diff --git a/CHANGES b/CHANGES
index f39545b..7355376 100644
--- a/CHANGES
+++ b/CHANGES
@@ -25,6 +25,20 @@ The following are the changes from calc version 2.12.6.6 to date:
     This helps with an interactive bug that was reported by Ruslan Kabatsayev
     (b7 dot 10110111 at gmail dot com).
 
+    The calc man page indicates that -d also disables the printing of the
+    leading tilde.
+
+    Added information to "help command" about how to silence messages
+    while reading calc resource files.
+
+    Fixed an error message buffer overflow thanks to a report by
+    Frank Peters <nlp at northernlightsphoto dot biz>.
+
+    Replaced all use of the C funcion sprintf() with snprintf().
+    Replaced all use of the C funcion vsprintf() with vsnprintf().
+    Replaced all DONT_HAVE_VSPRINTF with DONT_HAVE_VSNPRINTF.
+    Replaced all Makefile var ${HAVE_VSPRINTF} with ${HAVE_VSNPRINTF}.
+
 
 The following are the changes from calc version 2.12.6.4 to 2.12.6.5:
 
diff --git a/Makefile.ship b/Makefile.ship
index 16c203f..d367c70 100644
--- a/Makefile.ship
+++ b/Makefile.ship
@@ -90,29 +90,29 @@ TERMCONTROL=
 #TERMCONTROL= -DUSE_SGTTY
 #TERMCONTROL= -DUSE_WIN32
 
-# If your system does not have a vsprintf() function, you could be in trouble.
+# If your system does not have a vsnprintf() function, you could be in trouble.
 #
-#	vsprintf(string, format, ap)
+#	vsnprintf(string, size, format, ap)
 #
-# This function works like sprintf except that the 3rd arg is a va_list
-# strarg (or varargs) list.  Some old systems do not have vsprintf().
-# If you do not have vsprintf(), then calc will try sprintf() and hope
+# This function works like spnrintf except that the 4th arg is a va_list
+# strarg (or varargs) list.  Some old systems do not have vsnprintf().
+# If you do not have vsnprintf(), then calc will try snprintf() and hope
 # for the best.
 #
 # A similar problem occurs if your system does not have a vsnprintf()
-# function.  This function is like the vsprintf() function except that
+# function.  This function is like the vsnprintf() function except that
 # there is an extra second argument that controls the maximum size
 # string that is produced.
 #
-# If HAVE_VSPRINTF is empty, this Makefile will run the have_stdvs.c and/or
-# have_varvs.c program to determine if vsprintf() is supported.  If
-# HAVE_VSPRINTF is set to -DDONT_HAVE_VSPRINTF then calc will hope that
-# sprintf() will work.
+# If HAVE_VSNPRINTF is empty, this Makefile will run the have_stdvs.c and/or
+# have_varvs.c program to determine if vsnprintf() is supported.  If
+# HAVE_VSNPRINTF is set to -DDONT_HAVE_VSNPRINTF then calc will hope that
+# snprintf() will work.
 #
-# If in doubt, leave HAVE_VSPRINTF empty.
+# If in doubt, leave HAVE_VSNPRINTF empty.
 #
-HAVE_VSPRINTF=
-#HAVE_VSPRINTF= -DDONT_HAVE_VSPRINTF
+HAVE_VSNPRINTF=
+#HAVE_VSNPRINTF= -DDONT_HAVE_VSNPRINTF
 
