Eliminate all uses of sprintf() and strcpy(). These were not being

misused. But getting rid of them removes a library dependency. And it avoids warnings from the OpenBSD compiler. Ticket #2336. (CVS 3916) FossilOrigin-Name: ba4845b32bdf38e623c4f7246e6e327715bbba4b
2025-08-07 02:42:48 +03:00 · 2007-05-04 13:15:55 +00:00
parent 92d4d7a92e
commit 5bb3eb9b9a
23 changed files with 204 additions and 162 deletions
--- a/54
+++ b/54
@@ -1,5 +1,5 @@
-C Test\scases\sand\scorrections\sto\sIO\sand\smalloc()\serror\shandling\sin\sincremental\sblob\sIO\sfunctions.\s(CVS\s3915)
-D 2007-05-04T12:05:56
+C Eliminate\sall\suses\sof\ssprintf()\sand\sstrcpy().\s\sThese\swere\snot\sbeing\nmisused.\s\sBut\sgetting\srid\sof\sthem\sremoves\sa\slibrary\sdependency.\s\sAnd\nit\savoids\swarnings\sfrom\sthe\sOpenBSD\scompiler.\s\sTicket\s#2336.\s(CVS\s3916)
+D 2007-05-04T13:15:56
 F Makefile.in 8cab54f7c9f5af8f22fd97ddf1ecfd1e1860de62
 F Makefile.linux-gcc 2d8574d1ba75f129aba2019f0b959db380a90935
 F README 9c4e2d6706bdcc3efdd773ce752a8cdab4f90028
@@ -57,22 +57,22 @@ F sqlite3.def a96c1d0d39362b763d2ddba220a32da41a15c4b4
 F sqlite3.pc.in 985b9bf34192a549d7d370e0f0b6b34a4f61369a
 F src/alter.c 2c79ec40f65e33deaf90ca493422c74586e481a3
 F src/analyze.c 4bbf5ddf9680587c6d4917e02e378b6037be3651
-F src/attach.c a16ada4a4654a0d126b8223ec9494ebb81bc5c3c
+F src/attach.c f088f8155541ff75542239ec40cf05f3d81390ba
 F src/auth.c 902f4722661c796b97f007d9606bd7529c02597f
-F src/btree.c a47fe8172eb62468f78a2fe4904d2e6b050038fb
+F src/btree.c ebf16f19fc9e732c93b98083c4dfdbadad247e5c
 F src/btree.h 2c187d60cf76d74c2b4767294d6b5fa267037ff0
-F src/build.c 02e01ec7907c7d947ab3041fda0e81eaed05db42
+F src/build.c 05ef6d80d957d17f6458afc04b81aa00cb4cb093
 F src/callback.c 6414ed32d55859d0f65067aa5b88d2da27b3af9e
 F src/complete.c 7d1a44be8f37de125fcafd3d3a018690b3799675
-F src/date.c 94a6777df13d2aaacd19de080d9e8d3444364133
+F src/date.c c34a9c86ffd6da4cb3903ea038d977ec539d07e2
 F src/delete.c 5c0d89b3ef7d48fe1f5124bfe8341f982747fe29
 F src/experimental.c 1b2d1a6cd62ecc39610e97670332ca073c50792b
 F src/expr.c 2f0f9f89efe9170e5e6ca5d5e93a9d5896fff5ac
-F src/func.c a4bc09fe4fdf3cbab8840ae8d8b76ca1f338de22
+F src/func.c 9445a7e20cfc1a04aa5e8c982b36e39cef851ff9
 F src/hash.c 67b23e14f0257b69a3e8aa663e4eeadc1a2b6fd5
 F src/hash.h 1b3f7e2609141fd571f62199fc38687d262e9564
-F src/insert.c 413cc06990cb3c401e64e596776c1e43934f8841
-F src/legacy.c c05a599a37f703ed1e66fdb5df60c2db65f29e71
+F src/insert.c e595ca26805dfb3a9ebaabc28e7947c479f3b14d
+F src/legacy.c 388c71ad7fbcd898ba1bcbfc98a3ac954bfa5d01
 F src/loadext.c afe4f4755dc49c36ef505748bbdddecb9f1d02a2
 F src/main.c e6eb036c3580ba9116fedfe4a8b58ed63d5abb37
 F src/md5.c c5fdfa5c2593eaee2e32a5ce6c6927c986eaf217
@@ -83,25 +83,25 @@ F src/os_os2.c 2ce97909b926a598823f97338027dbec1dcf4165
 F src/os_os2.h e5f17dd69333632bbc3112881ea407c37d245eb3
 F src/os_test.c 49833426101f99aee4bb5f6a44b7c4b2029fda1c
 F src/os_test.h 903c93554c23d88f34f667f1979e4a1cee792af3
-F src/os_unix.c 426b4c03c304ad78746d65d9ba101e0b72e18e23
+F src/os_unix.c cb1fb044b84870c7b1b8b2902e9d7be779f8b7ce
 F src/os_unix.h 5768d56d28240d3fe4537fac08cc85e4fb52279e
-F src/os_win.c e94903c7dc1c0599c8ddce42efa0b6928068ddc5
+F src/os_win.c 5e9e3d2aeed4d6f1b6ae81e866919f4f43b4a23d
 F src/os_win.h 41a946bea10f61c158ce8645e7646b29d44f122b
-F src/pager.c 680e42a6e0306f43b3e52127324a7bcc8d3ce65b
+F src/pager.c f01e0e577b7b54c3cdba24a30ecc585a805f23fa
 F src/pager.h d652ddf092d2318d00e41f8539760fe8e57c157c
 F src/parse.y a3940369e12c69c4968aa580cdc74cf73a664980
 F src/pragma.c 4fdefc03c3fd0ee87f8aad82bf80ba9bf1cdf416
 F src/prepare.c 03277063bc4f5860efbf23548fa0123ac0f6eaec
 F src/printf.c 0c6f40648770831341ac45ab32423a80b4c87f05
 F src/random.c 6119474a6f6917f708c1dee25b9a8e519a620e88
-F src/select.c 3c8f3bc7fd823abb8af30ec89ba6bcc515923fa1
+F src/select.c e6a2546de63cd9cdad2499e224f8535743b99f1a
 F src/server.c 087b92a39d883e3fa113cae259d64e4c7438bc96
-F src/shell.c 762c81655da0f01067514924a5ba8f47a47ada1d
+F src/shell.c d07ae326b3815d80f71c69b3c7584382e47f6447
 F src/sqlite.h.in a666300976897eced975b448f722a722b362c6b1
 F src/sqlite3ext.h 7d0d363ea7327e817ef0dfe1b7eee1f171b72890
 F src/sqliteInt.h 5a8c0221a4f11998f46aa76364a9559af8d7c1f7
-F src/table.c 6d0da66dde26ee75614ed8f584a1996467088d06
-F src/tclsqlite.c 0906902b96e4b292ba98499dd380e22d3322f817
+F src/table.c a8de75bcedf84d4060d804264b067ab3b1a3561d
+F src/tclsqlite.c cd87bbaffd115ded71b4b9c03be7b5b213c4ba7a
 F src/test1.c 29a39fdde51f4612082ecf3f5af54dac93766f87
 F src/test2.c 24458b17ab2f3c90cbc1c8446bd7ffe69be62f88
 F src/test3.c 946ea9d1a8c928656e3c70f0a2fcb8e733a15e86
@@ -123,18 +123,18 @@ F src/tokenize.c 7d611fc942ca0b12514eea2e1fbb148a65af23f2
 F src/trigger.c 420192efe3e6f03addf7897c60c3c8bf913d3493
 F src/update.c 3359041db390a8f856d67272f299600e2104f350
 F src/utf.c e64a48bc21aa973eb622dd47da87d56a4cdcf528
-F src/util.c b6344325378e75b9e18175d8b6aed1723d73dad9
+F src/util.c 9f9fec5dc7ffab8ff982508d03af37269a59ff91
 F src/vacuum.c 8bd895d29e7074e78d4e80f948e35ddc9cf2beef
-F src/vdbe.c a4abf744b5376372a9be30f02ab4b231f353cab1
+F src/vdbe.c 74f348b125187f4bebd8bbba381e9be7de0a2bcf
 F src/vdbe.h 0025259af1939fb264a545816c69e4b5b8d52691
 F src/vdbeInt.h cb02cbbceddf3b40d49012e9f41576f17bcbec97
 F src/vdbeapi.c 37d793559390bec8a00c556f651f21b5f9e589af
-F src/vdbeaux.c 966d166f9d4079552c7cb48855afe8c1aa331556
-F src/vdbeblob.c 58b3f68f6bc18b58aeab3a31cff083cb4127292f
+F src/vdbeaux.c c432e17fef6efaf102d507e979cee4e47f6ceac4
+F src/vdbeblob.c 2944bca84a40c093d442a06ad7835cb00a6b1c0a
 F src/vdbefifo.c 3ca8049c561d5d67cbcb94dc909ae9bb68c0bf8f
 F src/vdbemem.c ba98f8572ec4609846b368fa7580db178022f1bb
-F src/vtab.c 89a0d5f39c1beba65a77fdb4d507b831fc5e6baf
-F src/where.c 0f17b7bed2ce50ba450e8f436d5ec8b420c4ab3f
+F src/vtab.c c5ebebf615b2f29499fbe97a584c4bb342632aa0
+F src/where.c f3920748cc650fc25ac916215500bdb90dee568e
 F tclinstaller.tcl 4356d9d94d2b5ed5e68f9f0c80c4df3048dd7617
 F test/aggerror.test a867e273ef9e3d7919f03ef4f0e8c0d2767944f2
 F test/all.test a8dca528354b70a52f130e1bb33dedc6848862a1
@@ -194,7 +194,7 @@ F test/crash.test 167eb4652eccbedb199b6f21850346c3f5d779fb
 F test/crash2.test 423c6ec404d15b7d7d0e40aef0a26740cce6075f
 F test/crashtest1.c 09c1c7d728ccf4feb9e481671e29dda5669bbcc2
 F test/createtab.test 9f122ca39bae0decf59416779d4d7d1eeb26e18f
-F test/date.test 09786cf0145147014867d822224b9bced2012b61
+F test/date.test 4834d022b2fa5982cafed20938f7523a7475e4cd
 F test/default.test 252298e42a680146b1dd64f563b95bdf088d94fb
 F test/delete.test 525a6953bc3978780cae35f3eaf1027cf4ce887d
 F test/delete2.test c06be3806ba804bc8c6f134476816080280b40e3
@@ -474,7 +474,7 @@ F www/tclsqlite.tcl bb0d1357328a42b1993d78573e587c6dcbc964b9
 F www/vdbe.tcl 87a31ace769f20d3627a64fa1fade7fed47b90d0
 F www/version3.tcl 890248cf7b70e60c383b0e84d77d5132b3ead42b
 F www/whentouse.tcl fc46eae081251c3c181bd79c5faef8195d7991a5
-P 2d37687a08a7b6b3a7f77f55a7c2e29a1f8731a8
-R 631ed7d60317b63e0f0649096fcada2a
-U danielk1977
-Z dfc7741fad7b57c2866d720631f3b47d
+P 641e55284e1ba6070073c83ac6ed78ffb29f7e60
+R 4cdecc280e220d3e1cee8e04f6997968
+U drh
+Z 99090230812abe75d62b878273731ef5
--- a/manifest.uuid
+++ b/manifest.uuid
@@ -1 +1 @@
-641e55284e1ba6070073c83ac6ed78ffb29f7e60
+ba4845b32bdf38e623c4f7246e6e327715bbba4b
--- a/src/attach.c
+++ b/src/attach.c
@@ -11,7 +11,7 @@
 *************************************************************************
 ** This file contains code used to implement the ATTACH and DETACH commands.
 **
-** $Id: attach.c,v 1.57 2007/03/27 21:47:07 drh Exp $
+** $Id: attach.c,v 1.58 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"

