diff --git a/common/rfb/SConnection.cxx b/common/rfb/SConnection.cxx
index c5c9038..6b81055 100644
--- a/common/rfb/SConnection.cxx
+++ b/common/rfb/SConnection.cxx
@@ -116,11 +116,9 @@
 
   if (cp.majorVersion != 3) {
     // unknown protocol version
-    char msg[256];
-    sprintf(msg,"Error: client needs protocol version %d.%d, server has %d.%d",
-            cp.majorVersion, cp.minorVersion,
-            defaultMajorVersion, defaultMinorVersion);
-    throwConnFailedException(msg);
+    throwConnFailedException("Client needs protocol version %d.%d, server has %d.%d",
+                             cp.majorVersion, cp.minorVersion,
+                             defaultMajorVersion, defaultMinorVersion);
   }
 
   if (cp.minorVersion != 3 && cp.minorVersion != 7 && cp.minorVersion != 8) {
@@ -150,10 +148,8 @@
       if (*i == secTypeNone || *i == secTypeVncAuth) break;
     }
     if (i == secTypes.end()) {
-      char msg[256];
-      sprintf(msg,"No supported security type for %d.%d client",
-              cp.majorVersion, cp.minorVersion);
-      throwConnFailedException(msg);
+      throwConnFailedException("No supported security type for %d.%d client",
+                               cp.majorVersion, cp.minorVersion);
     }
 
     os->writeU32(*i);
@@ -204,7 +200,7 @@
     state_ = RFBSTATE_SECURITY;
     ssecurity = security.GetSSecurity(secType);
   } catch (rdr::Exception& e) {
-    throwConnFailedException(e.str());
+    throwConnFailedException("%s", e.str());
   }
 
   processSecurityMsg();
@@ -236,22 +232,31 @@
   reader_->readClientInit();
 }
 
-void SConnection::throwConnFailedException(const char* msg)
+void SConnection::throwConnFailedException(const char* format, ...)
 {
-  vlog.info("%s", msg);
+	va_list ap;
+	char str[256];
+
+	va_start(ap, format);
+	(void) vsnprintf(str, sizeof(str), format, ap);
+	va_end(ap);
+
+  vlog.info("Connection failed: %s", str);
+
   if (state_ == RFBSTATE_PROTOCOL_VERSION) {
     if (cp.majorVersion == 3 && cp.minorVersion == 3) {
       os->writeU32(0);
-      os->writeString(msg);
+      os->writeString(str);
       os->flush();
     } else {
       os->writeU8(0);
-      os->writeString(msg);
+      os->writeString(str);
       os->flush();
     }
   }
+
   state_ = RFBSTATE_INVALID;
-  throw ConnFailedException(msg);
+  throw ConnFailedException(str);
 }
 
 void SConnection::writeConnFailedFromScratch(const char* msg,
@@ -301,15 +306,17 @@
   if (state_ != RFBSTATE_QUERYING)
     throw Exception("SConnection::approveConnection: invalid state");
 
-  if (!reason) reason = "Authentication failure";
-
   if (!cp.beforeVersion(3,8) || ssecurity->getType() != secTypeNone) {
     if (accept) {
       os->writeU32(secResultOK);
     } else {
       os->writeU32(secResultFailed);
-      if (!cp.beforeVersion(3,8)) // 3.8 onwards have failure message
-        os->writeString(reason);
+      if (!cp.beforeVersion(3,8)) { // 3.8 onwards have failure message
+        if (reason)
+          os->writeString(reason);
+        else
+          os->writeString("Authentication failure");
+      }
     }
     os->flush();
   }
@@ -321,7 +328,10 @@
     authSuccess();
   } else {
     state_ = RFBSTATE_INVALID;
-    throw AuthFailureException(reason);
+    if (reason)
+      throw AuthFailureException(reason);
+    else
+      throw AuthFailureException();
   }
 }