diff --git a/engine/client/cd_linux.c b/engine/client/cd_linux.c
index 65e7e02c..3f74d1a3 100644
--- a/engine/client/cd_linux.c
+++ b/engine/client/cd_linux.c
@@ -337,9 +337,9 @@ void BGMVolume_Callback(struct cvar_s *var, char *oldvalue)
 
 	cdvolume = atof(oldvalue);
 
-	if (cdvolume && !var->value)
+	if (cdvolume && !var->ival)
 		CDAudio_Pause ();
-	else if (!cdvolume && var->value)
+	else if (!cdvolume && var->ival)
 		CDAudio_Resume ();
 }
 
diff --git a/engine/client/cd_sdl.c b/engine/client/cd_sdl.c
index 6ab3b736..fd35edc8 100644
--- a/engine/client/cd_sdl.c
+++ b/engine/client/cd_sdl.c
@@ -313,9 +313,9 @@ void BGMVolume_Callback(struct cvar_s *var, char *oldvalue)
 
 	cdvolume = atof(oldvalue);
 
-	if (cdvolume && !var->value)
+	if (cdvolume && !var->ival)
 		CDAudio_Pause ();
-	else if (!cdvolume && var->value)
+	else if (!cdvolume && var->ival)
 		CDAudio_Resume ();
 }
 
diff --git a/engine/client/cd_win.c b/engine/client/cd_win.c
index 87d2aab7..9f8f3024 100644
--- a/engine/client/cd_win.c
+++ b/engine/client/cd_win.c
@@ -441,9 +441,9 @@ void BGMVolume_Callback(struct cvar_s *var, char *oldvalue)
 
 	cdvolume = atof(oldvalue);
 
-	if (cdvolume && !var->value)
+	if (cdvolume && !var->ival)
 		CDAudio_Pause ();
-	else if (!cdvolume && var->value)
+	else if (!cdvolume && var->ival)
 		CDAudio_Resume ();
 }
 
diff --git a/engine/client/cl_demo.c b/engine/client/cl_demo.c
index 1bde7fb2..27e07f81 100644
--- a/engine/client/cl_demo.c
+++ b/engine/client/cl_demo.c
@@ -1355,7 +1355,7 @@ void CL_ReRecord_f (void)
 		return;
 	}
 
-	sprintf (name, "%s", s);
+	Q_snprintfz (name, sizeof(name), "%s", s);
 
 //
 // open the demo file
diff --git a/engine/client/cl_main.c b/engine/client/cl_main.c
index 3e46b017..69e89ccc 100644
--- a/engine/client/cl_main.c
+++ b/engine/client/cl_main.c
@@ -305,7 +305,7 @@ void CL_ConnectToDarkPlaces(char *challenge, netadr_t adr)
 
 	connect_time = realtime;	// for retransmit requests
 
-	sprintf(data, "%c%c%c%cconnect\\protocol\\darkplaces 3\\challenge\\%s", 255, 255, 255, 255, challenge);
+	Q_snprintfz(data, sizeof(data), "%c%c%c%cconnect\\protocol\\darkplaces 3\\challenge\\%s", 255, 255, 255, 255, challenge);
 
 	NET_SendPacket (NS_CLIENT, strlen(data), data, adr);
 
@@ -523,7 +523,7 @@ void CL_SendConnectPacket (
 	}
 #endif
 
-	sprintf(data, "%c%c%c%cconnect", 255, 255, 255, 255);
+	Q_snprintfz(data, sizeof(data), "%c%c%c%cconnect", 255, 255, 255, 255);
 
 	if (clients>1)	//splitscreen 'connect' command specifies the number of userinfos sent.
 		Q_strncatz(data, va("%i", clients), sizeof(data));
@@ -749,7 +749,7 @@ void CL_CheckForResend (void)
 	else
 #endif
 	{
-		sprintf (data, "%c%c%c%cgetchallenge\n", 255, 255, 255, 255);
+		Q_snprintfz (data, sizeof(data), "%c%c%c%cgetchallenge\n", 255, 255, 255, 255);
 		NET_SendPacket (NS_CLIENT, strlen(data), data, adr);
 	}
 
@@ -1382,7 +1382,7 @@ void CL_Color_f (void)
 	if (bottom > 13)
 		bottom = 13;
 
-	sprintf (num, "%i", top);
+	Q_snprintfz (num, sizeof(num), "%i", top);
 	if (top == 0)
 		*num = '\0';
 	if (Cmd_ExecLevel>RESTRICT_SERVER) //colour command came from server for a split client
@@ -1391,7 +1391,7 @@ void CL_Color_f (void)
 //		Cvar_LockFromServer(&topcolor, num);
 	else
 		Cvar_Set (&topcolor, num);
-	sprintf (num, "%i", bottom);
+	Q_snprintfz (num, sizeof(num), "%i", bottom);
 	if (bottom == 0)
 		*num = '\0';
 	if (Cmd_ExecLevel>RESTRICT_SERVER) //colour command came from server for a split client
@@ -1892,9 +1892,9 @@ void CL_NextDemo (void)
 	}
 
 	if (!strcmp(cls.demos[cls.demonum], "quit"))
-		sprintf (str,"quit\n");
+		Q_snprintfz (str, sizeof(str), "quit\n");
 	else
-		sprintf (str,"playdemo %s\n", cls.demos[cls.demonum]);
+		Q_snprintfz (str, sizeof(str), "playdemo %s\n", cls.demos[cls.demonum]);
 	Cbuf_InsertText (str, RESTRICT_LOCAL, false);
 	cls.demonum++;
 }
@@ -2099,7 +2099,7 @@ void CL_ConnectionlessPacket (void)
 		//firstly it needs an auth message, so it can't be spoofed.
 		//secondly, it needs a copy of the realip ident, so you can't report a different player's client (you would need access to their ip).
 		data[5] = ' ';
-		sprintf(data+6, "%i %i", atoi(MSG_ReadString()), cls.realip_ident);
+		Q_snprintfz(data+6, sizeof(data)-6, "%i %i", atoi(MSG_ReadString()), cls.realip_ident);
 		len = strlen(data);
 
