Refactored all the sprintf to use snprintf instead. (#628)

apps/mstpcrc/main.c

@@ -154,7 +154,7 @@ static void Parse_Arguments(int argc, char *argv[])
     }
 }
 
-static void filename_create(char *filename)
+static void filename_create(char *filename, size_t filesize)
 {
     time_t my_time;
     struct tm *today;
@@ -162,7 +162,7 @@ static void filename_create(char *filename)
     if (filename) {
         my_time = time(NULL);
         today = localtime(&my_time);
-        sprintf(filename, "mstp_%04d%02d%02d%02d%02d%02d.cap",
+        snprintf(filename, filesize, "mstp_%04d%02d%02d%02d%02d%02d.cap",
             1900 + today->tm_year, 1 + today->tm_mon, today->tm_mday,
             today->tm_hour, today->tm_min, today->tm_sec);
     }
@@ -223,7 +223,7 @@ static void write_received_packet(uint8_t *buffer, unsigned length)
 
 static void Write_Pcap(uint8_t *buffer, unsigned length)
 {
-    filename_create(&Capture_Filename[0]);
+    filename_create(&Capture_Filename[0], sizeof(Capture_Filename));
     write_global_header(&Capture_Filename[0]);
     write_received_packet(buffer, length);
     if (pFile) {
@@ -236,7 +236,7 @@ static void Process_Text_File(void)
 {
     char *argi = NULL;
 
-    filename_create(&Capture_Filename[0]);
+    filename_create(&Capture_Filename[0], sizeof(Capture_Filename));
     write_global_header(&Capture_Filename[0]);
     while (fgets(Text_Buffer, sizeof(Text_Buffer), pText_File)) {
         CRC_Buffer_Len = 0;

apps/perl/perl_bindings.c

@@ -66,7 +66,7 @@ static void MyAbortHandler(
     if (address_match(&Target_Address, src) &&
         (invoke_id == Request_Invoke_ID)) {
         char msg[MAX_ERROR_STRING];
-        sprintf(msg, "BACnet Abort: %s",
+        snprintf(msg, sizeof(msg), "BACnet Abort: %s",
             bactext_abort_reason_name((int)abort_reason));
         LogError(msg);
     }
@@ -78,7 +78,7 @@ static void MyRejectHandler(
     if (address_match(&Target_Address, src) &&
         (invoke_id == Request_Invoke_ID)) {
         char msg[MAX_ERROR_STRING];
-        sprintf(msg, "BACnet Reject: %s",
+        snprintf(msg, sizeof(msg), "BACnet Reject: %s",
             bactext_reject_reason_name((int)reject_reason));
         LogError(msg);
     }
@@ -92,7 +92,7 @@ static void My_Error_Handler(BACNET_ADDRESS *src,
     if (address_match(&Target_Address, src) &&
         (invoke_id == Request_Invoke_ID)) {
         char msg[MAX_ERROR_STRING];
-        sprintf(msg, "BACnet Error: %s: %s",
+        snprintf(msg, sizeof(msg), "BACnet Error: %s: %s",
             bactext_error_class_name((int)error_class),
             bactext_error_code_name((int)error_code));
         LogError(msg);
@@ -211,7 +211,7 @@ void rpm_ack_extract_data(BACNET_READ_ACCESS_DATA *rpm_data)
                 }
             } else {
                 /* AccessError */
-                sprintf(ackString, "BACnet Error: %s: %s",
+                snprintf(ackString, sizeof(ackString), "BACnet Error: %s: %s",
                     bactext_error_class_name(
                         (int)listOfProperties->error.error_class),
                     bactext_error_code_name(
@@ -251,13 +251,13 @@ static void AtomicReadFileAckHandler(uint8_t *service_request,
                 uint8_t *pFileData;
                 int i;
 
-                sprintf(msg, "EOF=%d,start=%d,", data.endOfFile,
+                snprintf(msg, sizeof(msg), "EOF=%d,start=%d,", data.endOfFile,
                     data.type.stream.fileStartPosition);
                 __LogAnswer(msg, 0);
 
                 pFileData = octetstring_value(&data.fileData);
                 for (i = 0; i < octetstring_length(&data.fileData); i++) {
-                    sprintf(msg, "%02x ", *pFileData);
+                    snprintf(msg, sizeof(msg), "%02x ", *pFileData);
                     __LogAnswer(msg, 1);
                     pFileData++;
                 }
@@ -710,14 +710,14 @@ int BacnetWriteProperty(int deviceInstanceNumber,
         property_tag = strtol(tag, NULL, 0);
 
         if (property_tag >= MAX_BACNET_APPLICATION_TAG) {
-            sprintf(msg, "Error: tag=%u - it must be less than %u",
+            snprintf(msg, sizeof(msg), "Error: tag=%u - it must be less than %u",
                 property_tag, MAX_BACNET_APPLICATION_TAG);
             LogError(msg);
             break;
         }
         if (!bacapp_parse_application_data(
                 property_tag, value, &propertyValue)) {
-            sprintf(msg, "Error: unable to parse the tag value");
+            snprintf(msg, sizeof(msg), "Error: unable to parse the tag value");
             LogError(msg);
             break;
         }
@@ -883,11 +883,11 @@ int BacnetTimeSync(int deviceInstanceNumber,
         bytes_sent = datalink_send_pdu(
             &Target_Address, &npdu_data, &Handler_Transmit_Buffer[0], pdu_len);
         if (bytes_sent <= 0) {
-            char errorMsg[64];
+            char msg[64];
-            sprintf(errorMsg,
+            snprintf(msg, sizeof(msg), 
                 "Failed to Send Time-Synchronization Request (%s)!",
                 strerror(errno));
-            LogError(errorMsg);
+            LogError(msg);
             break;
         }
 

ports/bdk-atxx4-mstp/ai.c

@@ -94,12 +94,12 @@ uint32_t Analog_Input_Index_To_Instance(unsigned index)
 bool Analog_Input_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ANALOG_INPUTS) {
-        sprintf(text_string, "AI-%lu", object_instance);
+        snprintf(text, sizeof(text), "AI-%lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

ports/bdk-atxx4-mstp/av.c

@@ -158,14 +158,14 @@ bool Analog_Value_Present_Value_Set(
 bool Analog_Value_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     unsigned index = 0;
     bool status = false;
 
     index = Analog_Value_Instance_To_Index(object_instance);
     if (index < MAX_ANALOG_VALUES) {
-        sprintf(text_string, "AV-%lu", object_instance);
+        snprintf(text, sizeof(text), "AV-%lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

