--- mc-4.6.0/doc/es/mc.1.in
+++ mc-4.6.0/doc/es/mc.1.in
@@ -1361,8 +1361,10 @@ A	Vuelca el contenido del archivo selecc
 	od -c %f
 
 B	Edita un informe de errores y lo env�a al superusuario
-	vi /tmp/mail.$$
-	mail -s "Error Midnight Commander" root < /tmp/mail.$$
+	I=`mktemp ${MC_TMPDIR:-/tmp}/mail.XXXXXX` || exit 1
+	vi $I
+	mail -s "Error Midnight Commander" root < $I
+	rm -f $I
 
 M	Lee al correo
 	emacs -f rmail
--- mc-4.6.0/doc/hu/mc.1.in
+++ mc-4.6.0/doc/hu/mc.1.in
@@ -1381,8 +1381,10 @@ A       A kiv�lasztott f�jlok list�z�sa 
         od -c %f
 
 B       A hiba le�r�s szerkeszt�se �s elk�ld�se a root-nak
-        vi /tmp/mail.$$
-        mail -s "Midnight Commander bug" root < /tmp/mail.$$
+	I=`mktemp ${MC_TMPDIR:-/tmp}/mail.XXXXXX` || exit 1
+        vi $I
+        mail -s "Midnight Commander bug" root < $I
+	rm -f $I
 
 M       Lev�l olvas�s
         emacs -f rmail
--- mc-4.6.0/doc/it/mc.1.in
+++ mc-4.6.0/doc/it/mc.1.in
@@ -1379,8 +1379,10 @@ A	Mostra un dump del file correntemente 
 	od -c %f
 
 B	Modifica un rapporto bachi e lo spedisce a root
-	vi /tmp/mail.$$
-	mail -s "Midnight Commander bug" root < /tmp/mail.$$
+	I=`mktemp ${MC_TMPDIR:-/tmp}/mail.XXXXXX` || exit 1
+	vi $I
+	mail -s "Midnight Commander bug" root < $I
+	rm -f $I
 
 M	Legge la posta
 	emacs -f rmail
--- mc-4.6.0/doc/ru/mc.1.in
+++ mc-4.6.0/doc/ru/mc.1.in
@@ -1557,8 +1557,10 @@ A	Dump the currently selected file
 	od -c %f
 
 B	Edit a bug report and send it to root
-	vi /tmp/mail.$$
-	mail -s "Midnight Commander bug" root < /tmp/mail.$$
+	I=`mktemp ${MC_TMPDIR:-/tmp}/mail.XXXXXX` || exit 1
+	vi $I
+	mail -s "Midnight Commander bug" root < $I
+	rm -f $I
 
