Fixed: all possible malloc, sprintf and strcpy problems

Signed-off-by: Alexander Wenzel <Alexander.AW.Wenzel@bmw.de>

30 files changed, 319 insertions, 244 deletions

diff --git a/include/dlt/dlt_common.h b/include/dlt/dlt_common.h
index be04e68..d03eca8 100755
--- a/include/dlt/dlt_common.h
+++ b/include/dlt/dlt_common.h
@@ -1159,20 +1159,23 @@ extern "C"
     /**
      * Print dlt version and dlt svn version to buffer
      * @param buf Pointer to buffer
+     * @param size size of buffer
      */
-    void dlt_get_version(char *buf);
+    void dlt_get_version(char *buf, size_t size);
 
     /**
     * Print dlt major version to buffer
     * @param buf Pointer to buffer
+    * @param size size of buffer
     */
-    void dlt_get_major_version(char *buf);
+    void dlt_get_major_version(char *buf, size_t size);
 
     /**
     * Print dlt minor version to buffer
     * @param buf Pointer to buffer
+    * @param size size of buffer
     */
-    void dlt_get_minor_version(char *buf);
+    void dlt_get_minor_version(char *buf, size_t size);
 
 #endif
 
diff --git a/src/adaptor/dlt-adaptor-stdin.c b/src/adaptor/dlt-adaptor-stdin.c
index fa3ab72..624ea1c 100755
--- a/src/adaptor/dlt-adaptor-stdin.c
+++ b/src/adaptor/dlt-adaptor-stdin.c
@@ -106,7 +106,7 @@ int main(int argc, char* argv[])
         }
         case 'h':
         {
-            dlt_get_version(version);
+            dlt_get_version(version,255);
 
             printf("Usage: dlt-adaptor-stdin [options]\n");
             printf("Adaptor for forwarding input from stdin to DLT daemon.\n");
diff --git a/src/adaptor/dlt-adaptor-udp.c b/src/adaptor/dlt-adaptor-udp.c
index 719707e..d817269 100755
--- a/src/adaptor/dlt-adaptor-udp.c
+++ b/src/adaptor/dlt-adaptor-udp.c
@@ -121,7 +121,7 @@ int main(int argc, char* argv[])
         }
         case 'h':
         {
-            dlt_get_version(version);
+            dlt_get_version(version,255);
 
             printf("Usage: dlt-adaptor-udp [options]\n");
             printf("Adaptor for forwarding received UDP messages to DLT daemon.\n");
diff --git a/src/console/dlt-control.c b/src/console/dlt-control.c
index 8b390c5..7d06f64 100755
--- a/src/console/dlt-control.c
+++ b/src/console/dlt-control.c
@@ -153,7 +153,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-control [options] hostname/serial_device_name\n");
     printf("Send control message to DLT daemon.\n");
diff --git a/src/console/dlt-convert.c b/src/console/dlt-convert.c
index b5cdd94..7a54343 100755
--- a/src/console/dlt-convert.c
+++ b/src/console/dlt-convert.c
@@ -94,7 +94,7 @@ void usage()
 {
     char version[DLT_CONVERT_TEXTBUFSIZE];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-convert [options] [commands] file1 [file2]\n");
     printf("Read DLT files, print DLT messages as ASCII and store the messages again.\n");
diff --git a/src/console/dlt-receive.c b/src/console/dlt-receive.c
index 4b0e53e..ff08dd1 100755
--- a/src/console/dlt-receive.c
+++ b/src/console/dlt-receive.c
@@ -103,7 +103,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-receive [options] hostname/serial_device_name\n");
     printf("Receive DLT messages from DLT daemon and print or store the messages.\n");
diff --git a/src/daemon/dlt-daemon.c b/src/daemon/dlt-daemon.c
index 8f4d9de..38f08c6 100644
--- a/src/daemon/dlt-daemon.c
+++ b/src/daemon/dlt-daemon.c
@@ -75,7 +75,7 @@ static char str[DLT_DAEMON_TEXTBUFSIZE];
 void usage()
 {
 	char version[DLT_DAEMON_TEXTBUFSIZE];
-	dlt_get_version(version);
+	dlt_get_version(version,DLT_DAEMON_TEXTBUFSIZE);
 
     //printf("DLT logging daemon %s %s\n", _DLT_PACKAGE_VERSION, _DLT_PACKAGE_VERSION_STATE);
     //printf("Compile options: %s %s %s %s",_DLT_SYSTEMD_ENABLE, _DLT_SYSTEMD_WATCHDOG_ENABLE, _DLT_TEST_ENABLE, _DLT_SHM_ENABLE);
@@ -175,7 +175,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 	daemon_local->flags.offlineTraceMaxSize = 0;
 	daemon_local->flags.loggingMode = 0;
 	daemon_local->flags.loggingLevel = 6;
-	strncpy(daemon_local->flags.loggingFilename, DLT_USER_DIR "/dlt.log",sizeof(daemon_local->flags.loggingFilename));
+	strncpy(daemon_local->flags.loggingFilename, DLT_USER_DIR "/dlt.log",sizeof(daemon_local->flags.loggingFilename)-1);
+	daemon_local->flags.loggingFilename[sizeof(daemon_local->flags.loggingFilename)-1]=0;
 	daemon_local->timeoutOnSend = 4;
 	daemon_local->flags.sendECUSoftwareVersion = 0;
 	memset(daemon_local->flags.pathToECUSoftwareVersion, 0, sizeof(daemon_local->flags.pathToECUSoftwareVersion));
@@ -207,11 +208,13 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 
 					if(token[0]==0)
 					{
-                                                strncpy(token,pch,sizeof(token) - 1);
+                        strncpy(token,pch,sizeof(token) - 1);
+                        token[sizeof(token) - 1]=0;
 					}
 					else
 					{
-                                                strncpy(value,pch,sizeof(value) - 1);
+                        strncpy(value,pch,sizeof(value) - 1);
+                        value[sizeof(value) - 1]=0;
 						break;
 					}
 
@@ -268,22 +271,26 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"RS232DeviceName")==0)
 						{
-                                                        strncpy(daemon_local->flags.yvalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.yvalue,value,NAME_MAX);
+                            daemon_local->flags.yvalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"RS232Baudrate")==0)
 						{
-                                                        strncpy(daemon_local->flags.bvalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.bvalue,value,NAME_MAX);
+                            daemon_local->flags.bvalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"ECUId")==0)
 						{
-                                                        strncpy(daemon_local->flags.evalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.evalue,value,NAME_MAX);
+                            daemon_local->flags.evalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"PersistanceStoragePath")==0)
 						{
-                                                        strncpy(daemon_local->flags.ivalue,value,NAME_MAX);
+                            strncpy(daemon_local->flags.ivalue,value,NAME_MAX);
+                            daemon_local->flags.ivalue[NAME_MAX]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"LoggingMode")==0)
@@ -298,7 +305,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"LoggingFilename")==0)
 						{
-                                                        strncpy(daemon_local->flags.loggingFilename,value,sizeof(daemon_local->flags.loggingFilename) - 1);
+                            strncpy(daemon_local->flags.loggingFilename,value,sizeof(daemon_local->flags.loggingFilename) - 1);
+                            daemon_local->flags.loggingFilename[sizeof(daemon_local->flags.loggingFilename) - 1]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
                        	else if(strcmp(token,"TimeOutOnSend")==0)
@@ -313,7 +321,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"OfflineTraceDirectory")==0)
 						{
-                                                        strncpy(daemon_local->flags.offlineTraceDirectory,value,sizeof(daemon_local->flags.offlineTraceDirectory) - 1);
+                            strncpy(daemon_local->flags.offlineTraceDirectory,value,sizeof(daemon_local->flags.offlineTraceDirectory) - 1);
+                            daemon_local->flags.offlineTraceDirectory[sizeof(daemon_local->flags.offlineTraceDirectory) - 1]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"OfflineTraceFileSize")==0)
@@ -333,7 +342,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
 						}
 						else if(strcmp(token,"PathToECUSoftwareVersion")==0)
 						{
-                                                        strncpy(daemon_local->flags.pathToECUSoftwareVersion,value,sizeof(daemon_local->flags.pathToECUSoftwareVersion) - 1);
+                            strncpy(daemon_local->flags.pathToECUSoftwareVersion,value,sizeof(daemon_local->flags.pathToECUSoftwareVersion) - 1);
+                            daemon_local->flags.pathToECUSoftwareVersion[sizeof(daemon_local->flags.pathToECUSoftwareVersion) - 1]=0;
 							//printf("Option: %s=%s\n",token,value);
 						}
 						else if(strcmp(token,"SendTimezone")==0)
@@ -396,9 +406,9 @@ int main(int argc, char* argv[])
     dlt_log_init(daemon_local.flags.loggingMode);
 
     /* Print version information */
-    dlt_get_version(version);
+    dlt_get_version(version,DLT_DAEMON_TEXTBUFSIZE);
 
-    sprintf(str,"Starting DLT Daemon; %s\n", version );
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Starting DLT Daemon; %s\n", version );
     dlt_log(LOG_NOTICE, str);
 
 	PRINT_FUNCTION_VERBOSE(daemon_local.flags.vflag);
@@ -467,7 +477,7 @@ int main(int argc, char* argv[])
             int error = errno;
             /* retry if SIGINT was received, else error out */
             if ( error != EINTR ) {
-                sprintf(str,"select() failed: %s\n", strerror(error) );
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"select() failed: %s\n", strerror(error) );
                 dlt_log(LOG_CRIT, str);
                 return -1;
             }
@@ -511,7 +521,7 @@ int main(int argc, char* argv[])
                     uint64_t expir=0;
                     ssize_t res = read(daemon_local.timer_wd, &expir, sizeof(expir));
                     if(res < 0) {
-                        sprintf(str,"Failed to read timer_wd; %s\n", strerror(errno) );
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to read timer_wd; %s\n", strerror(errno) );
                         dlt_log(LOG_WARNING, str);
                         // Activity received on timer_wd, but unable to read the fd:
                         // let's go on sending notification
@@ -530,7 +540,7 @@ int main(int argc, char* argv[])
                     uint64_t expir=0;
                     ssize_t res = read(daemon_local.timer_one_s, &expir, sizeof(expir));
                     if(res < 0) {
-                        sprintf(str,"Failed to read timer_timingpacket; %s\n", strerror(errno) );
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to read timer_timingpacket; %s\n", strerror(errno) );
                         dlt_log(LOG_WARNING, str);
                         // Activity received on timer_wd, but unable to read the fd:
                         // let's go on sending notification
@@ -555,7 +565,7 @@ int main(int argc, char* argv[])
                     uint64_t expir=0;
                     ssize_t res = read(daemon_local.timer_sixty_s, &expir, sizeof(expir));
                     if(res < 0) {
-                        sprintf(str,"Failed to read timer_ecuversion; %s\n", strerror(errno) );
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to read timer_ecuversion; %s\n", strerror(errno) );
                         dlt_log(LOG_WARNING, str);
                         // Activity received on timer_wd, but unable to read the fd:
                         // let's go on sending notification
@@ -629,7 +639,7 @@ int dlt_daemon_local_init_p1(DltDaemon *daemon, DltDaemonLocal *daemon_local, in
     ret=mkdir(DLT_USER_DIR, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IROTH  | S_IWOTH | S_ISVTX );
     if (ret==-1 && errno != EEXIST)
     {
-        sprintf(str,"FIFO user dir %s cannot be created!\n", DLT_USER_DIR);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user dir %s cannot be created!\n", DLT_USER_DIR);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -638,7 +648,7 @@ int dlt_daemon_local_init_p1(DltDaemon *daemon, DltDaemonLocal *daemon_local, in
     ret=chmod(DLT_USER_DIR, S_IRUSR | S_IWUSR | S_IXUSR | S_IRGRP | S_IWGRP | S_IXGRP | S_IROTH  | S_IWOTH | S_IXOTH | S_ISGID | S_ISVTX );
     if (ret==-1)
     {
-        sprintf(str,"FIFO user dir %s cannot be chmoded!\n", DLT_USER_DIR);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user dir %s cannot be chmoded!\n", DLT_USER_DIR);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -760,7 +770,12 @@ int dlt_daemon_local_init_p2(DltDaemon *daemon, DltDaemonLocal *daemon_local, in
     if(dlt_daemon_local_ecu_version_init(daemon, daemon_local, daemon_local->flags.vflag) < 0)
     {
     	daemon->ECUVersionString = malloc(DLT_DAEMON_TEXTBUFSIZE);
-    	dlt_get_version(daemon->ECUVersionString);
+    	if(daemon->ECUVersionString==0)
+        {
+        	dlt_log(LOG_ERR,"Could not allocate memory for version string\n");
+            return -1;
+        }
+        dlt_get_version(daemon->ECUVersionString,DLT_DAEMON_TEXTBUFSIZE);
     }
 