ports/bdk-atxx4-mstp/avrosp/SerialPort.cpp

@@ -64,7 +64,7 @@ void SerialPort::openChannel()
 		/* For COM ports greater than 9 you have to use a special syntax
 		for CreateFile. The syntax also works for COM ports 1-9. */
 		/* http://support.microsoft.com/kb/115831 */
-		sprintf(comName, "\\\\.\\COM%ld", portNumber);
+		snprintf(comName, sizeof(comName), "\\\\.\\COM%ld", portNumber);
 	}
 	serialHandle = CreateFile( comName, GENERIC_READ | GENERIC_WRITE, 0, NULL,
 			OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL );

ports/bdk-atxx4-mstp/bi.c

@@ -139,12 +139,12 @@ bool Binary_Input_Present_Value_Set(
 bool Binary_Input_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_BINARY_INPUTS) {
-        sprintf(text_string, "BI-%lu", object_instance);
+        snprintf(text, sizeof(text), "BI-%lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

ports/bdk-atxx4-mstp/bo.c

@@ -209,12 +209,12 @@ bool Binary_Output_Out_Of_Service(uint32_t instance)
 bool Binary_Output_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_BINARY_OUTPUTS) {
-        sprintf(text_string, "BO-%lu", object_instance);
+        snprintf(text, sizeof(text), "BO-%lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

ports/bdk-atxx4-mstp/device.c

@@ -284,11 +284,12 @@ uint32_t Device_Index_To_Instance(unsigned index)
 
 static char *Device_Name_Default(void)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
 
-    sprintf(text_string, "DEVICE-%lu", Object_Instance_Number);
+    snprintf(text, sizeof(text), "DEVICE-%lu", 
+        (unsigned long)Object_Instance_Number);
 
-    return text_string;
+    return text;
 }
 
 bool Device_Object_Name(

ports/bdk-atxx4-mstp/test.c

@@ -154,7 +154,7 @@ void test_task(void)
 
     if (mstimer_expired(&Test_Timer)) {
         mstimer_reset(&Test_Timer);
-        sprintf(Send_Buffer, "BACnet: 0000000\r\n");
+        snprintf(Send_Buffer, sizeof(Send_Buffer), "BACnet: 0000000\r\n");
         MSTP_MAC_Address = input_address();
         Send_Buffer[8] = (MSTP_MAC_Address & BIT(0)) ? '1' : '0';
         Send_Buffer[9] = (MSTP_MAC_Address & BIT(1)) ? '1' : '0';
@@ -198,17 +198,17 @@ void test_task(void)
                 break;
             case 'e':
                 seeprom_bytes_read(NV_SEEPROM_TYPE_0, (uint8_t *)&id, 2);
-                sprintf(Send_Buffer, "\r\n%04X", id);
+                snprintf(Send_Buffer, sizeof(Send_Buffer), "\r\n%04X", id);
                 serial_bytes_send((uint8_t *)Send_Buffer, strlen(Send_Buffer));
                 break;
             case 'b':
-                sprintf(Send_Buffer, "\r\n%lubps",
+                snprintf(Send_Buffer, sizeof(Send_Buffer), "\r\n%lubps",
                     (unsigned long)rs485_baud_rate());
                 serial_bytes_send((uint8_t *)Send_Buffer, strlen(Send_Buffer));
                 break;
             case 'm':
-                sprintf(
+                snprintf(Send_Buffer, sizeof(Send_Buffer), 
-                    Send_Buffer, "\r\nMax:%u", (unsigned)dlmstp_max_master());
+                    "\r\nMax:%u", (unsigned)dlmstp_max_master());
                 serial_bytes_send((uint8_t *)Send_Buffer, strlen(Send_Buffer));
                 break;
             default:

ports/esp32/src/ai.c

@@ -204,7 +204,7 @@ void Analog_Input_Present_Value_Set(uint32_t object_instance, float value)
 bool Analog_Input_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = "";
+    static char text[32] = "";
     unsigned int index;
     bool status = false;
 
@@ -215,8 +215,8 @@ bool Analog_Input_Object_Name(
     else {
         index = Analog_Input_Instance_To_Index(object_instance);
         if (index < MAX_ANALOG_INPUTS) {
-            sprintf(text_string, "ANALOG INPUT %lu", (unsigned long)index);
+            snprintf(text, sizeof(text), "ANALOG INPUT %lu", (unsigned long)index);
-            status = characterstring_init_ansi(object_name, text_string);
+            status = characterstring_init_ansi(object_name, text);
         }
     }
     return status;

ports/esp32/src/bo.c

@@ -171,16 +171,16 @@ bool Binary_Output_Out_Of_Service(uint32_t object_instance)
 bool Binary_Output_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = "";
+    static char text[32] = "";
     bool status = false;
 
     if (object_instance == 0)
         status = characterstring_init_ansi(object_name, "Led");
     else {
         if (object_instance < MAX_BINARY_OUTPUTS) {
-            sprintf(text_string, "BINARY OUTPUT %lu",
+            snprintf(text, sizeof(text), "BINARY OUTPUT %lu",
                 (unsigned long)object_instance);
-            status = characterstring_init_ansi(object_name, text_string);
+            status = characterstring_init_ansi(object_name, text);
         }
     }
     return status;

ports/linux/bip-init.c

@@ -597,7 +597,7 @@ static char *ntoa(uint32_t addr)
 {
     static char buffer[18];
 
-    sprintf(buffer, "%d.%d.%d.%d", (addr & 0x000000FF),
+    snprintf(buffer, sizeof(buffer), "%d.%d.%d.%d", (addr & 0x000000FF),
         (addr & 0x0000FF00) >> 8, (addr & 0x00FF0000) >> 16,
         (addr & 0xFF000000) >> 24);
 

ports/pic18f6720/ai.c

@@ -66,11 +66,11 @@ uint32_t Analog_Input_Index_To_Instance(unsigned index)
 
 char *Analog_Input_Name(uint32_t object_instance)
 {
-    static char text_string[16] = ""; /* okay for single thread */
+    static char text[16] = ""; /* okay for single thread */
 
     if (object_instance < MAX_ANALOG_INPUTS) {
-        sprintf(text_string, "AI-%lu", (unsigned long)object_instance);
+        snprintf(text, sizeof(text), "AI-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/pic18f6720/av.c

@@ -131,11 +131,11 @@ float Analog_Value_Present_Value(uint32_t object_instance)
 /* note: the object name must be unique within this device */
 char *Analog_Value_Name(uint32_t object_instance)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
 
     if (object_instance < MAX_ANALOG_VALUES) {
-        sprintf(text_string, "AV-%lu", object_instance);
+        snprintf(text, sizeof(text), "AV-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/pic18f6720/bi.c

@@ -103,11 +103,11 @@ BACNET_BINARY_PV Binary_Input_Present_Value(uint32_t object_instance)
 
 char *Binary_Input_Name(uint32_t object_instance)
 {
-    static char text_string[16] = ""; /* okay for single thread */
+    static char text[16] = ""; /* okay for single thread */
 
     if (object_instance < MAX_BINARY_INPUTS) {
-        sprintf(text_string, "BI-%lu", object_instance);
+        snprintf(text, sizeof(text), "BI-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/pic18f6720/bv.c

