr), zErr, 
         "attached databases must use the same text encoding as main database");
       goto attach_error;
     }
@@ -246,7 +247,8 @@ static void detachFunc(
     goto detach_error;
   }
   if( !db->autoCommit ){
-    strcpy(zErr, "cannot DETACH database within transaction");
+    sqlite3_snprintf(sizeof(zErr), zErr,
+                     "cannot DETACH database within transaction");
     goto detach_error;
   }
   if( sqlite3BtreeIsInReadTrans(pDb->pBt) ){
diff --git a/src/btree.c b/src/btree.c
index 7a786602e3..cfdb91813d 100644
--- a/src/btree.c
+++ b/src/btree.c
@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.372 2007/05/04 12:05:56 danielk1977 Exp $
+** $Id: btree.c,v 1.373 2007/05/04 13:15:56 drh Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** For a detailed discussion of BTrees, refer to
@@ -6237,7 +6237,7 @@ static int btreePageDump(BtShared *pBt, int pgno, int recursive, MemPage *pParen
     pCell = &data[addr];
     parseCellPtr(pPage, pCell, &info);
     sz = info.nSize;
-    sprintf(range,"%d..%d", addr, addr+sz-1);
+    sqlite3_snprintf(sizeof(range),range,"%d..%d", addr, addr+sz-1);
     if( pPage->leaf ){
       child = 0;
     }else{
@@ -6264,7 +6264,7 @@ static int btreePageDump(BtShared *pBt, int pgno, int recursive, MemPage *pParen
   idx = get2byte(&data[hdr+1]);
   while( idx>0 && idx<pPage->pBt->usableSize ){
     int sz = get2byte(&data[idx+2]);
-    sprintf(range,"%d..%d", idx, idx+sz-1);
+    sqlite3_snprintf(sizeof(range),range,"%d..%d", idx, idx+sz-1);
     nFree += sz;
     sqlite3DebugPrintf("freeblock %2d: i=%-10s size=%-4d total=%d\n",
        i, range, sz, nFree);
@@ -6579,7 +6579,7 @@ static int checkTreePage(
   char zContext[100];
   char *hit;
 
-  sprintf(zContext, "Page %d: ", iPage);
+  sqlite3_snprintf(sizeof(zContext), zContext, "Page %d: ", iPage);
 
   /* Check that the page exists
   */
@@ -6608,7 +6608,8 @@ static int checkTreePage(
 
     /* Check payload overflow pages
     */
-    sprintf(zContext, "On tree page %d cell %d: ", iPage, i);
+    sqlite3_snprintf(sizeof(zContext), zContext,
+             "On tree page %d cell %d: ", iPage, i);
     pCell = findCell(pPage,i);
     parseCellPtr(pPage, pCell, &info);
     sz = info.nData;
@@ -6643,7 +6644,8 @@ static int checkTreePage(
   }
   if( !pPage->leaf ){
     pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
-    sprintf(zContext, "On page %d at right child: ", iPage);
+    sqlite3_snprintf(sizeof(zContext), zContext, 
+                     "On page %d at right child: ", iPage);
 #ifndef SQLITE_OMIT_AUTOVACUUM
     if( pBt->autoVacuum ){
       checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, 0);
diff --git a/src/build.c b/src/build.c
index d3ecf4f673..11e01fbabd 100644
--- a/src/build.c
+++ b/src/build.c
@@ -22,7 +22,7 @@
 **     COMMIT
 **     ROLLBACK
 **
-** $Id: build.c,v 1.422 2007/04/26 14:42:36 danielk1977 Exp $
+** $Id: build.c,v 1.423 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include <ctype.h>
@@ -1322,22 +1322,24 @@ static char *createTableStmt(Table *p, int isTemp){
   n += 35 + 6*p->nCol;
   zStmt = sqliteMallocRaw( n );
   if( zStmt==0 ) return 0;
-  strcpy(zStmt, !OMIT_TEMPDB&&isTemp ? "CREATE TEMP TABLE ":"CREATE TABLE ");
+  sqlite3_snprintf(n, zStmt,
+                  !OMIT_TEMPDB&&isTemp ? "CREATE TEMP TABLE ":"CREATE TABLE ");
   k = strlen(zStmt);
   identPut(zStmt, &k, p->zName);
   zStmt[k++] = '(';
   for(pCol=p->aCol, i=0; i<p->nCol; i++, pCol++){
-    strcpy(&zStmt[k], zSep);
+    sqlite3_snprintf(n-k, &zStmt[k], zSep);
     k += strlen(&zStmt[k]);
     zSep = zSep2;
     identPut(zStmt, &k, pCol->zName);
     if( (z = pCol->zType)!=0 ){
       zStmt[k++] = ' ';
-      strcpy(&zStmt[k], z);
+      assert( strlen(z)+k+1<=n );
+      sqlite3_snprintf(n-k, &zStmt[k], "%s", z);
       k += strlen(z);
     }
   }
-  strcpy(&zStmt[k], zEnd);
+  sqlite3_snprintf(n-k, &zStmt[k], "%s", zEnd);
   return zStmt;
 }
 
