enforce string limits (reported by pedantic checking tools & some developers).

mostly replace strcpy with BLI_strncpy and multiple strcat's with a BLI_snprintf().
also fix possible crash if CWD isnt available.

source/blender/blenfont/intern/blf_dir.c

@@ -125,20 +125,16 @@ char *blf_dir_search(const char *file)
 {
 	DirBLF *dir;
 	char full_path[FILE_MAXDIR+FILE_MAXFILE];
-	char *s;
+	char *s= NULL;
-	
+
-	dir= global_font_dir.first;
+	for(dir=global_font_dir.first; dir; dir= dir->next) {
-	s= NULL;
+		BLI_join_dirfile(full_path, sizeof(full_path), dir->path, file);
-	while (dir) {
-		BLI_join_dirfile(full_path, dir->path, file);
 		if (BLI_exist(full_path)) {
-			s= (char *)MEM_mallocN(strlen(full_path)+1,"blf_dir_search");
+			s= BLI_strdup(full_path);
-			strcpy(s, full_path);
 			break;
 		}
-		dir= dir->next;
 	}
-	
+
 	if (!s) {
 		/* check the current directory, why not ? */
 		if (BLI_exist(file))

source/blender/blenfont/intern/blf_lang.c

@@ -38,11 +38,11 @@
 #include "DNA_listBase.h"
 #include "DNA_vec_types.h"
 
+#include "MEM_guardedalloc.h"
 
-
-#include "BLI_blenlib.h"
 #include "BLI_linklist.h"	/* linknode */
 #include "BLI_string.h"
+#include "BLI_path_util.h"
 
 
 #ifdef __APPLE__
@@ -79,20 +79,14 @@ void BLF_lang_set(const char *str)
 #else
 	char *locreturn= setlocale(LC_ALL, str);
 	if (locreturn == NULL) {
-		char *lang;
+		char *lang= BLI_sprintfN("%s.UTF-8", str);
-
-		lang= (char*)malloc(sizeof(char)*(strlen(str)+7));
-
-		lang[0]= '\0';
-		strcat(lang, str);
-		strcat(lang, ".UTF-8");
 
 		locreturn= setlocale(LC_ALL, lang);
 		if (locreturn == NULL) {
 			printf("could not change language to %s nor %s\n", str, lang);
 		}
 
-		free(lang);
+		MEM_freeN(lang);
 	}
 
 	setlocale(LC_NUMERIC, "C");
@@ -100,12 +94,12 @@ void BLF_lang_set(const char *str)
 	textdomain(DOMAIN_NAME);
 	bindtextdomain(DOMAIN_NAME, global_messagepath);
 	/* bind_textdomain_codeset(DOMAIN_NAME, global_encoding_name); */
-	strcpy(global_language, str);
+	BLI_strncpy(global_language, str, sizeof(global_language));
 }
 
 void BLF_lang_encoding(const char *str)
 {
-	strcpy(global_encoding_name, str);
+	BLI_strncpy(global_encoding_name, str, sizeof(global_encoding_name));
 	/* bind_textdomain_codeset(DOMAIN_NAME, encoding_name); */
 }
 
@@ -116,7 +110,7 @@ void BLF_lang_init(void)
 	return;
 }
 
-void BLF_lang_encoding(char *str)
+void BLF_lang_encoding(const char *str)
 {
 	(void)str;
 	return;

source/blender/blenkernel/BKE_armature.h

@@ -80,7 +80,7 @@ void free_armature(struct bArmature *arm);
 void make_local_armature(struct bArmature *arm);
 struct bArmature *copy_armature(struct bArmature *arm);
 
-int bone_autoside_name (char *name, int strip_number, short axis, float head, float tail);
+int bone_autoside_name (char name[32], int strip_number, short axis, float head, float tail);
 
 struct Bone *get_named_bone (struct bArmature *arm, const char *name);
 

source/blender/blenkernel/intern/armature.c

@@ -248,16 +248,15 @@ Bone *get_named_bone (bArmature *arm, const char *name)
 }
 
 /* Finds the best possible extension to the name on a particular axis. (For renaming, check for unique names afterwards)
- * This assumes that bone names are at most 32 chars long!
  * 	strip_number: removes number extensions  (TODO: not used)
  *	axis: the axis to name on
  *	head/tail: the head/tail co-ordinate of the bone on the specified axis
  */
-int bone_autoside_name (char *name, int UNUSED(strip_number), short axis, float head, float tail)
+int bone_autoside_name (char name[MAXBONENAME], int UNUSED(strip_number), short axis, float head, float tail)
 {
 	unsigned int len;
-	char	basename[32]={""};
+	char	basename[MAXBONENAME]= "";
-	char 	extension[5]={""};
+	char 	extension[5]= "";
 
 	len= strlen(name);
 	if (len == 0) return 0;
@@ -350,13 +349,13 @@ int bone_autoside_name (char *name, int UNUSED(strip_number), short axis, float
 				}
 			}
 		}
-		
+
-		if ((32 - len) < strlen(extension) + 1) { /* add 1 for the '.' */
+		if ((MAXBONENAME - len) < strlen(extension) + 1) { /* add 1 for the '.' */
 			strncpy(name, basename, len-strlen(extension));
 		}
-		
+
-		sprintf(name, "%s.%s", basename, extension);
+		BLI_snprintf(name, MAXBONENAME, "%s.%s", basename, extension);
-		
+
 		return 1;
 	}
 

source/blender/blenkernel/intern/blender.c

@@ -457,7 +457,7 @@ static int read_undosave(bContext *C, UndoElem *uel)
 		success= BKE_read_file_from_memfile(C, &uel->memfile, NULL);
 
 	/* restore */
-	strcpy(G.main->name, mainstr); /* restore */
+	BLI_strncpy(G.main->name, mainstr, sizeof(G.main->name)); /* restore */
 	G.fileflags= fileflags;
 
 	if(success) {
@@ -525,7 +525,7 @@ void BKE_write_undo(bContext *C, const char *name)
 	
 		success= BLO_write_file(CTX_data_main(C), tstr, G.fileflags, NULL, NULL);
 		
-		strcpy(curundo->str, tstr);
+		BLI_strncpy(curundo->str, tstr, sizeof(curundo->str));
 	}
 	else {
 		MemFile *prevfile=NULL;

source/blender/blenkernel/intern/boids.c

@@ -1470,7 +1470,7 @@ BoidRule *boid_new_rule(int type)
 
 	rule->type = type;
 	rule->flag |= BOIDRULE_IN_AIR|BOIDRULE_ON_LAND;
-	strcpy(rule->name, boidrule_type_items[type-1].name);
+	BLI_strncpy(rule->name, boidrule_type_items[type-1].name, sizeof(rule->name));
 
 	return rule;
 }

source/blender/blenkernel/intern/constraint.c

@@ -752,7 +752,7 @@ static void default_get_tarmat (bConstraint *con, bConstraintOb *cob, bConstrain
 			bConstraintTarget *ctn = ct->next; \
 			if (nocopy == 0) { \
 				datatar= ct->tar; \
-				strcpy(datasubtarget, ct->subtarget); \
+				BLI_strncpy(datasubtarget, ct->subtarget, sizeof(datasubtarget)); \
 				con->tarspace= (char)ct->space; \
 			} \
 			 \

source/blender/blenkernel/intern/deform.c

@@ -348,20 +348,20 @@ void flip_side_name (char *name, const char *from_name, int strip_number)
 	len= strlen(from_name);
 	if(len<3) return; // we don't do names like .R or .L
 
-	strcpy(name, from_name);
+	BLI_strncpy(name, from_name, sizeof(name));
 
 	/* We first check the case with a .### extension, let's find the last period */
 	if(isdigit(name[len-1])) {
 		index= strrchr(name, '.'); // last occurrence
 		if (index && isdigit(index[1]) ) { // doesnt handle case bone.1abc2 correct..., whatever!
 			if(strip_number==0)
-				strcpy(number, index);
+				BLI_strncpy(number, index, sizeof(number));
 			*index= 0;
 			len= strlen(name);
 		}
 	}
 
-	strcpy (prefix, name);
+	BLI_strncpy(prefix, name, sizeof(prefix));
 