 		NET_SendPacket (NS_CLIENT, len, &data, net_from);
diff --git a/engine/client/cl_parse.c b/engine/client/cl_parse.c
index 3c579e50..36dc1a5a 100644
--- a/engine/client/cl_parse.c
+++ b/engine/client/cl_parse.c
@@ -840,7 +840,7 @@ void Model_CheckDownloads (void)
 			char picname[256];
 			if (!*cl.image_name[i])
 				continue;
-			sprintf(picname, "pics/%s.pcx", cl.image_name[i]);
+			Q_snprintfz(picname, sizeof(picname), "pics/%s.pcx", cl.image_name[i]);
 			CL_CheckOrEnqueDownloadFile(picname, picname, 0);
 		}
 		if (!CLQ2_RegisterTEntModels())
@@ -1704,13 +1704,13 @@ void CL_ParseDownload (void)
 	{
 		if (strncmp(cls.downloadtempname,"skins/",6))
 		{
-			sprintf (name, "%s", cls.downloadtempname);
+			Q_snprintfz(name, sizeof(name), "%s", cls.downloadtempname);
 			FS_CreatePath (name, FS_GAME);
 			cls.downloadqw = FS_OpenVFS (name, "wb", FS_GAME);
 		}
 		else
 		{
-			sprintf (name, "%s", cls.downloadtempname+6);
+			Q_snprintfz(name, sizeof(name)-6, "%s", cls.downloadtempname+6);
 			FS_CreatePath (name, FS_SKINS);
 			cls.downloadqw = FS_OpenVFS (name, "wb", FS_SKINS);
 		}
diff --git a/engine/client/cl_screen.c b/engine/client/cl_screen.c
index dedd6deb..50b484a7 100644
--- a/engine/client/cl_screen.c
+++ b/engine/client/cl_screen.c
@@ -1883,7 +1883,7 @@ void SCR_ScreenShot_f (void)
 	//
 	// find a file name to save it to
 	//
-		sprintf(pcxname,"screenshots/fte00000.%s", scr_sshot_type.string);
+		Q_snprintfz(pcxname, sizeof(pcxname), "screenshots/fte00000.%s", scr_sshot_type.string);
 
 		for (i=0 ; i<=100000 ; i++)
 		{
diff --git a/engine/client/clq3_parse.c b/engine/client/clq3_parse.c
index 2f3d1573..967a0104 100644
--- a/engine/client/clq3_parse.c
+++ b/engine/client/clq3_parse.c
@@ -853,7 +853,7 @@ void VARGS CLQ3_SendClientCommand(const char *fmt, ...)
 	char	command[MAX_STRING_CHARS];
 
 	va_start( argptr, fmt );
-	vsprintf( command, fmt, argptr );
+	vsnprintf( command, sizeof(command), fmt, argptr );
 	va_end( argptr );
 
 	// create new clientCommand
diff --git a/engine/client/keys.c b/engine/client/keys.c
index 32612931..9569468b 100644
--- a/engine/client/keys.c
+++ b/engine/client/keys.c
@@ -1379,7 +1379,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 				kb = keybindings[k][oldstate];
 				if (kb && kb[0] == '+')
 				{
-					sprintf (cmd, "-%s %i\n", kb+1, k+oldstate*256);
+					Q_snprintfz (cmd, sizeof(cmd), "-%s %i\n", kb+1, k+oldstate*256);
 					Cbuf_AddText (cmd, bindcmdlevel[k][oldstate]);
 				}
 				if (keyshift[k] != k)
@@ -1387,7 +1387,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 					kb = keybindings[keyshift[k]][oldstate];
 					if (kb && kb[0] == '+')
 					{
-						sprintf (cmd, "-%s %i\n", kb+1, k+oldstate*256);
+						Q_snprintfz (cmd, sizeof(cmd), "-%s %i\n", kb+1, k+oldstate*256);
 						Cbuf_AddText (cmd, bindcmdlevel[k][oldstate]);
 					}
 				}
@@ -1403,7 +1403,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 				{
 					if (kb[0] == '+')
 					{	// button commands add keynum as a parm
-						sprintf (cmd, "%s %i\n", kb, k+keystate*256);
+						Q_snprintfz (cmd, sizeof(cmd), "%s %i\n", kb, k+keystate*256);
 						Cbuf_AddText (cmd, bindcmdlevel[k][keystate]);
 					}
 					else
@@ -1560,7 +1560,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 		{
 			if (kb && kb[0] == '+')
 			{
-				sprintf (cmd, "-p%i %s %i\n", pnum+1, kb+1, key+oldstate*256);
+				Q_snprintfz (cmd, sizeof(cmd), "-p%i %s %i\n", pnum+1, kb+1, key+oldstate*256);
 				Cbuf_AddText (cmd, bindcmdlevel[key][keystate]);
 			}
 			if (keyshift[key] != key)
@@ -1568,7 +1568,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 				kb = keybindings[keyshift[key]][keystate];
 				if (kb && kb[0] == '+')
 				{
-					sprintf (cmd, "-p%i %s %i\n", pnum+1, kb+1, key+oldstate*256);
+					Q_snprintfz (cmd, sizeof(cmd), "-p%i %s %i\n", pnum+1, kb+1, key+oldstate*256);
 					Cbuf_AddText (cmd, bindcmdlevel[key][keystate]);
 				}
 			}
@@ -1577,7 +1577,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 		{
 			if (kb && kb[0] == '+')
 			{
-				sprintf (cmd, "-%s %i\n", kb+1, key+oldstate*256);
+				Q_snprintfz (cmd, sizeof(cmd), "-%s %i\n", kb+1, key+oldstate*256);
 				Cbuf_AddText (cmd, bindcmdlevel[key][keystate]);
 			}
 			if (keyshift[key] != key)
@@ -1585,7 +1585,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 				kb = keybindings[keyshift[key]][keystate];
 				if (kb && kb[0] == '+')
 				{
-					sprintf (cmd, "-%s %i\n", kb+1, key+oldstate*256);
+					Q_snprintfz (cmd, sizeof(cmd), "-%s %i\n", kb+1, key+oldstate*256);
 					Cbuf_AddText (cmd, bindcmdlevel[key][keystate]);
 				}
 			}
@@ -1630,12 +1630,12 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 			{
 				if (kb[0] == '+')
 				{	// button commands add keynum as a parm
-					sprintf (cmd, "+p%i %s %i\n", pnum+1, kb+1, key+oldstate*256);
+					Q_snprintfz (cmd, sizeof(cmd), "+p%i %s %i\n", pnum+1, kb+1, key+oldstate*256);
 					Cbuf_AddText (cmd, bindcmdlevel[key][keystate]);
 				}
 				else
 				{
-					sprintf (cmd, "p%i %s\n", pnum+1, kb);
+					Q_snprintfz (cmd, sizeof(cmd), "p%i %s\n", pnum+1, kb);
 					Cbuf_AddText (cmd, bindcmdlevel[key][keystate]);
 				}
 			}
@@ -1646,7 +1646,7 @@ void Key_Event (int pnum, int key, unsigned int unicode, qboolean down)
 			{
 				if (kb[0] == '+')
 				{	// button commands add keynum as a parm
-					sprintf (cmd, "%s %i\n", kb, key+oldstate*256);
+					Q_snprintfz (cmd, sizeof(cmd), "%s %i\n", kb, key+oldstate*256);
 					Cbuf_AddText (cmd, bindcmdlevel[key][keystate]);
 				}
 				else
diff --git a/engine/client/m_mp3.c b/engine/client/m_mp3.c
index ff0656c1..e688b8f6 100644
--- a/engine/client/m_mp3.c
+++ b/engine/client/m_mp3.c
@@ -1230,11 +1230,11 @@ cin_t *Media_Static_TryLoad(char *name)
 		char fullname[MAX_QPATH];
 		qbyte *file;
 