@@ -2355,7 +2357,7 @@ void sqlite3CreateIndex(
     int n;
     Index *pLoop;
     for(pLoop=pTab->pIndex, n=1; pLoop; pLoop=pLoop->pNext, n++){}
-    sprintf(zBuf,"_%d",n);
+    sqlite3_snprintf(sizeof(zBuf),zBuf,"_%d",n);
     zName = 0;
     sqlite3SetString(&zName, "sqlite_autoindex_", pTab->zName, zBuf, (char*)0);
     if( zName==0 ) goto exit_create_index;
@@ -2420,7 +2422,7 @@ void sqlite3CreateIndex(
   pIndex->aSortOrder = (u8 *)(&pIndex->aiRowEst[nCol+1]);
   pIndex->zName = (char *)(&pIndex->aSortOrder[nCol]);
   zExtra = (char *)(&pIndex->zName[nName+1]);
-  strcpy(pIndex->zName, zName);
+  memcpy(pIndex->zName, zName, nName+1);
   pIndex->pTable = pTab;
   pIndex->nColumn = pList->nExpr;
   pIndex->onError = onError;
@@ -2463,7 +2465,7 @@ void sqlite3CreateIndex(
     if( pListItem->pExpr ){
       assert( pListItem->pExpr->pColl );
       zColl = zExtra;
-      strcpy(zExtra, pListItem->pExpr->pColl->zName);
+      sqlite3_snprintf(nExtra, zExtra, "%s", pListItem->pExpr->pColl->zName);
       zExtra += (strlen(zColl) + 1);
     }else{
       zColl = pTab->aCol[j].zColl;
diff --git a/src/date.c b/src/date.c
index 5ff4045890..0f0522604a 100644
--- a/src/date.c
+++ b/src/date.c
@@ -16,7 +16,7 @@
 ** sqlite3RegisterDateTimeFunctions() found at the bottom of the file.
 ** All other code has file scope.
 **
-** $Id: date.c,v 1.63 2007/04/25 18:23:53 drh Exp $
+** $Id: date.c,v 1.64 2007/05/04 13:15:56 drh Exp $
 **
 ** NOTES:
 **
@@ -705,8 +705,8 @@ static void datetimeFunc(
   if( isDate(argc, argv, &x)==0 ){
     char zBuf[100];
     computeYMD_HMS(&x);
-    sprintf(zBuf, "%04d-%02d-%02d %02d:%02d:%02d",x.Y, x.M, x.D, x.h, x.m,
-           (int)(x.s));
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%04d-%02d-%02d %02d:%02d:%02d",
+                     x.Y, x.M, x.D, x.h, x.m, (int)(x.s));
     sqlite3_result_text(context, zBuf, -1, SQLITE_TRANSIENT);
   }
 }
@@ -725,7 +725,7 @@ static void timeFunc(
   if( isDate(argc, argv, &x)==0 ){
     char zBuf[100];
     computeHMS(&x);
-    sprintf(zBuf, "%02d:%02d:%02d", x.h, x.m, (int)x.s);
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%02d:%02d:%02d", x.h, x.m, (int)x.s);
     sqlite3_result_text(context, zBuf, -1, SQLITE_TRANSIENT);
   }
 }
@@ -744,7 +744,7 @@ static void dateFunc(
   if( isDate(argc, argv, &x)==0 ){
     char zBuf[100];
     computeYMD(&x);
-    sprintf(zBuf, "%04d-%02d-%02d", x.Y, x.M, x.D);
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%04d-%02d-%02d", x.Y, x.M, x.D);
     sqlite3_result_text(context, zBuf, -1, SQLITE_TRANSIENT);
   }
 }
@@ -826,7 +826,7 @@ static void strftimeFunc(
     }else{
       i++;
       switch( zFmt[i] ){
-        case 'd':  sprintf(&z[j],"%02d",x.D); j+=2; break;
+        case 'd':  sqlite3_snprintf(3, &z[j],"%02d",x.D); j+=2; break;
         case 'f': {
           double s = x.s;
           if( s>59.999 ) s = 59.999;
@@ -834,7 +834,7 @@ static void strftimeFunc(
           j += strlen(&z[j]);
           break;
         }
-        case 'H':  sprintf(&z[j],"%02d",x.h); j+=2; break;
+        case 'H':  sqlite3_snprintf(3, &z[j],"%02d",x.h); j+=2; break;
         case 'W': /* Fall thru */
         case 'j': {
           int nDay;             /* Number of days since 1st day of year */
@@ -847,25 +847,30 @@ static void strftimeFunc(
           if( zFmt[i]=='W' ){
             int wd;   /* 0=Monday, 1=Tuesday, ... 6=Sunday */
             wd = ((int)(x.rJD+0.5)) % 7;
-            sprintf(&z[j],"%02d",(nDay+7-wd)/7);
+            sqlite3_snprintf(3, &z[j],"%02d",(nDay+7-wd)/7);
             j += 2;
           }else{
-            sprintf(&z[j],"%03d",nDay+1);
+            sqlite3_snprintf(4, &z[j],"%03d",nDay+1);
             j += 3;
           }
           break;
         }
-        case 'J':  sprintf(&z[j],"%.16g",x.rJD); j+=strlen(&z[j]); break;
-        case 'm':  sprintf(&z[j],"%02d",x.M); j+=2; break;
-        case 'M':  sprintf(&z[j],"%02d",x.m); j+=2; break;
+        case 'J': {
+          sqlite3_snprintf(20, &z[j],"%.16g",x.rJD);
+          j+=strlen(&z[j]);
+          break;
+        }
+        case 'm':  sqlite3_snprintf(3, &z[j],"%02d",x.M); j+=2; break;
+        case 'M':  sqlite3_snprintf(3, &z[j],"%02d",x.m); j+=2; break;
         case 's': {
-          sprintf(&z[j],"%d",(int)((x.rJD-2440587.5)*86400.0 + 0.5));
+          sqlite3_snprintf(30,&z[j],"%d",
+                           (int)((x.rJD-2440587.5)*86400.0 + 0.5));
           j += strlen(&z[j]);
           break;
         }
-        case 'S':  sprintf(&z[j],"%02d",(int)x.s); j+=2; break;
+        case 'S':  sqlite3_snprintf(3,&z[j],"%02d",(int)x.s); j+=2; break;
         case 'w':  z[j++] = (((int)(x.rJD+1.5)) % 7) + '0'; break;
-        case 'Y':  sprintf(&z[j],"%04d",x.Y); j+=strlen(&z[j]); break;
+        case 'Y':  sqlite3_snprintf(5,&z[j],"%04d",x.Y); j+=strlen(&z[j]);break;
         case '%':  z[j++] = '%'; break;
       }
     }
diff --git a/src/func.c b/src/func.c
index c3279b4fe3..5e4b418d55 100644
--- a/src/func.c
+++ b/src/func.c
@@ -16,7 +16,7 @@
 ** sqliteRegisterBuildinFunctions() found at the bottom of the file.
 ** All other code has file scope.
 **
-** $Id: func.c,v 1.144 2007/05/02 02:08:29 drh Exp $
+** $Id: func.c,v 1.145 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include <ctype.h>
@@ -222,7 +222,7 @@ static void upperFunc(sqlite3_context *context, int argc, sqlite3_value **argv){
   if( z2 ){
     z1 = sqlite3_malloc(n+1);
     if( z1 ){
-      strcpy(z1, z2);
+      memcpy(z1, z2, n+1);
       for(i=0; z1[i]; i++){
         z1[i] = toupper(z1[i]);
       }
@@ -240,7 +240,7 @@ static void lowerFunc(sqlite3_context *context, int argc, sqlite3_value **argv){
   if( z2 ){
     z1 = sqlite3_malloc(n+1);
     if( z1 ){
-      strcpy(z1, z2);
+      memcpy(z1, z2, n+1);
       for(i=0; z1[i]; i++){
         z1[i] = tolower(z1[i]);
       }
diff --git a/src/insert.c b/src/insert.c
index 2bb70fc0ce..f18f55cebb 100644
--- a/src/insert.c
+++ b/src/insert.c
@@ -12,7 +12,7 @@
 ** This file contains C code routines that are called by the parser
 ** to handle INSERT statements in SQLite.
 **
-** $Id: insert.c,v 1.185 2007/04/18 14:24:33 danielk1977 Exp $
+** $Id: insert.c,v 1.186 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 
@@ -1122,25 +1122,26 @@ void sqlite3GenerateConstraintChecks(
       case OE_Fail: {
         int j, n1, n2;
         char zErrMsg[200];
-        strcpy(zErrMsg, pIdx->nColumn>1 ? "columns " : "column ");
+        sqlite3_snprintf(sizeof(zErrMsg), zErrMsg,
+                         pIdx->nColumn>1 ? "columns " : "column ");
         n1 = strlen(zErrMsg);
         for(j=0; j<pIdx->nColumn && n1<sizeof(zErrMsg)-30; j++){
           char *zCol = pTab->aCol[pIdx->aiColumn[j]].zName;
           n2 = strlen(zCol);
           if( j>0 ){
-            strcpy(&zErrMsg[n1], ", ");
+            sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], ", ");
             n1 += 2;
           }
           if( n1+n2>sizeof(zErrMsg)-30 ){
-            strcpy(&zErrMsg[n1], "...");
+            sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], "...");
             n1 += 3;
             break;
           }else{
-            strcpy(&zErrMsg[n1], zCol);
+            sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], "%s", zCol);
             n1 += n2;
           }
         }
-        strcpy(&zErrMsg[n1], 
+        sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], 
             pIdx->nColumn>1 ? " are not unique" : " is not unique");
         sqlite3VdbeOp3(v, OP_Halt, SQLITE_CONSTRAINT, onError, zErrMsg, 0);
         break;
diff --git a/src/legacy.c b/src/legacy.c
index a641663428..8d96b1e58b 100644
--- a/src/legacy.c
+++ b/src/legacy.c
@@ -14,7 +14,7 @@
 ** other files are for internal use by SQLite and should not be
 ** accessed by users of the library.
 **
-** $Id: legacy.c,v 1.17 2007/04/25 11:28:17 drh Exp $
+** $Id: legacy.c,v 1.18 2007/05/04 13:15:56 drh Exp $
 */
 
