diff --git a/engine/client/cl_cmds.c b/engine/client/cl_cmds.c
index fcc3f3cc..5d7fdc6d 100644
--- a/engine/client/cl_cmds.c
+++ b/engine/client/cl_cmds.c
@@ -145,7 +145,7 @@ void CL_PlayCDTrack_f( void )
 CL_ScreenshotGetName
 ==================
 */
-qboolean CL_ScreenshotGetName( int lastnum, char *filename )
+static qboolean CL_ScreenshotGetName( int lastnum, char *filename, size_t size )
 {
 	if( lastnum < 0 || lastnum > 9999 )
 	{
@@ -153,9 +153,7 @@ qboolean CL_ScreenshotGetName( int lastnum, char *filename )
 		return false;
 	}
 
-	Q_sprintf( filename, "scrshots/%s_shot%04d.png", clgame.mapname, lastnum );
-
-	return true;
+	return Q_snprintf( filename, size, "scrshots/%s_shot%04d.png", clgame.mapname, lastnum ) > 0;
 }
 
 /*
@@ -163,7 +161,7 @@ qboolean CL_ScreenshotGetName( int lastnum, char *filename )
 CL_SnapshotGetName
 ==================
 */
-qboolean CL_SnapshotGetName( int lastnum, char *filename )
+static qboolean CL_SnapshotGetName( int lastnum, char *filename, size_t size )
 {
 	if( lastnum < 0 || lastnum > 9999 )
 	{
@@ -172,9 +170,7 @@ qboolean CL_SnapshotGetName( int lastnum, char *filename )
 		return false;
 	}
 
-	Q_sprintf( filename, "../%s_%04d.png", clgame.mapname, lastnum );
-
-	return true;
+	return Q_snprintf( filename, size, "../%s_%04d.png", clgame.mapname, lastnum ) > 0;
 }
 
 /*
@@ -207,7 +203,7 @@ void CL_ScreenShot_f( void )
 		// scan for a free filename
 		for( i = 0; i < 9999; i++ )
 		{
-			if( !CL_ScreenshotGetName( i, checkname ))
+			if( !CL_ScreenshotGetName( i, checkname, sizeof( checkname )))
 				return;	// no namespace
 
 			if( !FS_FileExists( checkname, false ))
@@ -247,7 +243,7 @@ void CL_SnapShot_f( void )
 		// scan for a free filename
 		for( i = 0; i < 9999; i++ )
 		{
-			if( !CL_SnapshotGetName( i, checkname ))
+			if( !CL_SnapshotGetName( i, checkname, sizeof( checkname )))
 				return;	// no namespace
 
 			if( !FS_FileExists( checkname, false ))
@@ -278,7 +274,7 @@ void CL_EnvShot_f( void )
 		return;
 	}
 
-	Q_sprintf( cls.shotname, "gfx/env/%s", Cmd_Argv( 1 ));
+	Q_snprintf( cls.shotname, sizeof( cls.shotname ), "gfx/env/%s", Cmd_Argv( 1 ));
 	cls.scrshot_action = scrshot_envshot;	// build new frame for envshot
 	cls.envshot_vieworg = NULL; // no custom view
 	cls.envshot_viewsize = 0;
@@ -299,7 +295,7 @@ void CL_SkyShot_f( void )
 		return;
 	}
 
-	Q_sprintf( cls.shotname, "gfx/env/%s", Cmd_Argv( 1 ));
+	Q_snprintf( cls.shotname, sizeof( cls.shotname ),"gfx/env/%s", Cmd_Argv( 1 ));
 	cls.scrshot_action = scrshot_skyshot;	// build new frame for skyshot
 	cls.envshot_vieworg = NULL; // no custom view
 	cls.envshot_viewsize = 0;
@@ -323,7 +319,8 @@ void CL_LevelShot_f( void )
 	// check for exist
 	if( cls.demoplayback && ( cls.demonum != -1 ))
 	{
-		Q_sprintf( cls.shotname, "levelshots/%s_%s.bmp", cls.demoname, refState.wideScreen ? "16x9" : "4x3" );
+		Q_snprintf( cls.shotname, sizeof( cls.shotname ),
+			"levelshots/%s_%s.bmp", cls.demoname, refState.wideScreen ? "16x9" : "4x3" );
 		Q_snprintf( filename, sizeof( filename ), "%s.dem", cls.demoname );
 