-		sprintf(fullname, "%s", name);
+		Q_snprintfz(fullname, sizeof(fullname), "%s", name);
 		fsize = FS_LoadFile(fullname, (void **)&file);
 		if (!file)
 		{
-			sprintf(fullname, "pics/%s", name);
+			Q_snprintfz(fullname, sizeof(fullname), "pics/%s", name);
 			fsize = FS_LoadFile(fullname, (void **)&file);
 			if (!file)
 				return NULL;
@@ -1995,7 +1995,7 @@ void Media_RecordFrame (void)
 	case CT_SCREENSHOT:
 		{
 			char filename[MAX_OSPATH];
-			sprintf(filename, "%s/%8.8i.%s", capturefilenameprefix, captureframe++, capturecodec.string);
+			Q_snprintfz(filename, sizeof(filename), "%s/%8.8i.%s", capturefilenameprefix, captureframe++, capturecodec.string);
 			SCR_ScreenShot(filename);
 		}
 		break;
@@ -2244,7 +2244,7 @@ void Media_RecordFilm_f (void)
 				sbits = 16;
 			if (chans > 6)
 				chans = 6;
-			sprintf(filename, "%s/audio_%ichan_%ikhz_%ib.raw", capturefilenameprefix, chans, snd_speed/1000, sbits);
+			Q_snprintfz(filename, sizeof(filename), "%s/audio_%ichan_%ikhz_%ib.raw", capturefilenameprefix, chans, snd_speed/1000, sbits);
 			captureaudiorawfile = FS_OpenVFS(filename, "wb", FS_GAMEONLY);
 
 			if (captureaudiorawfile)
diff --git a/engine/client/m_script.c b/engine/client/m_script.c
index 095292e6..740fe927 100644
--- a/engine/client/m_script.c
+++ b/engine/client/m_script.c
@@ -275,7 +275,7 @@ void M_MenuS_Comboi_f (void)
 	for (opt = 0; opt < sizeof(opts)/sizeof(opts[0])-2 && *(line=Cmd_Argv(5+opt)); opt++)
 	{
 		opts[opt] = line;
-		sprintf(valuesb[opt], "%i", opt);
+		Q_snprintfz(valuesb[opt], sizeof(valuesb[opt]), "%i", opt);
 		values[opt] = valuesb[opt];
 	}
 	opts[opt] = NULL;
diff --git a/engine/client/m_single.c b/engine/client/m_single.c
index c568e0a6..2d65511d 100644
--- a/engine/client/m_single.c
+++ b/engine/client/m_single.c
@@ -666,10 +666,10 @@ static void ShowDemoMenu (menu_t *menu, char *path)
 	M_Demo_Flush(menu->data);
 	if (*path)
 	{
-		sprintf(match, "%s../", path);
+		Q_snprintfz(match, sizeof(match), "%s../", path);
 		DemoAddItem(match, 0, menu->data);
 	}
-	sprintf(match, "%s*", path);
+	Q_snprintfz(match, sizeof(match), "%s*", path);
 