 # Determine the byte order of your machine
 #
@@ -1054,7 +1054,7 @@ EXT=
 
 # The default calc versions
 #
-VERSION= 2.12.6.7
+VERSION= 2.12.6.8
 
 # Names of shared libraries with versions
 #
@@ -3545,7 +3545,7 @@ args.h: have_stdvs.c have_varvs.c have_string.h have_unistd.h have_string.h
 	${Q} echo '' >> args.h
 	${Q} echo '' >> args.h
 	${Q} ${RM} -f have_stdvs.o have_stdvs${EXT}
-	-${Q} ${LCC} ${ICFLAGS} ${HAVE_VSPRINTF} have_stdvs.c -c \
+	-${Q} ${LCC} ${ICFLAGS} ${HAVE_VSNPRINTF} have_stdvs.c -c \
 		>/dev/null 2>&1; ${TRUE}
 	-${Q} ${LCC} ${ILDFLAGS} have_stdvs.o -o have_stdvs${EXT} \
 	    >/dev/null 2>&1; ${TRUE}
@@ -3554,10 +3554,10 @@ args.h: have_stdvs.c have_varvs.c have_string.h have_unistd.h have_string.h
 	else \
 	    ${TRUE}; \
 	fi
-	-${Q} if [ ! -f have_args.sh ] && [ X"${HAVE_VSPRINTF}" = X ]; then \
+	-${Q} if [ ! -f have_args.sh ] && [ X"${HAVE_VSNPRINTF}" = X ]; then \
 	    ${RM} -f have_stdvs.o have_stdvs${EXT} have_varvs.o; \
 	    ${RM} -f have_varvs${EXT}; \
-	    ${LCC} ${ICFLAGS} ${HAVE_VSPRINTF} have_varvs.c -c \
+	    ${LCC} ${ICFLAGS} ${HAVE_VSNPRINTF} have_varvs.c -c \
 		    2>/dev/null; \
 	    ${LCC} ${ILDFLAGS} have_varvs.o -o have_varvs${EXT} 2>/dev/null; \
 	    if ./have_varvs${EXT} >>args.h 2>/dev/null; then \
@@ -3573,8 +3573,8 @@ args.h: have_stdvs.c have_varvs.c have_string.h have_unistd.h have_string.h
 	else \
 	    echo 'exit 1' > have_args.sh; \
 	    echo "Unable to determine what type of variable args and"; \
-	    echo "what type of vsprintf() should be used.  Set or change"; \
-	    echo "the Makefile variable HAVE_VSPRINTF."; \
+	    echo "what type of vsnprintf() should be used.  Set or change"; \
+	    echo "the Makefile variable HAVE_VSNPRINTF."; \
 	fi
 	${Q} sh ./have_args.sh
 	${Q} echo '' >> args.h
@@ -4160,7 +4160,7 @@ env:
 	@echo 'HAVE_UNUSED=${HAVE_UNUSED}'; echo ''
 	@echo 'HAVE_URANDOM_H=${HAVE_URANDOM_H}'; echo ''
 	@echo 'HAVE_USTAT=${HAVE_USTAT}'; echo ''
-	@echo 'HAVE_VSPRINTF=${HAVE_VSPRINTF}'; echo ''
+	@echo 'HAVE_VSNPRINTF=${HAVE_VSNPRINTF}'; echo ''
 	@echo 'HELPDIR=${HELPDIR}'; echo ''
 	@echo 'HELP_PASSDOWN=${HELP_PASSDOWN}'; echo ''
 	@echo 'H_SRC=${H_SRC}'; echo ''
diff --git a/calc.c b/calc.c
index 687d917..0f5a505 100644
--- a/calc.c
+++ b/calc.c
@@ -775,7 +775,7 @@ calc_interrupt(char *fmt, ...)
 	va_start(ap, fmt);
 	vsnprintf(calc_err_msg, MAXERROR, fmt, ap);
 	va_end(ap);
-	calc_err_msg[MAXERROR] = '\0';
+	calc_err_msg[MAXERROR] = '\0';	/* paranoia */
 	fprintf(stderr, "%s\n\n", calc_err_msg);
 	funcname = NULL;
 	if (calc_use_scanerr_jmpbuf != 0) {
diff --git a/calc.man b/calc.man
index aea9d5a..0146d30 100644
--- a/calc.man
+++ b/calc.man
@@ -1,5 +1,5 @@
 .\"
-.\" Copyright (C) 1999-2007,2014	Landon Curt Noll
+.\" Copyright (C) 1999-2007,2014,2018	Landon Curt Noll
 .\"
 .\" Calc is open software; you can redistribute it and/or modify it under
 .\" the terms of the version 2.1 of the GNU Lesser General Public License
@@ -138,7 +138,7 @@ calc -d "read qtime; qtime(2)"
 .fi
 .in -5n
 .sp 1
-will just say:
+will just print:
 .sp 1
 .in +5n
 .nf
@@ -148,6 +148,41 @@ It's nearly ten past six.
 .sp 1
 This flag disables the reporting of missing calc
 startup resource files.
+.sp 1
+
+This flag also disables the printing the leading tilde. For example:
+.sp 1
+.in +5n
+.nf
+calc 2/3
+.fi
+.in -5n
+.sp 1
+will print:
+.sp 1
+.in +5n
+.nf
+~0.66666666666666666667
+.fi
+.in -5n
+.sp 1
+.sp 1
+whereas:
+.sp 1
+.in +5n
+.nf
+calc -d 2/3
+.fi
+.in -5n
+.sp 1
+will just print:
+.sp 1
+.in +5n
+.nf
+0.66666666666666666667
+.fi
+.in -5n
+.sp 1
 
 .TP
 .BR -D " calc_debug[:resource_debug[:user_debug]]"
diff --git a/custom.c b/custom.c
index 2e540d5..d8fe2d8 100644
--- a/custom.c
+++ b/custom.c
@@ -1,7 +1,7 @@
 /*
  * custom - interface for custom software and hardware interfaces
  *
- * Copyright (C) 1999-2006  Landon Curt Noll
+ * Copyright (C) 1999-2006,2018  Landon Curt Noll
  *
  * Calc is open software; you can redistribute it and/or modify it under
  * the terms of the version 2.1 of the GNU Lesser General Public License
@@ -180,6 +180,7 @@ customhelp(char *name)
 #if defined(CUSTOM)
 
 	char *customname;	/* a string of the form: custom/name */
+	size_t snprintf_len;	/* malloced snprintf buffer length */
 
 	/*
 	 * firewall
@@ -191,12 +192,14 @@ customhelp(char *name)
 	/*
 	 * form the custom help name
 	 */
-	customname = (char *)malloc(sizeof("custhelp")+1+strlen(name)+1);
+	snprintf_len = sizeof("custhelp")+1+strlen(name)+1;
+	customname = (char *)malloc(snprintf_len+1);
 	if (customname == NULL) {
 		math_error("bad malloc of customname");
 		/*NOTREACHED*/
 	}
-	sprintf(customname, "custhelp/%s", name);
+	snprintf(customname, snprintf_len, "custhelp/%s", name);
+	customname[snprintf_len] = '\0';	/* paranoia */
 