@@ -90,7 +90,8 @@ static void attachFunc(
    goto attach_error;
  }
  if( !db->autoCommit ){
-    strcpy(zErr, "cannot ATTACH database within transaction");
+    sqlite3_snprintf(sizeof(zErr), zErr,
+                     "cannot ATTACH database within transaction");
    goto attach_error;
  }
  for(i=0; i<db->nDb; i++){
@@ -130,7 +131,7 @@ static void attachFunc(
    if( !aNew->pSchema ){
      rc = SQLITE_NOMEM;
    }else if( aNew->pSchema->file_format && aNew->pSchema->enc!=ENC(db) ){
-      strcpy(zErr, 
+      sqlite3_snprintf(sizeof(zErr), zErr, 
        "attached databases must use the same text encoding as main database");
      goto attach_error;
    }
@@ -246,7 +247,8 @@ static void detachFunc(
    goto detach_error;
  }
  if( !db->autoCommit ){
-    strcpy(zErr, "cannot DETACH database within transaction");
+    sqlite3_snprintf(sizeof(zErr), zErr,
+                     "cannot DETACH database within transaction");
    goto detach_error;
  }
  if( sqlite3BtreeIsInReadTrans(pDb->pBt) ){
--- a/src/btree.c
+++ b/src/btree.c
@@ -9,7 +9,7 @@
 **    May you share freely, never taking more than you give.
 **
 *************************************************************************
-** $Id: btree.c,v 1.372 2007/05/04 12:05:56 danielk1977 Exp $
+** $Id: btree.c,v 1.373 2007/05/04 13:15:56 drh Exp $
 **
 ** This file implements a external (disk-based) database using BTrees.
 ** For a detailed discussion of BTrees, refer to
@@ -6237,7 +6237,7 @@ static int btreePageDump(BtShared *pBt, int pgno, int recursive, MemPage *pParen
    pCell = &data[addr];
    parseCellPtr(pPage, pCell, &info);
    sz = info.nSize;
-    sprintf(range,"%d..%d", addr, addr+sz-1);
+    sqlite3_snprintf(sizeof(range),range,"%d..%d", addr, addr+sz-1);
    if( pPage->leaf ){
      child = 0;
    }else{
@@ -6264,7 +6264,7 @@ static int btreePageDump(BtShared *pBt, int pgno, int recursive, MemPage *pParen
  idx = get2byte(&data[hdr+1]);
  while( idx>0 && idx<pPage->pBt->usableSize ){
    int sz = get2byte(&data[idx+2]);
-    sprintf(range,"%d..%d", idx, idx+sz-1);
+    sqlite3_snprintf(sizeof(range),range,"%d..%d", idx, idx+sz-1);
    nFree += sz;
    sqlite3DebugPrintf("freeblock %2d: i=%-10s size=%-4d total=%d\n",
       i, range, sz, nFree);
@@ -6579,7 +6579,7 @@ static int checkTreePage(
  char zContext[100];
  char *hit;

-  sprintf(zContext, "Page %d: ", iPage);
+  sqlite3_snprintf(sizeof(zContext), zContext, "Page %d: ", iPage);

  /* Check that the page exists
  */
@@ -6608,7 +6608,8 @@ static int checkTreePage(