 	COM_EnumerateFiles(match, DemoAddItem, menu->data);
 	M_Demo_Flatten(menu->data);
diff --git a/engine/client/net_master.c b/engine/client/net_master.c
index 6bacea42..8f340a30 100644
--- a/engine/client/net_master.c
+++ b/engine/client/net_master.c
@@ -1437,9 +1437,9 @@ void Master_QueryServer(serverinfo_t *server)
 	server->sends--;
 	server->refreshtime = Sys_DoubleTime();
 	if (server->special & SS_QUAKE3)
-		sprintf(data, "%c%c%c%cgetstatus", 255, 255, 255, 255);
+		Q_snprintfz(data, sizeof(data), "%c%c%c%cgetstatus", 255, 255, 255, 255);
 	else if (server->special & SS_DARKPLACES)
-		sprintf(data, "%c%c%c%cgetinfo", 255, 255, 255, 255);
+		Q_snprintfz(data, sizeof(data), "%c%c%c%cgetinfo", 255, 255, 255, 255);
 	else if (server->special & SS_NETQUAKE)
 	{
 #ifdef NQPROT
@@ -1457,7 +1457,7 @@ void Master_QueryServer(serverinfo_t *server)
 		return;
 	}
 	else
-		sprintf(data, "%c%c%c%cstatus", 255, 255, 255, 255);
+		Q_snprintfz(data, sizeof(data), "%c%c%c%cstatus", 255, 255, 255, 255);
 	NET_SendPollPacket (strlen(data), data, server->adr);
 }
 //send a packet to each server in sequence.
diff --git a/engine/client/sbar.c b/engine/client/sbar.c
index 370febc4..f7faf9a6 100644
--- a/engine/client/sbar.c
+++ b/engine/client/sbar.c
@@ -2471,7 +2471,7 @@ void Sbar_Draw (void)
 
 					if (hud_tracking_show.ival)
 					{
-						sprintf(st, "Tracking %-.64s",
+						Q_snprintfz(st, sizeof(st), "Tracking %-.64s",
 							cl.players[spec_track[pnum]].name);
 						Sbar_DrawString(0, -8, st);
 					}
diff --git a/engine/client/skin.c b/engine/client/skin.c
index 4604ea3a..f1d70d6d 100644
--- a/engine/client/skin.c
+++ b/engine/client/skin.c
@@ -267,10 +267,10 @@ qbyte	*Skin_Cache8 (skin_t *skin)
 
 #ifdef Q2CLIENT
 	if (cls.protocol == CP_QUAKE2)
-		sprintf (name, "players/%s.pcx", skin->name);
+		Q_snprintfz (name, sizeof(name), "players/%s.pcx", skin->name);
 	else
 #endif
-		sprintf (name, "skins/%s.pcx", skin->name);
+		Q_snprintfz (name, sizeof(name), "skins/%s.pcx", skin->name);
 	raw = COM_LoadTempFile (name);
 	if (!raw)
 	{
@@ -282,9 +282,9 @@ qbyte	*Skin_Cache8 (skin_t *skin)
 				skin->tex_base = R_LoadReplacementTexture(skin->name, "skins", IF_NOALPHA);
 				if (TEXVALID(skin->tex_base))
 				{
-					sprintf (name, "%s_shirt", skin->name);
+					Q_snprintfz (name, sizeof(name), "%s_shirt", skin->name);
 					skin->tex_upper = R_LoadReplacementTexture(name, "skins", 0);
-					sprintf (name, "%s_pants", skin->name);
+					Q_snprintfz (name, sizeof(name), "%s_pants", skin->name);
 					skin->tex_lower = R_LoadReplacementTexture(name, "skins", 0);
 
 					skin->failedload = true;
@@ -294,7 +294,7 @@ qbyte	*Skin_Cache8 (skin_t *skin)
 #endif
 			//if its not already the base skin, try the base (and warn if anything not base couldn't load).
 			Con_Printf ("Couldn't load skin %s\n", name);
-			sprintf (name, "skins/%s.pcx", baseskin.string);
+			Q_snprintfz (name, sizeof(name), "skins/%s.pcx", baseskin.string);
 			raw = COM_LoadTempFile (name);
 		}
 		if (!raw)
@@ -437,7 +437,7 @@ qbyte	*Skin_Cache32 (skin_t *skin)
 //
 // load the pic from disk
 //
-	sprintf (name, "%s%s.tga", path, skin->name);
+	Q_snprintfz (name, sizeof(name), "%s%s.tga", path, skin->name);
 	raw = COM_LoadTempFile (name);
 	if (raw)
 	{
@@ -450,7 +450,7 @@ qbyte	*Skin_Cache32 (skin_t *skin)
 			return out;
 		}
 	}
-	sprintf (name, "%s%s.pcx", path, skin->name);
+	Q_snprintfz (name, sizeof(name), "%s%s.pcx", path, skin->name);
 	raw = COM_LoadTempFile (name);
 	if (raw)
 	{
@@ -464,7 +464,7 @@ qbyte	*Skin_Cache32 (skin_t *skin)
 		}
 	}
 #ifdef AVAIL_PNGLIB
-	sprintf (name, "%s%s.png", path, skin->name);
+	Q_snprintfz (name, sizeof(name), "%s%s.png", path, skin->name);
 	raw = COM_LoadTempFile (name);
 	if (raw)
 	{
@@ -479,7 +479,7 @@ qbyte	*Skin_Cache32 (skin_t *skin)
 	}
 #endif
 #ifdef AVAIL_JPEGLIB
-	sprintf (name, "%s%s.jpeg", path, skin->name);
+	Q_snprintfz (name, sizeof(name), "%s%s.jpeg", path, skin->name);
 	raw = COM_LoadTempFile (name);
 	if (raw)
 	{
@@ -492,7 +492,7 @@ qbyte	*Skin_Cache32 (skin_t *skin)
 			return out;
 		}
 	}
-	sprintf (name, "%s%s.jpg", path, skin->name);	//jpegs are gready with 2 extensions...
+	Q_snprintfz (name, sizeof(name), "%s%s.jpg", path, skin->name);	//jpegs are gready with 2 extensions...
 	raw = COM_LoadTempFile (name);
 	if (raw)
 	{
diff --git a/engine/client/snd_mem.c b/engine/client/snd_mem.c
index 118cd921..b2a50f11 100644
--- a/engine/client/snd_mem.c
+++ b/engine/client/snd_mem.c
@@ -791,7 +791,7 @@ sfxcache_t *S_LoadSound (sfx_t *s)
 		FILE *f;
 #ifndef _WIN32	//convert from windows to a suitable alternative.
 		char unixname[128];
-		sprintf(unixname, "/mnt/%c/%s", name[0]-'A'+'a', name+3);
+		snprintf(unixname, sizeof(unixname), "/mnt/%c/%s", name[0]-'A'+'a', name+3);
 		name = unixname;
 		while (*name)
 		{
diff --git a/engine/client/snd_mp3.c b/engine/client/snd_mp3.c
index 87fd121d..088938bd 100644
--- a/engine/client/snd_mp3.c
+++ b/engine/client/snd_mp3.c
@@ -109,7 +109,7 @@ sfxcache_t *S_LoadMP3Sound (sfx_t *s)
 	if (name[0] == '#')
 		strcpy(namebuffer, &name[1]);
 	else
-		sprintf (namebuffer, "sound/%s", name);
+		Q_snprintfz (namebuffer, sizeof(namebuffer), "sound/%s", name);
 
