diff -r 5e8da0663ff8 xen/arch/ia64/linux-xen/perfmon.c
--- a/xen/arch/ia64/linux-xen/perfmon.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/linux-xen/perfmon.c	Tue Jan 30 15:45:17 2007 +0100
@@ -2305,7 +2305,7 @@ pfm_alloc_fd(struct file **cfile)
 	inode->i_uid  = current->fsuid;
 	inode->i_gid  = current->fsgid;
 
-	sprintf(name, "[%lu]", inode->i_ino);
+	snprintf(name, sizeof(name), "[%lu]", inode->i_ino);
 	this.name = name;
 	this.len  = strlen(name);
 	this.hash = inode->i_ino;
diff -r 5e8da0663ff8 xen/arch/ia64/linux-xen/setup.c
--- a/xen/arch/ia64/linux-xen/setup.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/linux-xen/setup.c	Tue Jan 30 15:51:40 2007 +0100
@@ -550,7 +550,7 @@ show_cpuinfo (struct seq_file *m, void *
 	switch (c->family) {
 	      case 0x07:	memcpy(family, "Itanium", 8); break;
 	      case 0x1f:	memcpy(family, "Itanium 2", 10); break;
-	      default:		sprintf(family, "%u", c->family); break;
+	      default:		snprintf(family, sizeof(family), "%u", c->family); break;
 	}
 
 	/* build the feature string: */
@@ -572,7 +572,7 @@ show_cpuinfo (struct seq_file *m, void *
 		/* print unknown features as a hex value: */
 		if (sep)
 			*cp++ = sep;
-		sprintf(cp, " 0x%lx", mask);
+		snprintf(cp, sizeof(features) - (cp - features), " 0x%lx", mask);
 	}
 
 	seq_printf(m,
diff -r 5e8da0663ff8 xen/arch/ia64/linux-xen/sn/kernel/io_init.c
--- a/xen/arch/ia64/linux-xen/sn/kernel/io_init.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/linux-xen/sn/kernel/io_init.c	Tue Jan 30 15:48:33 2007 +0100
@@ -754,7 +754,7 @@ void sn_generate_path(struct pci_bus *pc
 	geoid = cnodeid_get_geoid(cnode);
 	moduleid = geo_module(geoid);
 
-	sprintf(address, "module_%c%c%c%c%.2d",
+	snprintf(address, 15, "module_%c%c%c%c%.2d",
 		'0'+RACK_GET_CLASS(MODULE_GET_RACK(moduleid)),
 		'0'+RACK_GET_GROUP(MODULE_GET_RACK(moduleid)),
 		'0'+RACK_GET_NUM(MODULE_GET_RACK(moduleid)),
@@ -764,7 +764,7 @@ void sn_generate_path(struct pci_bus *pc
 	bricktype = MODULE_GET_BTYPE(moduleid);
 	if ((bricktype == L1_BRICKTYPE_191010) ||
 	    (bricktype == L1_BRICKTYPE_1932))
-			sprintf(address, "%s^%d", address, geo_slot(geoid));
+			snprintf(address, 15+8, "%s^%d", address, geo_slot(geoid));
 }
 #endif
 
diff -r 5e8da0663ff8 xen/arch/ia64/linux-xen/unaligned.c
--- a/xen/arch/ia64/linux-xen/unaligned.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/linux-xen/unaligned.c	Tue Jan 30 15:52:17 2007 +0100
@@ -1792,7 +1792,7 @@ printk("ia64_handle_unaligned: called, n
 			char buf[200];	/* comm[] is at most 16 bytes... */
 			size_t len;
 