 #define IS_SEPARATOR(a) ((a)=='.' || (a)==' ' || (a)=='-' || (a)=='_')
 

source/blender/blenkernel/intern/exotic.c

@@ -1652,7 +1652,7 @@ static void dxf_read_arc(Scene *scene, int noob)
 	cent[2]= center[2];
 
 	dxf_get_mesh(scene, &me, &ob, noob);
-	strcpy(oldllay, layname);		
+	BLI_strncpy(oldllay, layname, sizeof(oldllay));
 	if(ob) VECCOPY(ob->loc, cent);
 	dxf_add_mat (ob, me, color, layname);
 

source/blender/blenkernel/intern/font.c

@@ -96,13 +96,14 @@ chtoutf8(unsigned long c, char *o)
 void
 wcs2utf8s(char *dst, wchar_t *src)
 {
-	char ch[5];
+	/* NULL terminator not needed */
+	char ch[4];
 
 	while(*src)
 	{
-		memset(ch, 0, 5);
+		memset(ch, 0, sizeof(ch));
 		chtoutf8(*src++, ch);
-		strcat(dst, ch);
+		dst= strncat(dst, ch, sizeof(ch));
 	}
 }
 
@@ -363,14 +364,14 @@ VFont *load_vfont(const char *name)
 	struct TmpFont *tmpfnt;
 	
 	if (strcmp(name, FO_BUILTIN_NAME)==0) {
-		strcpy(filename, name);
+		BLI_strncpy(filename, name, sizeof(filename));
 		
 		pf= get_builtin_packedfile();
 		is_builtin= 1;
 	} else {
 		char dir[FILE_MAXDIR];
 		
-		strcpy(dir, name);
+		BLI_strncpy(dir, name, sizeof(dir));
 		BLI_splitdirstring(dir, filename);
 
 		pf= newPackedFile(NULL, name);

source/blender/blenkernel/intern/idprop.c

@@ -711,9 +711,9 @@ IDProperty *IDP_New(int type, IDPropertyTemplate val, const char *name)
 				prop->len = 1; /*NULL string, has len of 1 to account for null byte.*/
 			} else {
 				int stlen = strlen(st) + 1;
-				prop->data.pointer = MEM_callocN(stlen, "id property string 2");
+				prop->data.pointer = MEM_mallocN(stlen, "id property string 2");
 				prop->len = prop->totallen = stlen;
-				strcpy(prop->data.pointer, st);
+				memcpy(prop->data.pointer, st, stlen);
 			}
 			break;
 		}

source/blender/blenkernel/intern/object.c

@@ -1078,7 +1078,7 @@ Object *add_object(struct Scene *scene, int type)
 	Base *base;
 	char name[32];
 
-	strcpy(name, get_obdata_defname(type));
+	BLI_strncpy(name, get_obdata_defname(type), sizeof(name));
 	ob = add_only_object(type, name);
 
 	ob->data= add_obdata_from_type(type);

source/blender/blenkernel/intern/pointcache.c

@@ -1992,7 +1992,7 @@ void BKE_ptcache_id_clear(PTCacheID *pid, int mode, unsigned int cfra)
 					if (strncmp(filename, de->d_name, len ) == 0) { /* do we have the right prefix */
 						if (mode == PTCACHE_CLEAR_ALL) {
 							pid->cache->last_exact = MIN2(pid->cache->startframe, 0);
-							BLI_join_dirfile(path_full, path, de->d_name);
+							BLI_join_dirfile(path_full, sizeof(path_full), path, de->d_name);
 							BLI_delete(path_full, 0, 0);
 						} else {
 							/* read the number of the file */
@@ -2006,7 +2006,7 @@ void BKE_ptcache_id_clear(PTCacheID *pid, int mode, unsigned int cfra)
 								if((mode==PTCACHE_CLEAR_BEFORE && frame < cfra)	|| 
 								(mode==PTCACHE_CLEAR_AFTER && frame > cfra)	) {
 									
-									BLI_join_dirfile(path_full, path, de->d_name);
+									BLI_join_dirfile(path_full, sizeof(path_full), path, de->d_name);
 									BLI_delete(path_full, 0, 0);
 									if(pid->cache->cached_frames && frame >=sta && frame <= end)
 										pid->cache->cached_frames[frame-sta] = 0;
@@ -2354,7 +2354,7 @@ void BKE_ptcache_remove(void)
 			if( strcmp(de->d_name, ".")==0 || strcmp(de->d_name, "..")==0) {
 				/* do nothing */
 			} else if (strstr(de->d_name, PTCACHE_EXT)) { /* do we have the right extension?*/
-				BLI_join_dirfile(path_full, path, de->d_name);
+				BLI_join_dirfile(path_full, sizeof(path_full), path, de->d_name);
 				BLI_delete(path_full, 0, 0);
 			} else {
 				rmdir = 0; /* unknown file, dont remove the dir */
@@ -2856,7 +2856,7 @@ void BKE_ptcache_disk_cache_rename(PTCacheID *pid, char *from, char *to)
 					BLI_strncpy(num, de->d_name + (strlen(de->d_name) - 15), sizeof(num));
 					frame = atoi(num);
 
-					BLI_join_dirfile(old_path_full, path, de->d_name);
+					BLI_join_dirfile(old_path_full, sizeof(old_path_full), path, de->d_name);
 					ptcache_filename(pid, new_path_full, frame, 1, 1);
 					BLI_rename(old_path_full, new_path_full);
 				}

source/blender/blenkernel/intern/sequencer.c

@@ -664,7 +664,7 @@ void reload_sequence_new_file(Scene *scene, Sequence * seq, int lock_range)
 	new_tstripdata(seq);
 
 	if (ELEM3(seq->type, SEQ_SCENE, SEQ_META, SEQ_IMAGE)==0) {
-		BLI_join_dirfile(str, seq->strip->dir, seq->strip->stripdata->name);
+		BLI_join_dirfile(str, sizeof(str), seq->strip->dir, seq->strip->stripdata->name);
 		BLI_path_abs(str, G.main->name);
 	}
 
@@ -1134,7 +1134,7 @@ static int seq_proxy_get_fname(SeqRenderData context, Sequence * seq, int cfra,
 	}
 
 	if (seq->flag & SEQ_USE_PROXY_CUSTOM_FILE) {
-		BLI_join_dirfile(name, dir, seq->strip->proxy->file);
+		BLI_join_dirfile(name, FILE_MAX, dir, seq->strip->proxy->file); /* XXX, not real length */
 		BLI_path_abs(name, G.main->name);
 
 		return TRUE;
@@ -2043,7 +2043,7 @@ static ImBuf * seq_render_strip(SeqRenderData context, Sequence * seq, float cfr
 			StripElem * s_elem = give_stripelem(seq, cfra);
 
 			if (s_elem) {
-				BLI_join_dirfile(name, seq->strip->dir, s_elem->name);
+				BLI_join_dirfile(name, sizeof(name), seq->strip->dir, s_elem->name);
 				BLI_path_abs(name, G.main->name);
 			}
 
@@ -2066,7 +2066,7 @@ static ImBuf * seq_render_strip(SeqRenderData context, Sequence * seq, float cfr
 		case SEQ_MOVIE:
 		{
 			if(seq->anim==0) {
-				BLI_join_dirfile(name, seq->strip->dir, seq->strip->stripdata->name);
+				BLI_join_dirfile(name, sizeof(name), seq->strip->dir, seq->strip->stripdata->name);
 				BLI_path_abs(name, G.main->name);
 					
 				seq->anim = openanim(name, IB_rect |

source/blender/blenlib/BLI_path_util.h

@@ -103,7 +103,7 @@ void BLI_make_file_string(const char *relabase, char *string,  const char *dir,
 void BLI_make_exist(char *dir);
 void BLI_make_existing_file(const char *name);
 void BLI_split_dirfile(const char *string, char *dir, char *file);
-void BLI_join_dirfile(char *string, const char *dir, const char *file);
+void BLI_join_dirfile(char *string, const int maxlen, const char *dir, const char *file);
 char *BLI_path_basename(char *path);
 int BKE_rebase_path(char *abs, int abs_size, char *rel, int rel_size, const char *base_dir, const char *src_dir, const char *dest_dir);
 char *BLI_last_slash(const char *string);
@@ -181,7 +181,7 @@ void BLI_char_switch(char *string, char from, char to);
 	 * @param fullname The full path and full name of the executable
 	 * @param name The name of the executable (usually argv[0]) to be checked
 	 */
-void BLI_where_am_i(char *fullname, const char *name);
+void BLI_where_am_i(char *fullname, const int maxlen, const char *name);
 
 char *get_install_dir(void);
 	/**
@@ -192,7 +192,7 @@ char *get_install_dir(void);
 	 *
 	 * @param fullname The full path to the temp directory
 	 */
-void BLI_where_is_temp(char *fullname, int usertemp);
+void BLI_where_is_temp(char *fullname, const int maxlen, int usertemp);
 