 	len = strlen(namebuffer);
 	telluser = strcmp(namebuffer+len-4, ".wav");
@@ -128,7 +128,7 @@ sfxcache_t *S_LoadMP3Sound (sfx_t *s)
 		char unixname[128];
 		if (name[1] == ':' && name[2] == '\\')	//convert from windows to a suitable alternative.
 		{			
-			sprintf(unixname, "/mnt/%c/%s", name[0]-'A'+'a', name+3);
+			snprintf(unixname, sizeof(unixname), "/mnt/%c/%s", name[0]-'A'+'a', name+3);
 			name = unixname;
 			while (*name)
 			{
diff --git a/engine/client/textedit.c b/engine/client/textedit.c
index 4bfc4c01..2f3e7d3f 100644
--- a/engine/client/textedit.c
+++ b/engine/client/textedit.c
@@ -266,7 +266,7 @@ static void EditorOpenFile(char *name)
 
 	if (!(F = FS_OpenVFS(OpenEditorFile, "rb", FS_GAME)))
 	{
-		sprintf(OpenEditorFile, "src/%s", name);
+		Q_snprintfz(OpenEditorFile, sizeof(OpenEditorFile), "src/%s", name);
 		if (!(F = FS_OpenVFS(OpenEditorFile, "rb", FS_GAME)))
 		{
 			Con_Printf("Couldn't open file \"%s\"\nA new file will be created\n", name);
diff --git a/engine/client/zqtp.c b/engine/client/zqtp.c
index d6d0c904..31e69ded 100644
--- a/engine/client/zqtp.c
+++ b/engine/client/zqtp.c
@@ -497,7 +497,7 @@ static char *Macro_BestAmmo (void)
 static char *Macro_BestWeaponAndAmmo (void)
 {
 	char buf[MAX_MACRO_VALUE];
-	sprintf (buf, "%s:%s", Macro_BestWeapon(), Macro_BestAmmo());
+	Q_snprintfz (buf, sizeof(buf), "%s:%s", Macro_BestWeapon(), Macro_BestAmmo());
 	strcpy (macro_buf, buf);
 	return macro_buf;
 }
@@ -1217,17 +1217,17 @@ static char *TP_ParseMacroString (char *s)
 				if (!macro_string[0])
 					macro_string = "a";
 				if (cl.stats[SP][STAT_ARMOR] < 30)
-					sprintf (mbuf, "\x10%s:%i\x11", macro_string, cl.stats[SP][STAT_ARMOR]);
+					Q_snprintfz (mbuf, sizeof(mbuf), "\x10%s:%i\x11", macro_string, cl.stats[SP][STAT_ARMOR]);
 				else
-					sprintf (mbuf, "%s:%i", macro_string, cl.stats[SP][STAT_ARMOR]);
+					Q_snprintfz (mbuf, sizeof(mbuf), "%s:%i", macro_string, cl.stats[SP][STAT_ARMOR]);
 				macro_string = mbuf;
 				break;
 
 			case 'h':
 				if (cl.stats[SP][STAT_HEALTH] >= 50)
-					sprintf (macro_buf, "%i", cl.stats[SP][STAT_HEALTH]);
+					Q_snprintfz (macro_buf, sizeof(macro_buf), "%i", cl.stats[SP][STAT_HEALTH]);
 				else
-					sprintf (macro_buf, "\x10%i\x11", cl.stats[SP][STAT_HEALTH]);
+					Q_snprintfz (macro_buf, sizeof(macro_buf), "\x10%i\x11", cl.stats[SP][STAT_HEALTH]);
 				macro_string = macro_buf;
 				break;
 
@@ -1235,7 +1235,7 @@ static char *TP_ParseMacroString (char *s)
 			case 'P':
 				macro_string = Macro_Powerups();
 				if (macro_string[0])
-					sprintf (mbuf, "\x10%s\x11", macro_string);
+					Q_snprintfz (mbuf, sizeof(mbuf), "\x10%s\x11", macro_string);
 				else
 					mbuf[0] = 0;
 				macro_string = mbuf;
diff --git a/engine/common/com_mesh.c b/engine/common/com_mesh.c
index 778e6fd1..9d74e762 100644
--- a/engine/common/com_mesh.c
+++ b/engine/common/com_mesh.c
@@ -2205,7 +2205,7 @@ static void *Q1_LoadSkins_GL (daliasskintype_t *pskintype, unsigned int skintran
 
 
 