    /* Check payload overflow pages
    */
-    sprintf(zContext, "On tree page %d cell %d: ", iPage, i);
+    sqlite3_snprintf(sizeof(zContext), zContext,
+             "On tree page %d cell %d: ", iPage, i);
    pCell = findCell(pPage,i);
    parseCellPtr(pPage, pCell, &info);
    sz = info.nData;
@@ -6643,7 +6644,8 @@ static int checkTreePage(
  }
  if( !pPage->leaf ){
    pgno = get4byte(&pPage->aData[pPage->hdrOffset+8]);
-    sprintf(zContext, "On page %d at right child: ", iPage);
+    sqlite3_snprintf(sizeof(zContext), zContext, 
+                     "On page %d at right child: ", iPage);
 #ifndef SQLITE_OMIT_AUTOVACUUM
    if( pBt->autoVacuum ){
      checkPtrmap(pCheck, pgno, PTRMAP_BTREE, iPage, 0);
--- a/src/build.c
+++ b/src/build.c
@@ -22,7 +22,7 @@
 **     COMMIT
 **     ROLLBACK
 **
-** $Id: build.c,v 1.422 2007/04/26 14:42:36 danielk1977 Exp $
+** $Id: build.c,v 1.423 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include <ctype.h>
@@ -1322,22 +1322,24 @@ static char *createTableStmt(Table *p, int isTemp){
  n += 35 + 6*p->nCol;
  zStmt = sqliteMallocRaw( n );
  if( zStmt==0 ) return 0;
-  strcpy(zStmt, !OMIT_TEMPDB&&isTemp ? "CREATE TEMP TABLE ":"CREATE TABLE ");
+  sqlite3_snprintf(n, zStmt,
+                  !OMIT_TEMPDB&&isTemp ? "CREATE TEMP TABLE ":"CREATE TABLE ");
  k = strlen(zStmt);
  identPut(zStmt, &k, p->zName);
  zStmt[k++] = '(';
  for(pCol=p->aCol, i=0; i<p->nCol; i++, pCol++){
-    strcpy(&zStmt[k], zSep);
+    sqlite3_snprintf(n-k, &zStmt[k], zSep);
    k += strlen(&zStmt[k]);
    zSep = zSep2;
    identPut(zStmt, &k, pCol->zName);
    if( (z = pCol->zType)!=0 ){
      zStmt[k++] = ' ';
-      strcpy(&zStmt[k], z);
+      assert( strlen(z)+k+1<=n );
+      sqlite3_snprintf(n-k, &zStmt[k], "%s", z);
      k += strlen(z);
    }
  }
-  strcpy(&zStmt[k], zEnd);
+  sqlite3_snprintf(n-k, &zStmt[k], "%s", zEnd);
  return zStmt;
 }

@@ -2355,7 +2357,7 @@ void sqlite3CreateIndex(
    int n;
    Index *pLoop;
    for(pLoop=pTab->pIndex, n=1; pLoop; pLoop=pLoop->pNext, n++){}
-    sprintf(zBuf,"_%d",n);
+    sqlite3_snprintf(sizeof(zBuf),zBuf,"_%d",n);
    zName = 0;
    sqlite3SetString(&zName, "sqlite_autoindex_", pTab->zName, zBuf, (char*)0);
    if( zName==0 ) goto exit_create_index;
@@ -2420,7 +2422,7 @@ void sqlite3CreateIndex(
  pIndex->aSortOrder = (u8 *)(&pIndex->aiRowEst[nCol+1]);
  pIndex->zName = (char *)(&pIndex->aSortOrder[nCol]);
  zExtra = (char *)(&pIndex->zName[nName+1]);
-  strcpy(pIndex->zName, zName);
+  memcpy(pIndex->zName, zName, nName+1);
  pIndex->pTable = pTab;
  pIndex->nColumn = pList->nExpr;
  pIndex->onError = onError;
@@ -2463,7 +2465,7 @@ void sqlite3CreateIndex(
    if( pListItem->pExpr ){
      assert( pListItem->pExpr->pColl );
      zColl = zExtra;
-      strcpy(zExtra, pListItem->pExpr->pColl->zName);
+      sqlite3_snprintf(nExtra, zExtra, "%s", pListItem->pExpr->pColl->zName);
      zExtra += (strlen(zColl) + 1);
    }else{
      zColl = pTab->aCol[j].zColl;
--- a/src/date.c
+++ b/src/date.c
@@ -16,7 +16,7 @@
 ** sqlite3RegisterDateTimeFunctions() found at the bottom of the file.
 ** All other code has file scope.
 **
-** $Id: date.c,v 1.63 2007/04/25 18:23:53 drh Exp $
+** $Id: date.c,v 1.64 2007/05/04 13:15:56 drh Exp $
 **
 ** NOTES:
 **
@@ -705,8 +705,8 @@ static void datetimeFunc(
  if( isDate(argc, argv, &x)==0 ){
    char zBuf[100];
    computeYMD_HMS(&x);
-    sprintf(zBuf, "%04d-%02d-%02d %02d:%02d:%02d",x.Y, x.M, x.D, x.h, x.m,
-           (int)(x.s));
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%04d-%02d-%02d %02d:%02d:%02d",
+                     x.Y, x.M, x.D, x.h, x.m, (int)(x.s));
    sqlite3_result_text(context, zBuf, -1, SQLITE_TRANSIENT);
  }
 }
@@ -725,7 +725,7 @@ static void timeFunc(
  if( isDate(argc, argv, &x)==0 ){
    char zBuf[100];
    computeHMS(&x);
-    sprintf(zBuf, "%02d:%02d:%02d", x.h, x.m, (int)x.s);
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%02d:%02d:%02d", x.h, x.m, (int)x.s);
    sqlite3_result_text(context, zBuf, -1, SQLITE_TRANSIENT);
  }
 }
@@ -744,7 +744,7 @@ static void dateFunc(
  if( isDate(argc, argv, &x)==0 ){
    char zBuf[100];
    computeYMD(&x);
-    sprintf(zBuf, "%04d-%02d-%02d", x.Y, x.M, x.D);
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%04d-%02d-%02d", x.Y, x.M, x.D);
    sqlite3_result_text(context, zBuf, -1, SQLITE_TRANSIENT);
  }
 }
@@ -826,7 +826,7 @@ static void strftimeFunc(
    }else{
      i++;
      switch( zFmt[i] ){
-        case 'd':  sprintf(&z[j],"%02d",x.D); j+=2; break;
+        case 'd':  sqlite3_snprintf(3, &z[j],"%02d",x.D); j+=2; break;
        case 'f': {
          double s = x.s;
          if( s>59.999 ) s = 59.999;
@@ -834,7 +834,7 @@ static void strftimeFunc(
          j += strlen(&z[j]);
          break;
        }
-        case 'H':  sprintf(&z[j],"%02d",x.h); j+=2; break;
+        case 'H':  sqlite3_snprintf(3, &z[j],"%02d",x.h); j+=2; break;
        case 'W': /* Fall thru */
        case 'j': {
          int nDay;             /* Number of days since 1st day of year */
@@ -847,25 +847,30 @@ static void strftimeFunc(
          if( zFmt[i]=='W' ){
            int wd;   /* 0=Monday, 1=Tuesday, ... 6=Sunday */
            wd = ((int)(x.rJD+0.5)) % 7;
-            sprintf(&z[j],"%02d",(nDay+7-wd)/7);
+            sqlite3_snprintf(3, &z[j],"%02d",(nDay+7-wd)/7);
            j += 2;
          }else{
-            sprintf(&z[j],"%03d",nDay+1);
+            sqlite3_snprintf(4, &z[j],"%03d",nDay+1);
            j += 3;
          }
          break;
        }
-        case 'J':  sprintf(&z[j],"%.16g",x.rJD); j+=strlen(&z[j]); break;
-        case 'm':  sprintf(&z[j],"%02d",x.M); j+=2; break;
-        case 'M':  sprintf(&z[j],"%02d",x.m); j+=2; break;
+        case 'J': {
+          sqlite3_snprintf(20, &z[j],"%.16g",x.rJD);
+          j+=strlen(&z[j]);
+          break;
+        }
+        case 'm':  sqlite3_snprintf(3, &z[j],"%02d",x.M); j+=2; break;
+        case 'M':  sqlite3_snprintf(3, &z[j],"%02d",x.m); j+=2; break;
        case 's': {
-          sprintf(&z[j],"%d",(int)((x.rJD-2440587.5)*86400.0 + 0.5));
+          sqlite3_snprintf(30,&z[j],"%d",
+                           (int)((x.rJD-2440587.5)*86400.0 + 0.5));
          j += strlen(&z[j]);
          break;
        }
-        case 'S':  sprintf(&z[j],"%02d",(int)x.s); j+=2; break;
+        case 'S':  sqlite3_snprintf(3,&z[j],"%02d",(int)x.s); j+=2; break;
        case 'w':  z[j++] = (((int)(x.rJD+1.5)) % 7) + '0'; break;
-        case 'Y':  sprintf(&z[j],"%04d",x.Y); j+=strlen(&z[j]); break;
+        case 'Y':  sqlite3_snprintf(5,&z[j],"%04d",x.Y); j+=strlen(&z[j]);break;
        case '%':  z[j++] = '%'; break;
      }
    }
--- a/src/func.c
+++ b/src/func.c
@@ -16,7 +16,7 @@
 ** sqliteRegisterBuildinFunctions() found at the bottom of the file.
 ** All other code has file scope.
 **
-** $Id: func.c,v 1.144 2007/05/02 02:08:29 drh Exp $
+** $Id: func.c,v 1.145 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include <ctype.h>
@@ -222,7 +222,7 @@ static void upperFunc(sqlite3_context *context, int argc, sqlite3_value **argv){
  if( z2 ){
    z1 = sqlite3_malloc(n+1);
    if( z1 ){
-      strcpy(z1, z2);
+      memcpy(z1, z2, n+1);
      for(i=0; z1[i]; i++){
        z1[i] = toupper(z1[i]);
      }
@@ -240,7 +240,7 @@ static void lowerFunc(sqlite3_context *context, int argc, sqlite3_value **argv){
  if( z2 ){
    z1 = sqlite3_malloc(n+1);
    if( z1 ){
-      strcpy(z1, z2);
+      memcpy(z1, z2, n+1);
      for(i=0; z1[i]; i++){
        z1[i] = tolower(z1[i]);
      }
--- a/src/insert.c
+++ b/src/insert.c
@@ -12,7 +12,7 @@
 ** This file contains C code routines that are called by the parser
 ** to handle INSERT statements in SQLite.
 **
-** $Id: insert.c,v 1.185 2007/04/18 14:24:33 danielk1977 Exp $
+** $Id: insert.c,v 1.186 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"