@@ -100,11 +100,11 @@ BACNET_BINARY_PV Binary_Value_Present_Value(uint32_t object_instance)
 /* note: the object name must be unique within this device */
 char *Binary_Value_Name(uint32_t object_instance)
 {
-    static char text_string[16] = ""; /* okay for single thread */
+    static char text[16] = ""; /* okay for single thread */
 
     if (object_instance < MAX_BINARY_VALUES) {
-        sprintf(text_string, "BV-%lu", object_instance);
+        snprintf(text, sizeof(text), "BV-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/pic18f97j60/ai.c

@@ -66,11 +66,11 @@ uint32_t Analog_Input_Index_To_Instance(unsigned index)
 
 char *Analog_Input_Name(uint32_t object_instance)
 {
-    static char text_string[16] = ""; /* okay for single thread */
+    static char text[16] = ""; /* okay for single thread */
 
     if (object_instance < MAX_ANALOG_INPUTS) {
-        sprintf(text_string, "AI-%lu", (unsigned long)object_instance);
+        snprintf(text, sizeof(text), "AI-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/pic18f97j60/av.c

@@ -131,11 +131,11 @@ float Analog_Value_Present_Value(uint32_t object_instance)
 /* note: the object name must be unique within this device */
 char *Analog_Value_Name(uint32_t object_instance)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
 
     if (object_instance < MAX_ANALOG_VALUES) {
-        sprintf(text_string, "AV-%lu", object_instance);
+        snprintf(text, sizeof(text), "AV-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/pic18f97j60/bi.c

@@ -103,11 +103,11 @@ BACNET_BINARY_PV Binary_Input_Present_Value(uint32_t object_instance)
 
 char *Binary_Input_Name(uint32_t object_instance)
 {
-    static char text_string[16] = ""; /* okay for single thread */
+    static char text[16] = ""; /* okay for single thread */
 
     if (object_instance < MAX_BINARY_INPUTS) {
-        sprintf(text_string, "BI-%lu", object_instance);
+        snprintf(text, sizeof(text), "BI-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/pic18f97j60/bv.c

@@ -100,11 +100,11 @@ BACNET_BINARY_PV Binary_Value_Present_Value(uint32_t object_instance)
 /* note: the object name must be unique within this device */
 char *Binary_Value_Name(uint32_t object_instance)
 {
-    static char text_string[16] = ""; /* okay for single thread */
+    static char text[16] = ""; /* okay for single thread */
 
     if (object_instance < MAX_BINARY_VALUES) {
-        sprintf(text_string, "BV-%lu", object_instance);
+        snprintf(text, sizeof(text), "BV-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/rx62n/bo.c

@@ -194,11 +194,11 @@ bool Binary_Output_Out_Of_Service(uint32_t instance)
 /* note: the object name must be unique within this device */
 char *Binary_Output_Name(uint32_t object_instance)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
 
     if (object_instance < MAX_BINARY_OUTPUTS) {
-        sprintf(text_string, "BO-%lu", object_instance);
+        snprintf(text, sizeof(text), "BO-%lu", (unsigned long)object_instance);
-        return text_string;
+        return text;
     }
 
     return NULL;

ports/win32/ethernet.c

@@ -59,8 +59,9 @@
 #include "remote-ext.h"
 
 /* commonly used comparison address for ethernet */
-uint8_t Ethernet_Broadcast[MAX_MAC_LEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
+uint8_t Ethernet_Broadcast[MAX_MAC_LEN] = {
-    0xFF };
+    0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
+};
 /* commonly used empty address for ethernet quick compare */
 uint8_t Ethernet_Empty_MAC[MAX_MAC_LEN] = { 0, 0, 0, 0, 0, 0 };
 
@@ -134,7 +135,7 @@ bool ethernet_init(char *if_name)
     BOOLEAN result;
     CHAR str[sizeof(PACKET_OID_DATA) + 128];
     int i;
-    char msgBuf[200];
+    char msg[200];
 
     if (ethernet_valid())
         ethernet_cleanup();
@@ -144,9 +145,10 @@ bool ethernet_init(char *if_name)
      */
     /* Retrieve the device list */
     if (pcap_findalldevs(&pcap_all_if, pcap_errbuf) == -1) {
-        sprintf(
+        snprintf(
-            msgBuf, "ethernet.c: error in pcap_findalldevs: %s\n", pcap_errbuf);
+            msg, sizeof(msg), "ethernet.c: error in pcap_findalldevs: %s\n",
-        LogError(msgBuf);
+            pcap_errbuf);
+        LogError(msg);
         return false;
     }
     /* Scan the list printing every entry */
@@ -156,9 +158,10 @@ bool ethernet_init(char *if_name)
     }
     pcap_freealldevs(pcap_all_if); /* we don't need it anymore */
     if (dev == NULL) {
-        sprintf(
+        snprintf(
-            msgBuf, "ethernet.c: specified interface not found: %s\n", if_name);
+            msg, sizeof(msg), "ethernet.c: specified interface not found: %s\n",
-        LogError(msgBuf);
+            if_name);
+        LogError(msg);
         return false;
     }
 
@@ -169,9 +172,10 @@ bool ethernet_init(char *if_name)
     lpAdapter = PacketOpenAdapter(if_name);
     if (lpAdapter == NULL) {
         ethernet_cleanup();
-        sprintf(msgBuf, "ethernet.c: error in PacketOpenAdapter(\"%s\")\n",
+        snprintf(
-            if_name);
+            msg, sizeof(msg),
-        LogError(msgBuf);
+            "ethernet.c: error in PacketOpenAdapter(\"%s\")\n", if_name);
+        LogError(msg);
         return false;
     }
     pOidData = (PPACKET_OID_DATA)str;
@@ -192,7 +196,8 @@ bool ethernet_init(char *if_name)
      * Open interface for subsequent sending and receiving
      */
     /* Open the output device */
-    pcap_eth802_fp = pcap_open(if_name, /* name of the device */
+    pcap_eth802_fp = pcap_open(
+        if_name, /* name of the device */
         ETHERNET_MPDU_MAX, /* portion of the packet to capture */
         PCAP_OPENFLAG_PROMISCUOUS, /* promiscuous mode */
         eth_timeout, /* read timeout */
@@ -202,11 +207,12 @@ bool ethernet_init(char *if_name)
     if (pcap_eth802_fp == NULL) {
         PacketCloseAdapter(lpAdapter);
         ethernet_cleanup();
-        sprintf(msgBuf,
+        snprintf(
+            msg, sizeof(msg),
             "ethernet.c: unable to open the adapter. %s is not supported by "
             "WinPcap\n",
             if_name);
-        LogError(msgBuf);
+        LogError(msg);
         return false;
     }
 