 
 #ifdef WITH_ICONV

source/blender/blenlib/intern/bpath.c

@@ -808,7 +808,7 @@ static int findFileRecursive(char *filename_new, const char *dirname, const char
 		if (strcmp(".", de->d_name)==0 || strcmp("..", de->d_name)==0)
 			continue;
 		
-		BLI_join_dirfile(path, dirname, de->d_name);
+		BLI_join_dirfile(path, sizeof(path), dirname, de->d_name);
 		
 		if (stat(path, &status) != 0)
 			continue; /* cant stat, dont bother with this file, could print debug info here */

source/blender/blenlib/intern/path_util.c

@@ -861,7 +861,7 @@ static int test_path(char *targetpath, const char *path_base, const char *path_s
 {
 	char tmppath[FILE_MAX];
 	
-	if(path_sep)	BLI_join_dirfile(tmppath, path_base, path_sep);
+	if(path_sep)	BLI_join_dirfile(tmppath, sizeof(tmppath), path_base, path_sep);
 	else			BLI_strncpy(tmppath, path_base, sizeof(tmppath));
 	
 	BLI_make_file_string("/", targetpath, tmppath, folder_name);
@@ -905,9 +905,9 @@ static int get_path_local(char *targetpath, const char *folder_name, const char
 #endif
 	
 	if (subfolder_name) {
-		BLI_join_dirfile(relfolder, folder_name, subfolder_name);
+		BLI_join_dirfile(relfolder, sizeof(relfolder), folder_name, subfolder_name);
 	} else {
-		BLI_strncpy(relfolder, folder_name, FILE_MAX);
+		BLI_strncpy(relfolder, folder_name, sizeof(relfolder));
 	}
 	
 	/* use argv[0] (bprogname) to get the path to the executable */
@@ -973,15 +973,18 @@ static int get_path_system(char *targetpath, const char *folder_name, const char
 	BLI_split_dirfile(bprogname, bprogdir, NULL);
 
 	if (subfolder_name) {
-		BLI_join_dirfile(relfolder, folder_name, subfolder_name);
+		BLI_join_dirfile(relfolder, sizeof(relfolder), folder_name, subfolder_name);
 	} else {
-		BLI_strncpy(relfolder, folder_name, FILE_MAX);
+		BLI_strncpy(relfolder, folder_name, sizeof(relfolder));
 	}
 
 	/* try CWD/release/folder_name */
-	if(test_path(targetpath, BLI_getwdN(cwd, sizeof(cwd)), "release", relfolder))
+	if(BLI_getwdN(cwd, sizeof(cwd))) {
-		return 1;
+		if(test_path(targetpath, cwd, "release", relfolder)) {
-	
+			return 1;
+		}
+	}
+
 	/* try EXECUTABLE_DIR/release/folder_name */
 	if(test_path(targetpath, bprogdir, "release", relfolder))
 		return 1;
@@ -1420,12 +1423,12 @@ void BLI_split_dirfile(const char *string, char *dir, char *file)
 }
 
 /* simple appending of filename to dir, does not check for valid path! */
-void BLI_join_dirfile(char *string, const char *dir, const char *file)
+void BLI_join_dirfile(char *string, const int maxlen, const char *dir, const char *file)
 {
 	int sl_dir;
 	
 	if(string != dir) /* compare pointers */
-		BLI_strncpy(string, dir, FILE_MAX);
+		BLI_strncpy(string, dir, maxlen);
 
 	if (!file)
 		return;
@@ -1433,7 +1436,7 @@ void BLI_join_dirfile(char *string, const char *dir, const char *file)
 	sl_dir= BLI_add_slash(string);
 	
 	if (sl_dir <FILE_MAX) {
-		BLI_strncpy(string + sl_dir, file, FILE_MAX-sl_dir);
+		BLI_strncpy(string + sl_dir, file, maxlen - sl_dir);
 	}
 }
 
@@ -1508,21 +1511,21 @@ int BKE_rebase_path(char *abs, int abs_size, char *rel, int rel_size, const char
 
 		/* if image is _in_ current .blend file directory */
 		if (!strcmp(dir, blend_dir)) {
-			BLI_join_dirfile(dest_path, dest_dir, base);
+			BLI_join_dirfile(dest_path, sizeof(dest_path), dest_dir, base);
 		}
 		/* "below" */
 		else {
 			/* rel = image_path_dir - blend_dir */
 			BLI_strncpy(rel_dir, dir + len, sizeof(rel_dir));
 
-			BLI_join_dirfile(dest_path, dest_dir, rel_dir);
+			BLI_join_dirfile(dest_path, sizeof(dest_path), dest_dir, rel_dir);
-			BLI_join_dirfile(dest_path, dest_path, base);
+			BLI_join_dirfile(dest_path, sizeof(dest_path), dest_path, base);
 		}
 
 	}
 	/* image is out of current directory */
 	else {
-		BLI_join_dirfile(dest_path, dest_dir, base);
+		BLI_join_dirfile(dest_path, sizeof(dest_path), dest_dir, base);
 	}
 
 	if (abs)
@@ -1646,17 +1649,15 @@ static int add_win32_extension(char *name)
 }
 
 /* filename must be FILE_MAX length minimum */
-void BLI_where_am_i(char *fullname, const char *name)
+void BLI_where_am_i(char *fullname, const int maxlen, const char *name)
 {
 	char filename[FILE_MAXDIR+FILE_MAXFILE];
 	char *path = NULL, *temp;
-	
+
 #ifdef _WIN32
 	const char *separator = ";";
-	char slash = '\\';
 #else
 	const char *separator = ":";
-	char slash = '/';
 #endif
 
 	
@@ -1664,36 +1665,37 @@ void BLI_where_am_i(char *fullname, const char *name)
 	/* linux uses binreloc since argv[0] is not relyable, call br_init( NULL ) first */
 	path = br_find_exe( NULL );
 	if (path) {
-		BLI_strncpy(fullname, path, FILE_MAXDIR+FILE_MAXFILE);
+		BLI_strncpy(fullname, path, maxlen);
 		free(path);
 		return;
 	}
 #endif
 
 #ifdef _WIN32
-	if(GetModuleFileName(0, fullname, FILE_MAXDIR+FILE_MAXFILE)) {
+	if(GetModuleFileName(0, fullname, maxlen)) {
-		GetShortPathName(fullname, fullname, FILE_MAXDIR+FILE_MAXFILE);
+		GetShortPathName(fullname, fullname, maxlen);
 		return;
 	}
 #endif
 
 	/* unix and non linux */
-	if (name && fullname && strlen(name)) {
+	if (name && name[0]) {
-		strcpy(fullname, name);
+		BLI_strncpy(fullname, name, maxlen);
 		if (name[0] == '.') {
-			// relative path, prepend cwd
+			char wdir[FILE_MAX]= "";
-			BLI_getwdN(fullname, FILE_MAX);
+			BLI_getwdN(wdir, sizeof(wdir));	 /* backup cwd to restore after */
-			
+
 			// not needed but avoids annoying /./ in name
-			if(name && name[0]=='.' && name[1]==slash)
+			if(name[1]==SEP)
-				BLI_join_dirfile(fullname, fullname, name+2);
+				BLI_join_dirfile(fullname, maxlen, wdir, name+2);
 			else
-				BLI_join_dirfile(fullname, fullname, name);
+				BLI_join_dirfile(fullname, maxlen, wdir, name);
-			
+
-			add_win32_extension(fullname);
+			add_win32_extension(fullname); /* XXX, doesnt respect length */
-		} else if (BLI_last_slash(name)) {
+		}
+		else if (BLI_last_slash(name)) {
 			// full path
-			strcpy(fullname, name);
+			BLI_strncpy(fullname, name, maxlen);
 			add_win32_extension(fullname);
 		} else {
 			// search for binary in $PATH
@@ -1708,9 +1710,9 @@ void BLI_where_am_i(char *fullname, const char *name)
 					} else {
 						strncpy(filename, path, sizeof(filename));
 					}
-					BLI_join_dirfile(fullname, fullname, name);
+					BLI_join_dirfile(fullname, maxlen, fullname, name);
 					if (add_win32_extension(filename)) {
-						strcpy(fullname, filename);
+						BLI_strncpy(fullname, filename, maxlen);
 						break;
 					}
 				} while (temp);
@@ -1728,7 +1730,7 @@ void BLI_where_am_i(char *fullname, const char *name)
 		// spaces and double-quotes. There's another solution to this
 		// with spawnv(P_WAIT, bprogname, argv) instead of system() but
 		// that's even uglier
-		GetShortPathName(fullname, fullname, FILE_MAXDIR+FILE_MAXFILE);
+		GetShortPathName(fullname, fullname, maxlen);
 #if defined(DEBUG)
 		printf("Shortname = '%s'\n", fullname);
 #endif
@@ -1736,12 +1738,12 @@ void BLI_where_am_i(char *fullname, const char *name)
 	}
 }
 