@@ -1122,25 +1122,26 @@ void sqlite3GenerateConstraintChecks(
      case OE_Fail: {
        int j, n1, n2;
        char zErrMsg[200];
-        strcpy(zErrMsg, pIdx->nColumn>1 ? "columns " : "column ");
+        sqlite3_snprintf(sizeof(zErrMsg), zErrMsg,
+                         pIdx->nColumn>1 ? "columns " : "column ");
        n1 = strlen(zErrMsg);
        for(j=0; j<pIdx->nColumn && n1<sizeof(zErrMsg)-30; j++){
          char *zCol = pTab->aCol[pIdx->aiColumn[j]].zName;
          n2 = strlen(zCol);
          if( j>0 ){
-            strcpy(&zErrMsg[n1], ", ");
+            sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], ", ");
            n1 += 2;
          }
          if( n1+n2>sizeof(zErrMsg)-30 ){
-            strcpy(&zErrMsg[n1], "...");
+            sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], "...");
            n1 += 3;
            break;
          }else{
-            strcpy(&zErrMsg[n1], zCol);
+            sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], "%s", zCol);
            n1 += n2;
          }
        }
-        strcpy(&zErrMsg[n1], 
+        sqlite3_snprintf(sizeof(zErrMsg)-n1, &zErrMsg[n1], 
            pIdx->nColumn>1 ? " are not unique" : " is not unique");
        sqlite3VdbeOp3(v, OP_Halt, SQLITE_CONSTRAINT, onError, zErrMsg, 0);
        break;
--- a/src/legacy.c
+++ b/src/legacy.c
@@ -14,7 +14,7 @@
 ** other files are for internal use by SQLite and should not be
 ** accessed by users of the library.
 **
-** $Id: legacy.c,v 1.17 2007/04/25 11:28:17 drh Exp $
+** $Id: legacy.c,v 1.18 2007/05/04 13:15:56 drh Exp $
 */

 #include "sqliteInt.h"
@@ -118,9 +118,10 @@ exec_out:

  rc = sqlite3ApiExit(0, rc);
  if( rc!=SQLITE_OK && rc==sqlite3_errcode(db) && pzErrMsg ){
-    *pzErrMsg = sqlite3_malloc(1+strlen(sqlite3_errmsg(db)));
+    int nErrMsg = 1 + strlen(sqlite3_errmsg(db));
+    *pzErrMsg = sqlite3_malloc(nErrMsg);
    if( *pzErrMsg ){
-      strcpy(*pzErrMsg, sqlite3_errmsg(db));
+      memcpy(*pzErrMsg, sqlite3_errmsg(db), nErrMsg);
    }
  }else if( pzErrMsg ){
    *pzErrMsg = 0;
--- a/src/os_unix.c
+++ b/src/os_unix.c
@@ -959,7 +959,7 @@ int sqlite3UnixTempFileName(char *zBuf){
    break;
  }
  do{
-    sprintf(zBuf, "%s/"TEMP_FILE_PREFIX, zDir);
+    sqlite3_snprintf(SQLITE_TEMPNAME_SIZE, zBuf, "%s/"TEMP_FILE_PREFIX, zDir);
    j = strlen(zBuf);
    sqlite3Randomness(15, &zBuf[j]);
    for(i=0; i<15; i++, j++){
@@ -2518,33 +2518,40 @@ static int allocateUnixFile(
  }else{
    *pNew = f;
    switch(lockingStyle) {
-      case afpLockingStyle:
+      case afpLockingStyle: {
        /* afp locking uses the file path so it needs to be included in
        ** the afpLockingContext */
+        int nFilename;
        pNew->pMethod = &sqlite3AFPLockingUnixIoMethod;
        pNew->lockingContext = 
          sqlite3ThreadSafeMalloc(sizeof(afpLockingContext));
+        nFilename = strlen(zFilename)+1;
        ((afpLockingContext *)pNew->lockingContext)->filePath = 
-          sqlite3ThreadSafeMalloc(strlen(zFilename) + 1);
-        strcpy(((afpLockingContext *)pNew->lockingContext)->filePath, 
-               zFilename);
+          sqlite3ThreadSafeMalloc(nFilename);
+        memcpy(((afpLockingContext *)pNew->lockingContext)->filePath, 
+               zFilename, nFilename);
        srandomdev();
        break;
+      }
      case flockLockingStyle:
        /* flock locking doesn't need additional lockingContext information */
        pNew->pMethod = &sqlite3FlockLockingUnixIoMethod;
        break;
-      case dotlockLockingStyle:
+      case dotlockLockingStyle: {
        /* dotlock locking uses the file path so it needs to be included in
         ** the dotlockLockingContext */
+        int nFilename;
        pNew->pMethod = &sqlite3DotlockLockingUnixIoMethod;
        pNew->lockingContext = sqlite3ThreadSafeMalloc(
          sizeof(dotlockLockingContext));
+        nFilename = strlen(zFilename) + 6;
        ((dotlockLockingContext *)pNew->lockingContext)->lockPath = 
-            sqlite3ThreadSafeMalloc(strlen(zFilename) + strlen(".lock") + 1);
-        sprintf(((dotlockLockingContext *)pNew->lockingContext)->lockPath, 
+            sqlite3ThreadSafeMalloc( nFilename );
+        sqlite3_snprintf(nFilename, 
+                ((dotlockLockingContext *)pNew->lockingContext)->lockPath, 
                "%s.lock", zFilename);
        break;
+      }
      case posixLockingStyle:
        /* posix locking doesn't need additional lockingContext information */
        pNew->pMethod = &sqlite3UnixIoMethod;
--- a/src/os_win.c
+++ b/src/os_win.c
@@ -946,7 +946,7 @@ int sqlite3WinTempFileName(char *zBuf){
  for(i=strlen(zTempPath); i>0 && zTempPath[i-1]=='\\'; i--){}
  zTempPath[i] = 0;
  for(;;){
-    sprintf(zBuf, "%s\\"TEMP_FILE_PREFIX, zTempPath);
+    sqlite3_snprintf(sizeof(zBuf), zBuf, "%s\\"TEMP_FILE_PREFIX, zTempPath);
    j = strlen(zBuf);
    sqlite3Randomness(15, &zBuf[j]);
    for(i=0; i<15; i++, j++){
--- a/src/pager.c
+++ b/src/pager.c
@@ -18,7 +18,7 @@
 ** file simultaneously, or one process from reading the database while
 ** another is writing.
 **
-** @(#) $Id: pager.c,v 1.334 2007/05/04 12:01:03 drh Exp $
+** @(#) $Id: pager.c,v 1.335 2007/05/04 13:15:56 drh Exp $
 */
 #ifndef SQLITE_OMIT_DISKIO
 #include "sqliteInt.h"
@@ -1736,14 +1736,14 @@ int sqlite3PagerOpen(
  pPager->zFilename = (char*)&pPager[1];
  pPager->zDirectory = &pPager->zFilename[nameLen+1];
  pPager->zJournal = &pPager->zDirectory[nameLen+1];
-  strcpy(pPager->zFilename, zFullPathname);
-  strcpy(pPager->zDirectory, zFullPathname);
+  memcpy(pPager->zFilename, zFullPathname, nameLen+1);
+  memcpy(pPager->zDirectory, zFullPathname, nameLen+1);