 	/*
 	 * give help directly to the custom file
diff --git a/custom/Makefile b/custom/Makefile
index dda093d..be8585a 100644
--- a/custom/Makefile
+++ b/custom/Makefile
@@ -2,7 +2,7 @@
 #
 # custom - makefile for calc custom routines
 #
-# Copyright (C) 1999-2006,2014,2017  Landon Curt Noll
+# Copyright (C) 1999-2006,2014,2017-2018  Landon Curt Noll
 #
 # Calc is open software; you can redistribute it and/or modify it under
 # the terms of the version 2.1 of the GNU Lesser General Public License
@@ -348,7 +348,7 @@ EXT=
 
 # The default calc versions
 #
-VERSION= 2.12.6.7
+VERSION= 2.12.6.8
 
 # Names of shared libraries with versions
 #
diff --git a/custom/Makefile.head b/custom/Makefile.head
index 0e0aa04..8951507 100644
--- a/custom/Makefile.head
+++ b/custom/Makefile.head
@@ -2,7 +2,7 @@
 #
 # custom - makefile for calc custom routines
 #
-# Copyright (C) 1999-2006,2014,2017  Landon Curt Noll
+# Copyright (C) 1999-2006,2014,2017-2018  Landon Curt Noll
 #
 # Calc is open software; you can redistribute it and/or modify it under
 # the terms of the version 2.1 of the GNU Lesser General Public License
@@ -348,7 +348,7 @@ EXT=
 
 # The default calc versions
 #
-VERSION= 2.12.6.7
+VERSION= 2.12.6.8
 
 # Names of shared libraries with versions
 #
diff --git a/file.c b/file.c
index 8bc73bf..63449e0 100644
--- a/file.c
+++ b/file.c
@@ -1,7 +1,7 @@
 /*
  * file - file I/O routines callable by users
  *
- * Copyright (C) 1999-2007  David I. Bell and Landon Curt Noll
+ * Copyright (C) 1999-2007,2018  David I. Bell and Landon Curt Noll
  *
  * Primary author:  David I. Bell
  *
@@ -143,6 +143,7 @@ file_init(void)
 		 * stat the descriptor to see what we have
 		 */
 		if (fstat(i, &sbuf) >= 0) {
+			size_t snprintf_len;	/* malloced snprintf length */
 			fp = (FILE *) fdopen(i,"r+");	/*guess mode*/
 			if (fp) {
 				strcpy(files[idnum].mode, "r+");
@@ -161,12 +162,15 @@ file_init(void)
 						continue;
 				}
 			}
-			tname = (char *)malloc(sizeof("descriptor[19]"));
+			snprintf_len =
+			  sizeof("descriptor[12345678901234567890]") + 1;
+			tname = (char *)malloc(snprintf_len+1);
 			if (tname == NULL) {
 				math_error("Out of memory for init_file");
 				/*NOTREACHED*/
 			}
-			sprintf(tname, "descriptor[%d]", i);
+			snprintf(tname, snprintf_len, "descriptor[%d]", i);
+			tname[snprintf_len] = '\0';	/* paranoia */
 			files[idnum].name = tname;
 			files[idnum].id = idnum;
 			files[idnum].fp = fp;
diff --git a/func.c b/func.c
index e034960..7ae68b2 100644
--- a/func.c
+++ b/func.c
@@ -1,7 +1,7 @@
 /*
  * func - built-in functions implemented here
  *
- * Copyright (C) 1999-2007  David I. Bell, Landon Curt Noll and Ernest Bowen
+ * Copyright (C) 1999-2007,2018  David I. Bell, Landon Curt Noll & Ernest Bowen
  *
  * Primary author:  David I. Bell
  *
@@ -6022,12 +6022,15 @@ f_strerror(int count, VALUE **vals)
 	/* firewall - return generic error string if it is not assigned */
 	if (i >= nexterrnum || (i > E__HIGHEST && i < E_USERDEF)
 			|| (i < E__BASE && strerror(i) == NULL)) {
-		cp = (char *) malloc(sizeof("Error 1234567890")+1);
+		size_t snprintf_len;	/* malloced snprintf buffer length */
+		snprintf_len = sizeof("Unknown error 12345678901234567890")+1;
+		cp = (char *) malloc(snprintf_len+1);
 		if (cp == NULL) {
 			math_error("Out of memory for strerror");
 			/*NOTREACHED*/
 		}
-		sprintf(cp, "Unknown error %ld", i);
+		snprintf(cp, snprintf_len, "Unknown error %ld", i);
+		cp[snprintf_len] = '\0';	/* paranoia */
 		result.v_str = makestring(cp);
 		return result;
 	}
@@ -7550,6 +7553,8 @@ f_putenv(int count, VALUE **vals)
 	 * parse args
 	 */
 	if (count == 2) {
+		size_t snprintf_len;	/* malloced snprintf buffer length */
+
 		/* firewall */
 		if (vals[0]->v_type != V_STR || vals[1]->v_type != V_STR) {
 			math_error("Non-string argument for putenv");
@@ -7557,14 +7562,17 @@ f_putenv(int count, VALUE **vals)
 		}
 