     return 0;
@@ -787,7 +802,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
     ret=mkfifo(DLT_USER_FIFO, S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP );
     if (ret==-1)
     {
-        sprintf(str,"FIFO user %s cannot be created!\n",DLT_USER_FIFO);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user %s cannot be created!\n",DLT_USER_FIFO);
         dlt_log(LOG_ERR, str);
         return -1;
     } /* if */
@@ -795,7 +810,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
     daemon_local->fp = open(DLT_USER_FIFO, O_RDWR);
     if (daemon_local->fp==-1)
     {
-        sprintf(str,"FIFO user %s cannot be opened!\n",DLT_USER_FIFO);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"FIFO user %s cannot be opened!\n",DLT_USER_FIFO);
         dlt_log(LOG_ERR, str);
         return -1;
     } /* if */
@@ -825,7 +840,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
         daemon_local->fdserial=open(daemon_local->flags.yvalue,O_RDWR);
         if (daemon_local->fdserial<0)
         {
-            sprintf(str,"Failed to open serial device %s\n", daemon_local->flags.yvalue);
+            snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to open serial device %s\n", daemon_local->flags.yvalue);
             daemon_local->flags.yvalue[0] = 0;
             dlt_log(LOG_ERR, str);
             return -1;
@@ -845,7 +860,7 @@ int dlt_daemon_local_connection_init(DltDaemon *daemon, DltDaemonLocal *daemon_l
             if (dlt_setup_serial(daemon_local->fdserial,daemon_local->baudrate)<0)
             {
                 close(daemon_local->fdserial);
-                sprintf(str,"Failed to configure serial device %s (%s) \n", daemon_local->flags.yvalue, strerror(errno));
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Failed to configure serial device %s (%s) \n", daemon_local->flags.yvalue, strerror(errno));
                 daemon_local->flags.yvalue[0] = 0;
                 dlt_log(LOG_ERR, str);
                 return -1;
@@ -916,6 +931,12 @@ int dlt_daemon_local_ecu_version_init(DltDaemon *daemon, DltDaemonLocal *daemon_
 
 	/* Allocate permanent buffer for version info */
 	version = malloc(size + 1);
+	if(version==0)
+	{
+		dlt_log(LOG_ERR, "Cannot allocate memory for ECU version.\n");
+		fclose(f);
+		return -1;
+	}
 	off_t offset = 0;
 	while(!feof(f))
 	{
@@ -995,7 +1016,7 @@ void dlt_daemon_signal_handler(int sig)
     case SIGQUIT:
     {
         /* finalize the server */
-        sprintf(str,"Exiting DLT daemon due to signal: %s\n", strsignal(sig) );
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Exiting DLT daemon due to signal: %s\n", strsignal(sig) );
         dlt_log(LOG_NOTICE, str);
 
         /* Try to delete existing pipe, ignore result of unlink() */
@@ -1086,7 +1107,7 @@ void dlt_daemon_daemonize(int verbose)
     }
     /* only first instance continues */
 
-    sprintf(str,"%d\n",getpid());
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%d\n",getpid());
     pid_len = strlen(str);
     if(write(lfp,str,pid_len) != pid_len) /* record pid to lockfile */
         dlt_log(LOG_ERR, "Could not write pid to file in dlt_daemon_daemonize.\n");
@@ -1138,7 +1159,7 @@ int dlt_daemon_process_client_connect(DltDaemon *daemon, DltDaemonLocal *daemon_
     //flags = fcntl(in_sock, F_GETFL, 0);
     //fcntl(in_sock, F_SETFL, flags | O_NONBLOCK);
 
-    //sprintf("str,"Client Connection from %s\n", inet_ntoa(cli.sin_addr));
+    //snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Client Connection from %s\n", inet_ntoa(cli.sin_addr));
     //dlt_log(str);
     FD_SET(in_sock, &(daemon_local->master)); /* add to master set */
     if (in_sock > daemon_local->fdmax)
@@ -1150,7 +1171,7 @@ int dlt_daemon_process_client_connect(DltDaemon *daemon, DltDaemonLocal *daemon_
     daemon_local->client_connections++;
     if (daemon_local->flags.vflag)
     {
-        sprintf(str, "New connection to client established, #connections: %d\n",daemon_local->client_connections);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE, "New connection to client established, #connections: %d\n",daemon_local->client_connections);
         dlt_log(LOG_INFO, str);
     }
 
@@ -1536,7 +1557,7 @@ int dlt_daemon_process_user_message_register_application(DltDaemon *daemon, DltD
 {
     uint32_t len=0;
     DltDaemonApplication *application;
-    char description[DLT_DAEMON_DESCSIZE];
+    char description[DLT_DAEMON_DESCSIZE+1];
     DltUserControlMsgRegisterApplication *usercontext;
 
     PRINT_FUNCTION_VERBOSE(verbose);
@@ -1562,6 +1583,8 @@ int dlt_daemon_process_user_message_register_application(DltDaemon *daemon, DltD
     {
         /* Read and store application description */
         strncpy(description, (daemon_local->receiver.buf+sizeof(DltUserHeader)+sizeof(DltUserControlMsgRegisterApplication)), len);
+        description[sizeof(description)-1]=0;
+
     }
 
     application=dlt_daemon_application_add(daemon,usercontext->apid,usercontext->pid,description,verbose);
@@ -1590,7 +1613,7 @@ int dlt_daemon_process_user_message_register_context(DltDaemon *daemon, DltDaemo
     uint32_t len=0;
     int8_t loglevel, tracestatus;
     DltUserControlMsgRegisterContext *usercontext;
-    char description[DLT_DAEMON_DESCSIZE];
+    char description[DLT_DAEMON_DESCSIZE+1];
 	DltDaemonApplication *application;
 	DltDaemonContext *context;
 	DltServiceGetLogInfoRequest *req;
@@ -1620,6 +1643,7 @@ int dlt_daemon_process_user_message_register_context(DltDaemon *daemon, DltDaemo
     {
         /* Read and store context description */
         strncpy(description, (daemon_local->receiver.buf+sizeof(DltUserHeader)+sizeof(DltUserControlMsgRegisterContext)), len);
+        description[sizeof(description)-1]=0;
     }
 
     application = dlt_daemon_application_find(daemon,usercontext->apid,verbose);
@@ -1983,7 +2007,7 @@ int dlt_daemon_process_user_message_log(DltDaemon *daemon, DltDaemonLocal *daemo
 		{
 			if(dlt_daemon_send_message_overflow(daemon,daemon_local,verbose)==0)
 			{
-				sprintf(str,"%u messages discarded!\n",daemon->overflow_counter);
+				snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%u messages discarded!\n",daemon->overflow_counter);
 				dlt_log(LOG_ERR, str);
 				daemon->overflow_counter=0;
 			}
@@ -2436,7 +2460,7 @@ int dlt_daemon_close_socket(int sock, DltDaemon *daemon, DltDaemonLocal *daemon_
 
 	if (daemon_local->flags.vflag)
 	{
-		sprintf(str, "Connection to client lost, #connections: %d\n",daemon_local->client_connections);
+		snprintf(str,DLT_DAEMON_TEXTBUFSIZE, "Connection to client lost, #connections: %d\n",daemon_local->client_connections);
 		dlt_log(LOG_INFO, str);
 	}
 
diff --git a/src/daemon/dlt_daemon_client.c b/src/daemon/dlt_daemon_client.c
index 936c462..5f85b15 100644
--- a/src/daemon/dlt_daemon_client.c
+++ b/src/daemon/dlt_daemon_client.c
@@ -719,7 +719,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
 
     if (verbose)
     {
-        sprintf(str,"Allocate %d bytes for response msg databuffer\n", resp.datasize);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"Allocate %d bytes for response msg databuffer\n", resp.datasize);
         dlt_log(LOG_INFO, str);
     }
 
@@ -753,7 +753,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
         offset+=sizeof(uint16_t);
 
 #if (DLT_DEBUG_GETLOGINFO==1)
-        sprintf(str,"#apid: %d \n", count_app_ids);
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"#apid: %d \n", count_app_ids);
         dlt_log(LOG_DEBUG, str);
 #endif
 
@@ -792,7 +792,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
 
 #if (DLT_DEBUG_GETLOGINFO==1)
                 dlt_print_id(buf, apid);
-                sprintf(str,"apid: %s\n",buf);
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"apid: %s\n",buf);
                 dlt_log(LOG_DEBUG, str);
 #endif
 
@@ -809,14 +809,14 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
                 offset+=sizeof(uint16_t);
 
 #if (DLT_DEBUG_GETLOGINFO==1)
-                sprintf(str,"#ctid: %d \n", count_con_ids);
+                snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"#ctid: %d \n", count_con_ids);
                 dlt_log(LOG_DEBUG, str);
 #endif
 
                 for (j=0;j<count_con_ids;j++)
                 {
 #if (DLT_DEBUG_GETLOGINFO==1)
-                    sprintf(str,"j: %d \n",j);
+                    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"j: %d \n",j);
                     dlt_log(LOG_DEBUG, str);
 #endif
                     if (!((count_con_ids==1) && (req->apid[0]!='\0') && (req->ctid[0]!='\0')))
@@ -836,7 +836,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
 
 #if (DLT_DEBUG_GETLOGINFO==1)
                         dlt_print_id(buf, context->ctid);
-                        sprintf(str,"ctid: %s \n",buf);
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"ctid: %s \n",buf);
                         dlt_log(LOG_DEBUG, str);
 #endif
 
@@ -876,7 +876,7 @@ void dlt_daemon_control_get_log_info(int sock, DltDaemon *daemon, DltDaemonLocal
                         }
 
 #if (DLT_DEBUG_GETLOGINFO==1)
-                        sprintf(str,"ll=%d ts=%d \n",(int32_t)ll,(int32_t)ts);
+                        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"ll=%d ts=%d \n",(int32_t)ll,(int32_t)ts);
                         dlt_log(LOG_DEBUG, str);
 #endif
                     }
diff --git a/src/daemon/dlt_daemon_common.c b/src/daemon/dlt_daemon_common.c
index be6fa26..6e9bf9b 100644
--- a/src/daemon/dlt_daemon_common.c
+++ b/src/daemon/dlt_daemon_common.c
@@ -153,24 +153,42 @@ int dlt_daemon_init(DltDaemon *daemon,const char *runtime_directory, int verbose
 
     append_length = PATH_MAX - sizeof(DLT_RUNTIME_APPLICATION_CFG);
     if(runtime_directory[0])
+    {
         strncpy(daemon->runtime_application_cfg,runtime_directory,append_length);
+        daemon->runtime_application_cfg[append_length]=0;
+    }
     else
-    	strcpy(daemon->runtime_application_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY);
-    strcat(daemon->runtime_application_cfg,DLT_RUNTIME_APPLICATION_CFG);
+    {
+    	strncpy(daemon->runtime_application_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY,append_length);
+        daemon->runtime_application_cfg[append_length]=0;
+    }
+    strcat(daemon->runtime_application_cfg,DLT_RUNTIME_APPLICATION_CFG); /* strcat uncritical here, because max length already checked */
 
     append_length = PATH_MAX - sizeof(DLT_RUNTIME_CONTEXT_CFG);
     if(runtime_directory[0])
+    {
         strncpy(daemon->runtime_context_cfg,runtime_directory,append_length);
+        daemon->runtime_context_cfg[append_length]=0;
+    }
     else
-    	strcpy(daemon->runtime_context_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY);
-    strcat(daemon->runtime_context_cfg,DLT_RUNTIME_CONTEXT_CFG);
+    {
+    	strncpy(daemon->runtime_context_cfg,DLT_RUNTIME_DEFAULT_DIRECTORY,append_length);
+        daemon->runtime_context_cfg[append_length]=0;
+    }
+    strcat(daemon->runtime_context_cfg,DLT_RUNTIME_CONTEXT_CFG); /* strcat uncritical here, because max length already checked */
 
     append_length = PATH_MAX - sizeof(DLT_RUNTIME_CONFIGURATION);
-    if(runtime_directory[0])    
+    if(runtime_directory[0])
+    {
         strncpy(daemon->runtime_configuration,runtime_directory,append_length);
+        daemon->runtime_configuration[append_length]=0;
+    }
     else
-    	strcpy(daemon->runtime_configuration,DLT_RUNTIME_DEFAULT_DIRECTORY);
-    strcat(daemon->runtime_configuration,DLT_RUNTIME_CONFIGURATION);
+    {
+    	strncpy(daemon->runtime_configuration,DLT_RUNTIME_DEFAULT_DIRECTORY,append_length);
+        daemon->runtime_configuration[append_length]=0;
+    }
+    strcat(daemon->runtime_configuration,DLT_RUNTIME_CONFIGURATION); /* strcat uncritical here, because max length already checked */
 