  for(i=nameLen; i>0 && pPager->zDirectory[i-1]!='/'; i--){}
  if( i>0 ) pPager->zDirectory[i-1] = 0;
-  strcpy(pPager->zJournal, zFullPathname);
+  memcpy(pPager->zJournal, zFullPathname,nameLen);
  sqliteFree(zFullPathname);
-  strcpy(&pPager->zJournal[nameLen], "-journal");
+  memcpy(&pPager->zJournal[nameLen], "-journal",sizeof("-journal"));
  pPager->fd = fd;
  /* pPager->journalOpen = 0; */
  pPager->useJournal = useJournal && !memDb;
--- a/src/select.c
+++ b/src/select.c
@@ -12,7 +12,7 @@
 ** This file contains C code routines that are called by the parser
 ** to handle SELECT statements in SQLite.
 **
-** $Id: select.c,v 1.339 2007/05/03 13:02:27 drh Exp $
+** $Id: select.c,v 1.340 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"

@@ -1012,7 +1012,7 @@ static void generateColumnNames(
    }else{
      char zName[30];
      assert( p->op!=TK_COLUMN || pTabList==0 );
-      sprintf(zName, "column%d", i+1);
+      sqlite3_snprintf(sizeof(zName), zName, "column%d", i+1);
      sqlite3VdbeSetColName(v, i, COLNAME_NAME, zName, 0);
    }
  }
--- a/src/shell.c
+++ b/src/shell.c
@@ -12,7 +12,7 @@
 ** This file contains code to implement the "sqlite" command line
 ** utility for accessing SQLite databases.
 **
-** $Id: shell.c,v 1.161 2007/05/03 17:18:38 drh Exp $
+** $Id: shell.c,v 1.162 2007/05/04 13:15:56 drh Exp $
 */
 #include <stdlib.h>
 #include <string.h>
@@ -833,7 +833,7 @@ static int run_schema_dump_query(
    if( pzErrMsg ) sqlite3_free(*pzErrMsg);
    zQ2 = malloc( len+100 );
    if( zQ2==0 ) return rc;
-    sprintf(zQ2, "%s ORDER BY rowid DESC", zQuery);
+    sqlite3_snprintf(sizeof(zQ2), zQ2, "%s ORDER BY rowid DESC", zQuery);
    rc = sqlite3_exec(p->db, zQ2, dump_callback, p, pzErrMsg);
    free(zQ2);
  }
@@ -1302,10 +1302,10 @@ static int do_meta_command(char *zLine, struct callback_data *p){
      p->mode = MODE_Tcl;
    }else if( strncmp(azArg[1],"csv",n2)==0 ){
      p->mode = MODE_Csv;
-      strcpy(p->separator, ",");
+      sqlite3_snprintf(sizeof(p->separator), p->separator, ",");
    }else if( strncmp(azArg[1],"tabs",n2)==0 ){
      p->mode = MODE_List;
-      strcpy(p->separator, "\t");
+      sqlite3_snprintf(sizeof(p->separator), p->separator, "\t");
    }else if( strncmp(azArg[1],"insert",n2)==0 ){
      p->mode = MODE_Insert;
      if( nArg>=3 ){
@@ -1320,7 +1320,8 @@ static int do_meta_command(char *zLine, struct callback_data *p){
  }else

  if( c=='n' && strncmp(azArg[0], "nullvalue", n)==0 && nArg==2 ) {
-    sprintf(p->nullvalue, "%.*s", (int)ArraySize(p->nullvalue)-1, azArg[1]);
+    sqlite3_snprintf(sizeof(p->nullvalue), p->nullvalue,
+                     "%.*s", (int)ArraySize(p->nullvalue)-1, azArg[1]);
  }else

  if( c=='o' && strncmp(azArg[0], "output", n)==0 && nArg==2 ){
@@ -1329,14 +1330,14 @@ static int do_meta_command(char *zLine, struct callback_data *p){
    }
    if( strcmp(azArg[1],"stdout")==0 ){
      p->out = stdout;
-      strcpy(p->outfile,"stdout");
+      sqlite3_snprintf(sizeof(p->outfile), p->outfile, "stdout");
    }else{
      p->out = fopen(azArg[1], "wb");
      if( p->out==0 ){
        fprintf(stderr,"can't write to \"%s\"\n", azArg[1]);
        p->out = stdout;
      } else {
-         strcpy(p->outfile,azArg[1]);
+         sqlite3_snprintf(sizeof(p->outfile), p->outfile, "%s", azArg[1]);
      }
    }
  }else
@@ -1428,7 +1429,8 @@ static int do_meta_command(char *zLine, struct callback_data *p){
  }else

  if( c=='s' && strncmp(azArg[0], "separator", n)==0 && nArg==2 ){
-    sprintf(p->separator, "%.*s", (int)ArraySize(p->separator)-1, azArg[1]);
+    sqlite3_snprintf(sizeof(p->separator), p->separator,
+                     "%.*s", (int)sizeof(p->separator)-1, azArg[1]);
  }else