 		// make sure what levelshot is newer than demo
@@ -332,7 +329,8 @@ void CL_LevelShot_f( void )
 	}
 	else
 	{
-		Q_sprintf( cls.shotname, "levelshots/%s_%s.bmp", clgame.mapname, refState.wideScreen ? "16x9" : "4x3" );
+		Q_snprintf( cls.shotname, sizeof( cls.shotname ),
+			"levelshots/%s_%s.bmp", clgame.mapname, refState.wideScreen ? "16x9" : "4x3" );
 
 		// make sure what levelshot is newer than bsp
 		ft1 = FS_FileTime( cl.worldmodel->name, false );
@@ -360,7 +358,7 @@ void CL_SaveShot_f( void )
 		return;
 	}
 
-	Q_sprintf( cls.shotname, DEFAULT_SAVE_DIRECTORY "%s.bmp", Cmd_Argv( 1 ));
+	Q_snprintf( cls.shotname, sizeof( cls.shotname ), DEFAULT_SAVE_DIRECTORY "%s.bmp", Cmd_Argv( 1 ));
 	cls.scrshot_action = scrshot_savegame;	// build new frame for saveshot
 }
 
diff --git a/engine/client/cl_demo.c b/engine/client/cl_demo.c
index 94bdb469..7f08a004 100644
--- a/engine/client/cl_demo.c
+++ b/engine/client/cl_demo.c
@@ -1317,16 +1317,16 @@ void CL_CheckStartupDemos( void )
 CL_DemoGetName
 ==================
 */
-static void CL_DemoGetName( int lastnum, char *filename )
+static void CL_DemoGetName( int lastnum, char *filename, size_t size )
 {
 	if( lastnum < 0 || lastnum > 9999 )
 	{
 		// bound
-		Q_strcpy( filename, "demo9999" );
+		Q_strncpy( filename, "demo9999.dem", size );
 		return;
 	}
 
-	Q_sprintf( filename, "demo%04d", lastnum );
+	Q_snprintf( filename, size, "demo%04d.dem", lastnum );
 }
 
 /*
@@ -1380,8 +1380,8 @@ void CL_Record_f( void )
 		// scan for a free filename
 		for( n = 0; n < 10000; n++ )
 		{
-			CL_DemoGetName( n, demoname );
-			if( !FS_FileExists( va( "%s.dem", demoname ), true ))
+			CL_DemoGetName( n, demoname, sizeof( demoname ));
+			if( !FS_FileExists( demoname, true ))
 				break;
 		}
 
@@ -1394,7 +1394,7 @@ void CL_Record_f( void )
 	else Q_strncpy( demoname, name, sizeof( demoname ));
 
 	// open the demo file
-	Q_sprintf( demopath, "%s.dem", demoname );
+	Q_snprintf( demopath, sizeof( demopath ), "%s.dem", demoname );
 
 	// make sure that old demo is removed
 	if( FS_FileExists( demopath, false ))
diff --git a/engine/client/keys.c b/engine/client/keys.c
index 9c65d3d7..16d0f839 100644
--- a/engine/client/keys.c
+++ b/engine/client/keys.c
@@ -434,8 +434,8 @@ void Key_Bind_f( void )
 
 	for( i = 2; i < c; i++ )
 	{
-		Q_strcat( cmd, Cmd_Argv( i ));
-		if( i != ( c - 1 )) Q_strcat( cmd, " " );
+		Q_strncat( cmd, Cmd_Argv( i ), sizeof( cmd ));
+		if( i != ( c - 1 )) Q_strncat( cmd, " ", sizeof( cmd ));
 	}
 