-void BLI_where_is_temp(char *fullname, int usertemp)
+void BLI_where_is_temp(char *fullname, int maxlen, int usertemp)
 {
 	fullname[0] = '\0';
 	
 	if (usertemp && BLI_is_dir(U.tempdir)) {
-		strcpy(fullname, U.tempdir);
+		BLI_strncpy(fullname, U.tempdir, maxlen);
 	}
 	
 	
@@ -1749,7 +1751,7 @@ void BLI_where_is_temp(char *fullname, int usertemp)
 	if (fullname[0] == '\0') {
 		char *tmp = getenv("TEMP"); /* Windows */
 		if (tmp && BLI_is_dir(tmp)) {
-			strcpy(fullname, tmp);
+			BLI_strncpy((fullname, tmp, maxlen);
 		}
 	}
 #else
@@ -1757,25 +1759,27 @@ void BLI_where_is_temp(char *fullname, int usertemp)
 	if (fullname[0] == '\0') {
 		char *tmp = getenv("TMP");
 		if (tmp && BLI_is_dir(tmp)) {
-			strcpy(fullname, tmp);
+			BLI_strncpy(fullname, tmp, maxlen);
 		}
 	}
 	
 	if (fullname[0] == '\0') {
 		char *tmp = getenv("TMPDIR");
 		if (tmp && BLI_is_dir(tmp)) {
-			strcpy(fullname, tmp);
+			BLI_strncpy(fullname, tmp, maxlen);
 		}
 	}
 #endif	
 	
 	if (fullname[0] == '\0') {
-		strcpy(fullname, "/tmp/");
+		BLI_strncpy(fullname, "/tmp/", maxlen);
 	} else {
 		/* add a trailing slash if needed */
 		BLI_add_slash(fullname);
 #ifdef WIN32
-		strcpy(U.tempdir, fullname); /* also set user pref to show %TEMP%. /tmp/ is just plain confusing for Windows users. */
+		if(U.tempdir != fullname) {
+			BLI_strncpy(U.tempdir, fullname, maxlen); /* also set user pref to show %TEMP%. /tmp/ is just plain confusing for Windows users. */
+		}
 #endif
 	}
 }

source/blender/blenlib/intern/storage.c

@@ -103,7 +103,7 @@ static struct ListBase dirbase_={
 	0,0};
 static struct ListBase *dirbase = &dirbase_;
 
-
+/* can return NULL when the size is not big enough */
 char *BLI_getwdN(char *dir, const int maxncpy)
 {
 	const char *pwd= getenv("PWD");

source/blender/blenloader/BLO_writefile.h

@@ -37,7 +37,7 @@ struct ReportList;
 
 extern int BLO_write_file(struct Main *mainvar, char *dir, int write_flags, struct ReportList *reports, int *thumb);
 extern int BLO_write_file_mem(struct Main *mainvar, struct MemFile *compare, struct MemFile *current, int write_flags);
-extern int BLO_write_runtime(struct Main *mainvar, char *file, char *exename, struct ReportList *reports);
+extern int BLO_write_runtime(struct Main *mainvar, const char *file, char *exename, struct ReportList *reports);
 
 #define BLEN_THUMB_SIZE 128
 

source/blender/blenloader/intern/readfile.c

@@ -9860,7 +9860,7 @@ static void do_versions(FileData *fd, Library *lib, Main *main)
 					if(seq->type == SEQ_HD_SOUND)
 					{
 						char str[FILE_MAX];
-						BLI_join_dirfile(str, seq->strip->dir, seq->strip->stripdata->name);
+						BLI_join_dirfile(str, sizeof(str), seq->strip->dir, seq->strip->stripdata->name);
 						BLI_path_abs(str, G.main->name);
 						seq->sound = sound_new_file(main, str);
 					}

source/blender/blenloader/intern/writefile.c

@@ -1296,7 +1296,7 @@ static void write_objects(WriteData *wd, ListBase *idbase)
 			if (ob->type == OB_ARMATURE) {
 				bArmature *arm = ob->data;
 				if (arm && ob->pose && arm->act_bone) {
-					strcpy(ob->pose->proxy_act_bone, arm->act_bone->name);
+					BLI_strncpy(ob->pose->proxy_act_bone, arm->act_bone->name, sizeof(ob->pose->proxy_act_bone));
 				}
 			}
 
@@ -2606,29 +2606,20 @@ int BLO_write_file_mem(Main *mainvar, MemFile *compare, MemFile *current, int wr
 
 	/* Runtime writing */
 
-#ifdef WIN32
-#define PATHSEPERATOR		"\\"
-#else
-#define PATHSEPERATOR		"/"
-#endif
-
 static char *get_runtime_path(char *exename) {
 	char *installpath= get_install_dir();
 
 	if (!installpath) {
 		return NULL;
-	} else {
+	}
-		char *path= MEM_mallocN(strlen(installpath)+strlen(PATHSEPERATOR)+strlen(exename)+1, "runtimepath");
+	else {
+		char *path= BLI_sprintfN("%s%c%s", installpath, SEP, exename);
 
 		if (path == NULL) {
 			MEM_freeN(installpath);
 			return NULL;
 		}
 
-		strcpy(path, installpath);
-		strcat(path, PATHSEPERATOR);
-		strcat(path, exename);
-
 		MEM_freeN(installpath);
 
 		return path;
@@ -2637,7 +2628,7 @@ static char *get_runtime_path(char *exename) {
 
 #ifdef __APPLE__
 
-static int recursive_copy_runtime(char *outname, char *exename, ReportList *reports)
+static int recursive_copy_runtime(const char *outname, char *exename, ReportList *reports)
 {
 	char *runtime = get_runtime_path(exename);
 	char command[2 * (FILE_MAXDIR+FILE_MAXFILE) + 32];
@@ -2673,7 +2664,7 @@ cleanup:
 	return !error;
 }
 
-int BLO_write_runtime(Main *mainvar, char *file, char *exename, ReportList *reports) 
+int BLO_write_runtime(Main *mainvar, const char *file, char *exename, ReportList *reports) 
 {
 	char gamename[FILE_MAXDIR+FILE_MAXFILE];
 	int outfd = -1, error= 0;
@@ -2687,8 +2678,7 @@ int BLO_write_runtime(Main *mainvar, char *file, char *exename, ReportList *repo
 		goto cleanup;
 	}
 
-	strcpy(gamename, file);
+	BLI_snprintf(gamename, sizeof(gamename), "%s/Contents/Resources/game.blend", file);
-	strcat(gamename, "/Contents/Resources/game.blend");
 	//printf("gamename %s\n", gamename);
 	outfd= open(gamename, O_BINARY|O_WRONLY|O_CREAT|O_TRUNC, 0777);
 	if (outfd != -1) {
@@ -2762,7 +2752,7 @@ static int handle_write_msb_int(int handle, int i)
 	return (write(handle, buf, 4)==4);
 }
 
-int BLO_write_runtime(Main *mainvar, char *file, char *exename, ReportList *reports)
+int BLO_write_runtime(Main *mainvar, const char *file, char *exename, ReportList *reports)
 {
 	int outfd= open(file, O_BINARY|O_WRONLY|O_CREAT|O_TRUNC, 0777);
 	int datastart, error= 0;

source/blender/collada/DocumentImporter.cpp

@@ -840,7 +840,7 @@ private:
 		char full_path[FILE_MAX];
 		
 		BLI_split_dirfile(filename, dir, NULL);
-		BLI_join_dirfile(full_path, dir, filepath.c_str());
+		BLI_join_dirfile(full_path, sizeof(full_path), dir, filepath.c_str());
 		Image *ima = BKE_add_image_file(full_path);
 		if (!ima) {
 			fprintf(stderr, "Cannot create image. \n");

source/blender/editors/armature/editarmature.c

@@ -5439,8 +5439,6 @@ void unique_bone_name(bArmature *arm, char *name)
 	BLI_uniquename_cb(bone_unique_check, (void *)arm, "Bone", '.', name, sizeof(((Bone *)NULL)->name));
 }
 