  if( c=='s' && strncmp(azArg[0], "show", n)==0){
@@ -1621,7 +1623,7 @@ static int process_input(struct callback_data *p, FILE *in){
      continue;
    }
    if( _is_command_terminator(zLine) ){
-      strcpy(zLine,";");
+      memcpy(zLine,";",2);
    }
    if( zSql==0 ){
      int i;
@@ -1633,7 +1635,7 @@ static int process_input(struct callback_data *p, FILE *in){
          fprintf(stderr, "out of memory\n");
          exit(1);
        }
-        strcpy(zSql, zLine);
+        memcpy(zSql, zLine, nSql+1);
        startline = lineno;
      }
    }else{
@@ -1643,8 +1645,8 @@ static int process_input(struct callback_data *p, FILE *in){
        fprintf(stderr,"%s: out of memory!\n", Argv0);
        exit(1);
      }
-      strcpy(&zSql[nSql++], "\n");
-      strcpy(&zSql[nSql], zLine);
+      zSql[nSql++] = '\n';
+      memcpy(&zSql[nSql], zLine, len+1);
      nSql += len;
    }
    free(zLine);
@@ -1655,9 +1657,10 @@ static int process_input(struct callback_data *p, FILE *in){
      if( rc || zErrMsg ){
        char zPrefix[100];
        if( in!=0 || !stdin_is_interactive ){
-          sprintf(zPrefix, "SQL error near line %d:", startline);
+          sqlite3_snprintf(sizeof(zPrefix), zPrefix, 
+                           "SQL error near line %d:", startline);
        }else{
-          sprintf(zPrefix, "SQL error:");
+          sqlite3_snprintf(sizeof(zPrefix), zPrefix, "SQL error:");
        }
        if( zErrMsg!=0 ){
          printf("%s %s\n", zPrefix, zErrMsg);
@@ -1730,8 +1733,9 @@ static char *find_home_dir(void){
 #endif

  if( home_dir ){
-    char *z = malloc( strlen(home_dir)+1 );
-    if( z ) strcpy(z, home_dir);
+    int n = strlen(home_dir) + 1;
+    char *z = malloc( n );
+    if( z ) memcpy(z, home_dir, n);
    home_dir = z;
  }

@@ -1762,7 +1766,7 @@ static void process_sqliterc(
      fprintf(stderr,"%s: out of memory!\n", Argv0);
      exit(1);
    }
-    sprintf(zBuf,"%s/.sqliterc",home_dir);
+    sqlite3_snprintf(sizeof(zBuf), zBuf,"%s/.sqliterc",home_dir);
    free(home_dir);
    sqliterc = (const char*)zBuf;
  }
@@ -1816,10 +1820,10 @@ static void usage(int showDetail){
 static void main_init(struct callback_data *data) {
  memset(data, 0, sizeof(*data));
  data->mode = MODE_List;
-  strcpy(data->separator,"|");
+  memcpy(data->separator,"|", 2);
  data->showHeader = 0;
-  strcpy(mainPrompt,"sqlite> ");
-  strcpy(continuePrompt,"   ...> ");
+  sqlite3_snprintf(sizeof(mainPrompt), mainPrompt,"sqlite> ");
+  sqlite3_snprintf(sizeof(continuePrompt), continuePrompt,"   ...> ");
 }

 int main(int argc, char **argv){
@@ -1917,13 +1921,15 @@ int main(int argc, char **argv){
      data.mode = MODE_Column;
    }else if( strcmp(z,"-csv")==0 ){
      data.mode = MODE_Csv;
-      strcpy(data.separator,",");
+      memcpy(data.separator,",",2);
    }else if( strcmp(z,"-separator")==0 ){
      i++;
-      sprintf(data.separator,"%.*s",(int)sizeof(data.separator)-1,argv[i]);
+      sqlite3_snprintf(sizeof(data.separator), data.separator,
+                       "%.*s",(int)sizeof(data.separator)-1,argv[i]);
    }else if( strcmp(z,"-nullvalue")==0 ){
      i++;
-      sprintf(data.nullvalue,"%.*s",(int)sizeof(data.nullvalue)-1,argv[i]);
+      sqlite3_snprintf(sizeof(data.nullvalue), data.nullvalue,
+                       "%.*s",(int)sizeof(data.nullvalue)-1,argv[i]);
    }else if( strcmp(z,"-header")==0 ){
      data.showHeader = 1;
    }else if( strcmp(z,"-noheader")==0 ){
@@ -1969,14 +1975,15 @@ int main(int argc, char **argv){
    if( stdin_is_interactive ){
      char *zHome;
      char *zHistory = 0;
+      int nHistory;
      printf(
        "SQLite version %s\n"
        "Enter \".help\" for instructions\n",
        sqlite3_libversion()
      );
      zHome = find_home_dir();
-      if( zHome && (zHistory = malloc(strlen(zHome)+20))!=0 ){
-        sprintf(zHistory,"%s/.sqlite_history", zHome);
+      if( zHome && (zHistory = malloc(nHistory = strlen(zHome)+20))!=0 ){
+        sqlite3_snprintf(nHistory, zHistory,"%s/.sqlite_history", zHome);
      }
 #if defined(HAVE_READLINE) && HAVE_READLINE==1
      if( zHistory ) read_history(zHistory);
--- a/src/table.c
+++ b/src/table.c
@@ -92,9 +92,10 @@ static int sqlite3_get_table_cb(void *pArg, int nCol, char **argv, char **colv){
      if( argv[i]==0 ){
        z = 0;
      }else{
-        z = sqlite3_malloc( strlen(argv[i])+1 );
+        int n = strlen(argv[i])+1;
+        z = sqlite3_malloc( n );
        if( z==0 ) goto malloc_failed;
-        strcpy(z, argv[i]);
+        memcpy(z, argv[i], n);
      }
      p->azResult[p->nData++] = z;
    }
--- a/src/tclsqlite.c
+++ b/src/tclsqlite.c
@@ -12,7 +12,7 @@
 ** A TCL Interface to SQLite.  Append this file to sqlite3.c and
 ** compile the whole thing to build a TCL-enabled version of SQLite.
 **
-** $Id: tclsqlite.c,v 1.183 2007/05/04 12:05:56 danielk1977 Exp $
+** $Id: tclsqlite.c,v 1.184 2007/05/04 13:15:56 drh Exp $
 */
 #include "tcl.h"
 #include <errno.h>
@@ -329,7 +329,7 @@ static int createIncrblobChannel(
  p->iSeek = 0;
  p->pBlob = pBlob;

-  sprintf(zChannel, "incrblob_%d", ++count);
+  sqlite3_snprintf(sizeof(zChannel), zChannel, "incrblob_%d", ++count);
  p->channel = Tcl_CreateChannel(&IncrblobChannelType, zChannel, p, flags);
  Tcl_RegisterChannel(interp, p->channel);

@@ -470,7 +470,7 @@ static int DbBusyHandler(void *cd, int nTries){
  int rc;
  char zVal[30];