 #include "sqliteInt.h"
@@ -118,9 +118,10 @@ exec_out:
 
   rc = sqlite3ApiExit(0, rc);
   if( rc!=SQLITE_OK && rc==sqlite3_errcode(db) && pzErrMsg ){
-    *pzErrMsg = sqlite3_malloc(1+strlen(sqlite3_errmsg(db)));
+    int nErrMsg = 1 + strlen(sqlite3_errmsg(db));
+    *pzErrMsg = sqlite3_malloc(nErrMsg);
     if( *pzErrMsg ){
-      strcpy(*pzErrMsg, sqlite3_errmsg(db));
+      memcpy(*pzErrMsg, sqlite3_errmsg(db), nErrMsg);
     }
   }else if( pzErrMsg ){
     *pzErrMsg = 0;
diff --git a/src/os_unix.c b/src/os_unix.c
index 281348b79d..4d0b617985 100644
--- a/src/os_unix.c
+++ b/src/os_unix.c
@@ -959,7 +959,7 @@ int sqlite3UnixTempFileName(char *zBuf){
     break;
   }
   do{
-    sprintf(zBuf, "%s/"TEMP_FILE_PREFIX, zDir);
+    sqlite3_snprintf(SQLITE_TEMPNAME_SIZE, zBuf, "%s/"TEMP_FILE_PREFIX, zDir);
     j = strlen(zBuf);
     sqlite3Randomness(15, &zBuf[j]);
     for(i=0; i<15; i++, j++){
@@ -2518,33 +2518,40 @@ static int allocateUnixFile(
   }else{
     *pNew = f;
     switch(lockingStyle) {
-      case afpLockingStyle:
+      case afpLockingStyle: {
         /* afp locking uses the file path so it needs to be included in
         ** the afpLockingContext */
+        int nFilename;
         pNew->pMethod = &sqlite3AFPLockingUnixIoMethod;
         pNew->lockingContext = 
           sqlite3ThreadSafeMalloc(sizeof(afpLockingContext));
+        nFilename = strlen(zFilename)+1;
         ((afpLockingContext *)pNew->lockingContext)->filePath = 
-          sqlite3ThreadSafeMalloc(strlen(zFilename) + 1);
-        strcpy(((afpLockingContext *)pNew->lockingContext)->filePath, 
-               zFilename);
+          sqlite3ThreadSafeMalloc(nFilename);
+        memcpy(((afpLockingContext *)pNew->lockingContext)->filePath, 
+               zFilename, nFilename);
         srandomdev();
         break;
+      }
       case flockLockingStyle:
         /* flock locking doesn't need additional lockingContext information */
         pNew->pMethod = &sqlite3FlockLockingUnixIoMethod;
         break;
-      case dotlockLockingStyle:
+      case dotlockLockingStyle: {
         /* dotlock locking uses the file path so it needs to be included in
          ** the dotlockLockingContext */
+        int nFilename;
         pNew->pMethod = &sqlite3DotlockLockingUnixIoMethod;
         pNew->lockingContext = sqlite3ThreadSafeMalloc(
           sizeof(dotlockLockingContext));
+        nFilename = strlen(zFilename) + 6;
         ((dotlockLockingContext *)pNew->lockingContext)->lockPath = 
-            sqlite3ThreadSafeMalloc(strlen(zFilename) + strlen(".lock") + 1);
-        sprintf(((dotlockLockingContext *)pNew->lockingContext)->lockPath, 
+            sqlite3ThreadSafeMalloc( nFilename );
+        sqlite3_snprintf(nFilename, 
+                ((dotlockLockingContext *)pNew->lockingContext)->lockPath, 
                 "%s.lock", zFilename);
         break;
+      }
       case posixLockingStyle:
         /* posix locking doesn't need additional lockingContext information */
         pNew->pMethod = &sqlite3UnixIoMethod;
diff --git a/src/os_win.c b/src/os_win.c
index b15de03340..a61b71a4d3 100644
--- a/src/os_win.c
+++ b/src/os_win.c
@@ -946,7 +946,7 @@ int sqlite3WinTempFileName(char *zBuf){
   for(i=strlen(zTempPath); i>0 && zTempPath[i-1]=='\\'; i--){}
   zTempPath[i] = 0;
   for(;;){
-    sprintf(zBuf, "%s\\"TEMP_FILE_PREFIX, zTempPath);
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%s\\"TEMP_FILE_PREFIX, zTempPath);
     j = strlen(zBuf);
     sqlite3Randomness(15, &zBuf[j]);
     for(i=0; i<15; i++, j++){
diff --git a/src/pager.c b/src/pager.c
index eb9ccb4580..e9c0f408f4 100644
--- a/src/pager.c
+++ b/src/pager.c
@@ -18,7 +18,7 @@
 ** file simultaneously, or one process from reading the database while
 ** another is writing.
 **
-** @(#) $Id: pager.c,v 1.334 2007/05/04 12:01:03 drh Exp $
+** @(#) $Id: pager.c,v 1.335 2007/05/04 13:15:56 drh Exp $
 */
 #ifndef SQLITE_OMIT_DISKIO
 #include "sqliteInt.h"
@@ -1736,14 +1736,14 @@ int sqlite3PagerOpen(
   pPager->zFilename = (char*)&pPager[1];
   pPager->zDirectory = &pPager->zFilename[nameLen+1];
   pPager->zJournal = &pPager->zDirectory[nameLen+1];
-  strcpy(pPager->zFilename, zFullPathname);
-  strcpy(pPager->zDirectory, zFullPathname);
+  memcpy(pPager->zFilename, zFullPathname, nameLen+1);
+  memcpy(pPager->zDirectory, zFullPathname, nameLen+1);
 