-
-#define MAXBONENAME 32
 /* helper call for armature_bone_rename */
 static void constraint_bone_name_fix(Object *ob, ListBase *conlist, char *oldname, char *newname)
 {

source/blender/editors/interface/interface.c

@@ -664,7 +664,7 @@ void ui_menu_block_set_keymaps(const bContext *C, uiBlock *block)
 {
 	uiBut *but;
 	IDProperty *prop;
-	char buf[512], *butstr;
+	char buf[512];
 
 	/* only do it before bounding */
 	if(block->minx != block->maxx)
@@ -675,15 +675,10 @@ void ui_menu_block_set_keymaps(const bContext *C, uiBlock *block)
 			prop= (but->opptr)? but->opptr->data: NULL;
 
 			if(WM_key_event_operator_string(C, but->optype->idname, but->opcontext, prop, buf, sizeof(buf))) {
-				butstr= MEM_mallocN(strlen(but->str)+strlen(buf)+2, "menu_block_set_keymaps");
+				char *butstr_orig= BLI_strdup(but->str);
-				strcpy(butstr, but->str);
+				BLI_snprintf(but->strdata, sizeof(but->strdata), "%s|%s", butstr_orig, buf);
-				strcat(butstr, "|");
+				MEM_freeN(butstr_orig);
-				strcat(butstr, buf);
-
 				but->str= but->strdata;
-				BLI_strncpy(but->str, butstr, sizeof(but->strdata));
-				MEM_freeN(butstr);
-
 				ui_check_but(but);
 			}
 		}
@@ -2162,8 +2157,7 @@ void ui_check_but(uiBut *but)
 
 			ui_get_but_string(but, str, UI_MAX_DRAW_STR-strlen(but->str));
 
-			strcpy(but->drawstr, but->str);
+			BLI_snprintf(but->drawstr, sizeof(but->drawstr), "%s%s", but->str, str);
-			strcat(but->drawstr, str);
 		}
 		break;
 	

source/blender/editors/interface/interface_draw.c

@@ -553,8 +553,6 @@ static void ui_draw_but_CHARTAB(uiBut *but)
 	/* Set the font, in case it is not FO_BUILTIN_NAME font */
 	if(G.selfont && strcmp(G.selfont->name, FO_BUILTIN_NAME))
 	{
-		char tmpStr[256];
-
 		// Is the font file packed, if so then use the packed file
 		if(G.selfont->packedfile)
 		{
@@ -563,9 +561,10 @@ static void ui_draw_but_CHARTAB(uiBut *but)
 		}
 		else
 		{
+			char tmpStr[256];
 			int err;
 
-			strcpy(tmpStr, G.selfont->name);
+			BLI_strncpy(tmpStr, G.selfont->name, sizeof(tmpStr));
 			BLI_path_abs(tmpStr, G.main->name);
 			err = FTF_SetFont((unsigned char *)tmpStr, 0, 14.0);
 		}

source/blender/editors/interface/interface_handlers.c

@@ -3968,35 +3968,31 @@ static void but_shortcut_name_func(bContext *C, void *arg1, int UNUSED(event))
 	uiBut *but = (uiBut *)arg1;
 
 	if (but->optype) {
-		char buf[512], *butstr, *cpoin;
+		char buf[512], *cpoin;
 
 		IDProperty *prop= (but->opptr)? but->opptr->data: NULL;
 		
 		/* complex code to change name of button */
 		if(WM_key_event_operator_string(C, but->optype->idname, but->opcontext, prop, buf, sizeof(buf))) {
 			wmKeyMap *km= NULL;
+			char *butstr_orig;
 
-			butstr= MEM_mallocN(strlen(but->str)+strlen(buf)+2, "menu_block_set_keymaps");
-			
 			// XXX but->str changed... should not, remove the hotkey from it
 			cpoin= strchr(but->str, '|');
 			if(cpoin) *cpoin= 0;		
-			
+
-			strcpy(butstr, but->str);
+			butstr_orig= BLI_strdup(but->str);
-			strcat(butstr, "|");
+			BLI_snprintf(but->strdata, sizeof(but->strdata), "%s|%s", butstr_orig, buf);
-			strcat(butstr, buf);
+			MEM_freeN(butstr_orig);
-			
 			but->str= but->strdata;
-			BLI_strncpy(but->str, butstr, sizeof(but->strdata));
+
-			MEM_freeN(butstr);
-			
 			ui_check_but(but);
-			
+
 			/* set the keymap editable else the key wont save */
 			WM_key_event_operator_id(C, but->optype->idname, but->opcontext, prop, 1, &km);
 			WM_keymap_copy_to_user(km);
-				
+		}
-		} else {
+		else {
 			/* shortcut was removed */
 			cpoin= strchr(but->str, '|');
 			if(cpoin) *cpoin= 0;

source/blender/editors/interface/resources.c

@@ -1004,10 +1004,8 @@ void init_userdef_do_versions(void)
 		U.tb_rightmouse= 5;
 	}
 	if(U.mixbufsize==0) U.mixbufsize= 2048;
-	if (BLI_streq(U.tempdir, "/")) {
+	if (strcmp(U.tempdir, "/") == 0) {
-		char *tmp= getenv("TEMP");
+		BLI_where_is_temp(U.tempdir, sizeof(U.tempdir), FALSE);
-		
-		strcpy(U.tempdir, tmp?tmp:"/tmp/");
 	}
 	if (U.autokey_mode == 0) {
 		/* 'add/replace' but not on */

source/blender/editors/mesh/editmesh_loop.c

@@ -220,9 +220,8 @@ void CutEdgeloop(Object *obedit, wmOperator *op, EditMesh *em, int numcuts)
 			dist= 50;
 			nearest = findnearestedge(&vc, &dist);	// returns actual distance in dist
 //			scrarea_do_windraw(curarea);	// after findnearestedge, backbuf!
-			
+
-			sprintf(msg,"Number of Cuts: %d (S)mooth: ",numcuts);
+			BLI_snprintf(msg, sizeof(msg),"Number of Cuts: %d (S)mooth: %s", numcuts, smooth ? "on":"off");
-			strcat(msg, smooth ? "on":"off");
 			
 //			headerprint(msg);
 			/* Need to figure preview */

source/blender/editors/physics/physics_fluid.c

@@ -641,10 +641,10 @@ static int fluid_init_filepaths(Object *fsDomain, char *targetDir, char *targetF
 	strncpy(targetDir, domainSettings->surfdataPath, FILE_MAXDIR);
 	strncpy(newSurfdataPath, domainSettings->surfdataPath, FILE_MAXDIR);
 	BLI_path_abs(targetDir, G.main->name); // fixed #frame-no 
-	
+
-	strcpy(targetFile, targetDir);
+	// .tmp: dont overwrite/delete original file
-	strcat(targetFile, suffixConfig);
+	BLI_snprintf(targetFile, sizeof(targetFile), "%s%s.tmp", targetDir, suffixConfig);
-	strcat(targetFile,".tmp"); // dont overwrite/delete original file
+
 	// make sure all directories exist
 	// as the bobjs use the same dir, this only needs to be checked
 	// for the cfg output
@@ -664,19 +664,13 @@ static int fluid_init_filepaths(Object *fsDomain, char *targetDir, char *targetF
 		char blendFile[FILE_MAXDIR+FILE_MAXFILE];
 		
 		// invalid dir, reset to current/previous
-		strcpy(blendDir, G.main->name);
+		BLI_strncpy(blendDir, G.main->name, sizeof(blendDir));
 		BLI_splitdirstring(blendDir, blendFile);
-		if(BLI_strnlen(blendFile, 7) > 6){
+		BLI_replace_extension(blendFile, sizeof(blendFile), ""); /* strip .blend */
-			int len = strlen(blendFile);
+
-			if( (blendFile[len-6]=='.')&& (blendFile[len-5]=='b')&& (blendFile[len-4]=='l')&&
+		BLI_snprintf(newSurfdataPath, sizeof(newSurfdataPath) ,"//fluidsimdata/%s_%s_", blendFile, fsDomain->id.name);
-			   (blendFile[len-3]=='e')&& (blendFile[len-2]=='n')&& (blendFile[len-1]=='d') ){
-				blendFile[len-6] = '\0';
-			}
-		}
-		// todo... strip .blend ?
-		snprintf(newSurfdataPath,FILE_MAXFILE+FILE_MAXDIR,"//fluidsimdata/%s_%s_", blendFile, fsDomain->id.name);
 		