-  sprintf(zVal, "%d", nTries);
+  sqlite3_snprintf(sizeof(zVal), zVal, "%d", nTries);
  rc = Tcl_VarEval(pDb->interp, pDb->zBusy, " ", zVal, (char*)0);
  if( rc!=TCL_OK || atoi(Tcl_GetStringResult(pDb->interp)) ){
    return 0;
@@ -979,7 +979,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      zAuth = Tcl_GetStringFromObj(objv[2], &len);
      if( zAuth && len>0 ){
        pDb->zAuth = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zAuth, zAuth);
+        memcpy(pDb->zAuth, zAuth, len+1);
      }else{
        pDb->zAuth = 0;
      }
@@ -1016,7 +1016,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      zBusy = Tcl_GetStringFromObj(objv[2], &len);
      if( zBusy && len>0 ){
        pDb->zBusy = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zBusy, zBusy);
+        memcpy(pDb->zBusy, zBusy, len+1);
      }else{
        pDb->zBusy = 0;
      }
@@ -1128,7 +1128,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
    pCollate->pNext = pDb->pCollate;
    pCollate->zScript = (char*)&pCollate[1];
    pDb->pCollate = pCollate;
-    strcpy(pCollate->zScript, zScript);
+    memcpy(pCollate->zScript, zScript, nScript+1);
    if( sqlite3_create_collation(pDb->db, zName, SQLITE_UTF8, 
        pCollate, tclSqlCollate) ){
      Tcl_SetResult(interp, (char *)sqlite3_errmsg(pDb->db), TCL_VOLATILE);
@@ -1181,7 +1181,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      zCommit = Tcl_GetStringFromObj(objv[2], &len);
      if( zCommit && len>0 ){
        pDb->zCommit = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zCommit, zCommit);
+        memcpy(pDb->zCommit, zCommit, len+1);
      }else{
        pDb->zCommit = 0;
      }
@@ -1359,9 +1359,10 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      }
      if( i+1!=nCol ){
        char *zErr;
-        zErr = malloc(200 + strlen(zFile));
+        int nErr = strlen(zFile) + 200;
+        zErr = malloc(nErr);
        if( zErr ){
-          sprintf(zErr,
+          sqlite3_snprintf(nErr, zErr,
             "Error: %s line %d: expected %d columns of data but found %d",
             zFile, lineno, nCol, i+1);
          Tcl_AppendResult(interp, zErr, 0);
@@ -1399,7 +1400,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      rc = TCL_OK;
    }else{
      /* failure, append lineno where failed */
-      sprintf(zLineNum,"%d",lineno);
+      sqlite3_snprintf(sizeof(zLineNum), zLineNum,"%d",lineno);
      Tcl_AppendResult(interp,", failed while processing line: ",zLineNum,0);
      rc = TCL_ERROR;
    }
@@ -1979,7 +1980,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      zProgress = Tcl_GetStringFromObj(objv[3], &len);
      if( zProgress && len>0 ){
        pDb->zProgress = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zProgress, zProgress);
+        memcpy(pDb->zProgress, zProgress, len+1);
      }else{
        pDb->zProgress = 0;
      }
@@ -2021,7 +2022,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      zProfile = Tcl_GetStringFromObj(objv[2], &len);
      if( zProfile && len>0 ){
        pDb->zProfile = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zProfile, zProfile);
+        memcpy(pDb->zProfile, zProfile, len+1);
      }else{
        pDb->zProfile = 0;
      }
@@ -2116,7 +2117,7 @@ static int DbObjCmd(void *cd, Tcl_Interp *interp, int objc,Tcl_Obj *const*objv){
      zTrace = Tcl_GetStringFromObj(objv[2], &len);
      if( zTrace && len>0 ){
        pDb->zTrace = Tcl_Alloc( len + 1 );
-        strcpy(pDb->zTrace, zTrace);
+        memcpy(pDb->zTrace, zTrace, len+1);
      }else{
        pDb->zTrace = 0;
      }
--- a/src/util.c
+++ b/src/util.c
@@ -14,7 +14,7 @@
 ** This file contains functions for allocating memory, comparing
 ** strings, and stuff like that.
 **
-** $Id: util.c,v 1.199 2007/04/06 02:32:34 drh Exp $
+** $Id: util.c,v 1.200 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include "os.h"
@@ -424,7 +424,7 @@ int sqlite3OutstandingMallocs(Tcl_Interp *interp){
    z = &zAlloc[TESTALLOC_OFFSET_STACK(p)];
    for(i=0; i<TESTALLOC_STACKFRAMES; i++){
      char zHex[128];
-      sprintf(zHex, "%p", ((void **)z)[i]);
+      sqlite3_snprintf(sizeof(zHex), zHex, "%p", ((void **)z)[i]);
      Tcl_ListObjAppendElement(0, pStack, Tcl_NewStringObj(zHex, -1));
    }

@@ -722,9 +722,11 @@ int sqlite3AllocSize(void *p){
 */
 char *sqlite3StrDup(const char *z){
  char *zNew;
+  int n;
  if( z==0 ) return 0;
-  zNew = sqlite3MallocRaw(strlen(z)+1, 1);
-  if( zNew ) strcpy(zNew, z);
+  n = strlen(z)+1;
+  zNew = sqlite3MallocRaw(n, 1);
+  if( zNew ) memcpy(zNew, z, n);
  return zNew;
 }
 char *sqlite3StrNDup(const char *z, int n){
@@ -766,9 +768,11 @@ void sqlite3SetString(char **pz, ...){
  *zResult = 0;
  va_start(ap, pz);
  while( (z = va_arg(ap, const char*))!=0 ){
-    strcpy(zResult, z);
-    zResult += strlen(zResult);
+    int n = strlen(z);
+    memcpy(zResult, z, n);
+    zResult += n;
  }
+  zResult[0] = 0;
  va_end(ap);
 }

--- a/src/vdbe.c
+++ b/src/vdbe.c
@@ -43,7 +43,7 @@
 ** in this file for details.  If in doubt, do not deviate from existing
 ** commenting and indentation practices when changing or adding code.
 **
-** $Id: vdbe.c,v 1.605 2007/05/02 16:51:59 drh Exp $
+** $Id: vdbe.c,v 1.606 2007/05/04 13:15:56 drh Exp $
 */
 #include "sqliteInt.h"
 #include "os.h"
@@ -319,10 +319,13 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
      c = 's';
    }

-    zCsr += sprintf(zCsr, "%c", c);
-    zCsr += sprintf(zCsr, "%d[", pMem->n);
+    sqlite3_snprintf(100, zCsr, "%c", c);
+    zCsr += strlen(zCsr);
+    sqlite3_snprintf(100, zCsr, "%d[", pMem->n);
+    zCsr += strlen(zCsr);
    for(i=0; i<16 && i<pMem->n; i++){
-      zCsr += sprintf(zCsr, "%02X", ((int)pMem->z[i] & 0xFF));
+      sqlite3_snprintf(100, zCsr, "%02X", ((int)pMem->z[i] & 0xFF));
+      zCsr += strlen(zCsr);
    }
    for(i=0; i<16 && i<pMem->n; i++){
      char z = pMem->z[i];
@@ -330,9 +333,11 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
      else *zCsr++ = z;
    }