 	Key_SetBinding( b, cmd );
@@ -541,8 +541,8 @@ void Key_AddKeyCommands( int key, const char *kb, qboolean down )
 			if( button[0] == '+' )
 			{
 				// button commands add keynum as a parm
-				if( down ) Q_sprintf( cmd, "%s %i\n", button, key );
-				else Q_sprintf( cmd, "-%s %i\n", button + 1, key );
+				if( down ) Q_snprintf( cmd, sizeof( cmd ), "%s %i\n", button, key );
+				else Q_snprintf( cmd, sizeof( cmd ), "-%s %i\n", button + 1, key );
 				Cbuf_AddText( cmd );
 			}
 			else if( down )
diff --git a/engine/common/common.c b/engine/common/common.c
index 446a25c5..391b4e50 100644
--- a/engine/common/common.c
+++ b/engine/common/common.c
@@ -564,7 +564,7 @@ int GAME_EXPORT COM_ExpandFilename( const char *fileName, char *nameOutBuffer, i
 	// models\barney.mdl - D:\Xash3D\bshift\models\barney.mdl
 	if(( path = FS_GetDiskPath( fileName, false )) != NULL )
 	{
-		Q_sprintf( result, "%s/%s", host.rootdir, path );
+		Q_snprintf( result, sizeof( result ), "%s/%s", host.rootdir, path );
 
 		// check for enough room
 		if( Q_strlen( result ) > nameOutBufferSize )
diff --git a/engine/common/con_utils.c b/engine/common/con_utils.c
index c41206b6..87725c93 100644
--- a/engine/common/con_utils.c
+++ b/engine/common/con_utils.c
@@ -861,6 +861,7 @@ qboolean Cmd_CheckMapsList_R( qboolean fRefresh, qboolean onlyingamedir )
 	byte	buf[MAX_SYSPATH];
 	string	mpfilter;
 	char	*buffer;
+	size_t	buffersize;
 	string	result;
 	int	i, size;
 	search_t	*t;
@@ -883,7 +884,8 @@ qboolean Cmd_CheckMapsList_R( qboolean fRefresh, qboolean onlyingamedir )
 		return false;
 	}
 
-	buffer = Mem_Calloc( host.mempool, t->numfilenames * 2 * sizeof( result ));
+	buffersize = t->numfilenames * 2 * sizeof( result );
+	buffer = Mem_Calloc( host.mempool, buffersize );
 	use_filter = COM_CheckStringEmpty( GI->mp_filter ) ? true : false;
 
 	for( i = 0; i < t->numfilenames; i++ )
@@ -969,8 +971,8 @@ qboolean Cmd_CheckMapsList_R( qboolean fRefresh, qboolean onlyingamedir )
 			if( num_spawnpoints )
 			{
 				// format: mapname "maptitle"\n
-				Q_sprintf( result, "%s \"%s\"\n", mapname, message );
-				Q_strcat( buffer, result ); // add new string
+				Q_snprintf( result, sizeof( result ), "%s \"%s\"\n", mapname, message );
+				Q_strncat( buffer, result, buffersize ); // add new string
 			}
 		}
 	}
diff --git a/engine/common/host.c b/engine/common/host.c
index 1534e937..46b88de5 100644
--- a/engine/common/host.c
+++ b/engine/common/host.c
@@ -769,7 +769,7 @@ void GAME_EXPORT Host_Error( const char *error, ... )
 	recursive = true;
 	Q_strncpy( hosterror2, hosterror1, MAX_SYSPATH );
 	host.errorframe = host.framecount; // to avoid multply calls per frame
-	Q_sprintf( host.finalmsg, "Server crashed: %s", hosterror1 );
+	Q_snprintf( host.finalmsg, sizeof( host.finalmsg ), "Server crashed: %s", hosterror1 );
 