@@ -219,7 +225,8 @@ bool ethernet_init(char *if_name)
 
 /* function to send a packet out the 802.2 socket */
 /* returns bytes sent success, negative on failure */
-int ethernet_send(BACNET_ADDRESS *dest, /* destination address */
+int ethernet_send(
+    BACNET_ADDRESS *dest, /* destination address */
     BACNET_ADDRESS *src, /* source address */
     uint8_t *pdu, /* any data to be sent - may be null */
     unsigned pdu_len /* number of bytes of data */
@@ -272,10 +279,11 @@ int ethernet_send(BACNET_ADDRESS *dest, /* destination address */
     /* Send the packet */
     if (pcap_sendpacket(pcap_eth802_fp, mtu, mtu_len) != 0) {
         /* did it get sent? */
-        char msgBuf[200];
+        char msg[200];
-        sprintf(msgBuf, "ethernet.c: error sending packet: %s\n",
+        snprintf(
+            msg, sizeof(msg), "ethernet.c: error sending packet: %s\n",
             pcap_geterr(pcap_eth802_fp));
-        LogError(msgBuf);
+        LogError(msg);
         return -5;
     }
 
@@ -284,7 +292,8 @@ int ethernet_send(BACNET_ADDRESS *dest, /* destination address */
 
 /* function to send a packet out the 802.2 socket */
 /* returns number of bytes sent on success, negative on failure */
-int ethernet_send_pdu(BACNET_ADDRESS *dest, /* destination address */
+int ethernet_send_pdu(
+    BACNET_ADDRESS *dest, /* destination address */
     uint8_t *pdu, /* any data to be sent - may be null */
     unsigned pdu_len /* number of bytes of data */
 )
@@ -298,7 +307,8 @@ int ethernet_send_pdu(BACNET_ADDRESS *dest, /* destination address */
     }
     /* function to send a packet out the 802.2 socket */
     /* returns 1 on success, 0 on failure */
-    return ethernet_send(dest, /* destination address */
+    return ethernet_send(
+        dest, /* destination address */
         &src, /* source address */
         pdu, /* any data to be sent - may be null */
         pdu_len /* number of bytes of data */
@@ -307,7 +317,8 @@ int ethernet_send_pdu(BACNET_ADDRESS *dest, /* destination address */
 
 /* receives an 802.2 framed packet */
 /* returns the number of octets in the PDU, or zero on failure */
-uint16_t ethernet_receive(BACNET_ADDRESS *src, /* source address */
+uint16_t ethernet_receive(
+    BACNET_ADDRESS *src, /* source address */
     uint8_t *pdu, /* PDU data */
     uint16_t max_pdu, /* amount of space available in the PDU  */
     unsigned timeout /* number of milliseconds to wait for a packet. we ommit it
@@ -328,8 +339,9 @@ uint16_t ethernet_receive(BACNET_ADDRESS *src, /* source address */
     /* Capture a packet */
     res = pcap_next_ex(pcap_eth802_fp, &header, &pkt_data);
     if (res < 0) {
-        char msgBuf[200];
+        char msg[200];
-        sprintf(msgBuf, "ethernet.c: error in receiving packet: %s\n",
+        snprintf(
+            msg, sizeof(), "ethernet.c: error in receiving packet: %s\n",
             pcap_geterr(pcap_eth802_fp));
         return 0;
     } else if (res == 0)
@@ -418,27 +430,30 @@ void ethernet_get_broadcast_address(BACNET_ADDRESS *dest)
 void ethernet_debug_address(const char *info, BACNET_ADDRESS *dest)
 {
     int i = 0; /* counter */
-    char msgBuf[200];
+    char msg[200];
 
     if (info) {
-        sprintf(msgBuf, "%s", info);
+        snprintf(msg, sizeof(msg), "%s", info);
-        LogError(msgBuf);
+        LogError(msg);
     }
     /* if */
     if (dest) {
-        sprintf(
+        snprintf(
-            msgBuf, "Address:\n  MAC Length=%d\n  MAC Address=", dest->mac_len);
+            msg, sizeof(msg),
-        LogInfo(msgBuf);
+            "Address:\n  MAC Length=%d\n  MAC Address=", dest->mac_len);
+        LogInfo(msg);
         for (i = 0; i < MAX_MAC_LEN; i++) {
-            sprintf(msgBuf, "%02X ", (unsigned)dest->mac[i]);
+            snprintf(msg, sizeof(msg), "%02X ", (unsigned)dest->mac[i]);
-            LogInfo(msgBuf);
+            LogInfo(msg);
         } /* for */
         LogInfo("\n");
-        sprintf(msgBuf, "  Net=%hu\n  Len=%d\n  Adr=", dest->net, dest->len);
+        snprintf(
-        LogInfo(msgBuf);
+            msg, sizeof(msg), "  Net=%hu\n  Len=%d\n  Adr=", dest->net,
+            dest->len);
+        LogInfo(msg);
         for (i = 0; i < MAX_MAC_LEN; i++) {
-            sprintf(msgBuf, "%02X ", (unsigned)dest->adr[i]);
+            snprintf(msg, sizeof(msg), "%02X ", (unsigned)dest->adr[i]);
-            LogInfo(msgBuf);
+            LogInfo(msg);
         } /* for */
         LogInfo("\n");
     }

ports/win32/rs485.c

@@ -115,8 +115,11 @@ void RS485_Set_Interface(char *ifname)
         strupper(ifname);
         if (strncmp("COM", ifname, 3) == 0) {
             if (strlen(ifname) > 3) {
-                sprintf(RS485_Port_Name, "\\\\.\\COM%i", atoi(ifname + 3));
+                snprintf(
-                fprintf(stdout, "Adjusted interface name to %s\r\n",
+                    RS485_Port_Name, sizeof(RS485_Port_Name), "\\\\.\\COM%i",
+                    atoi(ifname + 3));
+                fprintf(
+                    stdout, "Adjusted interface name to %s\r\n",
                     RS485_Port_Name);
             }
         }
@@ -136,7 +139,7 @@ bool RS485_Interface_Valid(unsigned port_number)
     bool status = false;
     char ifname[255] = "";
 
-    sprintf(ifname, "\\\\.\\COM%u", port_number);
+    snprintf(ifname, sizeof(ifname), "\\\\.\\COM%u", port_number);
     h = CreateFile(
         ifname, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL);
     if (h == INVALID_HANDLE_VALUE) {

ports/xplained/ai.c

@@ -106,14 +106,14 @@ unsigned Analog_Input_Count(void)
 bool Analog_Input_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
     bool status = false;
     unsigned index = 0;
 
     index = Analog_Input_Instance_To_Index(object_instance);
     if (index < MAX_ANALOG_INPUTS) {
-        sprintf(text_string, "AI-%lu", object_instance);
+        snprintf(text, sizeof(text), "AI-%lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

ports/xplained/device.c

@@ -241,11 +241,12 @@ uint32_t Device_Index_To_Instance(unsigned index)
 
 static char *Device_Name_Default(void)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
 