     /* Check for runtime cfg, if it is loadable, load it! */
     if ((dlt_daemon_applications_load(daemon,daemon->runtime_application_cfg, verbose)==0) &&
@@ -354,7 +372,7 @@ DltDaemonApplication* dlt_daemon_application_add(DltDaemon *daemon,char *apid,pi
         application->application_description = malloc(strlen(description)+1);
         if (application->application_description)
         {
-            strncpy(application->application_description,description,strlen(description)+1);
+            strncpy(application->application_description,description,strlen(description));
             application->application_description[strlen(description)]='\0';
         }
     }
@@ -377,7 +395,7 @@ DltDaemonApplication* dlt_daemon_application_add(DltDaemon *daemon,char *apid,pi
     /* open user pipe only if it is not yet opened */
     if (application->user_handle==DLT_FD_INIT && pid!=0)
     {
-        sprintf(filename,"%s/dlt%d",DLT_USER_DIR,pid);
+        snprintf(filename,DLT_DAEMON_COMMON_TEXTBUFSIZE,"%s/dlt%d",DLT_USER_DIR,pid);
 
         dlt_user_handle = open(filename, O_WRONLY|O_NONBLOCK);
         if ( dlt_user_handle < 0 )
@@ -685,7 +703,7 @@ DltDaemonContext* dlt_daemon_context_add(DltDaemon *daemon,char *apid,char *ctid
 
         if (context->context_description)
         {
-            strncpy(context->context_description,description,strlen(description)+1);
+            strncpy(context->context_description,description,strlen(description));
             context->context_description[strlen(description)]='\0';
         }
     }
@@ -1045,11 +1063,13 @@ int dlt_daemon_configuration_load(DltDaemon *daemon,const char *filename, int ve
 
 					if(token[0]==0)
 					{
-						strncpy(token,pch,sizeof(token));
+						strncpy(token,pch,sizeof(token)-1);
+						token[sizeof(token)-1]=0;
 					}
 					else
 					{
-						strncpy(value,pch,sizeof(value));
+						strncpy(value,pch,sizeof(value)-1);
+						value[sizeof(value)-1]=0;
 						break;
 					}
 
@@ -1062,12 +1082,12 @@ int dlt_daemon_configuration_load(DltDaemon *daemon,const char *filename, int ve
 						if(strcmp(token,"LoggingMode")==0)
 						{
 							daemon->mode = atoi(value);
-							sprintf(str,"Runtime Option: %s=%d\n",token,daemon->mode);
+							snprintf(str,DLT_DAEMON_COMMON_TEXTBUFSIZE,"Runtime Option: %s=%d\n",token,daemon->mode);
 							dlt_log(LOG_INFO, str);
 						}
 						else
 						{
-							sprintf(str,"Unknown option: %s=%s\n",token,value);
+							snprintf(str,DLT_DAEMON_COMMON_TEXTBUFSIZE,"Unknown option: %s=%s\n",token,value);
 							dlt_log(LOG_ERR, str);
 						}
 					}
@@ -1081,7 +1101,7 @@ int dlt_daemon_configuration_load(DltDaemon *daemon,const char *filename, int ve
 	}
 	else
 	{
-        sprintf(str,"Cannot open configuration file: %s\n",filename);
+        snprintf(str,DLT_DAEMON_COMMON_TEXTBUFSIZE,"Cannot open configuration file: %s\n",filename);
         dlt_log(LOG_WARNING, str);
 	}	
 	
diff --git a/src/daemon/dlt_daemon_socket.c b/src/daemon/dlt_daemon_socket.c
index ca6f2ae..4888807 100644
--- a/src/daemon/dlt_daemon_socket.c
+++ b/src/daemon/dlt_daemon_socket.c
@@ -71,12 +71,12 @@ int dlt_daemon_socket_open(int *sock)
         return -1;
     } /* if */
 
-    sprintf(str,"%s: Socket created - socket_family:%i, socket_type:%i, protocol:%i\n", __FUNCTION__, socket_family, socket_type, protocol);
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%s: Socket created - socket_family:%i, socket_type:%i, protocol:%i\n", __FUNCTION__, socket_family, socket_type, protocol);
     dlt_log(LOG_INFO, str);
 
     if ( -1 == setsockopt(*sock, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)))
     {
-        sprintf(str,"dlt_daemon_socket_open: Setsockopt error in dlt_daemon_local_connection_init: %s\n",strerror(errno));
+        snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"dlt_daemon_socket_open: Setsockopt error in dlt_daemon_local_connection_init: %s\n",strerror(errno));
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -97,11 +97,11 @@ int dlt_daemon_socket_open(int *sock)
         return -1;
     } /* if */
 
-    sprintf(str,"%s: Listening on port: %u\n",__FUNCTION__,servPort);
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"%s: Listening on port: %u\n",__FUNCTION__,servPort);
     dlt_log(LOG_INFO, str);
 
     /* get socket buffer size */
-    sprintf(str,"dlt_daemon_socket_open: Socket send queue size: %d\n",dlt_daemon_socket_get_send_qeue_max_size(*sock));
+    snprintf(str,DLT_DAEMON_TEXTBUFSIZE,"dlt_daemon_socket_open: Socket send queue size: %d\n",dlt_daemon_socket_get_send_qeue_max_size(*sock));
     dlt_log(LOG_INFO, str);
 
     return 0; /* OK */
diff --git a/src/examples/dlt-example-filetransfer.c b/src/examples/dlt-example-filetransfer.c
index 4716edc..96336a4 100644
--- a/src/examples/dlt-example-filetransfer.c
+++ b/src/examples/dlt-example-filetransfer.c
@@ -80,7 +80,7 @@ void usage()
 {
 	char version[255];
 
-	dlt_get_version(version);
+	dlt_get_version(version,255);
 
     printf("Usage: dlt-example-filetransfer [options] absolute-path-to-file\n");
     printf("Simple filetransfer example");
diff --git a/src/examples/dlt-example-user-common-api.c b/src/examples/dlt-example-user-common-api.c
index 64ebd97..8404090 100644
--- a/src/examples/dlt-example-user-common-api.c
+++ b/src/examples/dlt-example-user-common-api.c
@@ -68,7 +68,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-example-common-api [options] message\n");
     printf("Generate DLT messages and store them to file or send them to daemon.\n");
@@ -237,6 +237,12 @@ int main(int argc, char* argv[])
 	if (zvalue)
 	{
 		char* buffer = malloc(atoi(zvalue));
+		if(buffer==0)
+		{
+	        /* no message, show usage and terminate */
+	        fprintf(stderr,"Cannot allocate buffer memory!\n");
+	        return -1;
+		}
         DLT_LOG2(mycontext,DLT_LOG_WARN,DLT_STRING(text),DLT_RAW(buffer,atoi(zvalue)));
 		free(buffer);
 	}
diff --git a/src/examples/dlt-example-user-func.c b/src/examples/dlt-example-user-func.c
index 79febdf..20b700a 100755
--- a/src/examples/dlt-example-user-func.c
+++ b/src/examples/dlt-example-user-func.c
@@ -84,7 +84,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-example-user-func [options] message\n");
     printf("Generate DLT messages and store them to file or send them to daemon.\n");
diff --git a/src/examples/dlt-example-user.c b/src/examples/dlt-example-user.c
index dabb6d7..3dcf245 100755
--- a/src/examples/dlt-example-user.c
+++ b/src/examples/dlt-example-user.c
@@ -84,7 +84,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-example-user [options] message\n");
     printf("Generate DLT messages and store them to file or send them to daemon.\n");
@@ -299,7 +299,13 @@ int main(int argc, char* argv[])
 	if (zvalue)
 	{
 		char* buffer = malloc(atoi(zvalue));
-        DLT_LOG(mycontext,DLT_LOG_WARN,DLT_STRING(text),DLT_RAW(buffer,atoi(zvalue)));		
+		if(buffer==0)
+		{
+	        /* no message, show usage and terminate */
+	        fprintf(stderr,"Cannot allocate buffer memory!\n");
+	        return -1;
+		}
+		DLT_LOG(mycontext,DLT_LOG_WARN,DLT_STRING(text),DLT_RAW(buffer,atoi(zvalue)));
 		free(buffer);
 	}
 #endif /* DLT_TEST_ENABLE */
diff --git a/src/lib/dlt_user.c b/src/lib/dlt_user.c
index c99a646..10675b9 100644
--- a/src/lib/dlt_user.c
+++ b/src/lib/dlt_user.c
@@ -103,16 +103,16 @@ static int dlt_user_queue_resend(void);
 
 int dlt_user_check_library_version(const char *user_major_version,const char *user_minor_version){
 
-	char str[200];
+	char str[DLT_USER_BUFFER_LENGTH];
 	char lib_major_version[DLT_USER_MAX_LIB_VERSION_LENGTH];
 	char lib_minor_version[DLT_USER_MAX_LIB_VERSION_LENGTH];
 
-	dlt_get_major_version( lib_major_version);
-	dlt_get_minor_version( lib_minor_version);
+	dlt_get_major_version( lib_major_version,DLT_USER_MAX_LIB_VERSION_LENGTH);
+	dlt_get_minor_version( lib_minor_version,DLT_USER_MAX_LIB_VERSION_LENGTH);
 
 	if( (strcmp(lib_major_version,user_major_version)!=0) || (strcmp(lib_minor_version,user_minor_version)!=0))
 	{
-		sprintf(str,"DLT Library version check failed! Installed DLT library version is %s.%s - Application using DLT library version %s.%s\n",lib_major_version,lib_minor_version,user_major_version,user_minor_version);
+		snprintf(str,DLT_USER_BUFFER_LENGTH,"DLT Library version check failed! Installed DLT library version is %s.%s - Application using DLT library version %s.%s\n",lib_major_version,lib_minor_version,user_major_version,user_minor_version);
 		dlt_log(LOG_WARNING, str);
 		return -1;
 	}
@@ -153,7 +153,7 @@ int dlt_init(void)
 #endif
 
     /* create and open DLT user FIFO */
-    sprintf(filename,"%s/dlt%d",DLT_USER_DIR,getpid());
+    snprintf(filename,DLT_USER_MAX_FILENAME_LENGTH,"%s/dlt%d",DLT_USER_DIR,getpid());
      