 		/* convert putenv("foo","bar") into putenv("foo=bar") */
-		putenv_str = (char *)malloc(vals[0]->v_str->s_len + 1 +
-			    vals[1]->v_str->s_len + 1);
+		snprintf_len = vals[0]->v_str->s_len + 1 +
+                               vals[1]->v_str->s_len + 1;
+		putenv_str = (char *)malloc(snprintf_len+1);
 		if (putenv_str == NULL) {
 			math_error("Cannot allocate string in putenv");
 			/*NOTREACHED*/
 		}
-		sprintf(putenv_str, "%s=%s", vals[0]->v_str->s_str,
+		snprintf(putenv_str, snprintf_len,
+			"%s=%s", vals[0]->v_str->s_str,
 			vals[1]->v_str->s_str);
+		putenv_str[snprintf_len] = '\0';	/* paranoia */
 
 
 	} else {
diff --git a/have_stdvs.c b/have_stdvs.c
index 5a6307f..eedd61f 100644
--- a/have_stdvs.c
+++ b/have_stdvs.c
@@ -1,7 +1,7 @@
 /*
- * have_stdvs - try <stdarg.h> to see if it really works with vsprintf()
+ * have_stdvs - try <stdarg.h> to see if it really works with vsnprintf()
  *
- * Copyright (C) 1999,2014  Landon Curt Noll
+ * Copyright (C) 1999,2014,2018  Landon Curt Noll
  *
  * Calc is open software; you can redistribute it and/or modify it under
  * the terms of the version 2.1 of the GNU Lesser General Public License
@@ -25,16 +25,16 @@
  */
 
 /*
- * On some systems that have both <stdarg.h> and <varargs.h>, vsprintf()
+ * On some systems that have both <stdarg.h> and <varargs.h>, vsnprintf()
  * does not work well under one type of include file.
  *
  * Some systems (such as UMIPS) have bugs in the <stdarg.h> implementation
- * that show up in vsprintf(), so we may have to try to use sprintf()
- * as if it were vsprintf() and hope for the best.
+ * that show up in vsnprintf(), so we may have to try to use snprintf()
+ * as if it were vsnprintf() and hope for the best.
  *
- * This program will output #defines and exits 0 if vsprintf() (or sprintf())
- * produces the results that we expect.	 This program exits 1 if vsprintf()
- * (or sprintf()) produces unexpected results while using the <stdarg.h>
+ * This program will output #defines and exits 0 if vsnprintf() (or snprintf())
+ * produces the results that we expect.	 This program exits 1 if vsnprintf()
+ * (or snprintf()) produces unexpected results while using the <stdarg.h>
  * include file.
  */
 
@@ -57,39 +57,24 @@
 # include <stdlib.h>
 #endif
 
-#undef VSPRINTF_SIZE_T
+#undef VSNPRINTF_SIZE_T
 #if defined(FORCE_STDC) || (defined(__STDC__) && __STDC__ != 0) || \
     defined(__cplusplus)
-# define VSPRINTF_SIZE_T size_t
+# define VSNPRINTF_SIZE_T size_t
 #else
-# define VSPRINTF_SIZE_T long
+# define VSNPRINTF_SIZE_T long
 #endif
 
-char buf[BUFSIZ];
+char buf[BUFSIZ+1];
 
 
 void
-try_this(char *fmt, ...)
-{
-	va_list ap;
-
-	va_start(ap, fmt);
-#if !defined(DONT_HAVE_VSPRINTF)
-	vsprintf(buf, fmt, ap);
-#else
-	sprintf(buf, fmt, ap);
-#endif
-	va_end(ap);
-}
-
-
-void
-try_nthis(char *fmt, VSPRINTF_SIZE_T size, ...)
+try_nthis(char *fmt, VSNPRINTF_SIZE_T size, ...)
 {
 	va_list ap;
 
 	va_start(ap, size);
-#if !defined(DONT_HAVE_VSPRINTF)
+#if !defined(DONT_HAVE_VSNPRINTF)
 	vsnprintf(buf, size, fmt, ap);
 #else
 	snprintf(buf, size, fmt, ap);
@@ -106,36 +91,12 @@ main(void)
 	 */
 	buf[0] = '\0';
 