-    zCsr += sprintf(zCsr, "]");
+    sqlite3_snprintf(100, zCsr, "]");
+    zCsr += strlen(zCsr);
    if( f & MEM_Zero ){
-      zCsr += sprintf(zCsr,"+%lldz",pMem->u.i);
+      sqlite3_snprintf(100, zCsr,"+%lldz",pMem->u.i);
+      zCsr += strlen(zCsr);
    }
    *zCsr = '\0';
  }else if( f & MEM_Str ){
@@ -351,7 +356,8 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
      zBuf[1] = 's';
    }
    k = 2;
-    k += sprintf(&zBuf[k], "%d", pMem->n);
+    sqlite3_snprintf(100, &zBuf[k], "%d", pMem->n);
+    k += strlen(&zBuf[k]);
    zBuf[k++] = '[';
    for(j=0; j<15 && j<pMem->n; j++){
      u8 c = pMem->z[j];
@@ -362,7 +368,8 @@ void sqlite3VdbeMemPrettyPrint(Mem *pMem, char *zBuf){
      }
    }
    zBuf[k++] = ']';
-    k += sprintf(&zBuf[k], encnames[pMem->enc]);
+    sqlite3_snprintf(100,&zBuf[k], encnames[pMem->enc]);
+    k += strlen(&zBuf[k]);
    zBuf[k++] = 0;
  }
 }
--- a/src/vdbeaux.c
+++ b/src/vdbeaux.c
@@ -589,24 +589,24 @@ static char *displayP3(Op *pOp, char *zTemp, int nTemp){
    case P3_KEYINFO: {
      int i, j;
      KeyInfo *pKeyInfo = (KeyInfo*)pOp->p3;
-      sprintf(zTemp, "keyinfo(%d", pKeyInfo->nField);
+      sqlite3_snprintf(nTemp, zTemp, "keyinfo(%d", pKeyInfo->nField);
      i = strlen(zTemp);
      for(j=0; j<pKeyInfo->nField; j++){
        CollSeq *pColl = pKeyInfo->aColl[j];
        if( pColl ){
          int n = strlen(pColl->zName);
          if( i+n>nTemp-6 ){
-            strcpy(&zTemp[i],",...");
+            memcpy(&zTemp[i],",...",4);
            break;
          }
          zTemp[i++] = ',';
          if( pKeyInfo->aSortOrder && pKeyInfo->aSortOrder[j] ){
            zTemp[i++] = '-';
          }
-          strcpy(&zTemp[i], pColl->zName);
+          memcpy(&zTemp[i], pColl->zName,n+1);
          i += n;
        }else if( i+4<nTemp-6 ){
-          strcpy(&zTemp[i],",nil");
+          memcpy(&zTemp[i],",nil",4);
          i += 4;
        }
      }
@@ -618,7 +618,7 @@ static char *displayP3(Op *pOp, char *zTemp, int nTemp){
    }
    case P3_COLLSEQ: {
      CollSeq *pColl = (CollSeq*)pOp->p3;
-      sprintf(zTemp, "collseq(%.20s)", pColl->zName);
+      sqlite3_snprintf(nTemp, zTemp, "collseq(%.20s)", pColl->zName);
      zP3 = zTemp;
      break;
    }
--- a/src/vdbeblob.c
+++ b/src/vdbeblob.c
@@ -10,7 +10,7 @@
 **
 *************************************************************************
 **
-** $Id: vdbeblob.c,v 1.6 2007/05/04 12:05:56 danielk1977 Exp $
+** $Id: vdbeblob.c,v 1.7 2007/05/04 13:15:57 drh Exp $
 */

 #include "sqliteInt.h"
@@ -83,8 +83,9 @@ int sqlite3_blob_open(

  Vdbe *v = 0;
  int rc = SQLITE_OK;
-  char zErr[128] = {0};
+  char zErr[128];

+  zErr[0] = 0;
  do {
    Parse sParse;
    Table *pTab;
@@ -131,7 +132,8 @@ int sqlite3_blob_open(
        int j;
        for(j=0; j<pIdx->nColumn; j++){
          if( pIdx->aiColumn[j]==iCol ){
-            strcpy(zErr, "cannot open indexed column for writing");
+            sqlite3_snprintf(sizeof(zErr), zErr,
+                             "cannot open indexed column for writing");
            rc = SQLITE_ERROR;
            sqlite3SafetyOff(db);
            goto blob_open_out;
--- a/src/vtab.c
+++ b/src/vtab.c
@@ -11,7 +11,7 @@
 *************************************************************************
 ** This file contains code used to help implement virtual tables.
 **
-** $Id: vtab.c,v 1.45 2007/04/19 14:48:37 danielk1977 Exp $
+** $Id: vtab.c,v 1.46 2007/05/04 13:15:57 drh Exp $
 */
 #ifndef SQLITE_OMIT_VIRTUALTABLE
 #include "sqliteInt.h"
@@ -29,7 +29,7 @@ int sqlite3_create_module(
  Module *pMod = (Module *)sqliteMallocRaw(sizeof(Module) + nName + 1);
  if( pMod ){
    char *zCopy = (char *)(&pMod[1]);
-    strcpy(zCopy, zName);
+    memcpy(zCopy, zName, nName+1);
    pMod->zName = zCopy;
    pMod->pModule = pModule;
    pMod->pAux = pAux;
@@ -705,7 +705,7 @@ FuncDef *sqlite3VtabOverloadFunction(
    return pDef;
  }
  *pNew = *pDef;
-  strcpy(pNew->zName, pDef->zName);
+  memcpy(pNew->zName, pDef->zName, strlen(pDef->zName)+1);
  pNew->xFunc = xFunc;
  pNew->pUserData = pArg;
  pNew->flags |= SQLITE_FUNC_EPHEM;
--- a/src/where.c
+++ b/src/where.c
@@ -16,7 +16,7 @@
 ** so is applicable.  Because this module is responsible for selecting
 ** indices, you might also think of this module as the "query optimizer".
 **
-** $Id: where.c,v 1.247 2007/04/20 12:22:02 drh Exp $
+** $Id: where.c,v 1.248 2007/05/04 13:15:57 drh Exp $
 */
 #include "sqliteInt.h"

@@ -2605,24 +2605,24 @@ WhereInfo *sqlite3WhereBegin(
    n = strlen(z);
    if( n+nQPlan < sizeof(sqlite3_query_plan)-10 ){
      if( pLevel->flags & WHERE_IDX_ONLY ){
-        strcpy(&sqlite3_query_plan[nQPlan], "{}");
+        memcpy(&sqlite3_query_plan[nQPlan], "{}", 2);
        nQPlan += 2;
      }else{
-        strcpy(&sqlite3_query_plan[nQPlan], z);
+        memcpy(&sqlite3_query_plan[nQPlan], z, n);
        nQPlan += n;
      }
      sqlite3_query_plan[nQPlan++] = ' ';
    }
    if( pLevel->flags & (WHERE_ROWID_EQ|WHERE_ROWID_RANGE) ){
-      strcpy(&sqlite3_query_plan[nQPlan], "* ");
+      memcpy(&sqlite3_query_plan[nQPlan], "* ", 2);
      nQPlan += 2;
    }else if( pLevel->pIdx==0 ){
-      strcpy(&sqlite3_query_plan[nQPlan], "{} ");
+      memcpy(&sqlite3_query_plan[nQPlan], "{} ", 3);
      nQPlan += 3;
    }else{
      n = strlen(pLevel->pIdx->zName);
      if( n+nQPlan < sizeof(sqlite3_query_plan)-2 ){
-        strcpy(&sqlite3_query_plan[nQPlan], pLevel->pIdx->zName);
+        memcpy(&sqlite3_query_plan[nQPlan], pLevel->pIdx->zName, n);
        nQPlan += n;
        sqlite3_query_plan[nQPlan++] = ' ';
      }
--- a/test/date.test
+++ b/test/date.test
@@ -11,7 +11,7 @@
 # This file implements regression tests for SQLite library.  The
 # focus of this file is testing date and time functions.
 #
-# $Id: date.test,v 1.21 2007/04/06 02:32:35 drh Exp $
+# $Id: date.test,v 1.22 2007/05/04 13:15:57 drh Exp $

 set testdir [file dirname $argv0]
 source $testdir/tester.tcl
@@ -126,7 +126,7 @@ datetest 3.1 {strftime('%d','2003-10-31 12:34:56.432')} 31
 datetest 3.2 {strftime('%f','2003-10-31 12:34:56.432')} 56.432
 datetest 3.3 {strftime('%H','2003-10-31 12:34:56.432')} 12
 datetest 3.4 {strftime('%j','2003-10-31 12:34:56.432')} 304
-datetest 3.5 {strftime('%J','2003-10-31 12:34:56.432')} 2452944.024264259
+datetest 3.5 {strftime('%J','2003-10-31 12:34:56.432')} 2452944.02426426
 datetest 3.6 {strftime('%m','2003-10-31 12:34:56.432')} 10
 datetest 3.7 {strftime('%M','2003-10-31 12:34:56.432')} 34
 datetest 3.8 {strftime('%s','2003-10-31 12:34:56.432')} 1067603696