     /* Try to delete existing pipe, ignore result of unlink */
     unlink(filename);
@@ -161,7 +161,7 @@ int dlt_init(void)
     ret=mkfifo(filename, S_IRUSR | S_IWUSR | S_IWGRP | S_IRGRP );
     if (ret==-1)
     {
-        sprintf(str,"Loging disabled, FIFO user %s cannot be created!\n",filename);
+        snprintf(str,DLT_USER_BUFFER_LENGTH,"Loging disabled, FIFO user %s cannot be created!\n",filename);
         dlt_log(LOG_WARNING, str);
         /* return 0; */ /* removed to prevent error, when FIFO already exists */
     }
@@ -170,7 +170,7 @@ int dlt_init(void)
     ret=chmod(filename, S_IRUSR | S_IWUSR | S_IWGRP | S_IRGRP );
     if (ret==-1)
     {
-        sprintf(str,"FIFO user %s cannot be chmoded!\n", DLT_USER_DIR);
+        snprintf(str,DLT_USER_BUFFER_LENGTH,"FIFO user %s cannot be chmoded!\n", DLT_USER_DIR);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -178,7 +178,7 @@ int dlt_init(void)
     dlt_user.dlt_user_handle = open(filename, O_RDWR | O_CLOEXEC);
     if (dlt_user.dlt_user_handle == DLT_FD_INIT)
     {
-        sprintf(str,"Loging disabled, FIFO user %s cannot be opened!\n",filename);
+        snprintf(str,DLT_USER_BUFFER_LENGTH,"Loging disabled, FIFO user %s cannot be opened!\n",filename);
         dlt_log(LOG_WARNING, str);
         unlink(filename);
         return 0;
@@ -188,7 +188,7 @@ int dlt_init(void)
     dlt_user.dlt_log_handle = open(DLT_USER_FIFO, O_WRONLY | O_NONBLOCK | O_CLOEXEC );
     if (dlt_user.dlt_log_handle==-1)
     {
-        sprintf(str,"Loging disabled, FIFO %s cannot be opened with open()!\n",DLT_USER_FIFO);
+        snprintf(str,DLT_USER_BUFFER_LENGTH,"Loging disabled, FIFO %s cannot be opened with open()!\n",DLT_USER_FIFO);
         dlt_log(LOG_WARNING, str);
         //return 0;
     }
@@ -198,7 +198,7 @@ int dlt_init(void)
 		/* init shared memory */
 		if (dlt_shm_init_client(&(dlt_user.dlt_shm),DLT_SHM_KEY) < 0)
 		{
-			sprintf(str,"Loging disabled, Shared memory %d cannot be created!\n",DLT_SHM_KEY);
+			snprintf(str,DLT_USER_BUFFER_LENGTH,"Loging disabled, Shared memory %d cannot be created!\n",DLT_SHM_KEY);
 			dlt_log(LOG_WARNING, str);
 			//return 0; 
 		}   
@@ -269,7 +269,7 @@ int dlt_init_file(const char *name)
     dlt_user.dlt_log_handle = open(name,O_WRONLY|O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); /* mode: wb */
     if (dlt_user.dlt_log_handle == -1)
     {
-        sprintf(str,"Log file %s cannot be opened!\n",name);
+        snprintf(str,DLT_USER_BUFFER_LENGTH,"Log file %s cannot be opened!\n",name);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -290,7 +290,7 @@ int dlt_init_message_queue(void)
 
     /* Generate per process name for queue */
     char queue_name[NAME_MAX];
-    sprintf(queue_name, "%s.%d", DLT_MESSAGE_QUEUE_NAME, getpid());
+    snprintf(queue_name,NAME_MAX, "%s.%d", DLT_MESSAGE_QUEUE_NAME, getpid());
 
     /* Maximum queue size is 10, limit to size of pointers */
     struct mq_attr mqatr;
@@ -437,7 +437,7 @@ void dlt_user_atexit_handler(void)
 
 	if(count != 0){
 		char tmp[256];
-		sprintf(tmp,"Lost log messages in user buffer when exiting: %i\n",count);
+		snprintf(tmp,256,"Lost log messages in user buffer when exiting: %i\n",count);
 		dlt_log(LOG_ERR, tmp);
 	}
 
@@ -507,7 +507,7 @@ int dlt_free(void)
 
     if (dlt_user.dlt_user_handle!=DLT_FD_INIT)
     {
-        sprintf(filename,"%s/dlt%d",DLT_USER_DIR,getpid());
+        snprintf(filename,DLT_USER_MAX_FILENAME_LENGTH,"%s/dlt%d",DLT_USER_DIR,getpid());
 
         close(dlt_user.dlt_user_handle);
         dlt_user.dlt_user_handle=DLT_FD_INIT;
@@ -558,7 +558,7 @@ int dlt_free(void)
     DLT_SEM_FREE();
 
     char queue_name[NAME_MAX];
-    sprintf(queue_name, "%s.%d", DLT_MESSAGE_QUEUE_NAME, getpid());
+    snprintf(queue_name,NAME_MAX, "%s.%d", DLT_MESSAGE_QUEUE_NAME, getpid());
 
     /**
      * Ignore errors from these, to not to spam user if dlt_free
@@ -645,8 +645,6 @@ int dlt_register_app(const char *appid, const char * description)
         dlt_user.application_description= malloc(desc_len+1);
         if (dlt_user.application_description){
             strncpy(dlt_user.application_description, description, desc_len);
-
-            /* Terminate transmitted string with 0 */
             dlt_user.application_description[desc_len]='\0';
         }
         else
@@ -847,8 +845,6 @@ int dlt_register_context_ll_ts(DltContext *handle, const char *contextid, const
 		}
 
 		strncpy(dlt_user.dlt_ll_ts[dlt_user.dlt_ll_ts_num_entries].context_description, description, desc_len);
-
-		/* Terminate transmitted string with 0 */
 		dlt_user.dlt_ll_ts[dlt_user.dlt_ll_ts_num_entries].context_description[desc_len]='\0';
 	}
 
@@ -1119,7 +1115,7 @@ int dlt_forward_msg(void *msgdata,size_t size)
         {
             if (dlt_user_log_send_overflow()==0)
             {
-				sprintf(str,"Buffer full! %u messages discarded!\n",dlt_user.overflow_counter);
+				snprintf(str,DLT_USER_BUFFER_LENGTH,"Buffer full! %u messages discarded!\n",dlt_user.overflow_counter);
 				dlt_log(LOG_ERR, str);
                 dlt_user.overflow_counter=0;            }
         }
@@ -2973,7 +2969,7 @@ DltReturnValue dlt_user_log_send_log(DltContextData *log, int mtype)
         {
             if (dlt_user_log_send_overflow()==0)
             {
-				sprintf(str,"%u messages discarded!\n",dlt_user.overflow_counter);
+				snprintf(str,DLT_USER_BUFFER_LENGTH,"%u messages discarded!\n",dlt_user.overflow_counter);
 				dlt_log(LOG_ERR, str);
                 dlt_user.overflow_counter=0;
             }
@@ -3724,7 +3720,7 @@ void dlt_user_log_reattach_to_daemon(void)
 			/* init shared memory */
 			if (dlt_shm_init_client(&dlt_user.dlt_shm,DLT_SHM_KEY) < 0)
 			{
-				sprintf(str,"Loging disabled, Shared memory %d cannot be created!\n",DLT_SHM_KEY);
+				snprintf(str,DLT_USER_BUFFER_LENGTH,"Loging disabled, Shared memory %d cannot be created!\n",DLT_SHM_KEY);
 				dlt_log(LOG_WARNING, str);
 				//return 0; 
 			}   
diff --git a/src/shared/dlt_common.c b/src/shared/dlt_common.c
index 662e9b5..dd4d74a 100755
--- a/src/shared/dlt_common.c
+++ b/src/shared/dlt_common.c
@@ -125,11 +125,11 @@ int dlt_print_hex_string(char *text,int textlength,uint8_t *ptr,int size)
     {
         if (num>0)
         {
-            sprintf(text," ");
+            snprintf(text,2," ");
             text++;
         }
 
-        sprintf(text,"%.2x",((uint8_t*)ptr)[num]);
+        snprintf(text,3,"%.2x",((uint8_t*)ptr)[num]);
         text+=2; /* 2 chars */
     }
 
@@ -164,7 +164,7 @@ int dlt_print_mixed_string(char *text,int textlength,uint8_t *ptr,int size,int h
 
     if (textlength<required_size)
     {
-        sprintf(str, "String does not fit mixed data (available=%d, required=%d) !\n", textlength, required_size);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH, "String does not fit mixed data (available=%d, required=%d) !\n", textlength, required_size);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -173,7 +173,7 @@ int dlt_print_mixed_string(char *text,int textlength,uint8_t *ptr,int size,int h
     for (lines=0; lines< (size / DLT_COMMON_HEX_CHARS); lines++)
     {
         /* Line number */
-        sprintf(text,"%.6x: ",lines * DLT_COMMON_HEX_CHARS);
+        snprintf(text,DLT_COMMON_HEX_LINELEN+1,"%.6x: ",lines * DLT_COMMON_HEX_CHARS);
         text+=DLT_COMMON_HEX_LINELEN; /* 'XXXXXX: ' */
 
         /* Hex-Output */
@@ -182,7 +182,7 @@ int dlt_print_mixed_string(char *text,int textlength,uint8_t *ptr,int size,int h
         dlt_print_hex_string(text,textlength,(uint8_t*)(ptr+(lines*DLT_COMMON_HEX_CHARS)),DLT_COMMON_HEX_CHARS);
         text+=((2*DLT_COMMON_HEX_CHARS)+(DLT_COMMON_HEX_CHARS-1)); /* 32 characters + 15 spaces */
 
-        sprintf(text," ");
+        snprintf(text,2," ");
         text+=DLT_COMMON_CHARLEN;
 
         /* Char-Output */
@@ -192,12 +192,12 @@ int dlt_print_mixed_string(char *text,int textlength,uint8_t *ptr,int size,int h
 
         if (html==0)
         {
-            sprintf(text,"\n");
+            snprintf(text,2,"\n");
             text+=DLT_COMMON_CHARLEN;
         }
         else
         {
-            sprintf(text,"<BR>");
+            snprintf(text,5,"<BR>");
             text+=(4*DLT_COMMON_CHARLEN);
         }
     }
@@ -208,7 +208,7 @@ int dlt_print_mixed_string(char *text,int textlength,uint8_t *ptr,int size,int h
     if (rest>0)
     {
         /* Line number */
-        sprintf(text,"%.6x: ", (size / DLT_COMMON_HEX_CHARS) * DLT_COMMON_HEX_CHARS);
+        snprintf(text,9,"%.6x: ", (size / DLT_COMMON_HEX_CHARS) * DLT_COMMON_HEX_CHARS);
         text+=DLT_COMMON_HEX_LINELEN; /* 'XXXXXX: ' */
 
         /* Hex-Output */
@@ -219,11 +219,11 @@ int dlt_print_mixed_string(char *text,int textlength,uint8_t *ptr,int size,int h
 
         for (i=0;i<(DLT_COMMON_HEX_CHARS-rest);i++)
         {
-            sprintf(text," xx");
+            snprintf(text,4," xx");
             text+=(3*DLT_COMMON_CHARLEN);
         }
 
-        sprintf(text," ");
+        snprintf(text,2," ");
         text+=DLT_COMMON_CHARLEN;
 
         /* Char-Output */
@@ -259,18 +259,18 @@ int dlt_print_char_string(char **text,int textlength,uint8_t *ptr,int size)
     {
         if ( (((char*)ptr)[num]<DLT_COMMON_ASCII_CHAR_SPACE) || (((char*)ptr)[num]>DLT_COMMON_ASCII_CHAR_TILDE) )
         {
-            sprintf(*text,".");
+            snprintf(*text,2,".");
         }
         else
         {
             /* replace < with . */
             if (((char*)ptr)[num]!=DLT_COMMON_ASCII_CHAR_LT)
             {
-                sprintf(*text,"%c",((char *)ptr)[num]);
+                snprintf(*text,2,"%c",((char *)ptr)[num]);
             }
             else
             {
-                sprintf(*text,".");
+                snprintf(*text,2,".");
             }
         }
         (*text)++;
@@ -412,7 +412,7 @@ int dlt_filter_load(DltFilter *filter,const char *filename,int verbose)
     handle = fopen(filename,"r");
     if (handle == 0)
     {
-        sprintf(str,"Filter file %s cannot be opened!\n",filename);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Filter file %s cannot be opened!\n",filename);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -466,7 +466,7 @@ int dlt_filter_load(DltFilter *filter,const char *filename,int verbose)
         }
         else
         {
-            sprintf(str, "Maximum number (%d) of allowed filters reached!\n", DLT_FILTER_MAX);
+            snprintf(str,DLT_COMMON_BUFFER_LENGTH, "Maximum number (%d) of allowed filters reached!\n", DLT_FILTER_MAX);
             dlt_log(LOG_ERR, str);
             return 0;
         }
@@ -493,7 +493,7 @@ int dlt_filter_save(DltFilter *filter,const char *filename,int verbose)
     handle = fopen(filename,"w");
     if (handle == 0)
     {
-        sprintf(str,"Filter file %s cannot be opened!\n",filename);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Filter file %s cannot be opened!\n",filename);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -723,7 +723,7 @@ int dlt_message_header_flags(DltMessage *msg,char *text,int textlength,int flags
         if (timeinfo!=0)
         {
             strftime (buffer,sizeof(buffer),"%Y/%m/%d %H:%M:%S",timeinfo);
-            sprintf(text,"%s.%.6d ",buffer,msg->storageheader->microseconds);
+            snprintf(text,textlength,"%s.%.6d ",buffer,msg->storageheader->microseconds);
         }
     }
 