-	/*
-	 * test variable args and vsprintf/sprintf
-	 */
-	try_this("@%d:%s:%d@", 1, "hi", 2);
-	if (strcmp(buf, "@1:hi:2@") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
-	    /* <stdarg.h> with vsprintf() didn't work */
-#else
-	    /* <stdarg.h> with sprintf() simulating vsprintf() didn't work */
-#endif
-	    exit(1);
-	}
-	try_this("%s %d%s%d%d %s",
-	    "Landon Noll 1st coproved that", 2, "^", 21701, -1, "was prime");
-	if (strcmp(buf,
-		   "Landon Noll 1st coproved that 2^21701-1 was prime") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
-	    /* <stdarg.h> with vsprintf() didn't work */
-#else
-	    /* <stdarg.h> with sprintf() simulating vsprintf() didn't work */
-#endif
-	    exit(1);
-	}
-
 	/*
 	 * test variable args and vsnprintf/snprintf
 	 */
 	try_nthis("@%d:%s:%d@", sizeof(buf)-1, 1, "hello", 5);
 	if (strcmp(buf, "@1:hello:5@") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
+#if !defined(DONT_HAVE_VSNPRINTF)
 	    /* <stdarg.h> with vsnprintf() didn't work */
 #else
 	    /* <stdarg.h> with snprintf() simulating vsnprintf() didn't work */
@@ -146,7 +107,7 @@ main(void)
 	    "Landon Noll 1st proved that", 2, "^", 23209, -1, "was prime");
 	if (strcmp(buf,
 		   "Landon Noll 1st proved that 2^23209-1 was prime") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
+#if !defined(DONT_HAVE_VSNPRINTF)
 	    /* <stdarg.h> with vsnprintf() didn't work */
 #else
 	    /* <stdarg.h> with snprintf() simulating vsnprintf() didn't work */
@@ -158,7 +119,7 @@ main(void)
 	 * report the result
 	 */
 	puts("/* what type of variable args do we have? */");
-#if defined(DONT_HAVE_VSPRINTF)
+#if defined(DONT_HAVE_VSNPRINTF)
 	puts("/*");
 	puts(" * SIMULATE_STDARG");
 	puts(" *");
@@ -179,22 +140,21 @@ main(void)
 	puts("#define STDARG /* use <stdarg.h> */");
 	puts("#include <stdarg.h>");
 #endif
-	puts("\n/* should we use vsprintf() and vsnprintf()? */");
-#if !defined(DONT_HAVE_VSPRINTF)
-	puts("#define HAVE_VSPRINTF /* yes */");
+	puts("\n/* should we use vsnprintf() and vsnprintf()? */");
+#if !defined(DONT_HAVE_VSNPRINTF)
+	puts("#define HAVE_VSNPRINTF /* yes */");
 #else
 	puts("/*");
 	puts(" * Hack aleart!!!");
 	puts(" *");
-	puts(" * Systems that do not have vsprintf() need something.  In some");
-	puts(" * cases the sprintf function will deal correctly with the");
-	puts(" * va_alist 3rd arg.  Same gors for a lack of an vsnprintf()");
+	puts(" * Systems that do not have vsnprintf() need something. In some");
+	puts(" * cases the snprintf function will deal correctly with the");
+	puts(" * va_alist 4th arg.  Same gors for a lack of an vsnprintf()");
 	puts(" * function.  In either case we use the #defines below and");
 	puts(" * hope for the best!");
 	puts(" */");
-	puts("#define vsprintf sprintf");
 	puts("#define vsnprintf snprintf");
-	puts("#undef HAVE_VSPRINTF");
+	puts("#undef HAVE_VSNPRINTF");
 #endif
 	/* exit(0); */
 	return 0;
diff --git a/have_varvs.c b/have_varvs.c
index cacff86..0ccf450 100644
--- a/have_varvs.c
+++ b/have_varvs.c
@@ -1,7 +1,7 @@
 /*
- * have_varvs - try <varargs.h> to see if it really works with vsprintf()
+ * have_varvs - try <varargs.h> to see if it really works with vsnprintf()
  *
- * Copyright (C) 1999  Landon Curt Noll
+ * Copyright (C) 1999,2018  Landon Curt Noll
  *
  * Calc is open software; you can redistribute it and/or modify it under
  * the terms of the version 2.1 of the GNU Lesser General Public License
@@ -26,12 +26,12 @@
 
 /*
  * Some systems have bugs in the <varargs.h> implementation that show up in
- * vsprintf(), so we may have to try to use sprintf() as if it were vsprintf()
- * and hope for the best.
+ * vsnprintf(), so we may have to try to use snprintf() as if it were
+ * vsnprintf() and hope for the best.
  *
- * This program will output #defines and exits 0 if vsprintf() (or sprintf())
- * produces the results that we expect.	 This program exits 1 if vsprintf()
- * (or sprintf()) produces unexpected results while using the <stdarg.h>
+ * This program will output #defines and exits 0 if vsnprintf() (or snprintf())
+ * produces the results that we expect.	 This program exits 1 if vsnprintf()
+ * (or snprintf()) produces unexpected results while using the <stdarg.h>
  * include file.
  */
 
@@ -48,43 +48,27 @@
 # include <string.h>
 #endif
 
-#undef VSPRINTF_SIZE_T
+#undef VSNPRINTF_SIZE_T
 #if defined(FORCE_STDC) || (defined(__STDC__) && __STDC__ != 0) || \
     defined(__cplusplus)
-# define VSPRINTF_SIZE_T size_t
+# define VSNPRINTF_SIZE_T size_t
 #else
-# define VSPRINTF_SIZE_T long
+# define VSNPRINTF_SIZE_T long
 #endif
 
-char buf[BUFSIZ];
+char buf[BUFSIZ+1];
 
 #if !defined(STDARG) && !defined(SIMULATE_STDARG)
 #include <varargs.h>
 
 void
-try_this(char *fmt, ...)
+try_nthis(char *fmt, VSNPRINTF_SIZE_T size, ...)
 {
     va_list ap;
 
     va_start(ap);
 
-#if !defined(DONT_HAVE_VSPRINTF)
-    vsprintf(buf, fmt, ap);
-#else
-    sprintf(buf, fmt, ap);
-#endif
-
-    va_end(ap);
-}
-
-void
-try_nthis(char *fmt, VSPRINTF_SIZE_T size, ...)
-{
-    va_list ap;
-
-    va_start(ap);
-
-#if !defined(DONT_HAVE_VSPRINTF)
+#if !defined(DONT_HAVE_VSNPRINTF)
     vsnprintf(buf, size, fmt, ap);
 #else
     snprintf(buf, size, fmt, ap);
@@ -96,13 +80,7 @@ try_nthis(char *fmt, VSPRINTF_SIZE_T size, ...)
 #else
 
 void
-try_this(char *a, int b, char *c, int d)
-{
-    return;
-}
-
-void
-try_nthis(char *a, VSPRINTF_SIZE_T size, int b, char *c, int d)
+try_nthis(char *a, VSNPRINTF_SIZE_T size, int b, char *c, int d)
 {
     return;
 }
@@ -118,36 +96,12 @@ main(void)
 	 */
 	buf[0] = '\0';
 