 	// clearing cmd buffer to prevent execute any commands
 	COM_InitHostState();
diff --git a/engine/common/identification.c b/engine/common/identification.c
index f51fcc19..a7d6ff7f 100644
--- a/engine/common/identification.c
+++ b/engine/common/identification.c
@@ -677,7 +677,7 @@ void ID_Init( void )
 	MD5Final( (byte*)md5, &hash );
 
 	for( i = 0; i < 16; i++ )
-		Q_sprintf( &id_md5[i*2], "%02hhx", md5[i] );
+		Q_snprintf( &id_md5[i*2], sizeof( id_md5 ) - i * 2, "%02hhx", md5[i] );
 
 #if XASH_ANDROID && !XASH_DEDICATED
 	Android_SaveID( va("%016llX", id^SYSTEM_XOR_MASK ) );
diff --git a/engine/common/imagelib/img_main.c b/engine/common/imagelib/img_main.c
index 3c749eb4..850d9774 100644
--- a/engine/common/imagelib/img_main.c
+++ b/engine/common/imagelib/img_main.c
@@ -422,7 +422,8 @@ qboolean FS_SaveImage( const char *filename, rgbdata_t *pix )
 			{
 				for( i = 0; i < 6; i++ )
 				{
-					Q_sprintf( path, format->formatstring, savename, box[i].suf, format->ext );
+					Q_snprintf( path, sizeof( path ),
+						format->formatstring, savename, box[i].suf, format->ext );
 					if( !format->savefunc( path, pix )) break; // there were errors
 					pix->buffer += pix->size; // move pointer
 				}
@@ -444,7 +445,8 @@ qboolean FS_SaveImage( const char *filename, rgbdata_t *pix )
 		{
 			if( !Q_stricmp( ext, format->ext ))
 			{
-				Q_sprintf( path, format->formatstring, savename, "", format->ext );
+				Q_snprintf( path, sizeof( path ),
+					format->formatstring, savename, "", format->ext );
 				if( format->savefunc( path, pix ))
 				{
 					// clear any force flags
diff --git a/engine/common/net_ws.c b/engine/common/net_ws.c
index 8cfde213..779b1052 100644
--- a/engine/common/net_ws.c
+++ b/engine/common/net_ws.c
@@ -732,7 +732,8 @@ const char *NET_AdrToString( const netadr_t a )
 		return s;
 	}
 
-	Q_sprintf( s, "%i.%i.%i.%i:%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3], ntohs( a.port ));
+	Q_snprintf( s, sizeof( s ),
+		"%i.%i.%i.%i:%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3], ntohs( a.port ));
 
 	return s;
 }
@@ -758,7 +759,8 @@ const char *NET_BaseAdrToString( const netadr_t a )
 		return s;
 	}
 
-	Q_sprintf( s, "%i.%i.%i.%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3] );
+	Q_snprintf( s, sizeof( s ),
+		"%i.%i.%i.%i", a.ip[0], a.ip[1], a.ip[2], a.ip[3] );
 
 	return s;
 }
diff --git a/engine/common/soundlib/snd_main.c b/engine/common/soundlib/snd_main.c
index 564f10ad..7c9e3a6e 100644
--- a/engine/common/soundlib/snd_main.c
+++ b/engine/common/soundlib/snd_main.c
@@ -90,7 +90,9 @@ wavdata_t *FS_LoadSound( const char *filename, const byte *buffer, size_t size )
 	{
 		if( anyformat || !Q_stricmp( ext, format->ext ))
 		{
-			Q_sprintf( path, format->formatstring, loadname, "", format->ext );
+			Q_snprintf( path, sizeof( path ),
+				format->formatstring, loadname, "", format->ext );
+
 			f = FS_LoadFile( path, &filesize, false );
 			if( f && filesize > 0 )
 			{
@@ -175,7 +177,9 @@ stream_t *FS_OpenStream( const char *filename )
 	{
 		if( anyformat || !Q_stricmp( ext, format->ext ))
 		{
-			Q_sprintf( path, format->formatstring, loadname, "", format->ext );
+			Q_snprintf( path, sizeof( path ),
+				format->formatstring, loadname, "", format->ext );
+
 			if(( stream = format->openfunc( path )) != NULL )
 			{
 				stream->format = format;
diff --git a/engine/server/sv_init.c b/engine/server/sv_init.c
index 06263c5a..b18565c9 100644
--- a/engine/server/sv_init.c
+++ b/engine/server/sv_init.c
@@ -997,7 +997,7 @@ qboolean SV_SpawnServer( const char *mapname, const char *startspot, qboolean ba
 