@@ -732,18 +732,18 @@ int dlt_message_header_flags(DltMessage *msg,char *text,int textlength,int flags
         /* print timestamp if available */
         if ( DLT_IS_HTYP_WTMS(msg->standardheader->htyp) )
         {
-            sprintf(text+strlen(text),"%10u ",msg->headerextra.tmsp);
+            snprintf(text+strlen(text),textlength-strlen(text),"%10u ",msg->headerextra.tmsp);
         }
         else
         {
-            sprintf(text+strlen(text),"---------- ");
+            snprintf(text+strlen(text),textlength-strlen(text),"---------- ");
         }
     }
 
     if ((flags & DLT_HEADER_SHOW_MSGCNT) == DLT_HEADER_SHOW_MSGCNT)
     {
         /* print message counter */
-        sprintf(text+strlen(text),"%.3d ",msg->standardheader->mcnt);
+        snprintf(text+strlen(text),textlength-strlen(text),"%.3d ",msg->standardheader->mcnt);
     }
 
     if ((flags & DLT_HEADER_SHOW_ECUID) == DLT_HEADER_SHOW_ECUID)
@@ -762,17 +762,17 @@ int dlt_message_header_flags(DltMessage *msg,char *text,int textlength,int flags
     /* print app id and context id if extended header available, else '----' */#
     if ((flags & DLT_HEADER_SHOW_APID) == DLT_HEADER_SHOW_APID)
     {
-        sprintf(text+strlen(text)," ");
+        snprintf(text+strlen(text),textlength-strlen(text)," ");
         if ((DLT_IS_HTYP_UEH(msg->standardheader->htyp)) && (msg->extendedheader->apid[0]!=0))
         {
             dlt_print_id(text+strlen(text),msg->extendedheader->apid);
         }
         else
         {
-            sprintf(text+strlen(text),"----");
+            snprintf(text+strlen(text),textlength-strlen(text),"----");
         }
 
-        sprintf(text+strlen(text)," ");
+        snprintf(text+strlen(text),textlength-strlen(text)," ");
     }
 
     if ((flags & DLT_HEADER_SHOW_CTID) == DLT_HEADER_SHOW_CTID)
@@ -783,10 +783,10 @@ int dlt_message_header_flags(DltMessage *msg,char *text,int textlength,int flags
         }
         else
         {
-            sprintf(text+strlen(text),"----");
+            snprintf(text+strlen(text),textlength-strlen(text),"----");
         }
 
-        sprintf(text+strlen(text)," ");
+        snprintf(text+strlen(text),textlength-strlen(text)," ");
     }
 
     /* print info about message type and length */
@@ -794,33 +794,33 @@ int dlt_message_header_flags(DltMessage *msg,char *text,int textlength,int flags
     {
         if ((flags & DLT_HEADER_SHOW_MSGTYPE) == DLT_HEADER_SHOW_MSGTYPE)
         {
-            sprintf(text+strlen(text),"%s",message_type[DLT_GET_MSIN_MSTP(msg->extendedheader->msin)]);
-            sprintf(text+strlen(text)," ");
+            snprintf(text+strlen(text),textlength-strlen(text),"%s",message_type[DLT_GET_MSIN_MSTP(msg->extendedheader->msin)]);
+            snprintf(text+strlen(text),textlength-strlen(text)," ");
         }
 
         if ((flags & DLT_HEADER_SHOW_MSGSUBTYPE) == DLT_HEADER_SHOW_MSGSUBTYPE)
         {
             if ((DLT_GET_MSIN_MSTP(msg->extendedheader->msin))==DLT_TYPE_LOG)
             {
-                sprintf(text+strlen(text),"%s",log_info[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
+                snprintf(text+strlen(text),textlength-strlen(text),"%s",log_info[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
             }
 
             if ((DLT_GET_MSIN_MSTP(msg->extendedheader->msin))==DLT_TYPE_APP_TRACE)
             {
-                sprintf(text+strlen(text),"%s",trace_type[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
+                snprintf(text+strlen(text),textlength-strlen(text),"%s",trace_type[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
             }
 
             if ((DLT_GET_MSIN_MSTP(msg->extendedheader->msin))==DLT_TYPE_NW_TRACE)
             {
-                sprintf(text+strlen(text),"%s",nw_trace_type[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
+                snprintf(text+strlen(text),textlength-strlen(text),"%s",nw_trace_type[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
             }
 
             if ((DLT_GET_MSIN_MSTP(msg->extendedheader->msin))==DLT_TYPE_CONTROL)
             {
-                sprintf(text+strlen(text),"%s",control_type[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
+                snprintf(text+strlen(text),textlength-strlen(text),"%s",control_type[DLT_GET_MSIN_MTIN(msg->extendedheader->msin)]);
             }
 
-            sprintf(text+strlen(text)," ");
+            snprintf(text+strlen(text),textlength-strlen(text)," ");
         }
 
         if ((flags & DLT_HEADER_SHOW_VNVSTATUS) == DLT_HEADER_SHOW_VNVSTATUS)
@@ -828,20 +828,20 @@ int dlt_message_header_flags(DltMessage *msg,char *text,int textlength,int flags
             /* print verbose status pf message */
             if (DLT_IS_MSIN_VERB(msg->extendedheader->msin))
             {
-                sprintf(text+strlen(text),"V");
+                snprintf(text+strlen(text),textlength-strlen(text),"V");
             }
             else
             {
-                sprintf(text+strlen(text),"N");
+                snprintf(text+strlen(text),textlength-strlen(text),"N");
             }
 
-            sprintf(text+strlen(text)," ");
+            snprintf(text+strlen(text),textlength-strlen(text)," ");
         }
 
         if ((flags & DLT_HEADER_SHOW_NOARG) == DLT_HEADER_SHOW_NOARG)
         {
             /* print number of arguments */
-            sprintf(text+strlen(text),"%d", msg->extendedheader->noar);
+            snprintf(text+strlen(text),textlength-strlen(text),"%d", msg->extendedheader->noar);
         }
 
     }
@@ -849,22 +849,22 @@ int dlt_message_header_flags(DltMessage *msg,char *text,int textlength,int flags
     {
         if ((flags & DLT_HEADER_SHOW_MSGTYPE) == DLT_HEADER_SHOW_MSGTYPE)
         {
-            sprintf(text+strlen(text),"--- ");
+            snprintf(text+strlen(text),textlength-strlen(text),"--- ");
         }
 
         if ((flags & DLT_HEADER_SHOW_MSGSUBTYPE) == DLT_HEADER_SHOW_MSGSUBTYPE)
         {
-            sprintf(text+strlen(text),"--- ");
+            snprintf(text+strlen(text),textlength-strlen(text),"--- ");
         }
 
         if ((flags & DLT_HEADER_SHOW_VNVSTATUS) == DLT_HEADER_SHOW_VNVSTATUS)
         {
-            sprintf(text+strlen(text),"N ");
+            snprintf(text+strlen(text),textlength-strlen(text),"N ");
         }
 
         if ((flags & DLT_HEADER_SHOW_NOARG) == DLT_HEADER_SHOW_NOARG)
         {
-            sprintf(text+strlen(text),"-");
+            snprintf(text+strlen(text),textlength-strlen(text),"-");
         }
     }
 
@@ -948,24 +948,24 @@ int dlt_message_payload(DltMessage *msg,char *text,int textlength,int type,int v
         {
             if (id > 0 && id <= DLT_SERVICE_ID_MESSAGE_BUFFER_OVERFLOW)
             {
-                sprintf(text+strlen(text),"%s",service_id[id]); /* service id */
+                snprintf(text+strlen(text),textlength-strlen(text),"%s",service_id[id]); /* service id */
             }
             else
             {
                 if (!(DLT_MSG_IS_CONTROL_TIME(msg)))
                 {
-                    sprintf(text+strlen(text),"service(%u)",id); /* service id */
+                    snprintf(text+strlen(text),textlength-strlen(text),"service(%u)",id); /* service id */
                 }
             }
 
             if (datalength>0)
             {
-                sprintf(text+strlen(text),", ");
+                snprintf(text+strlen(text),textlength-strlen(text),", ");
             }
         }
         else
         {
-            sprintf(text+strlen(text),"%u, ",id); /* message id */
+            snprintf(text+strlen(text),textlength-strlen(text),"%u, ",id); /* message id */
         }
 
         /* process return value */
@@ -976,16 +976,16 @@ int dlt_message_payload(DltMessage *msg,char *text,int textlength,int type,int v
                 DLT_MSG_READ_VALUE(retval,ptr,datalength,uint8_t); /* No endian conversion necessary */
                 if ( (retval<3) || (retval==8))
                 {
-                    sprintf(text+strlen(text),"%s",return_type[retval]);
+                    snprintf(text+strlen(text),textlength-strlen(text),"%s",return_type[retval]);
                 }
                 else
                 {
-                    sprintf(text+strlen(text),"%.2x",retval);
+                    snprintf(text+strlen(text),textlength-strlen(text),"%.2x",retval);
                 }
 
                 if (datalength>=1)
                 {
-                    sprintf(text+strlen(text),", ");
+                    snprintf(text+strlen(text),textlength-strlen(text),", ");
                 }
             }
         }
@@ -997,7 +997,7 @@ int dlt_message_payload(DltMessage *msg,char *text,int textlength,int type,int v
             if ((datalength>DLT_COMMON_ASCII_LIMIT_MAX_CHARS) &&
                     ((textlength-strlen(text))>4))
             {
-                sprintf(text+strlen(text)," ...");
+                snprintf(text+strlen(text),textlength-strlen(text)," ...");
             }
         }
         else
@@ -1018,7 +1018,7 @@ int dlt_message_payload(DltMessage *msg,char *text,int textlength,int type,int v
     {
         if (num!=0)
         {
-            sprintf(text+strlen(text)," ");
+            snprintf(text+strlen(text),textlength-strlen(text)," ");
         }
 
         /* first read the type info of the argument */
@@ -1150,24 +1150,24 @@ int dlt_message_read(DltMessage *msg,uint8_t *buffer,unsigned int length,int res
 
     if (verbose)
     {
-        sprintf(str,"Buffer length: %d\n",length);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Buffer length: %d\n",length);
         dlt_log(LOG_INFO, str);
     }
     if (verbose)
     {
-        sprintf(str,"Header Size: %d\n",msg->headersize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Header Size: %d\n",msg->headersize);
         dlt_log(LOG_INFO, str);
     }
     if (verbose)
     {
-        sprintf(str,"Data Size: %d\n",msg->datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Data Size: %d\n",msg->datasize);
         dlt_log(LOG_INFO, str);
     }
 
     /* check data size */
     if (msg->datasize < 0)
     {
-        sprintf(str,"Plausibility check failed. Complete message size too short (%d)!\n",msg->datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Plausibility check failed. Complete message size too short (%d)!\n",msg->datasize);
         dlt_log(LOG_ERR, str);
         return DLT_MESSAGE_ERROR_CONTENT;
     }
@@ -1218,7 +1218,7 @@ int dlt_message_read(DltMessage *msg,uint8_t *buffer,unsigned int length,int res
     }
     if (msg->databuffer == 0)
     {
-        sprintf(str,"Cannot allocate memory for payload buffer of size %d!\n",msg->datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Cannot allocate memory for payload buffer of size %d!\n",msg->datasize);
         dlt_log(LOG_ERR, str);
         return DLT_MESSAGE_ERROR_UNKNOWN;
     }
@@ -1370,19 +1370,19 @@ int dlt_file_read_header(DltFile *file,int verbose)
     file->msg.datasize = DLT_BETOH_16(file->msg.standardheader->len) + sizeof(DltStorageHeader) - file->msg.headersize;
     if (verbose)
     {
-        sprintf(str,"Header Size: %d\n",file->msg.headersize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Header Size: %d\n",file->msg.headersize);
         dlt_log(LOG_INFO, str);
     }
     if (verbose)
     {
-        sprintf(str,"Data Size: %d\n",file->msg.datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Data Size: %d\n",file->msg.datasize);
         dlt_log(LOG_INFO, str);
     }
 