-	/*
-	 * test variable args and vsprintf/sprintf
-	 */
-	try_this("@%d:%s:%d@", 1, "hi", 2);
-	if (strcmp(buf, "@1:hi:2@") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
-	    /* <varargs.h> with vsprintf() didn't work */
-#else
-	    /* <varargs.h> with sprintf() simulating vsprintf() didn't work */
-#endif
-	    exit(1);
-	}
-	try_this("%s %d%s%d%d %s",
-	    "Landon Noll 1st proved that", 2, "^", 23209, -1, "was prime");
-	if (strcmp(buf,
-		   "Landon Noll 1st proved that 2^23209-1 was prime") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
-	    /* <varargs.h> with vsprintf() didn't work */
-#else
-	    /* <varargs.h> with sprintf() simulating vsprintf() didn't work */
-#endif
-	    exit(1);
-	}
-
 	/*
 	 * test variable args and vsnprintf/snprintf
 	 */
 	try_nthis("@%d:%s:%d@", sizeof(buf)-1, 1, "hello", 5);
 	if (strcmp(buf, "@1:hello:5@") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
+#if !defined(DONT_HAVE_VSNPRINTF)
 	    /* <varargs.h> with vsnprintf() didn't work */
 #else
 	    /* <varargs.h> with snprintf() simulating vsnprintf() didn't work */
@@ -158,7 +112,7 @@ main(void)
 	    "Landon Noll 1st proved that", 2, "^", 23209, -1, "was prime");
 	if (strcmp(buf,
 		   "Landon Noll 1st proved that 2^23209-1 was prime") != 0) {
-#if !defined(DONT_HAVE_VSPRINTF)
+#if !defined(DONT_HAVE_VSNPRINTF)
 	    /* <varargs.h> with vsnprintf() didn't work */
 #else
 	    /* <varargs.h> with snprintf() simulating vsnprintf() didn't work */
@@ -172,22 +126,21 @@ main(void)
 	puts("/* what type of variable args do we have? */");
 	puts("#define VARARGS /* use <varargs.h> */");
 	puts("#include <varargs.h>");
-	puts("\n/* should we use vsprintf() and vsnprintf()? */");
-#if !defined(DONT_HAVE_VSPRINTF)
-	puts("#define HAVE_VSPRINTF /* yes */");
+	puts("\n/* should we use vsnprintf() and vsnprintf()? */");
+#if !defined(DONT_HAVE_VSNPRINTF)
+	puts("#define HAVE_VSNPRINTF /* yes */");
 #else
 	puts("/*");
 	puts(" * Hack aleart!!!");
 	puts(" *");
-	puts(" * Systems that do not have vsprintf() need something.  In some");
-	puts(" * cases the sprintf function will deal correctly with the");
-	puts(" * va_alist 3rd arg.  Same gors for a lack of an vsnprintf()");
+	puts(" * Systems that do not have vsnprintf() need something. In some");
+	puts(" * cases the snprintf() function will deal correctly with the");
+	puts(" * va_alist 4th arg.  Same gors for a lack of an vsnprintf()");
 	puts(" * function.  In either case we use the #defines below and");
 	puts(" * hope for the best!");
 	puts(" */");
-	puts("#define vsprintf sprintf");
 	puts("#define vsnprintf snprintf");
-	puts("#undef HAVE_VSPRINTF");
+	puts("#undef HAVE_VSNPRINTF");
 #endif
 	/* exit(0); */
 	return 0;
diff --git a/help.c b/help.c
index aeb5a23..7722243 100644
--- a/help.c
+++ b/help.c
@@ -1,7 +1,7 @@
 /*
  * help - display help for calc
  *
- * Copyright (C) 1999-2007,2014  Landon Curt Noll
+ * Copyright (C) 1999-2007,2014,2018  Landon Curt Noll
  *
  * Calc is open software; you can redistribute it and/or modify it under
  * the terms of the version 2.1 of the GNU Lesser General Public License
@@ -183,6 +183,7 @@ givehelp(char *type)
 	FILE *stream;		/* help file stream */
 	char *helppath;		/* path to the help file */
 	char *c;
+	size_t snprintf_len;	/* malloced snprintf buffer length */
 