-    sprintf(text_string, "DEVICE-%lu", Object_Instance_Number);
+    snprintf(text, sizeof(text), "DEVICE-%lu", 
+        (unsigned long)Object_Instance_Number);
 
-    return text_string;
+    return text;
 }
 
 bool Device_Object_Name(

ports/zephyr/bip6-init.c

@@ -58,8 +58,10 @@ LOG_MODULE_DECLARE(bacnet, CONFIG_BACNETSTACK_LOG_LEVEL);
 
 #define THIS_FILE "bip6-init.c"
 
-#if (MAX_MAC_LEN < BIP6_ADDRESS_MAX) /* Make sure an 18 byte address can be stored */
+#if (MAX_MAC_LEN < BIP6_ADDRESS_MAX) /* Make sure an 18 byte address can be \
-#error "BACNET_ADDRESS.mac (bacdef.h) is not large enough to store an IPv6 address."
+                                        stored */
+#error \
+    "BACNET_ADDRESS.mac (bacdef.h) is not large enough to store an IPv6 address."
 #endif
 
 /* zephyr socket */
@@ -77,48 +79,45 @@ static struct in6_addr BIP6_Multicast_Addr;
 
 /* Used by inet6_ntoa */
 #if CONFIG_BACNETSTACK_LOG_LEVEL
-static char ipv6_addr_str[42]={0};
+static char ipv6_addr_str[42] = { 0 };
 #else
-static char ipv6_addr_str[]="";
+static char ipv6_addr_str[] = "";
 #endif
 
 /**
-* @brief Return a string representation of an IPv6 address
+ * @brief Return a string representation of an IPv6 address
-* @param a - IPv6 address
+ * @param a - IPv6 address
-* @return Pointer to global string
+ * @return Pointer to global string
-*/
+ */
-static char* inet6_ntoa(struct in6_addr *a)
+static char *inet6_ntoa(struct in6_addr *a)
 {
-    #if CONFIG_BACNETSTACK_LOG_LEVEL
+#if CONFIG_BACNETSTACK_LOG_LEVEL
-    uint8_t x=0;
+    uint8_t x = 0;
-    uint8_t d=0;
+    uint8_t d = 0;
     uint8_t non_zero_count = 0;
 
     /* Avoid overwhelming the logging system */
-    while(log_buffered_cnt())
+    while (log_buffered_cnt()) {
-    {
         k_sleep(K_MSEC(1));
     }
 
-    for(x=0; x<IP6_ADDRESS_MAX; x+=2)
+    for (x = 0; x < IP6_ADDRESS_MAX; x += 2) {
-    {
+        if (a->s6_addr[x] | a->s6_addr[x + 1]) {
-        if(a->s6_addr[x] | a->s6_addr[x+1])
-        {
             non_zero_count++;
-            d+=sprintf(&ipv6_addr_str[d], "%02X%02X", a->s6_addr[x], a->s6_addr[x+1]);
+            d += snprintf(
+                &ipv6_addr_str[d], sizeof(ipv6_addr_str), "%02X%02X",
+                a->s6_addr[x], a->s6_addr[x + 1]);
         }
 
-        if(x<14)
+        if (x < 14) {
-        {
+            d += snprintf(&ipv6_addr_str[d], sizeof(ipv6_addr_str), ":");
-            d+=sprintf(&ipv6_addr_str[d], ":");
         }
     }
 
-    if(!non_zero_count)
+    if (!non_zero_count) {
-    {
+        snprintf(&ipv6_addr_str[0], sizeof(ipv6_addr_str), "undefined");
-        sprintf(&ipv6_addr_str[0], "undefined");
     }
-    #endif
+#endif
     return &ipv6_addr_str[0];
 }
 
@@ -179,7 +178,7 @@ void bip6_get_broadcast_address(BACNET_ADDRESS *dest)
     if (dest) {
         dest->mac_len = BIP6_ADDRESS_MAX;
         memcpy(&dest->mac[0], &BIP6_Multicast_Addr.s6_addr, IP6_ADDRESS_MAX);
-        memcpy(&dest->mac[IP6_ADDRESS_MAX], &BIP6_Port, sizeof(BIP6_Port) );
+        memcpy(&dest->mac[IP6_ADDRESS_MAX], &BIP6_Port, sizeof(BIP6_Port));
         memset(&dest->adr, 0, sizeof(dest->adr));
         dest->net = BACNET_BROADCAST_NETWORK;
         dest->len = 0;
@@ -225,7 +224,8 @@ bool bip6_get_addr(BACNET_IP6_ADDRESS *addr)
 bool bip6_set_broadcast_addr(BACNET_IP6_ADDRESS *addr)
 {
     if (addr) {
-        memcpy(&BIP6_Multicast_Addr.s6_addr, &addr->address[0], IP6_ADDRESS_MAX);
+        memcpy(
+            &BIP6_Multicast_Addr.s6_addr, &addr->address[0], IP6_ADDRESS_MAX);
         return true;
     }
     return false;
@@ -239,7 +239,8 @@ bool bip6_set_broadcast_addr(BACNET_IP6_ADDRESS *addr)
 bool bip6_get_broadcast_addr(BACNET_IP6_ADDRESS *addr)
 {
     if (addr) {
-        memcpy(&addr->address[0], &BIP6_Multicast_Addr.s6_addr, IP6_ADDRESS_MAX);
+        memcpy(
+            &addr->address[0], &BIP6_Multicast_Addr.s6_addr, IP6_ADDRESS_MAX);
         addr->port = ntohs(BIP6_Port);
         return true;
     }
@@ -293,8 +294,9 @@ int bip6_send_mpdu(BACNET_IP6_ADDRESS *dest, uint8_t *mtu, uint16_t mtu_len)
     bip6_dest.sin6_port = htons(dest->port);
 
     /* Send the packet */
-    return zsock_sendto(BIP6_Socket, (char *)mtu, mtu_len, 0,
+    return zsock_sendto(
-        (struct sockaddr *)&bip6_dest, sizeof(struct sockaddr));
+        BIP6_Socket, (char *)mtu, mtu_len, 0, (struct sockaddr *)&bip6_dest,
+        sizeof(struct sockaddr));
 }
 
 uint16_t bip6_receive(
@@ -334,17 +336,18 @@ uint16_t bip6_receive(
 
     /* see if there is a packet for us */
     if (zsock_select(max + 1, &read_fds, NULL, NULL, &select_timeout) > 0) {
-        received_bytes = zsock_recvfrom(BIP6_Socket, (char *)&npdu[0], max_npdu,
+        received_bytes = zsock_recvfrom(
-            0, (struct sockaddr *)&sin, &sin_len);
+            BIP6_Socket, (char *)&npdu[0], max_npdu, 0, (struct sockaddr *)&sin,
-    }
+            &sin_len);
-    else
+    } else {
-    {
         return 0;
     }
 