-		snprintf(debugStrBuffer,256,"fluidsimBake::error - warning resetting output dir to '%s'\n", newSurfdataPath);
+		BLI_snprintf(debugStrBuffer, sizeof(debugStrBuffer), "fluidsimBake::error - warning resetting output dir to '%s'\n", newSurfdataPath);
 		elbeemDebugOut(debugStrBuffer);
 		outStringsChanged=1;
 	}
@@ -686,14 +680,14 @@ static int fluid_init_filepaths(Object *fsDomain, char *targetDir, char *targetF
 	if(outStringsChanged) {
 		char dispmsg[FILE_MAXDIR+FILE_MAXFILE+256];
 		int  selection=0;
-		strcpy(dispmsg,"Output settings set to: '");
+		BLI_strncpy(dispmsg,"Output settings set to: '", sizeof(dispmsg));
 		strcat(dispmsg, newSurfdataPath);
 		strcat(dispmsg, "'%t|Continue with changed settings%x1|Discard and abort%x0");
 		
 		// ask user if thats what he/she wants...
 		selection = pupmenu(dispmsg);
 		if(selection<1) return 0; // 0 from menu, or -1 aborted
-		strcpy(targetDir, newSurfdataPath);
+		BLI_strncpy(targetDir, newSurfdataPath, sizeof(targetDir));
 		strncpy(domainSettings->surfdataPath, newSurfdataPath, FILE_MAXDIR);
 		BLI_path_abs(targetDir, G.main->name); // fixed #frame-no 
 	}
@@ -957,9 +951,8 @@ int fluidsimBake(bContext *C, ReportList *reports, Object *fsDomain)
 	}
 
 	/* ********  start writing / exporting ******** */
-	strcpy(targetFile, targetDir);
+	// use .tmp, dont overwrite/delete original file
-	strcat(targetFile, suffixConfig);
+	BLI_snprintf(targetFile, sizeof(targetFile), "%s%s.tmp", targetDir, suffixConfig);
-	strcat(targetFile,".tmp");  // dont overwrite/delete original file
 	
 	// make sure these directories exist as well
 	if(outStringsChanged) {
@@ -987,8 +980,8 @@ int fluidsimBake(bContext *C, ReportList *reports, Object *fsDomain)
 	fsset->aniFrameTime = channels->aniFrameTime;
 	fsset->noOfFrames = noFrames; // is otherwise subtracted in parser
 
-	strcpy(targetFile, targetDir);
+	BLI_snprintf(targetFile, sizeof(targetFile), "%s%s", targetDir, suffixSurface);
-	strcat(targetFile, suffixSurface);
+
 	// defaults for compressibility and adaptive grids
 	fsset->gstar = domainSettings->gstar;
 	fsset->maxRefine = domainSettings->maxRefine; // check <-> gridlevels
@@ -997,7 +990,7 @@ int fluidsimBake(bContext *C, ReportList *reports, Object *fsDomain)
 	fsset->surfaceSmoothing = domainSettings->surfaceSmoothing; 
 	fsset->surfaceSubdivs = domainSettings->surfaceSubdivs; 
 	fsset->farFieldSize = domainSettings->farFieldSize; 
-	strcpy( fsset->outputPath, targetFile);
+	BLI_strncpy(fsset->outputPath, targetFile, sizeof(fsset->outputPath));
 
 	// domain channels
 	fsset->channelSizeFrameTime = 

source/blender/editors/space_file/file_ops.c

@@ -541,7 +541,7 @@ void FILE_OT_cancel(struct wmOperatorType *ot)
 
 void file_sfile_to_operator(wmOperator *op, SpaceFile *sfile, char *filepath)
 {
-	BLI_join_dirfile(filepath, sfile->params->dir, sfile->params->file);
+	BLI_join_dirfile(filepath, FILE_MAX, sfile->params->dir, sfile->params->file); /* XXX, not real length */
 	if(RNA_struct_find_property(op->ptr, "relative_path")) {
 		if(RNA_boolean_get(op->ptr, "relative_path")) {
 			BLI_path_rel(filepath, G.main->name);
@@ -639,7 +639,7 @@ int file_draw_check_exists(SpaceFile *sfile)
 		if(RNA_struct_find_property(sfile->op->ptr, "check_existing")) {
 			if(RNA_boolean_get(sfile->op->ptr, "check_existing")) {
 				char filepath[FILE_MAX];
-				BLI_join_dirfile(filepath, sfile->params->dir, sfile->params->file);
+				BLI_join_dirfile(filepath, sizeof(filepath), sfile->params->dir, sfile->params->file);
 				if(BLI_exists(filepath) && !BLI_is_dir(filepath)) {
 					return TRUE;
 				}
@@ -929,13 +929,13 @@ static int new_folder_path(const char* parent, char *folder, char *name)
 	int len = 0;
 
 	BLI_strncpy(name, "New Folder", FILE_MAXFILE);
-	BLI_join_dirfile(folder, parent, name);
+	BLI_join_dirfile(folder, FILE_MAX, parent, name); /* XXX, not real length */
 	/* check whether folder with the name already exists, in this case
 	   add number to the name. Check length of generated name to avoid
 	   crazy case of huge number of folders each named 'New Folder (x)' */
 	while (BLI_exists(folder) && (len<FILE_MAXFILE)) {
 		len = BLI_snprintf(name, FILE_MAXFILE, "New Folder(%d)", i);
-		BLI_join_dirfile(folder, parent, name);
+		BLI_join_dirfile(folder, FILE_MAX, parent, name); /* XXX, not real length */
 		i++;
 	}
 
@@ -1017,8 +1017,8 @@ static void file_expand_directory(bContext *C)
 	if(sfile->params) {
 		if ( sfile->params->dir[0] == '~' ) {
 			char tmpstr[sizeof(sfile->params->dir)-1];
-			strncpy(tmpstr, sfile->params->dir+1, sizeof(tmpstr));
+			BLI_strncpy(tmpstr, sfile->params->dir+1, sizeof(tmpstr));
-			BLI_join_dirfile(sfile->params->dir, BLI_getDefaultDocumentFolder(), tmpstr);
+			BLI_join_dirfile(sfile->params->dir, sizeof(sfile->params->dir), BLI_getDefaultDocumentFolder(), tmpstr);
 		}
 
 #ifdef WIN32

source/blender/editors/space_file/filesel.c

@@ -555,7 +555,7 @@ void autocomplete_directory(struct bContext *C, char *str, void *UNUSED(arg_v))
 					char path[FILE_MAX];
 					struct stat status;
 					
-					BLI_join_dirfile(path, dirname, de->d_name);
+					BLI_join_dirfile(path, sizeof(path), dirname, de->d_name);
 
 					if (stat(path, &status) == 0) {
 						if (S_ISDIR(status.st_mode)) { /* is subdir */

source/blender/editors/space_sequencer/sequencer_add.c

@@ -315,7 +315,7 @@ static int sequencer_add_generic_strip_exec(bContext *C, wmOperator *op, SeqLoad
 
 		RNA_BEGIN(op->ptr, itemptr, "files") {
 			RNA_string_get(&itemptr, "name", file_only);
-			BLI_join_dirfile(seq_load.path, dir_only, file_only);
+			BLI_join_dirfile(seq_load.path, sizeof(seq_load.path), dir_only, file_only);
 
 			seq= seq_load_func(C, ed->seqbasep, &seq_load);
 		}

source/blender/editors/space_sequencer/sequencer_edit.c

@@ -1060,8 +1060,7 @@ void seq_remap_paths(Scene *scene)
 				BLI_strncpy(stripped, seq->strip->dir + strlen(from), FILE_MAX);
 				
 				/* new path */
-				BLI_strncpy(seq->strip->dir, to, FILE_MAX);
+				BLI_snprintf(seq->strip->dir, sizeof(seq->strip->dir), "%s%s", to, stripped);
-				strcat(seq->strip->dir, stripped);
 				printf("new %s\n", seq->strip->dir);
 			}
 		}

source/blender/makesdna/DNA_armature_types.h

@@ -189,4 +189,6 @@ typedef enum eBone_Flag {
 	BONE_NO_LOCAL_LOCATION		= (1<<22)	/* bone location is in armature space */
 } eBone_Flag;
 
+#define MAXBONENAME 32
+
 #endif

source/blender/makesrna/intern/rna_sequencer.c

@@ -446,7 +446,7 @@ static void rna_Sequence_filepath_get(PointerRNA *ptr, char *value)
 	Sequence *seq= (Sequence*)(ptr->data);
 	char path[FILE_MAX];
 