   for(i=nameLen; i>0 && pPager->zDirectory[i-1]!='/'; i--){}
   if( i>0 ) pPager->zDirectory[i-1] = 0;
-  strcpy(pPager->zJournal, zFullPathname);
+  memcpy(pPager->zJournal, zFullPathname,nameLen);
   sqliteFree(zFullPathname);
-  strcpy(&pPager->zJournal[nameLen], "-journal");
+  memcpy(&pPager->zJournal[nameLen], "-journal",sizeof("-journal"));
   pPager->fd = fd;
   /* pPager->journalOpen = 0; */
   pPager->useJournal = useJournal && !memDb;
diff --git a/src/select.c b/src/select.c
index ed524c2e73..6e962292e8 100644
--- a/src/select.c
+++ b/src/select.c
@@ -12,7 +12,7 @@
 ** This file contains C code routines that are called by the parser
 ** to handle SELECT statements in SQLite.
 **
-** $Id: select.c,v 1.339 2007/05/03 13:02:27 drh Exp $
+** $Id: select.c,v 1.340 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 
@@ -1012,7 +1012,7 @@ static void generateColumnNames(
     }else{
       char zName[30];
       assert( p->op!=TK_COLUMN || pTabList==0 );
-      sprintf(zName, "column%d", i+1);
+      sqlite3_snprintf(sizeof(zName), zName, "column%d", i+1);
       sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, 0);
     }
   }
diff --git a/src/shell.c b/src/shell.c
index 25f51d7bff..287022344d 100644
--- a/src/shell.c
+++ b/src/shell.c
@@ -12,7 +12,7 @@
 ** This file contains code to implement the "sqlite" command line
 ** utility for accessing SQLite databases.
 **
-** $Id: shell.c,v 1.161 2007/05/03 17:18:38 drh Exp $
+** $Id: shell.c,v 1.162 2007/05/04 13:15:56 drh Exp $
 */
 #include <stdlib.h>
 #include <string.h>
@@ -833,7 +833,7 @@ static int run_schema_dump_query(
     if( pzErrMsg ) sqlite3_free(*pzErrMsg);
     zQ2 = malloc( len+100 );
     if( zQ2==0 ) return rc;
-    sprintf(zQ2, "%s ORDER BY rowid DESC", zQuery);
+    sqlite3_snprintf(sizeof(zQ2), zQ2, "%s ORDER BY rowid DESC", zQuery);
     rc = sqlite3_exec(p->db, zQ2, dump_callback, p, pzErrMsg);
     free(zQ2);
   }
@@ -1302,10 +1302,10 @@ static int do_meta_command(char *zLine, struct callback_data *p){
       p->mode = MODE_Tcl;
     }else if( strncmp(azArg[1],"csv",n2)==0 ){
       p->mode = MODE_Csv;
-      strcpy(p->separator, ",");
+      sqlite3_snprintf(sizeof(p->separator), p->separator, ",");
     }else if( strncmp(azArg[1],"tabs",n2)==0 ){
       p->mode = MODE_List;
-      strcpy(p->separator, "\t");
+      sqlite3_snprintf(sizeof(p->separator), p->separator, "\t");
     }else if( strncmp(azArg[1],"insert",n2)==0 ){
       p->mode = MODE_Insert;
       if( nArg>=3 ){
@@ -1320,7 +1320,8 @@ static int do_meta_command(char *zLine, struct callback_data *p){
   }else
 
   if( c=='n' && strncmp(azArg[0], "nullvalue", n)==0 && nArg==2 ) {
-    sprintf(p->nullvalue, "%.*s", (int)ArraySize(p->nullvalue)-1, azArg[1]);
+    sqlite3_snprintf(sizeof(p->nullvalue), p->nullvalue,
+                     "%.*s", (int)ArraySize(p->nullvalue)-1, azArg[1]);
   }else
 