-			sprintf(skinname, "%s_%i", loadname, i);
+			Q_snprintfz(skinname, sizeof(skinname), "%s_%i", loadname, i);
 			if (skintranstype == 4)
 				texnums->shader = R_RegisterShader(skinname,
 					"{\n"
@@ -2284,24 +2284,24 @@ static void *Q1_LoadSkins_GL (daliasskintype_t *pskintype, unsigned int skintran
 				//LH naming scheme
 				if (!TEXVALID(texture))
 				{
-					sprintf(skinname, "%s_%i_%i", loadmodel->name, i, t);
+					Q_snprintfz(skinname, sizeof(skinname), "%s_%i_%i", loadmodel->name, i, t);
 					texture = R_LoadReplacementTexture(skinname, "models", IF_NOALPHA);
 				}
 				if (!TEXVALID(fbtexture) && r_fb_models.ival)
 				{
-					sprintf(skinname, "%s_%i_%i_luma", loadmodel->name, i, t);
+					Q_snprintfz(skinname, sizeof(skinname), "%s_%i_%i_luma", loadmodel->name, i, t);
 					fbtexture = R_LoadReplacementTexture(skinname, "models", 0);
 				}
 
 				//Fuhquake naming scheme
 				if (!TEXVALID(texture))
 				{
-					sprintf(skinname, "%s_%i_%i", loadname, i, t);
+					Q_snprintfz(skinname, sizeof(skinname), "%s_%i_%i", loadname, i, t);
 					texture = R_LoadReplacementTexture(skinname, "models", IF_NOALPHA);
 				}
 				if (!TEXVALID(fbtexture) && r_fb_models.ival)
 				{
-					sprintf(skinname, "%s_%i_%i_luma", loadname, i, t);
+					Q_snprintfz(skinname, sizeof(skinname), "%s_%i_%i_luma", loadname, i, t);
 					fbtexture = R_LoadReplacementTexture(skinname, "models", 0);
 				}
 
@@ -2318,14 +2318,14 @@ static void *Q1_LoadSkins_GL (daliasskintype_t *pskintype, unsigned int skintran
 					Mod_FloodFillSkin(saved, outskin->skinwidth, outskin->skinheight);
 					if (!TEXVALID(texture))
 					{
-						sprintf(skinname, "%s_%i_%i", loadname, i, t);
+						Q_snprintfz(skinname, sizeof(skinname), "%s_%i_%i", loadname, i, t);
 						texture = R_LoadTexture8(skinname, outskin->skinwidth, outskin->skinheight, saved, (skintranstype?0:IF_NOALPHA)|IF_NOGAMMA, skintranstype);
 					}
 
 
 					if (!TEXVALID(fbtexture) && r_fb_models.value)
 					{
-						sprintf(skinname, "%s_%i_%i_luma", loadname, i, t);
+						Q_snprintfz(skinname, sizeof(skinname), "%s_%i_%i_luma", loadname, i, t);
 						fbtexture = R_LoadTextureFB(skinname, outskin->skinwidth, outskin->skinheight, saved, IF_NOGAMMA);
 					}
 
@@ -2333,7 +2333,7 @@ static void *Q1_LoadSkins_GL (daliasskintype_t *pskintype, unsigned int skintran
 						BZ_Free(saved);
 				}
 
-				sprintf(skinname, "%s_%i_%i", loadname, i, t);
+				Q_snprintfz(skinname, sizeof(skinname), "%s_%i_%i", loadname, i, t);
 				texnums->shader = R_RegisterSkin(skinname);
 
 				texnums->base = texture;
diff --git a/engine/common/fs.c b/engine/common/fs.c
index 3e6c4d79..c1f388a2 100644
--- a/engine/common/fs.c
+++ b/engine/common/fs.c
@@ -1252,7 +1252,7 @@ static int FS_AddWildDataFiles (const char *descriptor, int size, void *vparam)
 	char			purefile[MAX_OSPATH];
 	flocation_t loc;
 
-	sprintf (pakfile, "%s%s", param->parentdesc, descriptor);
+	Q_snprintfz (pakfile, sizeof(pakfile), "%s%s", param->parentdesc, descriptor);
 
 	for (search = com_searchpaths; search; search = search->next)
 	{
@@ -1271,7 +1271,7 @@ static int FS_AddWildDataFiles (const char *descriptor, int size, void *vparam)
 	if (!pak)
 		return true;
 
-	sprintf (pakfile, "%s%s/", param->parentdesc, descriptor);
+	Q_snprintfz (pakfile, sizeof(pakfile), "%s%s/", param->parentdesc, descriptor);
 	if (*param->puredesc)
 		snprintf (purefile, sizeof(purefile), "%s/%s", param->puredesc, descriptor);
 	else
@@ -1312,7 +1312,7 @@ static void FS_AddDataFiles(const char *purepath, const char *pathto, searchpath
 	}
 
 	//now load the random ones
-	sprintf (pakfile, "*.%s", extension);
+	Q_snprintfz (pakfile, sizeof(pakfile), "*.%s", extension);
 	wp.funcs = funcs;
 	wp.parentdesc = pathto;
 	wp.parentpath = search;
diff --git a/engine/common/fs_stdio.c b/engine/common/fs_stdio.c
index d865bb65..6dd1cde9 100644
--- a/engine/common/fs_stdio.c
+++ b/engine/common/fs_stdio.c
@@ -151,7 +151,7 @@ static int FSSTDIO_RebuildFSHash(const char *filename, int filesize, void *data)
 	{	//this is actually a directory
 