 M	Read mail
 	emacs -f rmail
--- mc-4.6.0/edit/syntax.c
+++ mc-4.6.0/edit/syntax.c
@@ -99,7 +99,8 @@ static long compare_word_to_right (WEdit
     for (p = (unsigned char *) text, q = p + strlen ((char *) p); p < q; p++, i++) {
 	switch (*p) {
 	case '\001':
-	    p++;
+	    if (++p > q)
+		return -1;
 	    for (;;) {
 		c = edit_get_byte (edit, i);
 		if (!*p)
@@ -114,7 +115,8 @@ static long compare_word_to_right (WEdit
 	    }
 	    break;
 	case '\002':
-	    p++;
+	    if (++p > q)
+		return -1;
 	    j = 0;
 	    for (;;) {
 		c = edit_get_byte (edit, i);
@@ -150,12 +152,13 @@ static long compare_word_to_right (WEdit
 	    }
 	    break;
 	case '\003':
-	    p++;
+	    if (++p > q)
+		return -1;
 	    c = -1;
 	    for (;; i++) {
 		d = c;
 		c = edit_get_byte (edit, i);
-		for (j = 0; p[j] != '\003'; j++)
+		for (j = 0; p[j] != '\003' && p[j]; j++)
 		    if (c == p[j])
 			goto found_char2;
 		break;
@@ -163,20 +166,23 @@ static long compare_word_to_right (WEdit
 		j = c;		/* dummy command */
 	    }
 	    i--;
-	    while (*p != '\003')
+	    while (*p != '\003' && p <= q)
 		p++;
+	    if (p > q)
+		return -1;
 	    if (p[1] == d)
 		i--;
 	    break;
 	case '\004':
-	    p++;
+	    if (++p > q)
+		return -1;
 	    c = edit_get_byte (edit, i);
-	    for (; *p != '\004'; p++)
+	    for (; *p != '\004' && *p; p++)
 		if (c == *p)
 		    goto found_char3;
 	    return -1;
 	  found_char3:
-	    for (; *p != '\004'; p++);
+	    for (; *p != '\004' && *p; p++);
 	    break;
 	default:
 	    if (*p != edit_get_byte (edit, i))
@@ -534,14 +540,14 @@ this_try_alloc_color_pair (char *fg, cha
 	if (!*fg)
 	    fg = 0;
     if (fg) {
-	strcpy (f, fg);
+	g_strlcpy (f, fg, sizeof (f));
 	p = strchr (f, '/');
 	if (p)
 	    *p = '\0';
 	fg = f;
     }
     if (bg) {
-	strcpy (b, bg);
+	g_strlcpy (b, bg, sizeof (b));
 	p = strchr (b, '/');
 	if (p)
 	    *p = '\0';
@@ -637,13 +643,13 @@ static int edit_read_syntax_rules (WEdit
 	    check_a;
 	    if (!strcmp (*a, "left")) {
 		a++;
-		strcpy (whole_left, *a);
+		g_strlcpy (whole_left, *a, sizeof (whole_left));
 	    } else if (!strcmp (*a, "right")) {
 		a++;
-		strcpy (whole_right, *a);
+		g_strlcpy (whole_right, *a, sizeof (whole_right));
 	    } else {
-		strcpy (whole_left, *a);
-		strcpy (whole_right, *a);
+		g_strlcpy (whole_left, *a, sizeof (whole_left));
+		g_strlcpy (whole_right, *a, sizeof (whole_right));
 	    }
 	    a++;
 	    check_not_a;
@@ -705,8 +711,8 @@ static int edit_read_syntax_rules (WEdit
 	    bg = *a;
 	    if (*a)
 		a++;
-	    strcpy (last_fg, fg ? fg : "");
-	    strcpy (last_bg, bg ? bg : "");
+	    g_strlcpy (last_fg, fg ? fg : "", sizeof (last_fg));
+	    g_strlcpy (last_bg, bg ? bg : "", sizeof (last_bg));
 	    c->keyword[0]->color = this_try_alloc_color_pair (fg, bg);
 	    c->keyword[0]->keyword = g_strdup (" ");
 	    check_not_a;
--- mc-4.6.0/lib/cedit.menu
+++ mc-4.6.0/lib/cedit.menu
@@ -449,7 +449,7 @@ s       Invoke `shell'
 
 m       view `man'
         MAN=%{Enter name of man:}
-        TMPFILE=/tmp/mcview.$MAN.$$
+        TMPFILE=`mktemp ${MC_TMPDIR:-/tmp}/mcview.$MAN.$$` || exit 1
         man -Pcat $MAN >$TMPFILE
         mcview $TMPFILE
         rm -f $TMPFILE
--- mc-4.6.0/po/az.po
+++ mc-4.6.0/po/az.po
@@ -2411,13 +2411,13 @@ msgstr "Böyüklük:    %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " ( %d blok )"
+msgid " (%ld block)"
+msgstr " ( %ld blok )"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " ( %d blok )"
+msgid " (%ld blocks)"
+msgstr " ( %ld blok )"
 
 #: src/info.c:179
 #, c-format
@@ -3656,8 +3656,8 @@ msgstr "Fayl : %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/be.po
+++ mc-4.6.0/po/be.po
@@ -2404,13 +2404,13 @@ msgstr "�����:     %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d ����)"
+msgid " (%ld block)"
+msgstr " (%ld ����)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d ����)"
+msgid " (%ld blocks)"
+msgstr " (%ld ����)"
 
 #: src/info.c:179
 #, c-format
@@ -3630,8 +3630,8 @@ msgstr "����: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "���� 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "���� 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/bg.po
+++ mc-4.6.0/po/bg.po
@@ -2406,13 +2406,13 @@ msgstr "Размер:       %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d блок)"
+msgid " (%ld block)"
+msgstr " (%ld блок)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d блока)"
+msgid " (%ld blocks)"
+msgstr " (%ld блока)"
 