   if( c=='o' && strncmp(azArg[0], "output", n)==0 && nArg==2 ){
@@ -1329,14 +1330,14 @@ static int do_meta_command(char *zLine, struct callback_data *p){
     }
     if( strcmp(azArg[1],"stdout")==0 ){
       p->out = stdout;
-      strcpy(p->outfile,"stdout");
+      sqlite3_snprintf(sizeof(p->outfile), p->outfile, "stdout");
     }else{
       p->out = fopen(azArg[1], "wb");
       if( p->out==0 ){
         fprintf(stderr,"can't write to \"%s\"\n", azArg[1]);
         p->out = stdout;
       } else {
-         strcpy(p->outfile,azArg[1]);
+         sqlite3_snprintf(sizeof(p->outfile), p->outfile, "%s", azArg[1]);
       }
     }
   }else
@@ -1428,7 +1429,8 @@ static int do_meta_command(char *zLine, struct callback_data *p){
   }else
 
   if( c=='s' && strncmp(azArg[0], "separator", n)==0 && nArg==2 ){
-    sprintf(p->separator, "%.*s", (int)ArraySize(p->separator)-1, azArg[1]);
+    sqlite3_snprintf(sizeof(p->separator), p->separator,
+                     "%.*s", (int)sizeof(p->separator)-1, azArg[1]);
   }else
 
   if( c=='s' && strncmp(azArg[0], "show", n)==0){
@@ -1621,7 +1623,7 @@ static int process_input(struct callback_data *p, FILE *in){
       continue;
     }
     if( _is_command_terminator(zLine) ){
-      strcpy(zLine,";");
+      memcpy(zLine,";",2);
     }
     if( zSql==0 ){
       int i;
@@ -1633,7 +1635,7 @@ static int process_input(struct callback_data *p, FILE *in){
           fprintf(stderr, "out of memory\n");
           exit(1);
         }
-        strcpy(zSql, zLine);
+        memcpy(zSql, zLine, nSql+1);
         startline = lineno;
       }
     }else{
@@ -1643,8 +1645,8 @@ static int process_input(struct callback_data *p, FILE *in){
         fprintf(stderr,"%s: out of memory!\n", Argv0);
         exit(1);
       }
-      strcpy(&zSql[nSql++], "\n");
-      strcpy(&zSql[nSql], zLine);
+      zSql[nSql++] = '\n';
+      memcpy(&zSql[nSql], zLine, len+1);
       nSql += len;
     }
     free(zLine);
@@ -1655,9 +1657,10 @@ static int process_input(struct callback_data *p, FILE *in){
       if( rc || zErrMsg ){
         char zPrefix[100];
         if( in!=0 || !stdin_is_interactive ){
-          sprintf(zPrefix, "SQL error near line %d:", startline);
+          sqlite3_snprintf(sizeof(zPrefix), zPrefix, 
+                           "SQL error near line %d:", startline);
         }else{
-          sprintf(zPrefix, "SQL error:");
+          sqlite3_snprintf(sizeof(zPrefix), zPrefix, "SQL error:");
         }
         if( zErrMsg!=0 ){
           printf("%s %s\n", zPrefix, zErrMsg);
@@ -1730,8 +1733,9 @@ static char *find_home_dir(void){
 #endif
 
   if( home_dir ){
-    char *z = malloc( strlen(home_dir)+1 );
-    if( z ) strcpy(z, home_dir);
+    int n = strlen(home_dir) + 1;
+    char *z = malloc( n );
+    if( z ) memcpy(z, home_dir, n);
     home_dir = z;
   }
 
@@ -1762,7 +1766,7 @@ static void process_sqliterc(
       fprintf(stderr,"%s: out of memory!\n", Argv0);
       exit(1);
     }
-    sprintf(zBuf,"%s/.sqliterc",home_dir);
+    sqlite3_snprintf(sizeof(zBuf), zBuf,"%s/.sqliterc",home_dir);
     free(home_dir);
     sqliterc = (const char*)zBuf;
   }
@@ -1816,10 +1820,10 @@ static void usage(int showDetail){
 static void main_init(struct callback_data *data) {
   memset(data, 0, sizeof(*data));
   data->mode = MODE_List;
-  strcpy(data->separator,"|");
+  memcpy(data->separator,"|", 2);
   data->showHeader = 0;
-  strcpy(mainPrompt,"sqlite> ");
-  strcpy(continuePrompt,"   ...> ");
+  sqlite3_snprintf(sizeof(mainPrompt), mainPrompt,"sqlite> ");
+  sqlite3_snprintf(sizeof(continuePrompt), continuePrompt,"   ...> ");
 }
 
 int main(int argc, char **argv){
@@ -1917,13 +1921,15 @@ int main(int argc, char **argv){
       data.mode = MODE_Column;
     }else if( strcmp(z,"-csv")==0 ){
       data.mode = MODE_Csv;
-      strcpy(data.separator,",");
+      memcpy(data.separator,",",2);
     }else if( strcmp(z,"-separator")==0 ){
       i++;
-      sprintf(data.separator,"%.*s",(int)sizeof(data.separator)-1,argv[i]);
+      sqlite3_snprintf(sizeof(data.separator), data.separator,
+                       "%.*s",(int)sizeof(data.separator)-1,argv[i]);
     }else if( strcmp(z,"-nullvalue")==0 ){
       i++;
-      sprintf(data.nullvalue,"%.*s",(int)sizeof(data.nullvalue)-1,argv[i]);
+      sqlite3_snprintf(sizeof(data.nullvalue), data.nullvalue,
+                       "%.*s",(int)sizeof(data.nullvalue)-1,argv[i]);
     }else if( strcmp(z,"-header")==0 ){
       data.showHeader = 1;
     }else if( strcmp(z,"-noheader")==0 ){
@@ -1969,14 +1975,15 @@ int main(int argc, char **argv){
     if( stdin_is_interactive ){
       char *zHome;
       char *zHistory = 0;
+      int nHistory;
       printf(
         "SQLite version %s\n"
         "Enter \".help\" for instructions\n",
         sqlite3_libversion()
       );
       zHome = find_home_dir();
-      if( zHome && (zHistory = malloc(strlen(zHome)+20))!=0 ){
-        sprintf(zHistory,"%s/.sqlite_history", zHome);
+      if( zHome && (zHistory = malloc(nHistory = strlen(zHome)+20))!=0 ){
+        sqlite3_snprintf(nHistory, zHistory,"%s/.sqlite_history", zHome);
       }
 #if defined(HAVE_READLINE) && HAVE_READLINE==1
       if( zHistory ) read_history(zHistory);
diff --git a/src/table.c b/src/table.c
index 30c1484898..d58fb3ced2 100644
--- a/src/table.c
+++ b/src/table.c
@@ -92,9 +92,10 @@ static int sqlite3_get_table_cb(void *pArg, int nCol, char **argv, char **colv){
       if( argv[i]==0 ){
         z = 0;
       }else{
-        z = sqlite3_malloc( strlen(argv[i])+1 );
+        int n = strlen(argv[i])+1;
+        z = sqlite3_malloc( n );
         if( z==0 ) goto malloc_failed;
-        strcpy(z, argv[i]);
+        memcpy(z, argv[i], n);
       }
       p->azResult[p->nData++] = z;
     }
diff --git a/src/tclsqlite.c b/src/tclsqlite.c
index 79429cb168..7e6f32700e 100644
--- a/src/tclsqlite.c
+++ b/src/tclsqlite.c
@@ -12,7 +12,7 @@
 ** A TCL Interface to SQLite.  Append this file to sqlite3.c and
 ** compile the whole thing to build a TCL-enabled version of SQLite.
 **
-** $Id: tclsqlite.c,v 1.183 2007/05/04 12:05:56 danielk1977 Exp $
+** $Id: tclsqlite.c,v 1.184 2007/05/04 13:15:56 drh Exp $
 */
 #include "tcl.h"
 #include <errno.h>
@@ -329,7 +329,7 @@ static int createIncrblobChannel(
   p->iSeek = 0;
   p->pBlob = pBlob;
 