-			len = sprintf(buf, "%s(%d): unaligned access to 0x%016lx, "
+			len = snprintf(buf, sizeof(buf), "%s(%d): unaligned access to 0x%016lx, "
 				      "ip=0x%016lx\n\r", current->comm, current->pid,
 				      ifa, regs->cr_iip + ipsr->ri);
 			/*
diff -r 5e8da0663ff8 xen/arch/ia64/xen/domain.c
--- a/xen/arch/ia64/xen/domain.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/xen/domain.c	Tue Jan 30 15:53:07 2007 +0100
@@ -1124,7 +1124,7 @@ int construct_dom0(struct domain *d,
 		panic("can't allocate start info page");
 	si = page_to_virt(start_info_page);
 	memset(si, 0, PAGE_SIZE);
-	sprintf(si->magic, "xen-%i.%i-ia64",
+	snprintf(si->magic, sizeof(si->magic), "xen-%i.%i-ia64",
 		xen_major_version(), xen_minor_version());
 	si->nr_pages     = max_pages;
 	si->flags = SIF_INITDOMAIN|SIF_PRIVILEGED;
diff -r 5e8da0663ff8 xen/arch/ia64/xen/gdbstub.c
--- a/xen/arch/ia64/xen/gdbstub.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/xen/gdbstub.c	Tue Jan 30 16:07:09 2007 +0100
@@ -289,13 +289,13 @@ gdb_arch_read_reg(unsigned long regnum, 
 	}
 
 	dbg_printk("Register read regnum = 0x%lx, val = 0x%lx\n", regnum, reg);	
-	sprintf(buf, "%.08lx", swab64(reg));
+	snprintf(buf, sizeof(buf), "%.08lx", swab64(reg));
 out:
 	return gdb_send_reply(buf, ctx);
 
 out_err:
 	dbg_printk("Register read unsupported regnum = 0x%lx\n", regnum);
-	sprintf(buf, "%s", "x");
+	safe_strcpy(buf, "x");
 	goto out;
 }
 #else
@@ -756,19 +756,19 @@ gdb_arch_read_reg(unsigned long regnum, 
 	if (arg.error > 0) {
 		// notify gdb that this register is not supported.
 		// see fetch_register_using_p() in gdb/remote.c.
-		sprintf(buf, "%s", "x");
+		safe_strcpy(buf, "x");
 	} else if (IA64_FR0_REGNUM <= regnum && regnum <= IA64_FR0_REGNUM + 127) {
-		sprintf(buf, "%.016lx", swab64(freg.u.bits[0]));
-		sprintf(buf + 16, "%.016lx", swab64(freg.u.bits[1]));
+		snprintf(buf, sizeof(buf), "%.016lx", swab64(freg.u.bits[0]));
+		snprintf(buf + 16, sizeof(buf) - 16, "%.016lx", swab64(freg.u.bits[1]));
 	} else {
-		sprintf(buf, "%.016lx", swab64(reg));
+		snprintf(buf, sizeof(buf), "%.016lx", swab64(reg));
 	}
 out:
 	return gdb_send_reply(buf, ctx);
 
 out_err:
 	dbg_printk("Register read unsupported regnum = 0x%lx\n", regnum);
-	sprintf(buf, "%s", "E0");
+	safe_strcpy(buf, "E0");
 	goto out;
 }
 #endif
diff -r 5e8da0663ff8 xen/arch/ia64/xen/oprofile/perfmon.c
--- a/xen/arch/ia64/xen/oprofile/perfmon.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/xen/oprofile/perfmon.c	Tue Jan 30 15:19:41 2007 +0100
@@ -120,7 +120,6 @@ xenoprof_arch_init(int *num_events, int 
 {
     *num_events = 0;
     strlcpy(cpu_type, get_cpu_type(), XENOPROF_CPU_TYPE_SIZE);
-    cpu_type[XENOPROF_CPU_TYPE_SIZE - 1] = '\0';
 
     *is_primary = 0;
     if (xenoprof_primary_profiler == NULL) {
diff -r 5e8da0663ff8 xen/arch/ia64/xen/xensetup.c
--- a/xen/arch/ia64/xen/xensetup.c	Tue Jan 30 01:23:58 2007 +0000
+++ b/xen/arch/ia64/xen/xensetup.c	Tue Jan 30 15:54:11 2007 +0100
@@ -551,10 +551,10 @@ void arch_get_xen_caps(xen_capabilities_
     int major = xen_major_version();
     int minor = xen_minor_version();
 
-    p += sprintf(p,"xen-%d.%d-ia64 ", major, minor);
+    p += snprintf(p,sizeof(info), "xen-%d.%d-ia64 ", major, minor);
 
     if (vmx_enabled)
-        p += sprintf(p,"hvm-%d.%d-ia64 ", major, minor);
+        p += snprintf(p,sizeof(info) - (p - info),"hvm-%d.%d-ia64 ", major, minor);
 
     *(p-1) = 0;