 	/*
 	 * check permissions to see if we are allowed to help
@@ -247,18 +248,21 @@ givehelp(char *type)
 	 */
 #if defined(CUSTOM)
 	if (sizeof(CUSTOMHELPDIR) > sizeof(HELPDIR)) {
-		helppath = (char *)malloc(sizeof(CUSTOMHELPDIR)+1+strlen(type));
+		snprintf_len = sizeof(CUSTOMHELPDIR)+1+strlen(type) + 1;
 	} else {
-		helppath = (char *)malloc(sizeof(HELPDIR)+1+strlen(type));
+		snprintf_len = sizeof(HELPDIR)+1+strlen(type) + 1;
 	}
+	helppath = (char *)malloc(snprintf_len+1);
 #else /* CUSTOM */
-	helppath = (char *)malloc(sizeof(HELPDIR)+1+strlen(type));
+	snprintf_len = sizeof(HELPDIR)+1+strlen(type) + 1;
+	helppath = (char *)malloc(snprintf_len+1);
 #endif /* CUSTOM */
 	if (helppath == NULL) {
 		fprintf(stderr, "malloc failure in givehelp()\n");
 		return;
 	}
-	sprintf(helppath, "%s/%s", HELPDIR, type);
+	snprintf(helppath, snprintf_len, "%s/%s", HELPDIR, type);
+	helppath[snprintf_len] = '\0';	/* paranoia */
 	stream = fopen(helppath, "r");
 	if (stream != NULL) {
 
@@ -274,7 +278,8 @@ givehelp(char *type)
 	 */
 	} else {
 
-		sprintf(helppath, "%s/%s", CUSTOMHELPDIR, type);
+		snprintf(helppath, snprintf_len, "%s/%s", CUSTOMHELPDIR, type);
+		helppath[snprintf_len] = '\0';	/* paranoia */
 		stream = fopen(helppath, "r");
 		if (stream == NULL) {
 
diff --git a/help/command b/help/command
index 4a68e11..969ca2a 100644
--- a/help/command
+++ b/help/command
@@ -88,6 +88,31 @@ Command sequence
 	If the -m mode disallows opening of files for reading,
 	this command will be disabled.
 
+	To read a calc resource file without printing various
+	messages about defined functions, the "resource_debug"
+	config should be set to zero.  For example:
+
+	    read lucas;
+
+	will, by default, print messages such as:
+
+	    lucas(h,n) defined
+	    gen_u2(h,n,v1) defined
+	    gen_u0(h,n,v1) defined
+	    rodseth_xhn(x,h,n) defined
+	    gen_v1(h,n) defined
+	    ldebug(funct,str) defined
+	    legacy_gen_v1(h,n) defined
+
+        When "resource_debug" is zero, such messages are silenced.
+
+	    config("resource_debug", 0),;
+	    read lucas;
+
+	To silence such messages on the calc command line, try:
+
+	    calc -p -D :0 'read -once lucas; lucas(1, 23209);'
+
 
     write calc commands
     -------------------
@@ -350,7 +375,7 @@ Command sequence
 	statement   flow control and declaration statements
 	usage	    how to invoke the calc command and calc -options
 
-## Copyright (C) 1999-2006  Landon Curt Noll
+## Copyright (C) 1999-2006,2018  Landon Curt Noll
 ##
 ## Calc is open software; you can redistribute it and/or modify it under
 ## the terms of the version 2.1 of the GNU Lesser General Public License
diff --git a/input.c b/input.c
index 235fae5..c024564 100644
--- a/input.c
+++ b/input.c
@@ -1,7 +1,7 @@
 /*
  * input - nested input source file reader
  *
- * Copyright (C) 1999-2007,2014  David I. Bell
+ * Copyright (C) 1999-2007,2014,2018  David I. Bell
  *
  * Calc is open software; you can redistribute it and/or modify it under
  * the terms of the version 2.1 of the GNU Lesser General Public License
@@ -410,6 +410,7 @@ homeexpand(char *name)
 	char *after;		/* after the ~user or ~ */
 	char *username;		/* extracted username */
 	size_t fullpath_len;	/* length of fullpath */
+	size_t snprintf_len;	/* malloced snprintf buffer length */
 
 	/* firewall */
 	if (name[0] != HOMECHAR)
@@ -466,11 +467,13 @@ homeexpand(char *name)
 	/*
 	 * build the fullpath given the home directory
 	 */
-	fullpath = (char *)malloc(strlen(home2)+strlen(after)+1);
+	snprintf_len = strlen(home2)+strlen(after) + 1;
+	fullpath = (char *)malloc(snprintf_len+1);
 	if (fullpath == NULL) {
 		return NULL;
 	}
-	sprintf(fullpath, "%s%s", home2, after);
+	snprintf(fullpath, snprintf_len, "%s%s", home2, after);
+	fullpath[snprintf_len] = '\0';	/* paranoia */
 	return fullpath;
 #endif /* Windoz free systems */
 }
diff --git a/math_error.c b/math_error.c
index bbff588..b829dd7 100644
--- a/math_error.c
+++ b/math_error.c
@@ -83,7 +83,7 @@ math_error(char *fmt, ...)
 #endif
 	vsnprintf(calc_err_msg, MAXERROR, fmt, ap);
 	va_end(ap);
-	calc_err_msg[MAXERROR] = '\0';
+	calc_err_msg[MAXERROR] = '\0';	/* paranoia */
 