 		char childpath[256];
-		sprintf(childpath, "%s*", filename);
+		Q_snprintfz(childpath, sizeof(childpath), "%s*", filename);
 		Sys_EnumerateFiles((char*)data, childpath, FSSTDIO_RebuildFSHash, data);
 		return true;
 	}
diff --git a/engine/common/fs_win32.c b/engine/common/fs_win32.c
index 9de9665b..9624bdae 100644
--- a/engine/common/fs_win32.c
+++ b/engine/common/fs_win32.c
@@ -191,7 +191,7 @@ static int VFSW32_RebuildFSHash(const char *filename, int filesize, void *data)
 	{	//this is actually a directory
 
 		char childpath[256];
-		sprintf(childpath, "%s*", filename);
+		Q_snprintfz(childpath, sizeof(childpath), "%s*", filename);
 		Sys_EnumerateFiles((char*)data, childpath, VFSW32_RebuildFSHash, data);
 		return true;
 	}
diff --git a/engine/common/pr_bgcmd.c b/engine/common/pr_bgcmd.c
index 2ac0619a..3f2abc11 100644
--- a/engine/common/pr_bgcmd.c
+++ b/engine/common/pr_bgcmd.c
@@ -161,7 +161,7 @@ void VARGS PR_BIError(progfuncs_t *progfuncs, char *format, ...)
 pbool QC_WriteFile(const char *name, void *data, int len)
 {
 	char buffer[256];
-	sprintf(buffer, "%s", name);
+	Q_snprintfz(buffer, sizeof(buffer), "%s", name);
 	COM_WriteFile(buffer, data, len);
 	return true;
 }
diff --git a/engine/common/qvm.c b/engine/common/qvm.c
index d3ebc9e0..d8145663 100644
--- a/engine/common/qvm.c
+++ b/engine/common/qvm.c
@@ -339,7 +339,7 @@ qvm_t *QVM_LoadVM(const char *name, sys_callqvm_t syscall)
 	int n;
 	unsigned int i;
 
-	sprintf(path, "%s.qvm", name);
+	Q_snprintfz(path, sizeof(path), "%s.qvm", name);
 	FS_LoadFile(path, (void **)&raw);
 // file not found
 	if(!raw) return NULL;
diff --git a/engine/gl/gl_draw.c b/engine/gl/gl_draw.c
index 98567d81..14c0cb2e 100644
--- a/engine/gl/gl_draw.c
+++ b/engine/gl/gl_draw.c
@@ -1063,7 +1063,7 @@ void GL_Upload32_Int (char *name, unsigned *data, int width, int height, unsigne
 		qglGetTexLevelParameteriv(GL_TEXTURE_2D, 0, GL_TEXTURE_COMPRESSED_ARB, &compressed);
 		if (compressed == GL_TRUE && !strstr(name, ".."))	//is there any point in bothering with the whole endian thing?
 		{
-			sprintf(outname, "tex/%s.tex", name);
+			Q_snprintfz(outname, sizeof(outname), "tex/%s.tex", name);
 			FS_CreatePath(outname, FS_GAME);
 			out = FS_OpenVFS(outname, "wb", FS_GAME);
 			if (out)
diff --git a/engine/server/savegame.c b/engine/server/savegame.c
index 1265b913..11af2289 100644
--- a/engine/server/savegame.c
+++ b/engine/server/savegame.c
@@ -543,9 +543,9 @@ qboolean SV_LoadLevelCache(char *savename, char *level, char *startspot, qboolea
 	gametype = cache->gametype;
 
 	if (savename)
-		sprintf (name, "saves/%s/%s", savename, level);
+		Q_snprintfz (name, sizeof(name), "saves/%s/%s", savename, level);
 	else
-		sprintf (name, "saves/%s", level);
+		Q_snprintfz (name, sizeof(name), "saves/%s", level);
 	COM_DefaultExtension (name, ".lvc", sizeof(name));
 
 //	Con_TPrintf (STL_LOADGAMEFROM, name);
@@ -783,9 +783,9 @@ void SV_SaveLevelCache(char *savedir, qboolean dontharmgame)
 
 
 	if (savedir)
-		sprintf (name, "saves/%s/%s", savedir, cache->mapname);
+		Q_snprintfz (name, sizeof(name), "saves/%s/%s", savedir, cache->mapname);
 	else
-		sprintf (name, "saves/%s", cache->mapname);
+		Q_snprintfz (name, sizeof(name), "saves/%s", cache->mapname);
 	COM_DefaultExtension (name, ".lvc", sizeof(name));
 
 	FS_CreatePath(name, FS_GAMEONLY);
@@ -1040,7 +1040,7 @@ void SV_Loadgame_f (void)
 	if (!*savename || strstr(savename, ".."))
 		strcpy(savename, "quicksav");
 