     /* check data size */
     if (file->msg.datasize < 0)
     {
-        sprintf(str,"Plausibility check failed. Complete message size too short! (%d)\n", file->msg.datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Plausibility check failed. Complete message size too short! (%d)\n", file->msg.datasize);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1477,19 +1477,19 @@ int dlt_file_read_header_raw(DltFile *file,int resync,int verbose)
     file->msg.datasize = DLT_BETOH_16(file->msg.standardheader->len) + sizeof(DltStorageHeader) - file->msg.headersize;
     if (verbose)
     {
-        sprintf(str,"Header Size: %d\n",file->msg.headersize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Header Size: %d\n",file->msg.headersize);
         dlt_log(LOG_INFO, str);
     }
     if (verbose)
     {
-        sprintf(str,"Data Size: %d\n",file->msg.datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Data Size: %d\n",file->msg.datasize);
         dlt_log(LOG_INFO, str);
     }
 
     /* check data size */
     if (file->msg.datasize < 0)
     {
-        sprintf(str,"Plausibility check failed. Complete message size too short! (%d)\n", file->msg.datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Plausibility check failed. Complete message size too short! (%d)\n", file->msg.datasize);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1573,7 +1573,7 @@ int dlt_file_read_data(DltFile *file, int verbose)
 
     if (file->msg.databuffer == 0)
     {
-        sprintf(str,"Cannot allocate memory for payload buffer of size %d!\n",file->msg.datasize);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Cannot allocate memory for payload buffer of size %d!\n",file->msg.datasize);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1583,7 +1583,7 @@ int dlt_file_read_data(DltFile *file, int verbose)
     {
         if (file->msg.datasize!=0)
         {
-            sprintf(str,"Cannot read payload data from file of size %d!\n",file->msg.datasize);
+            snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Cannot read payload data from file of size %d!\n",file->msg.datasize);
             dlt_log(LOG_ERR, str);
             return -1;
         }
@@ -1626,7 +1626,7 @@ int dlt_file_open(DltFile *file,const char *filename,int verbose)
 
     if (0 != fseek(file->handle,0,SEEK_END))
     {
-        sprintf(str,"dlt_file_open: Seek failed to 0,SEEK_END");
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"dlt_file_open: Seek failed to 0,SEEK_END");
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1634,7 +1634,7 @@ int dlt_file_open(DltFile *file,const char *filename,int verbose)
 
     if (0 != fseek(file->handle,0,SEEK_SET))
     {
-        sprintf(str,"dlt_file_open: Seek failed to 0,SEEK_SET");
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"dlt_file_open: Seek failed to 0,SEEK_SET");
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1642,7 +1642,7 @@ int dlt_file_open(DltFile *file,const char *filename,int verbose)
     if (verbose)
     {
         /* print file length */
-        sprintf(str,"File is %lu bytes long\n",file->file_length);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"File is %lu bytes long\n",file->file_length);
         dlt_log(LOG_INFO, str);
     }
     return 0;
@@ -1655,7 +1655,7 @@ int dlt_file_read(DltFile *file,int verbose)
 
     if (verbose)
     {
-        sprintf(str,"%s: Message %d:\n",__func__, file->counter_total);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"%s: Message %d:\n",__func__, file->counter_total);
         dlt_log(LOG_INFO, str);
     }
 
@@ -1685,7 +1685,7 @@ int dlt_file_read(DltFile *file,int verbose)
     /* set to end of last succesful read message, because of conflicting calls to dlt_file_read and dlt_file_message */
     if (0 !=  fseek(file->handle,file->file_position,SEEK_SET))
     {
-        sprintf(str,"Seek failed to file_position %ld \n",file->file_position);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Seek failed to file_position %ld \n",file->file_position);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1693,7 +1693,7 @@ int dlt_file_read(DltFile *file,int verbose)
     /* get file position at start of DLT message */
     if (verbose)
     {
-        sprintf(str,"Position in file: %ld\n",file->file_position);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Position in file: %ld\n",file->file_position);
         dlt_log(LOG_INFO, str);
     }
 
@@ -1713,7 +1713,7 @@ int dlt_file_read(DltFile *file,int verbose)
             /* go back to last position in file */
             if (0 != fseek(file->handle,file->file_position,SEEK_SET))
             {
-                sprintf(str,"Seek to last file pos failed!\n");
+                snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Seek to last file pos failed!\n");
                 dlt_log(LOG_ERR, str);
             }
             return-1;
@@ -1735,12 +1735,12 @@ int dlt_file_read(DltFile *file,int verbose)
         if (fseek(file->handle,file->msg.datasize,SEEK_CUR)!=0)
         {
             /* go back to last position in file */
-            sprintf(str,"Seek failed to skip payload data of size %d!\n",file->msg.datasize);
+            snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Seek failed to skip payload data of size %d!\n",file->msg.datasize);
             dlt_log(LOG_ERR, str);
 
             if (0 != fseek(file->handle,file->file_position,SEEK_SET))
             {
-                sprintf(str,"Seek back also failed!\n");
+                snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Seek back also failed!\n");
                 dlt_log(LOG_ERR, str);
             }
 
@@ -1754,13 +1754,13 @@ int dlt_file_read(DltFile *file,int verbose)
         if (fseek(file->handle,file->msg.headersize - sizeof(DltStorageHeader) - sizeof(DltStandardHeader) + file->msg.datasize,SEEK_CUR))
         {
 
-            sprintf(str,"Seek failed to skip extra header and payload data from file of size %d!\n",
+            snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Seek failed to skip extra header and payload data from file of size %d!\n",
                     file->msg.headersize - sizeof(DltStorageHeader) - sizeof(DltStandardHeader) + file->msg.datasize);
             dlt_log(LOG_ERR, str);
             /* go back to last position in file */
             if (fseek(file->handle,file->file_position,SEEK_SET))
             {
-                sprintf(str,"Seek back also failed!\n");
+                snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Seek back also failed!\n");
                 dlt_log(LOG_ERR, str);
             }
             return -1;
@@ -1790,7 +1790,7 @@ int dlt_file_read_raw(DltFile *file,int resync, int verbose)
 
     if (verbose)
     {
-        sprintf(str,"%s: Message %d:\n",__func__, file->counter_total);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"%s: Message %d:\n",__func__, file->counter_total);
         dlt_log(LOG_INFO, str);
     }
 
@@ -1822,7 +1822,7 @@ int dlt_file_read_raw(DltFile *file,int resync, int verbose)
     /* get file position at start of DLT message */
     if (verbose)
     {
-        sprintf(str,"Position in file: %ld\n",file->file_position);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Position in file: %ld\n",file->file_position);
         dlt_log(LOG_INFO, str);
     }
 
@@ -1832,7 +1832,7 @@ int dlt_file_read_raw(DltFile *file,int resync, int verbose)
         /* go back to last position in file */
         if (0!= fseek(file->handle,file->file_position,SEEK_SET))
         {
-            sprintf(str,"dlt_file_read_raw, fseek failed 1\n");
+            snprintf(str,DLT_COMMON_BUFFER_LENGTH,"dlt_file_read_raw, fseek failed 1\n");
             dlt_log(LOG_ERR, str);
         }
         return -1;
@@ -1844,7 +1844,7 @@ int dlt_file_read_raw(DltFile *file,int resync, int verbose)
         /* go back to last position in file */
         if (0 != fseek(file->handle,file->file_position,SEEK_SET))
         {
-            sprintf(str,"dlt_file_read_raw, fseek failed 2\n");
+            snprintf(str,DLT_COMMON_BUFFER_LENGTH,"dlt_file_read_raw, fseek failed 2\n");
             dlt_log(LOG_ERR, str);
         }
         return-1;
@@ -1855,7 +1855,7 @@ int dlt_file_read_raw(DltFile *file,int resync, int verbose)
         /* go back to last position in file */
         if (0 != fseek(file->handle,file->file_position,SEEK_SET))
         {
-            sprintf(str,"dlt_file_read_raw, fseek failed 3\n");
+            snprintf(str,DLT_COMMON_BUFFER_LENGTH,"dlt_file_read_raw, fseek failed 3\n");
             dlt_log(LOG_ERR, str);
         }
         return-1;
@@ -1908,7 +1908,7 @@ int dlt_file_message(DltFile *file,int index,int verbose)
     /* check if message is in range */
     if (index >= file->counter)
     {
-        sprintf(str,"Message %d out of range!\r\n",index);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Message %d out of range!\r\n",index);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1916,7 +1916,7 @@ int dlt_file_message(DltFile *file,int index,int verbose)
     /* seek to position in file */
     if (fseek(file->handle,file->index[index],SEEK_SET)!=0)
     {
-        sprintf(str,"Seek to message %d to position %ld failed!\r\n",index,file->index[index]);
+        snprintf(str,DLT_COMMON_BUFFER_LENGTH,"Seek to message %d to position %ld failed!\r\n",index,file->index[index]);
         dlt_log(LOG_ERR, str);
         return -1;
     }
@@ -1977,6 +1977,7 @@ void dlt_log_set_level(int level)
 void dlt_log_set_filename(const char *filename)
 {
         strncpy(logging_filename,filename,NAME_MAX);
+        logging_filename[NAME_MAX]=0;
 
 }
 
@@ -2020,47 +2021,56 @@ int dlt_log(int prio, char *s)
     {
         case	LOG_EMERG:
         {
-            strncpy(logfmtstring,"DLT| EMERGENCY: %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| EMERGENCY: %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         case	LOG_ALERT:
         {
-            strncpy(logfmtstring,"DLT| ALERT:     %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| ALERT:     %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         case	LOG_CRIT:
         {
-            strncpy(logfmtstring,"DLT| CRITICAL:  %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| CRITICAL:  %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         case	LOG_ERR:
         {
-            strncpy(logfmtstring,"DLT| ERROR:     %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| ERROR:     %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         case	LOG_WARNING:
         {
-            strncpy(logfmtstring,"DLT| WARNING:   %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| WARNING:   %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         case	LOG_NOTICE:
         {
-            strncpy(logfmtstring,"DLT| NOTICE:    %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| NOTICE:    %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         case	LOG_INFO:
         {
-            strncpy(logfmtstring,"DLT| INFO:      %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| INFO:      %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         case	LOG_DEBUG:
         {
-            strncpy(logfmtstring,"DLT| DEBUG:     %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT| DEBUG:     %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
         default:
         {
-            strncpy(logfmtstring,"DLT|            %s",sizeof(logfmtstring));
+            strncpy(logfmtstring,"DLT|            %s",sizeof(logfmtstring)-1);
+            logfmtstring[sizeof(logfmtstring)-1]=0;
             break;
         }
     }
@@ -2609,7 +2619,8 @@ int dlt_buffer_push3(DltBuffer *buf,const unsigned char *data1,unsigned int size
 	}
 
 	// set header
-	strcpy(head.head,DLT_BUFFER_HEAD);
+	strncpy(head.head,DLT_BUFFER_HEAD,3);
+	head.head[3]=0;
 	head.status = 2;
 	head.size = size1+size2+size3;
 
@@ -3072,20 +3083,20 @@ speed_t dlt_convert_serial_speed(int baudrate)
 
 #endif
 
-void dlt_get_version(char *buf)
+void dlt_get_version(char *buf, size_t size)
 {
-    sprintf(buf,"DLT Package Version: %s %s, Package Revision: %s, build on %s %s\n%s %s %s %s\n",
+    snprintf(buf,size,"DLT Package Version: %s %s, Package Revision: %s, build on %s %s\n%s %s %s %s\n",
             _DLT_PACKAGE_VERSION, _DLT_PACKAGE_VERSION_STATE, _DLT_PACKAGE_REVISION, __DATE__ , __TIME__,_DLT_SYSTEMD_ENABLE,_DLT_SYSTEMD_WATCHDOG_ENABLE,_DLT_TEST_ENABLE,_DLT_SHM_ENABLE );
 }
 