 #: src/info.c:179
 #, c-format
@@ -3649,8 +3649,8 @@ msgstr "Файл: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Отместване 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Отместване 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/ca.po
+++ mc-4.6.0/po/ca.po
@@ -2416,13 +2416,13 @@ msgstr "Mida:      %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d bloc)"
+msgid " (%ld block)"
+msgstr " (%ld bloc)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blocs)"
+msgid " (%ld blocks)"
+msgstr " (%ld blocs)"
 
 #: src/info.c:179
 #, c-format
@@ -3670,8 +3670,8 @@ msgstr "Fitxer: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Despla�ament 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Despla�ament 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/cs.po
+++ mc-4.6.0/po/cs.po
@@ -2407,13 +2407,13 @@ msgstr "Velikost:  %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blok)"
+msgid " (%ld block)"
+msgstr " (%ld blok)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blok�)"
+msgid " (%ld blocks)"
+msgstr " (%ld blok�)"
 
 #: src/info.c:179
 #, c-format
@@ -3643,8 +3643,8 @@ msgstr "Soubor: %s "
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Posun 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Posun 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/da.po
+++ mc-4.6.0/po/da.po
@@ -1,8 +1,7 @@
-# Danish translation of Midnight Commander
-# Copyright (C) 1998 Free Software Foundation, Inc.
-# Kenneth Christiansen <kenneth@ripen.dk>, 1999-2000
-# Birger Langkjer <birger.langkjer@image.dk>, 1999.
-# Keld Simonsen <keld@dkuug.dk>, 2000.
+# Danish translation of Midnight Commander Copyright (C) 1998 Free Software
+# Foundation, Inc. Kenneth Christiansen <kenneth@ripen.dk>, 1999-2000 Birger
+# Langkjer <birger.langkjer@image.dk>, 1999. Keld Simonsen <keld@dkuug.dk>,
+# 2000.
 #
 # Note: MC best�r af konsol- (mc) og gtkdel (gmc)
 # Genveje i konsolen er '&+stort bogstav', resten
@@ -2416,13 +2415,13 @@ msgstr "St�rrelse: %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blok)"
+msgid " (%ld block)"
+msgstr " (%ld blok)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blokke)"
+msgid " (%ld blocks)"
+msgstr " (%ld blokke)"
 
 #: src/info.c:179
 #, c-format
@@ -3661,8 +3660,8 @@ msgstr "Fil: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Afstand 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Afstand 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/de.po
+++ mc-4.6.0/po/de.po
@@ -2415,13 +2415,13 @@ msgstr "Gr��e:     %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d Block)"
+msgid " (%ld block)"
+msgstr " (%ld Block)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr "(%d Bl�cke)"
+msgid " (%ld blocks)"
+msgstr "(%ld Bl�cke)"
 
 #: src/info.c:179
 #, c-format
@@ -3664,8 +3664,8 @@ msgstr "Datei: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/el.po
+++ mc-4.6.0/po/el.po
@@ -2304,12 +2304,12 @@ msgstr ""
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
+msgid " (%ld block)"
 msgstr ""
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
+msgid " (%ld blocks)"
 msgstr ""
 
 #: src/info.c:179
@@ -3480,7 +3480,7 @@ msgstr ""
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
+msgid "Offset 0x%08lx"
 msgstr ""
 
 #: src/view.c:826
--- mc-4.6.0/po/es.po
+++ mc-4.6.0/po/es.po
@@ -2403,13 +2403,13 @@ msgstr "Tama�o:     %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d bloque)"
+msgid " (%ld block)"
+msgstr " (%ld bloque)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d bloques)"
+msgid " (%ld blocks)"
+msgstr " (%ld bloques)"
 
 #: src/info.c:179
 #, c-format
@@ -3638,8 +3638,8 @@ msgstr "Archivo: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/eu.po
+++ mc-4.6.0/po/eu.po
@@ -2415,13 +2415,13 @@ msgstr "Tamaina:  %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d bloke)"
+msgid " (%ld block)"
+msgstr " (%ld bloke)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr "(%d bloke)"
+msgid " (%ld blocks)"
+msgstr "(%ld bloke)"
 
 #: src/info.c:179
 #, c-format
@@ -3665,8 +3665,8 @@ msgstr "Fitxategia: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Desplazamendua 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Desplazamendua 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/fi.po
+++ mc-4.6.0/po/fi.po
@@ -2364,12 +2364,12 @@ msgstr ""
 