-	sprintf (filename, "saves/%s/info.fsv", savename);
+	Q_snprintfz (filename, sizeof(filename), "saves/%s/info.fsv", savename);
 	f = FS_OpenVFS (filename, "rb", FS_GAME);
 	if (!f)
 	{
diff --git a/engine/server/sv_ccmds.c b/engine/server/sv_ccmds.c
index ff82f04c..f0472e81 100644
--- a/engine/server/sv_ccmds.c
+++ b/engine/server/sv_ccmds.c
@@ -1945,7 +1945,7 @@ void SV_Snap (int uid)
 	{
 		pcxname[strlen(pcxname) - 6] = i/10 + '0';
 		pcxname[strlen(pcxname) - 5] = i%10 + '0';
-		sprintf (checkname, "%s/snap/%s", gamedirfile, pcxname);
+		Q_snprintfz (checkname, sizeof(checkname), "%s/snap/%s", gamedirfile, pcxname);
 		if (!COM_FCheckExists(checkname))
 			break;	// file doesn't exist
 	}
diff --git a/engine/server/sv_init.c b/engine/server/sv_init.c
index 7bca2941..26e64479 100644
--- a/engine/server/sv_init.c
+++ b/engine/server/sv_init.c
@@ -846,13 +846,13 @@ void SV_SpawnServer (char *server, char *startspot, qboolean noents, qboolean us
 	{
 		char *exts[] = {"maps/%s.bsp", "maps/%s.cm", "maps/%s.hmp", NULL};
 		strcpy (sv.name, server);
-		sprintf (sv.modelname, exts[0], server);
+		Q_snprintfz (sv.modelname, sizeof(sv.modelname), exts[0], server);
 		if (!COM_FCheckExists(sv.modelname))
 		{
 			if (COM_FCheckExists(va(exts[1], server)))
-				sprintf (sv.modelname,exts[1], server);
+				Q_snprintfz (sv.modelname, sizeof(sv.modelname), exts[1], server);
 			else if (COM_FCheckExists(va(exts[2], server)))
-				sprintf (sv.modelname,exts[2], server);
+				Q_snprintfz (sv.modelname, sizeof(sv.modelname), exts[2], server);
 		}
 	}
 	sv.state = ss_loading;
diff --git a/engine/server/sv_sys_unix.c b/engine/server/sv_sys_unix.c
index 40f00db0..246edacb 100644
--- a/engine/server/sv_sys_unix.c
+++ b/engine/server/sv_sys_unix.c
@@ -884,7 +884,7 @@ void *Sys_GetGameAPI(void *parms)
 	searchpath = 0;
 	while((searchpath = COM_NextPath(searchpath)))
 	{
-		sprintf (name, "%s/%s/%s", curpath, searchpath, gamename);
+		snprintf (name, sizeof(name), "%s/%s/%s", curpath, searchpath, gamename);
 		game_library = dlopen (name, RTLD_LAZY );
 		if (game_library)
 		{
diff --git a/engine/server/sv_user.c b/engine/server/sv_user.c
index d71e98b5..c6687d34 100644
--- a/engine/server/sv_user.c
+++ b/engine/server/sv_user.c
@@ -414,7 +414,7 @@ void SVNQ_New_f (void)
 	}
 
 	MSG_WriteByte (&host_client->netchan.message, svc_print);
-	sprintf (message, "%c\n%s server\n", 2, version_string());
+	Q_snprintfz (message, sizeof(message), "%c\n%s server\n", 2, version_string());
 	MSG_WriteString (&host_client->netchan.message,message);
 
 	if (host_client->protocol == SCP_DARKPLACES6 || host_client->protocol == SCP_DARKPLACES7)
@@ -2046,7 +2046,7 @@ void VARGS OutofBandPrintf(netadr_t where, char *fmt, ...)
 	send[3] = 0xff;
 	send[4] = A2C_PRINT;
 	va_start (argptr, fmt);
-	vsprintf (send+5, fmt, argptr);
+	vsnprintf (send+5, sizeof(send)-5, fmt, argptr);
 	va_end (argptr);
 
 	NET_SendPacket (NS_SERVER, strlen(send)+1, send, where);
@@ -2792,12 +2792,12 @@ void SV_SayOne_f (void)
 		if (host_client->spectator)
 		{
 			if (!sv_spectalk.value || to->spectator)
-				sprintf (text, "[SPEC] {%s}:", host_client->name);
+				Q_snprintfz (text, sizeof(text), "[SPEC] {%s}:", host_client->name);
 			else
 				continue;
 		}
 		else
-			sprintf (text, "{%s}:", host_client->name);
+			Q_snprintfz (text, sizeof(text), "{%s}:", host_client->name);
 
 		if (host_client->ismuted)
 		{
@@ -2927,11 +2927,11 @@ void SV_Say (qboolean team)
 	}
 
 	if (host_client->spectator && (!sv_spectalk.value || team))
-		sprintf (text, "[SPEC] %s: ", host_client->name);
+		Q_snprintfz (text, sizeof(text), "[SPEC] %s: ", host_client->name);
 	else if (team)
-		sprintf (text, "(%s): ", host_client->name);
+		Q_snprintfz (text, sizeof(text), "(%s): ", host_client->name);
 	else
-		sprintf (text, "%s: ", host_client->name);
+		Q_snprintfz (text, sizeof(text), "%s: ", host_client->name);
 
 	if (host_client->ismuted)
 	{
diff --git a/engine/server/svq2_game.c b/engine/server/svq2_game.c
index d49ac39e..885d7bc5 100644
--- a/engine/server/svq2_game.c
+++ b/engine/server/svq2_game.c
@@ -61,7 +61,7 @@ static void VARGS PFQ2_dprintf (char *fmt, ...)
 	va_list		argptr;
 	
 	va_start (argptr,fmt);
-	vsprintf (msg, fmt, argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 
 	Con_Printf ("%s", msg);
@@ -98,7 +98,7 @@ static void VARGS PFQ2_cprintf (q2edict_t *ent, int level, char *fmt, ...)
 	}
 
 	va_start (argptr,fmt);
-	vsprintf (msg, fmt, argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 
 	if (ent)
@@ -151,7 +151,7 @@ static void VARGS PFQ2_error (char *fmt, ...)
 	va_list		argptr;
 	
 	va_start (argptr,fmt);
-	vsprintf (msg, fmt, argptr);
+	vsnprintf (msg, sizeof(msg), fmt, argptr);
 	va_end (argptr);
 
 	SV_Error("Game Error: %s", msg);
diff --git a/engine/server/svq3_game.c b/engine/server/svq3_game.c
index a9f1bfa0..1d19c6b0 100644
--- a/engine/server/svq3_game.c
+++ b/engine/server/svq3_game.c
@@ -1476,7 +1476,7 @@ static void VARGS BL_Print(int l, char *fmt, ...)
 	char		text[1024];
 
 	va_start (argptr, fmt);
-	vsprintf (text, fmt, argptr);
+	vsnprintf (text, sizeof(text), fmt, argptr);
 	va_end (argptr);
 
 	Con_Printf("%s", text);