-void dlt_get_major_version(char *buf)
+void dlt_get_major_version(char *buf, size_t size)
 {
-	sprintf(buf,"%s",_DLT_PACKAGE_MAJOR_VERSION);
+	snprintf(buf,size,"%s",_DLT_PACKAGE_MAJOR_VERSION);
 }
 
-void dlt_get_minor_version(char *buf)
+void dlt_get_minor_version(char *buf, size_t size)
 {
-    sprintf(buf,"%s",_DLT_PACKAGE_MINOR_VERSION);
+    snprintf(buf,size,"%s",_DLT_PACKAGE_MINOR_VERSION);
 }
 
 
@@ -3258,7 +3269,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
         DLT_MSG_READ_VALUE(value8u,*ptr,*datalength,uint8_t); /* No endian conversion necessary */
         if((*datalength)<0)
             return -1;
-        sprintf(text+strlen(text),"%d",value8u);
+        snprintf(text+strlen(text),textlength-strlen(text),"%d",value8u);
     }
     else if ((type_info & DLT_TYPE_INFO_SINT) || (type_info & DLT_TYPE_INFO_UINT))
     {
@@ -3333,7 +3344,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
 					DLT_MSG_READ_VALUE(value8i,*ptr,*datalength,int8_t); /* No endian conversion necessary */
                     if((*datalength)<0)
                         return -1;
-                    sprintf(text+strlen(text),"%d",value8i);
+                    snprintf(text+strlen(text),textlength-strlen(text),"%d",value8i);
 				}
 				else
 				{
@@ -3341,7 +3352,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
 					DLT_MSG_READ_VALUE(value8u,*ptr,*datalength,uint8_t); /* No endian conversion necessary */
                     if((*datalength)<0)
                         return -1;
-                    sprintf(text+strlen(text),"%d",value8u);
+                    snprintf(text+strlen(text),textlength-strlen(text),"%d",value8u);
 				}
 				break;
 			}
@@ -3355,7 +3366,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
                     if((*datalength)<0)
                         return -1;
                     value16i=DLT_ENDIAN_GET_16(msg->standardheader->htyp, value16i_tmp);
-					sprintf(text+strlen(text),"%hd",value16i);
+					snprintf(text+strlen(text),textlength-strlen(text),"%hd",value16i);
 				}
 				else
 				{
@@ -3365,7 +3376,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
                     if((*datalength)<0)
                         return -1;
                     value16u=DLT_ENDIAN_GET_16(msg->standardheader->htyp, value16u_tmp);
-					sprintf(text+strlen(text),"%hu",value16u);
+					snprintf(text+strlen(text),textlength-strlen(text),"%hu",value16u);
 				}
 				break;
 			}
@@ -3379,7 +3390,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
                     if((*datalength)<0)
                         return -1;
                     value32i=DLT_ENDIAN_GET_32(msg->standardheader->htyp, (uint32_t)value32i_tmp);
-					sprintf(text+strlen(text),"%d",value32i);
+					snprintf(text+strlen(text),textlength-strlen(text),"%d",value32i);
 				}
 				else
 				{
@@ -3389,7 +3400,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
                     if((*datalength)<0)
                         return -1;
                     value32u=DLT_ENDIAN_GET_32(msg->standardheader->htyp, value32u_tmp);
-					sprintf(text+strlen(text),"%u",value32u);
+					snprintf(text+strlen(text),textlength-strlen(text),"%u",value32u);
 				}
 				break;
 			}
@@ -3404,9 +3415,9 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
                         return -1;
                     value64i=DLT_ENDIAN_GET_64(msg->standardheader->htyp, (uint64_t)value64i_tmp);
 	#if defined (__WIN32__) && !defined(_MSC_VER)
-					sprintf(text+strlen(text),"%I64d",value64i);
+					snprintf(text+strlen(text),textlength-strlen(text),"%I64d",value64i);
 	#else
-					sprintf(text+strlen(text),"%lld",value64i);
+					snprintf(text+strlen(text),textlength-strlen(text),"%lld",value64i);
 	#endif
 				}
 				else
@@ -3418,9 +3429,9 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
                         return -1;
                     value64u=DLT_ENDIAN_GET_64(msg->standardheader->htyp, value64u_tmp);
 	#if defined (__WIN32__) && !defined(_MSC_VER)
-					sprintf(text+strlen(text),"%I64u",value64u);
+					snprintf(text+strlen(text),textlength-strlen(text),"%I64u",value64u);
 	#else
-					sprintf(text+strlen(text),"%llu",value64u);
+					snprintf(text+strlen(text),textlength-strlen(text),"%llu",value64u);
 	#endif
 				}
 				break;
@@ -3499,7 +3510,7 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
                     memcpy(&value32f_tmp_int32i,&value32f_tmp,sizeof(float32_t));
 					value32f_tmp_int32i_swaped=DLT_ENDIAN_GET_32(msg->standardheader->htyp, (uint32_t)value32f_tmp_int32i);
 					memcpy(&value32f,&value32f_tmp_int32i_swaped,sizeof(float32_t));
-					sprintf(text+strlen(text),"%g",value32f);
+					snprintf(text+strlen(text),textlength-strlen(text),"%g",value32f);
 				}
 				else
 				{
@@ -3523,9 +3534,9 @@ int dlt_message_argument_print(DltMessage *msg,uint32_t type_info,uint8_t **ptr,
 					value64f_tmp_int64i_swaped=DLT_ENDIAN_GET_64(msg->standardheader->htyp, (uint64_t)value64f_tmp_int64i);
 					memcpy(&value64f,&value64f_tmp_int64i_swaped,sizeof(float64_t));
 #ifdef __arm__
-					sprintf(text+strlen(text),"ILLEGAL");
+					snprintf(text+strlen(text),textlength-strlen(text),"ILLEGAL");
 #else
-					sprintf(text+strlen(text),"%g",value64f);
+					snprintf(text+strlen(text),textlength-strlen(text),"%g",value64f);
 #endif
 				}
 				else
diff --git a/src/shared/dlt_offline_trace.c b/src/shared/dlt_offline_trace.c
index be29831..554e2d5 100644
--- a/src/shared/dlt_offline_trace.c
+++ b/src/shared/dlt_offline_trace.c
@@ -76,7 +76,7 @@ int dlt_offline_trace_create_new_file(DltOfflineTrace *trace) {
     }
     if (strftime(outstr, sizeof(outstr),"%Y%m%d_%H%M%S", tmp) == 0) {
     }
-	sprintf(trace->filename,"%s/dlt_offlinetrace_%s.dlt",trace->directory,outstr);
+	snprintf(trace->filename,NAME_MAX + 1,"%s/dlt_offlinetrace_%s.dlt",trace->directory,outstr);
 
     /* open DLT output file */
 	trace->ohandle = open(trace->filename,O_WRONLY|O_CREAT, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH); /* mode: wb */
@@ -129,8 +129,8 @@ unsigned long dlt_offline_trace_get_total_size(DltOfflineTrace *trace) {
 
 int dlt_offline_trace_delete_oldest_file(DltOfflineTrace *trace) {
 	struct dirent *dp;
-	char filename[256];
-	char filename_oldest[256];
+	char filename[PATH_MAX+1];
+	char filename_oldest[PATH_MAX+1];
 	unsigned long size_oldest = 0;
 	struct stat status;
 	time_t time_oldest = 0;
@@ -153,7 +153,8 @@ int dlt_offline_trace_delete_oldest_file(DltOfflineTrace *trace) {
 						if(time_oldest == 0 || status.st_mtime < time_oldest) {
 								time_oldest = status.st_mtime;
 								size_oldest = status.st_size;
-								strcpy(filename_oldest,filename);
+								strncpy(filename_oldest,filename,PATH_MAX);
+								filename_oldest[PATH_MAX]=0;
 						}
 					}
 					else
@@ -196,7 +197,8 @@ int dlt_offline_trace_check_size(DltOfflineTrace *trace) {
 int dlt_offline_trace_init(DltOfflineTrace *trace,const char *directory,int fileSize,int maxSize) {
 
 	/* init parameters */
-        strncpy(trace->directory,directory,NAME_MAX);
+    strncpy(trace->directory,directory,NAME_MAX);
+    trace->directory[NAME_MAX]=0;
 	trace->fileSize = fileSize;
 	trace->maxSize = maxSize;
 
diff --git a/src/system/dlt-system-filetransfer.c b/src/system/dlt-system-filetransfer.c
index 72fe630..5cfcf09 100644
--- a/src/system/dlt-system-filetransfer.c
+++ b/src/system/dlt-system-filetransfer.c
@@ -368,7 +368,7 @@ int flush_dir_send(FiletransferOptions const *opts, const char *compress_dir,  c
                 //old file name (not: path) would have been:
                 char tmp[strlen(dp->d_name)-strlen(COMPRESS_EXTENSION)+1];
                 strncpy(tmp,dp->d_name,strlen(dp->d_name)-strlen(COMPRESS_EXTENSION));
-                tmp[strlen(dp->d_name)-3]='\0';
+                tmp[strlen(dp->d_name)-strlen(COMPRESS_EXTENSION)]='\0';
 
                 int len = strlen(tmp)+strlen(compress_dir)+1+1;//2 sizes + 1*"/" + \0
                 char *path_uncompressed = malloc(len);
diff --git a/src/system/dlt-system-journal.c b/src/system/dlt-system-journal.c
index d6c99c1..926cd17 100644
--- a/src/system/dlt-system-journal.c
+++ b/src/system/dlt-system-journal.c
@@ -112,7 +112,7 @@ int dlt_system_journal_get(sd_journal* j,char *target,const char *field,size_t m
 	{
 		// truncate
 		strncpy(target,data+field_size,max_size-1);
-		target[max_size]=0;
+		target[max_size-1]=0;
 	}
 	else
 	{
diff --git a/src/system/dlt-system-options.c b/src/system/dlt-system-options.c
index 113089b..3b4195d 100644
--- a/src/system/dlt-system-options.c
+++ b/src/system/dlt-system-options.c
@@ -62,7 +62,7 @@
 void usage(char *prog_name)
 {
 	char version[255];
-	dlt_get_version(version);
+	dlt_get_version(version,255);
 
 	printf("Usage: %s [options]\n", prog_name);
 	printf("Application to forward syslog messages to DLT, transfer system information, logs and files.\n");
@@ -103,7 +103,7 @@ int read_command_line(DltSystemCliOptions *options, int argc, char *argv[])
 			{
 				options->ConfigurationFileName = malloc(strlen(optarg)+1);
 				MALLOC_ASSERT(options->ConfigurationFileName);
-				strcpy(options->ConfigurationFileName, optarg);
+				strcpy(options->ConfigurationFileName, optarg); /* strcpy unritical here, because size matches exactly the size to be copied */
 				break;
 			}
 			case 'h':
@@ -226,11 +226,13 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 
 			if(token[0] == 0)
 			{
-				strncpy(token, pch, MAX_LINE);
+				strncpy(token, pch, MAX_LINE-1);
+				token[MAX_LINE-1]=0;
 			}
 			else
 			{
 				strncpy(value, pch, MAX_LINE);
+				value[MAX_LINE-1]=0;
 				break;
 			}
 