-  sprintf(zChannel, "incrblob_%d", ++count);
+  sqlite3_snprintf(sizeof(zChannel), zChannel, "incrblob_%d", ++count);
   p->channel = Tcl_CreateChannel(&IncrblobChannelType, zChannel, p, flags);
   Tcl_RegisterChannel(interp, p->channel);
 
@@ -470,7 +470,7 @@ static int DbBusyHandler(void *cd, int nTries){
   int rc;
   char zVal[30];
 
-  sprintf(zVal, "%d", nTries);
+  sqlite3_snprintf(sizeof(zVal), zVal, "%d", nTries);
   rc = Tcl_VarEval(pDb->interp, pDb->zBusy, " ", zVal, (char*)0);
   if( rc!=TCL_OK || atoi(Tcl_GetStringResult(pDb->interp)) ){
     return 0;
@@ -979,7 +979,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       zAuth = Tcl_GetStringFromObj(objv[2], &len);
       if( zAuth && len>0 ){
         pDb->zAuth = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zAuth, zAuth);
+        memcpy(pDb->zAuth, zAuth, len+1);
       }else{
         pDb->zAuth = 0;
       }
@@ -1016,7 +1016,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       zBusy = Tcl_GetStringFromObj(objv[2], &len);
       if( zBusy && len>0 ){
         pDb->zBusy = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zBusy, zBusy);
+        memcpy(pDb->zBusy, zBusy, len+1);
       }else{
         pDb->zBusy = 0;
       }
@@ -1128,7 +1128,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
     pCollate->pNext = pDb->pCollate;
     pCollate->zScript = (char*)&pCollate[1];
     pDb->pCollate = pCollate;
-    strcpy(pCollate->zScript, zScript);
+    memcpy(pCollate->zScript, zScript, nScript+1);
     if( sqlite3_create_collation(pDb->db, zName, SQLITE_UTF8, 
         pCollate, tclSqlCollate) ){
       Tcl_SetResult(interp, (char *)sqlite3_errmsg(pDb->db), TCL_VOLATILE);
@@ -1181,7 +1181,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       zCommit = Tcl_GetStringFromObj(objv[2], &len);
       if( zCommit && len>0 ){
         pDb->zCommit = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zCommit, zCommit);
+        memcpy(pDb->zCommit, zCommit, len+1);
       }else{
         pDb->zCommit = 0;
       }
@@ -1359,9 +1359,10 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       }
       if( i+1!=nCol ){
         char *zErr;
-        zErr = malloc(200 + strlen(zFile));
+        int nErr = strlen(zFile) + 200;
+        zErr = malloc(nErr);
         if( zErr ){
-          sprintf(zErr,
+          sqlite3_snprintf(nErr, zErr,
              "Error: %s line %d: expected %d columns of data but found %d",
              zFile, lineno, nCol, i+1);
           Tcl_AppendResult(interp, zErr, 0);
@@ -1399,7 +1400,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       rc = TCL_OK;
     }else{
       /* failure, append lineno where failed */
-      sprintf(zLineNum,"%d",lineno);
+      sqlite3_snprintf(sizeof(zLineNum), zLineNum,"%d",lineno);
       Tcl_AppendResult(interp,", failed while processing line: ",zLineNum,0);
       rc = TCL_ERROR;
     }
@@ -1979,7 +1980,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       zProgress = Tcl_GetStringFromObj(objv[3], &len);
       if( zProgress && len>0 ){
         pDb->zProgress = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zProgress, zProgress);
+        memcpy(pDb->zProgress, zProgress, len+1);
       }else{
         pDb->zProgress = 0;
       }
@@ -2021,7 +2022,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       zProfile = Tcl_GetStringFromObj(objv[2], &len);
       if( zProfile && len>0 ){
         pDb->zProfile = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zProfile, zProfile);
+        memcpy(pDb->zProfile, zProfile, len+1);
       }else{
         pDb->zProfile = 0;
       }
@@ -2116,7 +2117,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
       zTrace = Tcl_GetStringFromObj(objv[2], &len);
       if( zTrace && len>0 ){
         pDb->zTrace = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zTrace, zTrace);
+        memcpy(pDb->zTrace, zTrace, len+1);
       }else{
         pDb->zTrace = 0;
       }
diff --git a/src/util.c b/src/util.c
index b83fd94725..1908329080 100644
--- a/src/util.c
+++ b/src/util.c
@@ -14,7 +14,7 @@
 ** This file contains functions for allocating memory, comparing
 ** strings, and stuff like that.
 **
-** $Id: util.c,v 1.199 2007/04/06 02:32:34 drh Exp $
+** $Id: util.c,v 1.200 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include "os.h"
@@ -424,7 +424,7 @@ int sqlite3OutstandingMallocs(Tcl_Interp *interp){
     z = &zAlloc[TESTALLOC_OFFSET_STACK(p)];
     for(i=0; i<TESTALLOC_STACKFRAMES; i++){
       char zHex[128];
-      sprintf(zHex, "%p", ((void **)z)[i]);
+      sqlite3_snprintf(sizeof(zHex), zHex, "%p", ((void **)z)[i]);
       Tcl_ListObjAppendElement(0, pStack, Tcl_NewStringObj(zHex, -1));
     }
 