     /* See if there is a problem */
     if (received_bytes < 0) {
-        LOG_WRN("%s:%d - RX zsock_recvfrom() error: %d", THIS_FILE, __LINE__, received_bytes);
+        LOG_WRN(
+            "%s:%d - RX zsock_recvfrom() error: %d", THIS_FILE, __LINE__,
+            received_bytes);
         return 0;
     }
     /* no problem, just no bytes */
@@ -382,7 +385,8 @@ uint16_t bip6_receive(
     return npdu_len;
 }
 
-int bip6_send_pdu(BACNET_ADDRESS *dest,
+int bip6_send_pdu(
+    BACNET_ADDRESS *dest,
     BACNET_NPDU_DATA *npdu_data,
     uint8_t *pdu,
     unsigned pdu_len)
@@ -395,10 +399,10 @@ void bip6_set_interface(char *ifname)
 {
     struct net_if *interface = 0;
     int index = -1;
-    int x=0;
+    int x = 0;
 
-    BACNET_IP6_ADDRESS unicast = {0};
+    BACNET_IP6_ADDRESS unicast = { 0 };
-    BACNET_IP6_ADDRESS multicast = {0};
+    BACNET_IP6_ADDRESS multicast = { 0 };
 
     unicast.port = BIP6_Port;
     multicast.port = BIP6_Port;
@@ -406,81 +410,84 @@ void bip6_set_interface(char *ifname)
     LOG_INF("bip6_set_interface()");
     LOG_INF("UDP port: %d", ntohs(BIP6_Port));
 
-    if(ifname)
+    if (ifname) {
-    {
         index = atoi(ifname);
 
         /* if index is zero, discern between "0" and a parse error */
-        if(!index && strcmp(ifname,"0"))
+        if (!index && strcmp(ifname, "0")) {
-        {
+            LOG_ERR(
-            LOG_ERR("%s:%d - Argument must parse to an integer", THIS_FILE, __LINE__);
+                "%s:%d - Argument must parse to an integer", THIS_FILE,
-        }
+                __LINE__);
-        else
+        } else {
-        {
             interface = net_if_get_by_index(index);
-            if(interface)
+            if (interface) {
-            {
                 LOG_INF("Using interface %d", index);
-            }
+            } else {
-            else
+                LOG_ERR(
-            {
+                    "%s:%d - No interface at index %d", THIS_FILE, __LINE__,
-                LOG_ERR("%s:%d - No interface at index %d", THIS_FILE, __LINE__, index);
+                    index);
             }
         }
     }
 
-    if(index == -1)
+    if (index == -1) {
-    {
+        LOG_WRN(
-        LOG_WRN("%s:%d - No valid interface specified - using default ",THIS_FILE, __LINE__);
+            "%s:%d - No valid interface specified - using default ", THIS_FILE,
+            __LINE__);
         interface = net_if_get_default();
     }
 
-    if(interface)
+    if (interface) {
-    {
         LOG_INF("Interface set - Configured addresses:");
 
-        for(x=0; x<NET_IF_MAX_IPV6_ADDR; x++)
+        for (x = 0; x < NET_IF_MAX_IPV6_ADDR; x++) {
-        {
+            inet6_ntoa(&interface->config.ip.ipv6->unicast[x].address.in6_addr);
-            inet6_ntoa(&interface->config.ip.ipv6->unicast[x].address.in6_addr );
             LOG_INF("  unicast[%d]: %s", x, ipv6_addr_str);
         }
 
-        for(x=0; x<NET_IF_MAX_IPV6_MADDR; x++)
+        for (x = 0; x < NET_IF_MAX_IPV6_MADDR; x++) {
-        {
+            inet6_ntoa(&interface->config.ip.ipv6->mcast[x].address.in6_addr);
-            inet6_ntoa(&interface->config.ip.ipv6->mcast[x].address.in6_addr );
             LOG_INF(" multicast[%d]: %s", x, ipv6_addr_str);
         }
 
-        if(CONFIG_BACDL_BIP6_ADDRESS_INDEX >= NET_IF_MAX_IPV6_ADDR)
+        if (CONFIG_BACDL_BIP6_ADDRESS_INDEX >= NET_IF_MAX_IPV6_ADDR) {
-        {
+            LOG_ERR(
-            LOG_ERR("%s:%d - IPv6 address index of %d is out of range (0-%d)", THIS_FILE,
+                "%s:%d - IPv6 address index of %d is out of range (0-%d)",
-                __LINE__, CONFIG_BACDL_BIP6_ADDRESS_INDEX, NET_IF_MAX_IPV6_ADDR-1);
+                THIS_FILE, __LINE__, CONFIG_BACDL_BIP6_ADDRESS_INDEX,
+                NET_IF_MAX_IPV6_ADDR - 1);
             return;
         }
 
-        LOG_INF("Using IPv6 address at index %d", CONFIG_BACDL_BIP6_ADDRESS_INDEX);
+        LOG_INF(
+            "Using IPv6 address at index %d", CONFIG_BACDL_BIP6_ADDRESS_INDEX);
 
-        memcpy(&unicast.address, &interface->config.ip.ipv6->unicast
+        memcpy(
-            [CONFIG_BACDL_BIP6_ADDRESS_INDEX].address.in6_addr, IP6_ADDRESS_MAX);
+            &unicast.address,
+            &interface->config.ip.ipv6->unicast[CONFIG_BACDL_BIP6_ADDRESS_INDEX]
+                 .address.in6_addr,
+            IP6_ADDRESS_MAX);
 
-        if(net_addr_pton(AF_INET6, CONFIG_BACDL_BIP6_MCAST_ADDRESS, &multicast.address))
+        if (net_addr_pton(
-        {
+                AF_INET6, CONFIG_BACDL_BIP6_MCAST_ADDRESS,
-            LOG_ERR("%s:%d - Failed to parse IPv6 multicast address: %s", THIS_FILE, __LINE__, CONFIG_BACDL_BIP6_MCAST_ADDRESS);
+                &multicast.address)) {
+            LOG_ERR(
+                "%s:%d - Failed to parse IPv6 multicast address: %s", THIS_FILE,
+                __LINE__, CONFIG_BACDL_BIP6_MCAST_ADDRESS);
         }
 
         bip6_set_addr(&unicast);
         bip6_set_broadcast_addr(&multicast);
 