 #: src/info.c:173
 #, fuzzy, c-format
-msgid " (%d block)"
+msgid " (%ld block)"
 msgstr " J�rjest� valinta "
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
+msgid " (%ld blocks)"
 msgstr ""
 
 #: src/info.c:179
@@ -3556,8 +3556,8 @@ msgstr ""
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Siirros 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Siirros 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/fr.po
+++ mc-4.6.0/po/fr.po
@@ -2411,13 +2411,13 @@ msgstr "Taille :   %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d bloc)"
+msgid " (%ld block)"
+msgstr " (%ld bloc)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blocs)"
+msgid " (%ld blocks)"
+msgstr " (%ld blocs)"
 
 #: src/info.c:179
 #, c-format
@@ -3663,8 +3663,8 @@ msgstr "Fichier : %s "
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "D�calage 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "D�calage 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/hu.po
+++ mc-4.6.0/po/hu.po
@@ -2444,13 +2444,13 @@ msgstr "M�ret:        %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blokk)"
+msgid " (%ld block)"
+msgstr " (%ld blokk)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blokk)"
+msgid " (%ld blocks)"
+msgstr " (%ld blokk)"
 
 #: src/info.c:179
 #, c-format
@@ -3685,8 +3685,8 @@ msgstr "F�jl: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Poz�ci�: 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Poz�ci�: 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/it.po
+++ mc-4.6.0/po/it.po
@@ -2409,13 +2409,13 @@ msgstr "Dimensione: %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blocchi)"
+msgid " (%ld block)"
+msgstr " (%ld blocchi)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blocchi)"
+msgid " (%ld blocks)"
+msgstr " (%ld blocchi)"
 
 #: src/info.c:179
 #, c-format
@@ -3644,8 +3644,8 @@ msgstr "File: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset: 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset: 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/ja.po
+++ mc-4.6.0/po/ja.po
@@ -2410,13 +2410,13 @@ msgstr "������:    %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d�֥��å�)"
+msgid " (%ld block)"
+msgstr " (%ld�֥��å�)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d�֥��å�)"
+msgid " (%ld blocks)"
+msgstr " (%ld�֥��å�)"
 
 #: src/info.c:179
 #, c-format
@@ -3654,8 +3654,8 @@ msgstr "�ե�����: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "���ե��å� 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "���ե��å� 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/ko.po
+++ mc-4.6.0/po/ko.po
@@ -2399,13 +2399,13 @@ msgstr "ũ��:      %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d ����)"
+msgid " (%ld block)"
+msgstr " (%ld ����)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d ����)"
+msgid " (%ld blocks)"
+msgstr " (%ld ����)"
 
 #: src/info.c:179
 #, c-format
@@ -3631,8 +3631,8 @@ msgstr "����: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "�ɼ� 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "�ɼ� 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/lv.po
+++ mc-4.6.0/po/lv.po
@@ -2411,13 +2411,13 @@ msgstr "Lielums:      %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d bloks)"
+msgid " (%ld block)"
+msgstr " (%ld bloks)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d bloki)"
+msgid " (%ld blocks)"
+msgstr " (%ld bloki)"
 
 #: src/info.c:179
 #, c-format
@@ -3661,8 +3661,8 @@ msgstr "Fails: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Nob�de 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Nob�de 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/nl.po
+++ mc-4.6.0/po/nl.po
@@ -2406,13 +2406,13 @@ msgstr "Grootte:     %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blokken)"
+msgid " (%ld block)"
+msgstr " (%ld blokken)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr "(%d blokken)"
+msgid " (%ld blocks)"
+msgstr "(%ld blokken)"
 
 #: src/info.c:179
 #, c-format
@@ -3640,8 +3640,8 @@ msgstr "Bestand: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/no.po
+++ mc-4.6.0/po/no.po
@@ -2405,13 +2405,13 @@ msgstr "St�rrelse: %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blokk)"
+msgid " (%ld block)"
+msgstr " (%ld blokk)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blokker)"
+msgid " (%ld blocks)"
+msgstr " (%ld blokker)"
 