-	BLI_join_dirfile(path, seq->strip->dir, seq->strip->stripdata->name);
+	BLI_join_dirfile(path, sizeof(path), seq->strip->dir, seq->strip->stripdata->name);
 	BLI_strncpy(value, path, strlen(path)+1);
 }
 
@@ -455,7 +455,7 @@ static int rna_Sequence_filepath_length(PointerRNA *ptr)
 	Sequence *seq= (Sequence*)(ptr->data);
 	char path[FILE_MAX];
 
-	BLI_join_dirfile(path, seq->strip->dir, seq->strip->stripdata->name);
+	BLI_join_dirfile(path, sizeof(path), seq->strip->dir, seq->strip->stripdata->name);
 	return strlen(path)+1;
 }
 
@@ -474,7 +474,7 @@ static void rna_Sequence_proxy_filepath_get(PointerRNA *ptr, char *value)
 	StripProxy *proxy= (StripProxy*)(ptr->data);
 	char path[FILE_MAX];
 
-	BLI_join_dirfile(path, proxy->dir, proxy->file);
+	BLI_join_dirfile(path, sizeof(path), proxy->dir, proxy->file);
 	BLI_strncpy(value, path, strlen(path)+1);
 }
 
@@ -483,7 +483,7 @@ static int rna_Sequence_proxy_filepath_length(PointerRNA *ptr)
 	StripProxy *proxy= (StripProxy*)(ptr->data);
 	char path[FILE_MAX];
 
-	BLI_join_dirfile(path, proxy->dir, proxy->file);
+	BLI_join_dirfile(path, sizeof(path), proxy->dir, proxy->file);
 	return strlen(path)+1;
 }
 

source/blender/makesrna/intern/rna_userdef.c

@@ -255,7 +255,7 @@ static void rna_userdef_addon_remove(bAddon *bext)
 static void rna_userdef_temp_update(Main *bmain, Scene *scene, PointerRNA *ptr)
 {
 	extern char btempdir[];
-	BLI_where_is_temp(btempdir, 1);
+	BLI_where_is_temp(btempdir, FILE_MAX, 1);
 }
 
 static void rna_userdef_text_update(Main *bmain, Scene *scene, PointerRNA *ptr)

source/blender/modifiers/intern/MOD_collision.c

@@ -110,8 +110,6 @@ static void deformVerts(ModifierData *md, Object *ob,
 {
 	CollisionModifierData *collmd = (CollisionModifierData*) md;
 	DerivedMesh *dm = NULL;
-	float current_time = 0;
-	unsigned int numverts = 0, i = 0;
 	MVert *tempVert = NULL;
 	
 	/* if possible use/create DerivedMesh */
@@ -126,6 +124,9 @@ static void deformVerts(ModifierData *md, Object *ob,
 	
 	if(dm)
 	{
+		float current_time = 0;
+		unsigned int numverts = 0;
+
 		CDDM_apply_vert_coords(dm, vertexCos);
 		CDDM_calc_normals(dm);
 		
@@ -137,7 +138,9 @@ static void deformVerts(ModifierData *md, Object *ob,
 		numverts = dm->getNumVerts ( dm );
 		
 		if((current_time > collmd->time)|| (BKE_ptcache_get_continue_physics()))
-		{	
+		{
+			unsigned int i;
+
 			// check if mesh has changed
 			if(collmd->x && (numverts != collmd->numverts))
 				freeData((ModifierData *)collmd);

source/blender/modifiers/intern/MOD_explode.c

@@ -128,11 +128,10 @@ static void createFacepa(ExplodeModifierData *emd,
 	/* set protected verts */
 	if(emd->vgroup){
 		MDeformVert *dvert = dm->getVertDataArray(dm, CD_MDEFORMVERT);
-		float val;
 		if(dvert){
-			int defgrp_index= emd->vgroup-1;
+			const int defgrp_index= emd->vgroup-1;
 			for(i=0; i<totvert; i++, dvert++){
-				val = BLI_frand();
+				float val = BLI_frand();
 				val = (1.0f-emd->protect)*val + emd->protect*0.5f;
 				if(val < defvert_find_weight(dvert, defgrp_index))
 					vertpa[i] = -1;

source/blender/modifiers/intern/MOD_fluidsim_util.c

@@ -459,7 +459,7 @@ DerivedMesh *fluidsim_read_cache(DerivedMesh *orgdm, FluidsimModifierData *fluid
 		displaymode = fss->renderDisplayMode;
 	}
 
-	strncpy(targetDir, fss->surfdataPath, FILE_MAXDIR);
+	BLI_strncpy(targetDir, fss->surfdataPath, sizeof(targetDir));
 
 	// use preview or final mesh?
 	if(displaymode==1)
@@ -479,8 +479,7 @@ DerivedMesh *fluidsim_read_cache(DerivedMesh *orgdm, FluidsimModifierData *fluid
 	BLI_path_abs(targetDir, G.main->name);
 	BLI_path_frame(targetDir, curFrame, 0); // fixed #frame-no
 
-	strcpy(targetFile,targetDir);
+	BLI_snprintf(targetFile, sizeof(targetFile), "%s.bobj.gz", targetDir);
-	strcat(targetFile, ".bobj.gz");
 
 	dm = fluidsim_read_obj(targetFile);
 

source/blender/modifiers/intern/MOD_mask.c

@@ -53,7 +53,7 @@ static void copyData(ModifierData *md, ModifierData *target)
 	MaskModifierData *mmd = (MaskModifierData*) md;
 	MaskModifierData *tmmd = (MaskModifierData*) target;
 	
-	strcpy(tmmd->vgroup, mmd->vgroup);
+	BLI_strncpy(tmmd->vgroup, mmd->vgroup, sizeof(tmmd->vgroup));
 	tmmd->flag = mmd->flag;
 }
 

source/blender/modifiers/intern/MOD_screw.c

@@ -433,15 +433,15 @@ static DerivedMesh *applyModifier(ModifierData *md, Object *ob,
 			/* find the first vert */
 			vc= vert_connect;
 			for (i=0; i < totvert; i++, vc++) {
-				int v_best=-1, ed_loop_closed=0; /* vert and vert new */
-				int ed_loop_flip= 0; /* compiler complains if not initialized, but it should be initialized below */
-				float fl= -1.0f;
-				ScrewVertIter lt_iter;
-
 				/* Now do search for connected verts, order all edges and flip them
 				 * so resulting faces are flipped the right way */
 				vc_tot_linked= 0; /* count the number of linked verts for this loop */
 				if (vc->flag == 0) {
+					int v_best=-1, ed_loop_closed=0; /* vert and vert new */
+					ScrewVertIter lt_iter;
+					int ed_loop_flip= 0; /* compiler complains if not initialized, but it should be initialized below */
+					float fl= -1.0f;
+
 					/*printf("Loop on connected vert: %i\n", i);*/
 
 					for(j=0; j<2; j++) {

source/blender/modifiers/intern/MOD_shapekey.c

@@ -70,11 +70,12 @@ static void deformMatrices(ModifierData *md, Object *ob, DerivedMesh *derivedDat
 	Key *key= ob_get_key(ob);
 	KeyBlock *kb= ob_get_keyblock(ob);
 	float scale[3][3];
-	int a;
 
 	(void)vertexCos; /* unused */
 
 	if(kb && kb->totelem==numVerts && kb!=key->refkey) {
+		int a;
+
 		if(ob->shapeflag & OB_SHAPE_LOCK) scale_m3_fl(scale, 1);
 		else scale_m3_fl(scale, kb->curval);
 
@@ -107,11 +108,11 @@ static void deformMatricesEM(ModifierData *UNUSED(md), Object *ob,
 	Key *key= ob_get_key(ob);
 	KeyBlock *kb= ob_get_keyblock(ob);
 	float scale[3][3];
-	int a;
 
 	(void)vertexCos; /* unused */
 
 	if(kb && kb->totelem==numVerts && kb!=key->refkey) {
+		int a;
 		scale_m3_fl(scale, kb->curval);
 
 		for(a=0; a<numVerts; a++)

source/blender/modifiers/intern/MOD_shrinkwrap.c

@@ -32,9 +32,9 @@
 
 #include <string.h>
 
+#include "BLI_string.h"
 #include "BLI_utildefines.h"
 