-        LOG_INF("   Unicast: %s", inet6_ntoa((struct in6_addr*)&unicast.address));
+        LOG_INF(
-        LOG_INF(" Multicast: %s", inet6_ntoa((struct in6_addr*)&multicast.address));
+            "   Unicast: %s", inet6_ntoa((struct in6_addr *)&unicast.address));
-    }
+        LOG_INF(
-    else
+            " Multicast: %s",
-    {
+            inet6_ntoa((struct in6_addr *)&multicast.address));
+    } else {
         LOG_ERR("%s:%d - Failed to set interface", THIS_FILE, __LINE__);
     }
 }
 
-
 bool bip6_init(char *ifname)
 {
     LOG_INF("bip6_init()");
@@ -493,19 +500,19 @@ bool bip6_init(char *ifname)
     bip6_set_interface(ifname);
 
     if (BIP6_Address.s6_addr == 0) {
-        LOG_ERR("%s:%d - Failed to get an IPv6 address on interface: %s\n", THIS_FILE, __LINE__, ifname ? ifname : "[default]");
+        LOG_ERR(
+            "%s:%d - Failed to get an IPv6 address on interface: %s\n",
+            THIS_FILE, __LINE__, ifname ? ifname : "[default]");
         return false;
     }
 
     /* assumes that the driver has already been initialized */
     sock_fd = zsock_socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
     BIP6_Socket = sock_fd;
-     if (sock_fd < 0) {
+    if (sock_fd < 0) {
         LOG_ERR("%s:%d - Failed to create socket", THIS_FILE, __LINE__);
         return false;
-    }
+    } else {
-    else
-    {
         LOG_INF("Socket created");
     }
 
@@ -526,16 +533,14 @@ bool bip6_init(char *ifname)
 
     LOG_INF("Binding to port %d", ntohs(BIP6_Port));
 
-    status =
+    status = zsock_bind(
-        zsock_bind(sock_fd, (const struct sockaddr*)&sin6, sizeof(struct sockaddr));
+        sock_fd, (const struct sockaddr *)&sin6, sizeof(struct sockaddr));
     if (status < 0) {
         zsock_close(sock_fd);
         BIP6_Socket = -1;
         LOG_ERR("%s:%d - zsock_bind() failure", THIS_FILE, __LINE__);
         return false;
-    }
+    } else {
-    else
-    {
         LOG_INF("Socket bound");
     }
 

src/bacnet/basic/object/acc.c

@@ -136,13 +136,13 @@ unsigned Accumulator_Instance_To_Index(uint32_t object_instance)
 bool Accumulator_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32]; /* okay for single thread */
+    static char text[32]; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ACCUMULATORS) {
-        sprintf(
+        snprintf(text, sizeof(text),
-            text_string, "ACCUMULATOR-%lu", (long unsigned int)object_instance);
+            "ACCUMULATOR-%lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/access_credential.c

@@ -139,13 +139,13 @@ unsigned Access_Credential_Instance_To_Index(uint32_t object_instance)
 bool Access_Credential_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ACCESS_CREDENTIALS) {
-        sprintf(text_string, "ACCESS CREDENTIAL %lu",
+        snprintf(text, sizeof(text), "ACCESS CREDENTIAL %lu",
             (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/access_door.c

@@ -276,12 +276,13 @@ static int Access_Door_Priority_Array_Encode(
 bool Access_Door_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ACCESS_DOORS) {
-        sprintf(text_string, "ACCESS DOOR %lu", (unsigned long)object_instance);
+        snprintf(text, sizeof(text), "ACCESS DOOR %lu", 
-        status = characterstring_init_ansi(object_name, text_string);
+            (unsigned long)object_instance);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/access_point.c

@@ -142,13 +142,13 @@ unsigned Access_Point_Instance_To_Index(uint32_t object_instance)
 bool Access_Point_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ACCESS_POINTS) {
-        sprintf(
+        snprintf(text, sizeof(text), "ACCESS POINT %lu", 
-            text_string, "ACCESS POINT %lu", (unsigned long)object_instance);
+            (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/access_rights.c

@@ -134,13 +134,13 @@ unsigned Access_Rights_Instance_To_Index(uint32_t object_instance)
 bool Access_Rights_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ACCESS_RIGHTSS) {
-        sprintf(
+        snprintf(text, sizeof(text), "ACCESS RIGHTS %lu", 
-            text_string, "ACCESS RIGHTS %lu", (unsigned long)object_instance);
+            (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/access_user.c

@@ -131,12 +131,13 @@ unsigned Access_User_Instance_To_Index(uint32_t object_instance)
 bool Access_User_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ACCESS_USERS) {
-        sprintf(text_string, "ACCESS USER %lu", (unsigned long)object_instance);
+        snprintf(text, sizeof(text), "ACCESS USER %lu", 
-        status = characterstring_init_ansi(object_name, text_string);
+            (unsigned long)object_instance);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/access_zone.c

@@ -136,12 +136,13 @@ unsigned Access_Zone_Instance_To_Index(uint32_t object_instance)
 bool Access_Zone_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_ACCESS_ZONES) {
-        sprintf(text_string, "ACCESS ZONE %lu", (unsigned long)object_instance);
+        snprintf(text, sizeof(text), "ACCESS ZONE %lu", 
-        status = characterstring_init_ansi(object_name, text_string);
+            (unsigned long)object_instance);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/bi.c

@@ -464,16 +464,16 @@ static bool Binary_Input_Present_Value_Write(
 bool Binary_Input_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
     struct object_data *pObject;
 
     pObject = Binary_Input_Object(object_instance);
     if (pObject) {
         if (pObject->Object_Name == NULL) {
-            sprintf(
+            snprintf(text, sizeof(text), "BINARY INPUT %lu", 
-                text_string, "BINARY INPUT %lu", (unsigned long)object_instance);
+                (unsigned long)object_instance);
-            status = characterstring_init_ansi(object_name, text_string);
+            status = characterstring_init_ansi(object_name, text);
         } else {
             status = characterstring_init_ansi(object_name, pObject->Object_Name);
         }

src/bacnet/basic/object/bv.c

@@ -464,16 +464,16 @@ static bool Binary_Value_Present_Value_Write(uint32_t object_instance,
 bool Binary_Value_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
     struct object_data *pObject;
 
     pObject = Binary_Value_Object(object_instance);
     if (pObject) {
         if (pObject->Object_Name == NULL) {
-            sprintf(text_string, "BINARY INPUT %lu",
+            snprintf(text, sizeof(text), "BINARY INPUT %lu",
                 (unsigned long)object_instance);
-            status = characterstring_init_ansi(object_name, text_string);
+            status = characterstring_init_ansi(object_name, text);
         } else {
             status =
                 characterstring_init_ansi(object_name, pObject->Object_Name);

src/bacnet/basic/object/command.c

@@ -599,14 +599,15 @@ bool Command_All_Writes_Successful_Set(uint32_t object_instance, bool value)
 bool Command_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     unsigned int index;
     bool status = false;
 
     index = Command_Instance_To_Index(object_instance);
     if (index < MAX_COMMANDS) {
-        sprintf(text_string, "COMMAND %lu", (unsigned long)index);
+        snprintf(text, sizeof(text), "COMMAND %lu", 
-        status = characterstring_init_ansi(object_name, text_string);
+            (unsigned long)object_instance);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/credential_data_input.c