@@ -722,9 +722,11 @@ int sqlite3AllocSize(void *p){
 */
 char *sqlite3StrDup(const char *z){
   char *zNew;
+  int n;
   if( z==0 ) return 0;
-  zNew = sqlite3MallocRaw(strlen(z)+1, 1);
-  if( zNew ) strcpy(zNew, z);
+  n = strlen(z)+1;
+  zNew = sqlite3MallocRaw(n, 1);
+  if( zNew ) memcpy(zNew, z, n);
   return zNew;
 }
 char *sqlite3StrNDup(const char *z, int n){
@@ -766,9 +768,11 @@ void sqlite3SetString(char **pz, ...){
   *zResult = 0;
   va_start(ap, pz);
   while( (z = va_arg(ap, const char*))!=0 ){
-    strcpy(zResult, z);
-    zResult += strlen(zResult);
+    int n = strlen(z);
+    memcpy(zResult, z, n);
+    zResult += n;
   }
+  zResult[0] = 0;
   va_end(ap);
 }
 
diff --git a/src/vdbe.c b/src/vdbe.c
index 12aedc51b1..83197c4261 100644
--- a/src/vdbe.c
+++ b/src/vdbe.c
@@ -43,7 +43,7 @@
 ** in this file for details.  If in doubt, do not deviate from existing
 ** commenting and indentation practices when changing or adding code.
 **
-** $Id: vdbe.c,v 1.605 2007/05/02 16:51:59 drh Exp $
+** $Id: vdbe.c,v 1.606 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include "os.h"
@@ -319,10 +319,13 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
       c = 's';
     }
 
-    zCsr += sprintf(zCsr, "%c", c);
-    zCsr += sprintf(zCsr, "%d[", pMem->n);
+    sqlite3_snprintf(100, zCsr, "%c", c);
+    zCsr += strlen(zCsr);
+    sqlite3_snprintf(100, zCsr, "%d[", pMem->n);
+    zCsr += strlen(zCsr);
     for(i=0; i<16 && i<pMem->n; i++){
-      zCsr += sprintf(zCsr, "%02X", ((int)pMem->z[i] & 0xFF));
+      sqlite3_snprintf(100, zCsr, "%02X", ((int)pMem->z[i] & 0xFF));
+      zCsr += strlen(zCsr);
     }
     for(i=0; i<16 && i<pMem->n; i++){
       char z = pMem->z[i];
@@ -330,9 +333,11 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
       else *zCsr++ = z;
     }
 
-    zCsr += sprintf(zCsr, "]");
+    sqlite3_snprintf(100, zCsr, "]");
+    zCsr += strlen(zCsr);
     if( f & MEM_Zero ){
-      zCsr += sprintf(zCsr,"+%lldz",pMem->u.i);
+      sqlite3_snprintf(100, zCsr,"+%lldz",pMem->u.i);
+      zCsr += strlen(zCsr);
     }
     *zCsr = '\0';
   }else if( f & MEM_Str ){
@@ -351,7 +356,8 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
       zBuf[1] = 's';
     }
     k = 2;
-    k += sprintf(&zBuf[k], "%d", pMem->n);
+    sqlite3_snprintf(100, &zBuf[k], "%d", pMem->n);
+    k += strlen(&zBuf[k]);
     zBuf[k++] = '[';
     for(j=0; j<15 && j<pMem->n; j++){
       u8 c = pMem->z[j];
@@ -362,7 +368,8 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
       }
     }
     zBuf[k++] = ']';
-    k += sprintf(&zBuf[k], encnames[pMem->enc]);
+    sqlite3_snprintf(100,&zBuf[k], encnames[pMem->enc]);
+    k += strlen(&zBuf[k]);
     zBuf[k++] = 0;
   }
 }
diff --git a/src/vdbeaux.c b/src/vdbeaux.c
index 7cc44306ef..1134655181 100644
--- a/src/vdbeaux.c
+++ b/src/vdbeaux.c
@@ -589,24 +589,24 @@ static char *displayP3(Op *pOp, char *zTemp, int nTemp){
     case P3_KEYINFO: {
       int i, j;
       KeyInfo *pKeyInfo = (KeyInfo*)pOp->p3;
-      sprintf(zTemp, "keyinfo(%d", pKeyInfo->nField);
+      sqlite3_snprintf(nTemp, zTemp, "keyinfo(%d", pKeyInfo->nField);
       i = strlen(zTemp);
       for(j=0; j<pKeyInfo->nField; j++){
         CollSeq *pColl = pKeyInfo->aColl[j];
         if( pColl ){
           int n = strlen(pColl->zName);
           if( i+n>nTemp-6 ){
-            strcpy(&zTemp[i],",...");
+            memcpy(&zTemp[i],",...",4);
             break;
           }
           zTemp[i++] = ',';
           if( pKeyInfo->aSortOrder && pKeyInfo->aSortOrder[j] ){
             zTemp[i++] = '-';
           }
-          strcpy(&zTemp[i], pColl->zName);
+          memcpy(&zTemp[i], pColl->zName,n+1);
           i += n;
         }else if( i+4<nTemp-6 ){
-          strcpy(&zTemp[i],",nil");
+          memcpy(&zTemp[i],",nil",4);
           i += 4;
         }
       }
@@ -618,7 +618,7 @@ static char *displayP3(Op *pOp, char *zTemp, int nTemp){
     }
     case P3_COLLSEQ: {
       CollSeq *pColl = (CollSeq*)pOp->p3;
-      sprintf(zTemp, "collseq(%.20s)", pColl->zName);
+      sqlite3_snprintf(nTemp, zTemp, "collseq(%.20s)", pColl->zName);
       zP3 = zTemp;
       break;
     }
diff --git a/src/vdbeblob.c b/src/vdbeblob.c
index 9fbdca71a1..22e6d2da15 100644
--- a/src/vdbeblob.c
+++ b/src/vdbeblob.c
@@ -10,7 +10,7 @@
 **
 *************************************************************************
 **
-** $Id: vdbeblob.c,v 1.6 2007/05/04 12:05:56 danielk1977 Exp $
+** $Id: vdbeblob.c,v 1.7 2007/05/04 13:15:57 drh Exp $
 */
 
