diff --git a/BenchmarkGen.h b/BenchmarkGen.h
index 0b732bc..0f59848 100644
--- a/BenchmarkGen.h
+++ b/BenchmarkGen.h
@@ -4035,7 +4035,7 @@
         LOG(ERROR) << "Failed to read random data";
         return -EIO;
     }
-    if ((out = TEMP_FAILURE_RETRY(open(name, O_WRONLY|O_CREAT|O_TRUNC))) < 0) {
+    if ((out = TEMP_FAILURE_RETRY(open(name, O_WRONLY|O_CREAT|O_TRUNC, 0644))) < 0) {
         PLOG(ERROR) << "Failed to open " << name;
         return -errno;
     }
diff --git a/Loop.cpp b/Loop.cpp
index a5863b3..1127817 100644
--- a/Loop.cpp
+++ b/Loop.cpp
@@ -47,7 +47,7 @@
         struct loop_info64 li;
         int rc;
 
-        sprintf(filename, "/dev/block/loop%d", i);
+        snprintf(filename, sizeof(filename), "/dev/block/loop%d", i);
 
         if ((fd = open(filename, O_RDWR | O_CLOEXEC)) < 0) {
             if (errno != ENOENT) {
@@ -91,7 +91,7 @@
         struct loop_info64 li;
         int rc;
 
-        sprintf(filename, "/dev/block/loop%d", i);
+        snprintf(filename, sizeof(filename), "/dev/block/loop%d", i);
 
         if ((fd = open(filename, O_RDWR | O_CLOEXEC)) < 0) {
             if (errno != ENOENT) {
@@ -137,7 +137,7 @@
         int rc;
         char *secontext = NULL;
 
-        sprintf(filename, "/dev/block/loop%d", i);
+        snprintf(filename, sizeof(filename), "/dev/block/loop%d", i);
 
         /*
          * The kernel starts us off with 8 loop nodes, but more
diff --git a/Process.cpp b/Process.cpp
index 962a460..7dc0144 100644
--- a/Process.cpp
+++ b/Process.cpp
@@ -85,7 +85,7 @@
 
     // compute path to process's directory of open files
     char    path[PATH_MAX];
-    sprintf(path, "/proc/%d/fd", pid);
+    snprintf(path, sizeof(path), "/proc/%d/fd", pid);
     DIR *dir = opendir(path);
     if (!dir)
         return 0;
@@ -129,7 +129,7 @@
     FILE *file;
     char buffer[PATH_MAX + 100];
 
-    sprintf(buffer, "/proc/%d/maps", pid);
+    snprintf(buffer, sizeof(buffer), "/proc/%d/maps", pid);
     file = fopen(buffer, "r");
     if (!file)
         return 0;
@@ -155,7 +155,7 @@
     char    path[PATH_MAX];
     char    link[PATH_MAX];
 
-    sprintf(path, "/proc/%d/%s", pid, name);
+    snprintf(path, sizeof(path), "/proc/%d/%s", pid, name);
     if (readSymLink(path, link, sizeof(link)) && pathMatchesMountPoint(link, mountPoint)) 
         return 1;
     return 0;
diff --git a/bench/benchgen.py b/bench/benchgen.py
index ec14aef..bda3370 100644
--- a/bench/benchgen.py
+++ b/bench/benchgen.py
@@ -278,7 +278,7 @@
         LOG(ERROR) << "Failed to read random data";
         return -EIO;
     }
-    if ((out = TEMP_FAILURE_RETRY(open(name, O_WRONLY|O_CREAT|O_TRUNC))) < 0) {
+    if ((out = TEMP_FAILURE_RETRY(open(name, O_WRONLY|O_CREAT|O_TRUNC, 0644))) < 0) {
         PLOG(ERROR) << "Failed to open " << name;
         return -errno;
     }
diff --git a/cryptfs.c b/cryptfs.c
index b99dd56..c436c20 100644
--- a/cryptfs.c
+++ b/cryptfs.c
@@ -1064,6 +1064,7 @@
   struct dm_target_spec *tgt;
   char *crypt_params;
   char master_key_ascii[129]; /* Large enough to hold 512 bit key and null */
+  size_t buff_offset;
   int i;
 
   io = (struct dm_ioctl *) buffer;
@@ -1089,8 +1090,11 @@
 
   crypt_params = buffer + sizeof(struct dm_ioctl) + sizeof(struct dm_target_spec);
   convert_key_to_hex_ascii(master_key, crypt_ftr->keysize, master_key_ascii);
-  sprintf(crypt_params, "%s %s 0 %s 0 %s", crypt_ftr->crypto_type_name,
-          master_key_ascii, real_blk_name, extra_params);
+
+  buff_offset = crypt_params - buffer;
+  snprintf(crypt_params, sizeof(buffer) - buff_offset, "%s %s 0 %s 0 %s",
+           crypt_ftr->crypto_type_name, master_key_ascii, real_blk_name,
+           extra_params);
   crypt_params += strlen(crypt_params) + 1;
   crypt_params = (char *) (((unsigned long)crypt_params + 7) & ~8); /* Align to an 8 byte boundary */
   tgt->next = crypt_params - buffer;
@@ -1883,7 +1887,8 @@
   } else {
     /* Try mounting the file system anyway, just in case the problem's with
      * the footer, not the key. */
-    sprintf(tmp_mount_point, "%s/tmp_mnt", mount_point);
+    snprintf(tmp_mount_point, sizeof(tmp_mount_point), "%s/tmp_mnt",
+             mount_point);
     mkdir(tmp_mount_point, 0755);
     if (fs_mgr_do_mount(fstab, DATA_MNT_POINT, crypto_blkdev, tmp_mount_point)) {
       SLOGE("Error temp mounting decrypted block device\n");
diff --git a/fs/Vfat.cpp b/fs/Vfat.cpp
index 38681c9..1803c4b 100644
--- a/fs/Vfat.cpp
+++ b/fs/Vfat.cpp
@@ -139,7 +139,7 @@
     flags |= (ro ? MS_RDONLY : 0);
     flags |= (remount ? MS_REMOUNT : 0);
 
-    sprintf(mountData,
+    snprintf(mountData, sizeof(mountData),
             "utf8,uid=%d,gid=%d,fmask=%o,dmask=%o,shortname=mixed",
             ownerUid, ownerGid, permMask, permMask);