-
 #include "BKE_cdderivedmesh.h"
 #include "BKE_modifier.h"
 #include "BKE_shrinkwrap.h"
@@ -65,7 +65,7 @@ static void copyData(ModifierData *md, ModifierData *target)
 	tsmd->target	= smd->target;
 	tsmd->auxTarget = smd->auxTarget;
 
-	strcpy(tsmd->vgroup_name, smd->vgroup_name);
+	BLI_strncpy(tsmd->vgroup_name, smd->vgroup_name, sizeof(tsmd->vgroup_name));
 
 	tsmd->keepDist	= smd->keepDist;
 	tsmd->shrinkType= smd->shrinkType;

source/blender/modifiers/intern/MOD_simpledeform.c

@@ -34,6 +34,7 @@
 #include "DNA_object_types.h"
 
 #include "BLI_math.h"
+#include "BLI_string.h"
 #include "BLI_utildefines.h"
 
 #include "BKE_cdderivedmesh.h"
@@ -288,7 +289,7 @@ static void copyData(ModifierData *md, ModifierData *target)
 	tsmd->originOpts= smd->originOpts;
 	tsmd->factor= smd->factor;
 	memcpy(tsmd->limit, smd->limit, sizeof(tsmd->limit));
-	strcpy(tsmd->vgroup_name, smd->vgroup_name);
+	BLI_strncpy(tsmd->vgroup_name, smd->vgroup_name, sizeof(tsmd->vgroup_name));
 }
 
 static CustomDataMask requiredDataMask(Object *UNUSED(ob), ModifierData *md)

source/blender/modifiers/intern/MOD_surface.c

@@ -91,7 +91,6 @@ static void deformVerts(ModifierData *md, Object *ob,
 						int UNUSED(isFinalCalc))
 {
 	SurfaceModifierData *surmd = (SurfaceModifierData*) md;
-	unsigned int numverts = 0, i = 0;
 	
 	if(surmd->dm)
 		surmd->dm->release(surmd->dm);
@@ -108,6 +107,7 @@ static void deformVerts(ModifierData *md, Object *ob,
 	
 	if(surmd->dm)
 	{
+		unsigned int numverts = 0, i = 0;
 		int init = 0;
 		float *vec;
 		MVert *x, *v;

source/blender/python/generic/IDProp.c

@@ -201,7 +201,7 @@ static int BPy_IDGroup_SetName(BPy_IDProperty *self, PyObject *value, void *UNUS
 		return -1;
 	}
 
-	strcpy(self->prop->name, st);
+	BLI_strncpy(self->prop->name, st, sizeof(self->prop->name));
 	return 0;
 }
 

source/blender/render/intern/source/pipeline.c

@@ -574,7 +574,7 @@ static RenderResult *new_render_result(Render *re, rcti *partrct, int crop, int
 		rl= MEM_callocN(sizeof(RenderLayer), "new render layer");
 		BLI_addtail(&rr->layers, rl);
 		
-		strcpy(rl->name, srl->name);
+		BLI_strncpy(rl->name, srl->name, sizeof(rl->name));
 		rl->lay= srl->lay;
 		rl->lay_zmask= srl->lay_zmask;
 		rl->layflag= srl->layflag;
@@ -921,7 +921,7 @@ static void renderresult_add_names(RenderResult *rr)
 	
 	for(rl= rr->layers.first; rl; rl= rl->next)
 		for(rpass= rl->passes.first; rpass; rpass= rpass->next)
-			strcpy(rpass->name, get_pass_name(rpass->passtype, -1));
+			BLI_strncpy(rpass->name, get_pass_name(rpass->passtype, -1), sizeof(rpass->name));
 }
 
 /* called for reading temp files, and for external engines */
@@ -2049,7 +2049,7 @@ static void load_backbuffer(Render *re)
 		ImBuf *ibuf;
 		char name[256];
 		
-		strcpy(name, re->r.backbuf);
+		BLI_strncpy(name, re->r.backbuf, sizeof(name));
 		BLI_path_abs(name, re->main->name);
 		BLI_path_frame(name, re->r.cfra, 0);
 		

source/blender/windowmanager/intern/wm_files.c

@@ -259,7 +259,7 @@ static void wm_init_userdef(bContext *C)
 	/* set the python auto-execute setting from user prefs */
 	/* disabled by default, unless explicitly enabled in the command line */
 	if ((U.flag & USER_SCRIPT_AUTOEXEC_DISABLE) == 0) G.f |=  G_SCRIPT_AUTOEXEC;
-	if(U.tempdir[0]) BLI_where_is_temp(btempdir, 1);
+	if(U.tempdir[0]) BLI_where_is_temp(btempdir, FILE_MAX, 1);
 }
 
 void WM_read_file(bContext *C, const char *name, ReportList *reports)
@@ -469,10 +469,7 @@ void read_history(void)
 		if (line[0] && BLI_exists(line)) {
 			recent = (RecentFile*)MEM_mallocN(sizeof(RecentFile),"RecentFile");
 			BLI_addtail(&(G.recent_files), recent);
-			recent->filepath = (char*)MEM_mallocN(sizeof(char)*(strlen(line)+1), "name of file");
+			recent->filepath = BLI_strdup(line);
-			recent->filepath[0] = '\0';
-			
-			strcpy(recent->filepath, line);
 			num++;
 		}
 	}
@@ -505,7 +502,7 @@ static void write_history(void)
 			recent = (RecentFile*)MEM_mallocN(sizeof(RecentFile),"RecentFile");
 			recent->filepath = (char*)MEM_mallocN(sizeof(char)*(strlen(G.main->name)+1), "name of file");
 			recent->filepath[0] = '\0';
-			strcpy(recent->filepath, G.main->name);
+			BLI_strncpy(recent->filepath, G.main->name, sizeof(recent->filepath));
 			BLI_addhead(&(G.recent_files), recent);
 			/* write current file to recent-files.txt */
 			fprintf(fp, "%s\n", recent->filepath);
@@ -671,7 +668,7 @@ int WM_write_file(bContext *C, const char *target, int fileflags, ReportList *re
 	if (BLO_write_file(CTX_data_main(C), di, fileflags, reports, thumb)) {
 		if(!copy) {
 			G.relbase_valid = 1;
-			strcpy(G.main->name, di);	/* is guaranteed current file */
+			BLI_strncpy(G.main->name, di, sizeof(G.main->name));	/* is guaranteed current file */
 	
 			G.save_over = 1; /* disable untitled.blend convention */
 		}

source/creator/creator.c

@@ -138,8 +138,8 @@ static int print_version(int argc, char **argv, void *data);
 
 extern int pluginapi_force_ref(void);  /* from blenpluginapi:pluginapi.c */
 
-char bprogname[FILE_MAXDIR+FILE_MAXFILE]; /* from blenpluginapi:pluginapi.c */
+char bprogname[FILE_MAX]; /* from blenpluginapi:pluginapi.c */
-char btempdir[FILE_MAXDIR+FILE_MAXFILE];
+char btempdir[FILE_MAX];
 
 #define BLEND_VERSION_STRING_FMT "Blender %d.%02d (sub %d) Build\n", BLENDER_VERSION/100, BLENDER_VERSION%100, BLENDER_SUBVERSION
 
@@ -1145,7 +1145,7 @@ int main(int argc, char **argv)
 	// copy path to executable in bprogname. playanim and creting runtimes
 	// need this.
 
-	BLI_where_am_i(bprogname, argv[0]);
+	BLI_where_am_i(bprogname, sizeof(bprogname), argv[0]);
 	
 #ifdef BUILD_DATE	
 	strip_quotes(build_date);
@@ -1212,7 +1212,7 @@ int main(int argc, char **argv)
 		WM_init(C, argc, argv);
 
 		/* this is properly initialized with user defs, but this is default */
-		BLI_where_is_temp( btempdir, 1 ); /* call after loading the startup.blend so we can read U.tempdir */
+		BLI_where_is_temp(btempdir, FILE_MAX, 1); /* call after loading the startup.blend so we can read U.tempdir */
 
 #ifndef DISABLE_SDL
 	BLI_setenv("SDL_VIDEODRIVER", "dummy");
@@ -1223,7 +1223,7 @@ int main(int argc, char **argv)
 
 		WM_init(C, argc, argv);
 
-		BLI_where_is_temp( btempdir, 0 ); /* call after loading the startup.blend so we can read U.tempdir */
+		BLI_where_is_temp(btempdir, FILE_MAX, 0); /* call after loading the startup.blend so we can read U.tempdir */
 	}
 #ifdef WITH_PYTHON
 	/**