 #include "sqliteInt.h"
@@ -83,8 +83,9 @@ int sqlite3_blob_open(
 
   Vdbe *v = 0;
   int rc = SQLITE_OK;
-  char zErr[128] = {0};
+  char zErr[128];
 
+  zErr[0] = 0;
   do {
     Parse sParse;
     Table *pTab;
@@ -131,7 +132,8 @@ int sqlite3_blob_open(
         int j;
         for(j=0; j<pIdx->nColumn; j++){
           if( pIdx->aiColumn[j]==iCol ){
-            strcpy(zErr, "cannot open indexed column for writing");
+            sqlite3_snprintf(sizeof(zErr), zErr,
+                             "cannot open indexed column for writing");
             rc = SQLITE_ERROR;
             sqlite3SafetyOff(db);
             goto blob_open_out;
diff --git a/src/vtab.c b/src/vtab.c
index 4b885b6241..940c86e30b 100644
--- a/src/vtab.c
+++ b/src/vtab.c
@@ -11,7 +11,7 @@
 *************************************************************************
 ** This file contains code used to help implement virtual tables.
 **
-** $Id: vtab.c,v 1.45 2007/04/19 14:48:37 danielk1977 Exp $
+** $Id: vtab.c,v 1.46 2007/05/04 13:15:57 drh Exp $
 */
 #ifndef SQLITE_OMIT_VIRTUALTABLE
 #include "sqliteInt.h"
@@ -29,7 +29,7 @@ int sqlite3_create_module(
   Module *pMod = (Module *)sqliteMallocRaw(sizeof(Module) + nName + 1);
   if( pMod ){
     char *zCopy = (char *)(&pMod[1]);
-    strcpy(zCopy, zName);
+    memcpy(zCopy, zName, nName+1);
     pMod->zName = zCopy;
     pMod->pModule = pModule;
     pMod->pAux = pAux;
@@ -705,7 +705,7 @@ FuncDef *sqlite3VtabOverloadFunction(
     return pDef;
   }
   *pNew = *pDef;
-  strcpy(pNew->zName, pDef->zName);
+  memcpy(pNew->zName, pDef->zName, strlen(pDef->zName)+1);
   pNew->xFunc = xFunc;
   pNew->pUserData = pArg;
   pNew->flags |= SQLITE_FUNC_EPHEM;
diff --git a/src/where.c b/src/where.c
index 2737b150a1..dabce68b55 100644
--- a/src/where.c
+++ b/src/where.c
@@ -16,7 +16,7 @@
 ** so is applicable.  Because this module is responsible for selecting
 ** indices, you might also think of this module as the "query optimizer".
 **
-** $Id: where.c,v 1.247 2007/04/20 12:22:02 drh Exp $
+** $Id: where.c,v 1.248 2007/05/04 13:15:57 drh Exp $
 */
 #include "sqliteInt.h"
 
@@ -2605,24 +2605,24 @@ WhereInfo *sqlite3WhereBegin(
     n = strlen(z);
     if( n+nQPlan < sizeof(sqlite3_query_plan)-10 ){
       if( pLevel->flags & WHERE_IDX_ONLY ){
-        strcpy(&sqlite3_query_plan[nQPlan], "{}");
+        memcpy(&sqlite3_query_plan[nQPlan], "{}", 2);
         nQPlan += 2;
       }else{
-        strcpy(&sqlite3_query_plan[nQPlan], z);
+        memcpy(&sqlite3_query_plan[nQPlan], z, n);
         nQPlan += n;
       }
       sqlite3_query_plan[nQPlan++] = ' ';
     }
     if( pLevel->flags & (WHERE_ROWID_EQ|WHERE_ROWID_RANGE) ){
-      strcpy(&sqlite3_query_plan[nQPlan], "* ");
+      memcpy(&sqlite3_query_plan[nQPlan], "* ", 2);
       nQPlan += 2;
     }else if( pLevel->pIdx==0 ){
-      strcpy(&sqlite3_query_plan[nQPlan], "{} ");
+      memcpy(&sqlite3_query_plan[nQPlan], "{} ", 3);
       nQPlan += 3;
     }else{
       n = strlen(pLevel->pIdx->zName);
       if( n+nQPlan < sizeof(sqlite3_query_plan)-2 ){
-        strcpy(&sqlite3_query_plan[nQPlan], pLevel->pIdx->zName);
+        memcpy(&sqlite3_query_plan[nQPlan], pLevel->pIdx->zName, n);
         nQPlan += n;
         sqlite3_query_plan[nQPlan++] = ' ';
       }
diff --git a/test/date.test b/test/date.test
index 50798ccb1d..bf06fd1b93 100644
--- a/test/date.test
+++ b/test/date.test
@@ -11,7 +11,7 @@
 # This file implements regression tests for SQLite library.  The
 # focus of this file is testing date and time functions.
 #
-# $Id: date.test,v 1.21 2007/04/06 02:32:35 drh Exp $
+# $Id: date.test,v 1.22 2007/05/04 13:15:57 drh Exp $
 
 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -126,7 +126,7 @@ datetest 3.1 {strftime('%d','2003-10-31 12:34:56.432')} 31
 datetest 3.2 {strftime('%f','2003-10-31 12:34:56.432')} 56.432
 datetest 3.3 {strftime('%H','2003-10-31 12:34:56.432')} 12
 datetest 3.4 {strftime('%j','2003-10-31 12:34:56.432')} 304
-datetest 3.5 {strftime('%J','2003-10-31 12:34:56.432')} 2452944.024264259
+datetest 3.5 {strftime('%J','2003-10-31 12:34:56.432')} 2452944.02426426
 datetest 3.6 {strftime('%m','2003-10-31 12:34:56.432')} 10
 datetest 3.7 {strftime('%M','2003-10-31 12:34:56.432')} 34
 datetest 3.8 {strftime('%s','2003-10-31 12:34:56.432')} 1067603696