 #: src/info.c:179
 #, c-format
@@ -3640,8 +3640,8 @@ msgstr "Fil: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/pl.po
+++ mc-4.6.0/po/pl.po
@@ -2410,13 +2410,13 @@ msgstr "Rozmiar:   %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blok)"
+msgid " (%ld block)"
+msgstr " (%ld blok)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blok�w)"
+msgid " (%ld blocks)"
+msgstr " (%ld blok�w)"
 
 #: src/info.c:179
 #, c-format
@@ -3642,8 +3642,8 @@ msgstr "Plik: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Przesuni�cie 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Przesuni�cie 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/pt.po
+++ mc-4.6.0/po/pt.po
@@ -2410,13 +2410,13 @@ msgstr "Tamanho:   %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d bloco)"
+msgid " (%ld block)"
+msgstr " (%ld bloco)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blocos)"
+msgid " (%ld blocks)"
+msgstr " (%ld blocos)"
 
 #: src/info.c:179
 #, c-format
@@ -3657,8 +3657,8 @@ msgstr "Ficheiro: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/pt_BR.po
+++ mc-4.6.0/po/pt_BR.po
@@ -2429,13 +2429,13 @@ msgstr "Tamanho:   "
 
 #: src/info.c:173
 #, fuzzy, c-format
-msgid " (%d block)"
-msgstr " (%d blocos)"
+msgid " (%ld block)"
+msgstr " (%ld blocos)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blocos)"
+msgid " (%ld blocks)"
+msgstr " (%ld blocos)"
 
 #: src/info.c:179
 #, c-format
@@ -3691,8 +3691,8 @@ msgstr "Arquivo: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Deslocamento 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Deslocamento 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/ro.po
+++ mc-4.6.0/po/ro.po
@@ -2403,13 +2403,13 @@ msgstr "M�rime:    %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blocuri)"
+msgid " (%ld block)"
+msgstr " (%ld blocuri)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blocuri)"
+msgid " (%ld blocks)"
+msgstr " (%ld blocuri)"
 
 #: src/info.c:179
 #, c-format
@@ -3638,8 +3638,8 @@ msgstr "Fi�ier: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/ru.po
+++ mc-4.6.0/po/ru.po
@@ -2411,13 +2411,13 @@ msgstr "������:    %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d ����)"
+msgid " (%ld block)"
+msgstr " (%ld ����)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d ������)"
+msgid " (%ld blocks)"
+msgstr " (%ld ������)"
 
 #: src/info.c:179
 #, c-format
@@ -3644,8 +3644,8 @@ msgstr "����: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "�������� 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "�������� 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/sk.po
+++ mc-4.6.0/po/sk.po
@@ -2402,13 +2402,13 @@ msgstr "Veľkosť:     %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blok)"
+msgid " (%ld block)"
+msgstr " (%ld blok)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blokov)"
+msgid " (%ld blocks)"
+msgstr " (%ld blokov)"
 
 #: src/info.c:179
 #, c-format
@@ -3634,8 +3634,8 @@ msgstr "Súbor: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/sl.po
+++ mc-4.6.0/po/sl.po
@@ -2405,13 +2405,13 @@ msgstr "Velikost:  %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blokov)"
+msgid " (%ld block)"
+msgstr " (%ld blokov)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blokov)"
+msgid " (%ld blocks)"
+msgstr " (%ld blokov)"
 
 #: src/info.c:179
 #, c-format
@@ -3640,8 +3640,8 @@ msgstr "Datoteka: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/sv.po
+++ mc-4.6.0/po/sv.po
@@ -2434,13 +2434,13 @@ msgstr "Storlek:   %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d block)"
+msgid " (%ld block)"
+msgstr " (%ld block)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d block)"
+msgid " (%ld blocks)"
+msgstr " (%ld block)"
 
 #: src/info.c:179
 #, c-format
@@ -3678,8 +3678,8 @@ msgstr "Fil: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 # sv�ngelska?
 #: src/view.c:826
--- mc-4.6.0/po/ta.po
+++ mc-4.6.0/po/ta.po
@@ -2307,12 +2307,12 @@ msgstr ""
 
 #: src/info.c:173
 #, fuzzy, c-format
-msgid " (%d block)"
+msgid " (%ld block)"
 msgstr " ���̾��� š���¡�� "
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
+msgid " (%ld blocks)"
 msgstr ""
 
 #: src/info.c:179
@@ -3483,7 +3483,7 @@ msgstr ""
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
+msgid "Offset 0x%08lx"
 msgstr ""
 