 	for( i = WORLD_INDEX; i < sv.worldmodel->numsubmodels; i++ )
 	{
-		Q_sprintf( sv.model_precache[i+1], "*%i", i );
+		Q_snprintf( sv.model_precache[i+1], sizeof( sv.model_precache[i+1] ), "*%i", i );
 		sv.models[i+1] = Mod_ForName( sv.model_precache[i+1], false, false );
 		SetBits( sv.model_precache_flags[i+1], RES_FATALIFMISSING );
 	}
diff --git a/public/crtlib.c b/public/crtlib.c
index 719c07d0..813789f4 100644
--- a/public/crtlib.c
+++ b/public/crtlib.c
@@ -490,18 +490,6 @@ int Q_snprintf( char *buffer, size_t buffersize, const char *format, ... )
 	return result;
 }
 
-int Q_sprintf( char *buffer, const char *format, ... )
-{
-	va_list	args;
-	int	result;
-
-	va_start( args, format );
-	result = Q_vsnprintf( buffer, 99999, format, args );
-	va_end( args );
-
-	return result;
-}
-
 void COM_StripColors( const char *in, char *out )
 {
 	while ( *in )
@@ -530,14 +518,14 @@ char *Q_pretifymem( float value, int digitsafterdecimal )
 	if( value > onemb )
 	{
 		value /= onemb;
-		Q_strcpy( suffix, " Mb" );
+		Q_strncpy( suffix, " Mb", sizeof( suffix ));
 	}
 	else if( value > onekb )
 	{
 		value /= onekb;
-		Q_strcpy( suffix, " Kb" );
+		Q_strncpy( suffix, " Kb", sizeof( suffix ));
 	}
-	else Q_strcpy( suffix, " bytes" );
+	else Q_strncpy( suffix, " bytes", sizeof( suffix ));
 
 	// clamp to >= 0
 	digitsafterdecimal = Q_max( digitsafterdecimal, 0 );
@@ -545,15 +533,15 @@ char *Q_pretifymem( float value, int digitsafterdecimal )
 	// if it's basically integral, don't do any decimals
 	if( fabs( value - (int)value ) < 0.00001f )
 	{
-		Q_sprintf( val, "%i%s", (int)value, suffix );
+		Q_snprintf( val, sizeof( val ), "%i%s", (int)value, suffix );
 	}
 	else
 	{
 		char fmt[32];
 
 		// otherwise, create a format string for the decimals
-		Q_sprintf( fmt, "%%.%if%s", digitsafterdecimal, suffix );
-		Q_sprintf( val, fmt, (double)value );
+		Q_snprintf( fmt, sizeof( fmt ), "%%.%if%s", digitsafterdecimal, suffix );
+		Q_snprintf( val, sizeof( val ), fmt, (double)value );
 	}
 
 	// copy from in to out
diff --git a/ref/gl/gl_rmisc.c b/ref/gl/gl_rmisc.c
index 9a5b7443..cc630573 100644
--- a/ref/gl/gl_rmisc.c
+++ b/ref/gl/gl_rmisc.c
@@ -119,7 +119,7 @@ void R_NewMap( void )
 
 		Q_strncpy( mapname, WORLDMODEL->name, sizeof( mapname ));
 		COM_StripExtension( mapname );
-		Q_sprintf( filepath, "%s_detail.txt", mapname );
+		Q_snprintf( filepath, sizeof( filepath ), "%s_detail.txt", mapname );
 
 		R_ParseDetailTextures( filepath );
 	}