@@ -244,7 +246,7 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->ApplicationId = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->ApplicationId);
-				strcpy(config->ApplicationId, value);
+				strcpy(config->ApplicationId, value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 
 			// Shell
@@ -262,7 +264,7 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->Syslog.ContextId = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->Syslog.ContextId);
-				strcpy(config->Syslog.ContextId, value);
+				strcpy(config->Syslog.ContextId, value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "SyslogPort") == 0)
 			{
@@ -278,7 +280,7 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->Journal.ContextId = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->Journal.ContextId);
-				strcpy(config->Journal.ContextId, value);
+				strcpy(config->Journal.ContextId, value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "JournalCurrentBoot") == 0)
 			{
@@ -302,7 +304,7 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->Filetransfer.ContextId = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->Filetransfer.ContextId);
-				strcpy(config->Filetransfer.ContextId, value);
+				strcpy(config->Filetransfer.ContextId, value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "FiletransferTimeStartup") == 0)
 			{
@@ -320,13 +322,13 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->Filetransfer.TempDir = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->Filetransfer.TempDir);
-				strcpy(config->Filetransfer.TempDir, value);
+				strcpy(config->Filetransfer.TempDir, value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "FiletransferDirectory") == 0)
 			{
 				config->Filetransfer.Directory[config->Filetransfer.Count] = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->Filetransfer.Directory[config->Filetransfer.Count]);
-				strcpy(config->Filetransfer.Directory[config->Filetransfer.Count], value);
+				strcpy(config->Filetransfer.Directory[config->Filetransfer.Count], value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "FiletransferCompression") == 0)
 			{
@@ -358,7 +360,7 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->LogFile.Filename[config->LogFile.Count] = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->LogFile.Filename[config->LogFile.Count]);
-				strcpy(config->LogFile.Filename[config->LogFile.Count], value);
+				strcpy(config->LogFile.Filename[config->LogFile.Count], value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "LogFileMode") == 0)
 			{
@@ -372,7 +374,7 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->LogFile.ContextId[config->LogFile.Count] = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->LogFile.ContextId[config->LogFile.Count]);
-				strcpy(config->LogFile.ContextId[config->LogFile.Count], value);
+				strcpy(config->LogFile.ContextId[config->LogFile.Count], value); /* strcpy unritical here, because size matches exactly the size to be copied */
 				if(config->LogFile.Count < (DLT_SYSTEM_LOG_FILE_MAX - 1))
 				{
 					config->LogFile.Count++;
@@ -397,19 +399,19 @@ int read_configuration_file(DltSystemConfiguration *config, char *file_name)
 			{
 				config->LogProcesses.ContextId = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->LogProcesses.ContextId);
-				strcpy(config->LogProcesses.ContextId, value);
+				strcpy(config->LogProcesses.ContextId, value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "LogProcessName") == 0)
 			{
 				config->LogProcesses.Name[config->LogProcesses.Count] = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->LogProcesses.Name[config->LogProcesses.Count]);
-				strcpy(config->LogProcesses.Name[config->LogProcesses.Count], value);
+				strcpy(config->LogProcesses.Name[config->LogProcesses.Count], value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "LogProcessFilename") == 0)
 			{
 				config->LogProcesses.Filename[config->LogProcesses.Count] = malloc(strlen(value)+1);
 				MALLOC_ASSERT(config->LogProcesses.Filename[config->LogProcesses.Count]);
-				strcpy(config->LogProcesses.Filename[config->LogProcesses.Count], value);
+				strcpy(config->LogProcesses.Filename[config->LogProcesses.Count], value); /* strcpy unritical here, because size matches exactly the size to be copied */
 			}
 			else if(strcmp(token, "LogProcessMode") == 0)
 			{
diff --git a/src/system/dlt-system-processes.c b/src/system/dlt-system-processes.c
index 495c784..4457f50 100644
--- a/src/system/dlt-system-processes.c
+++ b/src/system/dlt-system-processes.c
@@ -69,7 +69,7 @@ void send_process(LogProcessOptions const *popts, int n)
 			DLT_STRING("dlt-system-processes, send process info."));
 	FILE * pFile;
 	struct dirent *dp;
-	char filename[256];
+	char filename[PATH_MAX];
 	char buffer[1024];
 	int bytes;
 	int found = 0;
@@ -83,7 +83,7 @@ void send_process(LogProcessOptions const *popts, int n)
 			if(isdigit(dp->d_name[0]))
 			{
 				buffer[0] = 0;
-				sprintf(filename, "/proc/%s/cmdline",dp->d_name);
+				snprintf(filename,PATH_MAX, "/proc/%s/cmdline",dp->d_name);
 				pFile = fopen(filename, "r");
 				if(pFile != NULL)
 				{
@@ -94,7 +94,7 @@ void send_process(LogProcessOptions const *popts, int n)
                    (strcmp(buffer, (*popts).Name[n])==0))
 				{
 					found = 1;
-                    sprintf(filename, "/proc/%s/%s", dp->d_name,(*popts).Filename[n]);
+                    snprintf(filename,PATH_MAX, "/proc/%s/%s", dp->d_name,(*popts).Filename[n]);
 					pFile = fopen(filename, "r");
 					if(pFile != NULL)
 					{
diff --git a/src/system/dlt-system-shell.c b/src/system/dlt-system-shell.c
index 5a35593..1c875fb 100644
--- a/src/system/dlt-system-shell.c
+++ b/src/system/dlt-system-shell.c
@@ -69,14 +69,14 @@ int dlt_shell_injection_callback(uint32_t service_id, void *data, uint32_t lengt
 	char text[DLT_SHELL_COMMAND_MAX_LENGTH];
     int syserr = 0;
 
-	if(length<DLT_SHELL_COMMAND_MAX_LENGTH-2)
+	if(length<=DLT_SHELL_COMMAND_MAX_LENGTH-1)
 	{
 		strncpy(text,data,length);
 		text[length] = 0;			
 	}
 	else
 	{
-		strncpy(text,data,DLT_SHELL_COMMAND_MAX_LENGTH-2);
+		strncpy(text,data,DLT_SHELL_COMMAND_MAX_LENGTH-1);
 		text[DLT_SHELL_COMMAND_MAX_LENGTH-1] = 0;	
 	}
 	
diff --git a/src/system/dlt-system-watchdog.c b/src/system/dlt-system-watchdog.c
index 5f7d124..c44b9b3 100644
--- a/src/system/dlt-system-watchdog.c
+++ b/src/system/dlt-system-watchdog.c
@@ -135,7 +135,7 @@ void watchdog_thread(void *v_conf)
 			// Calculate half of WATCHDOG_USEC in ns for timer tick
 			notifiyPeriodNSec = watchdogTimeoutSeconds / 2 ;
 
-			sprintf(str,"systemd watchdog timeout: %u nsec - timer will be initialized: %u nsec\n", watchdogTimeoutSeconds, notifiyPeriodNSec );
+			snprintf(str,512,"systemd watchdog timeout: %u nsec - timer will be initialized: %u nsec\n", watchdogTimeoutSeconds, notifiyPeriodNSec );
 			DLT_LOG(watchdogContext, DLT_LOG_DEBUG,DLT_STRING(str));
 
 			if (make_periodic (notifiyPeriodNSec, &info) < 0 )
@@ -159,7 +159,7 @@ void watchdog_thread(void *v_conf)
 		}
 		else
 		{
-			sprintf(str,"systemd watchdog timeout incorrect: %u\n", watchdogTimeoutSeconds);
+			snprintf(str,512,"systemd watchdog timeout incorrect: %u\n", watchdogTimeoutSeconds);
 			DLT_LOG(watchdogContext, DLT_LOG_DEBUG,DLT_STRING(str));
 		}
 	}
diff --git a/src/tests/dlt-test-client.c b/src/tests/dlt-test-client.c
index a8f10ff..75be454 100755
--- a/src/tests/dlt-test-client.c
+++ b/src/tests/dlt-test-client.c
@@ -121,7 +121,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-test-client [options] hostname/serial_device_name\n");
     printf("Test against received data from dlt-test-user.\n");
diff --git a/src/tests/dlt-test-multi-process-client.c b/src/tests/dlt-test-multi-process-client.c
index 6aaabd8..95e622a 100644
--- a/src/tests/dlt-test-multi-process-client.c
+++ b/src/tests/dlt-test-multi-process-client.c
@@ -85,7 +85,7 @@ int receive(DltMessage *msg, void *data);
  */
 void usage(char *name) {
 	char version[255];
-	dlt_get_version(version);
+	dlt_get_version(version,255);
 
 	printf("Usage: %s [options] <remote address|serial device>\n", name);
 	printf("Receive messages from dlt-test-multi-process.\n");
@@ -281,6 +281,11 @@ int receive(DltMessage *msg, void *data) {
 
 	int buflen = msg->datasize + 1;
 	char *buf = malloc(buflen);
+	if(buf==0)
+	{
+		printf("Out of memory\n");
+		return -1;
+	}
 	memset(buf, 0, buflen);
 
 	dlt_message_payload(msg,buf,buflen-1,DLT_OUTPUT_ASCII,0);
diff --git a/src/tests/dlt-test-multi-process.c b/src/tests/dlt-test-multi-process.c
index be5431b..bb81cb3 100755
--- a/src/tests/dlt-test-multi-process.c
+++ b/src/tests/dlt-test-multi-process.c
@@ -94,7 +94,7 @@ unsigned int pidcount = 0;
 void usage(char *prog_name)
 {
 	char version[255];
-	dlt_get_version(version);
+	dlt_get_version(version,255);
 	s_parameters defaults;
 	init_params(&defaults);
 
@@ -298,8 +298,8 @@ void do_logging(s_thread_data *data)
 	char 			ctid_name[256];
 
 
-    sprintf(ctid,"%.2x", rand() & 0x0000ffff);
-	sprintf(ctid_name, "Child %s in dlt-test-multi-process", ctid);
+    snprintf(ctid,5,"%.2x", rand() & 0x0000ffff);
+	snprintf(ctid_name,256, "Child %s in dlt-test-multi-process", ctid);
 	DLT_REGISTER_CONTEXT(mycontext, ctid, ctid_name);
 
 	int msgs_left = data->params.nmsgs;
@@ -324,8 +324,8 @@ void run_threads(s_parameters params)
 
 	srand(getpid());
 
-    sprintf(apid,"MT%02u", pidcount);
-    sprintf(apid_name, "Apps %s.", apid);
+    snprintf(apid,5,"MT%02u", pidcount);
+    snprintf(apid_name,256, "Apps %s.", apid);
 
 	DLT_REGISTER_APP(apid, apid_name);
 
diff --git a/src/tests/dlt-test-stress-client.c b/src/tests/dlt-test-stress-client.c
index b9e54ad..e3498c0 100644
--- a/src/tests/dlt-test-stress-client.c
+++ b/src/tests/dlt-test-stress-client.c
@@ -129,7 +129,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-test-stress-client [options] hostname/serial_device_name\n");
     printf("Test against received data from dlt-test-stress-user.\n");
diff --git a/src/tests/dlt-test-stress-user.c b/src/tests/dlt-test-stress-user.c
index 648f61c..6f0683f 100644
--- a/src/tests/dlt-test-stress-user.c
+++ b/src/tests/dlt-test-stress-user.c
@@ -98,7 +98,7 @@ void usage()
 {
 	char version[255];
 
-	dlt_get_version(version);
+	dlt_get_version(version,255);
 
 	printf("Usage: dlt-test-stress-user [options]\n");
 	printf("Test user application providing Test messages.\n");
diff --git a/src/tests/dlt-test-stress.c b/src/tests/dlt-test-stress.c
index 2f50e7e..650aecd 100755
--- a/src/tests/dlt-test-stress.c
+++ b/src/tests/dlt-test-stress.c
@@ -102,7 +102,7 @@ void usage()
 {
     char version[255];
 
-    dlt_get_version(version);
+    dlt_get_version(version,255);
 
     printf("Usage: dlt-test-stress [options]\n");
     printf("Test application executing several stress tests.\n");
@@ -248,7 +248,7 @@ void stress1(void)
     {
         /* Generate id */
         memset(ctid,0,5);
-        sprintf(ctid,"%d",i);
+        snprintf(ctid,5,"%d",i);
 
         //printf("%i: '%s' \n",i,ctid);
 
@@ -322,7 +322,7 @@ void thread_function(void)
     memset(ctid,0,5);
 
     /* Create random context id */
-    sprintf(ctid,"%.2x", rand() & 0x0000ffff);
+    snprintf(ctid,5,"%.2x", rand() & 0x0000ffff);
 
     usleep(rand()/1000);
 
diff --git a/src/tests/dlt-test-user.c b/src/tests/dlt-test-user.c
index c5940f2..6d6045f 100755
--- a/src/tests/dlt-test-user.c
+++ b/src/tests/dlt-test-user.c
@@ -122,7 +122,7 @@ void usage()
 {
 	char version[255];
 
-	dlt_get_version(version);
+	dlt_get_version(version,255);
 
 	printf("Usage: dlt-test-user [options]\n");
 	printf("Test user application providing several Tests.\n");