@@ -138,13 +138,13 @@ unsigned Credential_Data_Input_Instance_To_Index(uint32_t object_instance)
 bool Credential_Data_Input_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_CREDENTIAL_DATA_INPUTS) {
-        sprintf(text_string, "CREDENTIAL DATA INPUT %lu",
+        snprintf(text, sizeof(text), "CREDENTIAL DATA INPUT %lu",
             (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/iv.c

@@ -214,15 +214,15 @@ bool Integer_Value_Present_Value_Set(
 bool Integer_Value_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    char text_string[32] = "";
+    char text[32] = "";
     unsigned int index;
     bool status = false;
 
     index = Integer_Value_Instance_To_Index(object_instance);
     if (index < MAX_INTEGER_VALUES) {
-        sprintf(
+        snprintf(text, sizeof(text), "INTEGER VALUE %lu", 
-            text_string, "INTEGER VALUE %lu", (unsigned long)object_instance);
+            (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/lc.c

@@ -252,12 +252,12 @@ static BACNET_SHED_STATE Load_Control_Present_Value(uint32_t object_instance)
 bool Load_Control_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_LOAD_CONTROLS) {
-        sprintf(text_string, "LOAD CONTROL %u", object_instance);
+        snprintf(text, sizeof(text), "LOAD CONTROL %lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/nc.c

@@ -151,14 +151,15 @@ unsigned Notification_Class_Instance_To_Index(uint32_t object_instance)
 bool Notification_Class_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     unsigned int index;
     bool status = false;
 
     index = Notification_Class_Instance_To_Index(object_instance);
     if (index < MAX_NOTIFICATION_CLASSES) {
-        sprintf(text_string, "NOTIFICATION CLASS %lu", (unsigned long)index);
+        snprintf(text, sizeof(text), "NOTIFICATION CLASS %lu", 
-        status = characterstring_init_ansi(object_name, text_string);
+            (unsigned long)object_instance);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/osv.c

@@ -165,13 +165,13 @@ BACNET_OCTET_STRING *OctetString_Value_Present_Value(uint32_t object_instance)
 bool OctetString_Value_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_OCTETSTRING_VALUES) {
-        sprintf(text_string, "OCTETSTRING VALUE %lu",
+        snprintf(text, sizeof(text), "OCTETSTRING VALUE %lu",
             (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/piv.c

@@ -166,13 +166,13 @@ uint32_t PositiveInteger_Value_Present_Value(uint32_t object_instance)
 bool PositiveInteger_Value_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_POSITIVEINTEGER_VALUES) {
-        sprintf(text_string, "POSITIVEINTEGER VALUE %lu",
+        snprintf(text, sizeof(text), "POSITIVEINTEGER VALUE %lu",
             (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/schedule.c

@@ -130,14 +130,14 @@ unsigned Schedule_Instance_To_Index(uint32_t instance)
 bool Schedule_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     unsigned int index;
     bool status = false;
 
     index = Schedule_Instance_To_Index(object_instance);
     if (index < MAX_SCHEDULES) {
-        sprintf(text_string, "SCHEDULE %lu", (unsigned long)index);
+        snprintf(text, sizeof(text), "SCHEDULE %lu", (unsigned long)object_instance);
-        status = characterstring_init_ansi(object_name, text_string);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/object/trendlog.c

@@ -248,12 +248,13 @@ void Trend_Log_Init(void)
 bool Trend_Log_Object_Name(
     uint32_t object_instance, BACNET_CHARACTER_STRING *object_name)
 {
-    static char text_string[32] = ""; /* okay for single thread */
+    static char text[32] = ""; /* okay for single thread */
     bool status = false;
 
     if (object_instance < MAX_TREND_LOGS) {
-        sprintf(text_string, "Trend Log %u", object_instance);
+        snprintf(text, sizeof(text), "Trend Log %lu", 
-        status = characterstring_init_ansi(object_name, text_string);
+            (unsigned long)object_instance);
+        status = characterstring_init_ansi(object_name, text);
     }
 
     return status;

src/bacnet/basic/sys/debug.c

@@ -65,9 +65,9 @@ void debug_printf(const char *format, ...)
     BACNET_DATE date;
     BACNET_TIME time;
     datetime_local(&date, &time, NULL, NULL);
-    sprintf(stamp_str, "[%02d:%02d:%02d.%03d]: ", time.hour, time.min,
+    snprintf(
-        time.sec, time.hundredths * 10);
+        stamp_str, sizeof(stamp_str), "[%02d:%02d:%02d.%03d]: ", time.hour,
-
+        time.min, time.sec, time.hundredths * 10);
     va_start(ap, format);
     vsprintf(buf, format, ap);
     va_end(ap);

src/bacnet/datalink/dlenv.c

@@ -195,7 +195,8 @@ static int bbmd_register_as_foreign_device(void)
     } else {
         for (entry_number = 1; entry_number <= 128; entry_number++) {
             bdt_entry_valid = false;
-            sprintf(bbmd_env, "BACNET_BDT_ADDR_%u", entry_number);
+            snprintf(
+                bbmd_env, sizeof(bbmd_env), "BACNET_BDT_ADDR_%u", entry_number);
             pEnv = getenv(bbmd_env);
             if (pEnv) {
                 bdt_entry_valid =
@@ -212,7 +213,9 @@ static int bbmd_register_as_foreign_device(void)
             }
             if (bdt_entry_valid) {
                 bdt_entry_port = 0xBAC0;
-                sprintf(bbmd_env, "BACNET_BDT_PORT_%u", entry_number);
+                snprintf(
+                    bbmd_env, sizeof(bbmd_env), "BACNET_BDT_PORT_%u",
+                    entry_number);
                 pEnv = getenv(bbmd_env);
                 if (pEnv) {
                     bdt_entry_port = strtol(pEnv, NULL, 0);
@@ -230,7 +233,9 @@ static int bbmd_register_as_foreign_device(void)
                 /* broadcast mask */
                 bvlc_broadcast_distribution_mask_from_host(
                     &BBMD_Table_Entry.broadcast_mask, 0xFFFFFFFF);
-                sprintf(bbmd_env, "BACNET_BDT_MASK_%u", entry_number);
+                snprintf(
+                    bbmd_env, sizeof(bbmd_env), "BACNET_BDT_MASK_%u",
+                    entry_number);
                 pEnv = getenv(bbmd_env);
                 if (pEnv) {
                     c = sscanf(