 	/*
 	 * if we should longjmp, so do
diff --git a/sha1.c b/sha1.c
index c822a0b..10dbcd2 100644
--- a/sha1.c
+++ b/sha1.c
@@ -684,7 +684,7 @@ sha1_print(HASH *state)
 		 *	 the last full update or finalization.	Thus it
 		 *	 may NOT be the actual hash value.
 		 */
-		sprintf(buf,
+		snprintf(buf, DEBUG_SIZE,
 			"sha1: 0x%08x%08x%08x%08x%08x data: %d octets",
 			(int)state->h_union.h_sha1.digest[0],
 			(int)state->h_union.h_sha1.digest[1],
@@ -692,6 +692,7 @@ sha1_print(HASH *state)
 			(int)state->h_union.h_sha1.digest[3],
 			(int)state->h_union.h_sha1.digest[4],
 			(int)state->h_union.h_sha1.datalen);
+		buf[DEBUG_SIZE] = '\0';	/* paranoia */
 		math_str(buf);
 	} else {
 		math_str("sha1 hash state");
diff --git a/token.c b/token.c
index c0836f3..27468a9 100644
--- a/token.c
+++ b/token.c
@@ -718,7 +718,7 @@ scanerror(int skip, char *fmt, ...)
 	if (name) {
 		snprintf(calc_err_msg, MAXERROR, "\"%s\", line %ld: ",
 			 name, linenumber());
-		calc_err_msg[MAXERROR] = '\0';	/* firewall */
+		calc_err_msg[MAXERROR] = '\0';	/* paranoia */
 		len = strlen(calc_err_msg);
 		if (len < MAXERROR) {
 			vsnprintf(calc_err_msg+len, MAXERROR-len, fmt, ap);
@@ -727,7 +727,7 @@ scanerror(int skip, char *fmt, ...)
 		vsnprintf(calc_err_msg, MAXERROR, fmt, ap);
 	}
 	va_end(ap);
-	calc_err_msg[MAXERROR] = '\0';
+	calc_err_msg[MAXERROR] = '\0';	/* paranoia */
 
 	/* print error message if allowed */
 	if (calc_print_scanerr_msg != 0) {
@@ -782,7 +782,7 @@ scanerror(int skip, char *fmt, ...)
 	default:
 		snprintf(calc_err_msg, MAXERROR,
 			 "Unknown skip token for scanerror\n");
-		calc_err_msg[MAXERROR] = '\0';
+		calc_err_msg[MAXERROR] = '\0';	/* paranoia */
 		if (calc_print_scanerr_msg != 0) {
 			fprintf(stderr, "%s\n\n", calc_err_msg);
 		}
@@ -823,7 +823,7 @@ warning(char *fmt, ...)
 	if (name) {
 		snprintf(calc_warn_msg, MAXERROR, "\"%s\", line %ld: ",
 			 name, linenumber());
-		calc_warn_msg[MAXERROR] = '\0';	/* firewall */
+		calc_warn_msg[MAXERROR] = '\0';	/* paranoia */
 		len = strlen(calc_warn_msg);
 		if (len < MAXERROR) {
 			vsnprintf(calc_warn_msg+len, MAXERROR-len, fmt, ap);
@@ -832,7 +832,7 @@ warning(char *fmt, ...)
 		vsnprintf(calc_warn_msg, MAXERROR, fmt, ap);
 	}
 	va_end(ap);
-	calc_warn_msg[MAXERROR] = '\0';
+	calc_warn_msg[MAXERROR] = '\0';	/* paranoia */
 
 	/* print the warning if allowed */
 	if (calc_print_scanwarn_msg != 0) {
diff --git a/version.c b/version.c
index 6811f43..ba1fab5 100644
--- a/version.c
+++ b/version.c
@@ -1,7 +1,7 @@
 /*
  * version - determine the version of calc
  *
- * Copyright (C) 1999-2017  David I. Bell and Landon Curt Noll
+ * Copyright (C) 1999-2018  David I. Bell and Landon Curt Noll
  *
  * Primary author:  David I. Bell
  *
@@ -45,7 +45,7 @@ static char *program;
 #define MAJOR_VER	2	/* major library version */
 #define MINOR_VER	12	/* minor library version */
 #define MAJOR_PATCH	6	/* major software level under library version */
-#define MINOR_PATCH	7	/* minor software level or 0 if not patched */
+#define MINOR_PATCH	8	/* minor software level or 0 if not patched */
 
 
 /*
@@ -120,6 +120,7 @@ version(void)
 	snprintf(verbuf, BUFSIZ,
 	    "%d.%d.%d.%d", calc_major_ver, calc_minor_ver,
 	     calc_major_patch, calc_minor_patch);
+	verbuf[BUFSIZ] = '\0';	/* paranoia */
 
 	/*
 	 * save the versions string into a newly malloced buffer
diff --git a/win32.mkdef b/win32.mkdef
index a422c8a..7aa6950 100644
--- a/win32.mkdef
+++ b/win32.mkdef
@@ -1,5 +1,5 @@
 TERMCONTROL=-DUSE_WIN32
-HAVE_VSPRINTF=-UDONT_HAVE_VSPRINTF
+HAVE_VSNPRINTF=-UDONT_HAVE_VSNPRINTF
 BYTE_ORDER=-DLITTLE_ENDIAN
 LONG_BITS=32
 HAVE_FPOS=-DHAVE_NO_FPOS
diff --git a/zio.c b/zio.c
index 292382d..5e2a92d 100644
--- a/zio.c
+++ b/zio.c
@@ -177,7 +177,7 @@ math_fmt(char *fmt, ...)
 	va_start(ap, fmt);
 	vsnprintf(buf, BUFSIZ, fmt, ap);
 	va_end(ap);
-	buf[BUFSIZ] = '\0';
+	buf[BUFSIZ] = '\0';	/* paranoia */
 	math_str(buf);
 }