 #: src/view.c:826
--- mc-4.6.0/po/tr.po
+++ mc-4.6.0/po/tr.po
@@ -2409,13 +2409,13 @@ msgstr "Boyut:      %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blok)"
+msgid " (%ld block)"
+msgstr " (%ld blok)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d blok)"
+msgid " (%ld blocks)"
+msgstr " (%ld blok)"
 
 #: src/info.c:179
 #, c-format
@@ -3655,8 +3655,8 @@ msgstr "Dosya: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "Offset 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "Offset 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/uk.po
+++ mc-4.6.0/po/uk.po
@@ -2399,13 +2399,13 @@ msgstr "���ͦ�:    %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d ����)"
+msgid " (%ld block)"
+msgstr " (%ld ����)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d ���˦�)"
+msgid " (%ld blocks)"
+msgstr " (%ld ���˦�)"
 
 #: src/info.c:179
 #, c-format
@@ -3632,8 +3632,8 @@ msgstr "����: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "�ͦ����� 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "�ͦ����� 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/wa.po
+++ mc-4.6.0/po/wa.po
@@ -2425,13 +2425,13 @@ msgstr "Grandeu: %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d blok)"
+msgid " (%ld block)"
+msgstr " (%ld blok)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d bloks)"
+msgid " (%ld blocks)"
+msgstr " (%ld bloks)"
 
 #: src/info.c:179
 #, c-format
@@ -3650,7 +3650,7 @@ msgstr "Fitch�: %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
+msgid "Offset 0x%08lx"
 msgstr ""
 
 #: src/view.c:826
--- mc-4.6.0/po/zh_CN.po
+++ mc-4.6.0/po/zh_CN.po
@@ -2396,13 +2396,13 @@ msgstr "大小：     %s"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d block)"
-msgstr " (%d 个块)"
+msgid " (%ld block)"
+msgstr " (%ld 个块)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d 个块)"
+msgid " (%ld blocks)"
+msgstr " (%ld 个块)"
 
 #: src/info.c:179
 #, c-format
@@ -3629,8 +3629,8 @@ msgstr "文件：%s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "偏移 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "偏移 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/po/zh_TW.po
+++ mc-4.6.0/po/zh_TW.po
@@ -2407,13 +2407,13 @@ msgstr "�j�p�G      "
 
 #: src/info.c:173
 #, fuzzy, c-format
-msgid " (%d block)"
-msgstr " (%d �Ӱ϶�)"
+msgid " (%ld block)"
+msgstr " (%ld �Ӱ϶�)"
 
 #: src/info.c:173
 #, c-format
-msgid " (%d blocks)"
-msgstr " (%d �Ӱ϶�)"
+msgid " (%ld blocks)"
+msgstr " (%ld �Ӱ϶�)"
 
 #: src/info.c:179
 #, c-format
@@ -3655,8 +3655,8 @@ msgstr "�ɮסG %s"
 
 #: src/view.c:824
 #, c-format
-msgid "Offset 0x%08x"
-msgstr "������ 0x%08x"
+msgid "Offset 0x%08lx"
+msgstr "������ 0x%08lx"
 
 #: src/view.c:826
 #, c-format
--- mc-4.6.0/slang/sltermin.c
+++ mc-4.6.0/slang/sltermin.c
@@ -267,9 +267,12 @@ SLterminfo_Type *_SLtt_tigetent (char *t
 
    if (NULL != (home = getenv ("HOME")))
      {
-	strncpy (home_ti, home, sizeof (home_ti) - 11);
-	home_ti [sizeof(home_ti) - 11] = 0;
-	strcat (home_ti, "/.terminfo");
+	size_t len = strlen (home);
+
+	if (len > sizeof (home_ti) - sizeof ("/.terminfo"))
+	  len = sizeof (home_ti) - sizeof ("/.terminfo");
+	memcpy (home_ti, home, len);
+	memcpy (home_ti + len, "/.terminfo", sizeof ("/.terminfo"));
 	Terminfo_Dirs [0] = home_ti;
      }
 
--- mc-4.6.0/src/cmd.c
+++ mc-4.6.0/src/cmd.c
@@ -1132,7 +1132,7 @@ void edit_symlink_cmd (void)
 
 	q = g_strdup_printf (_(" Symlink `%s\' points to: "), name_trunc (p, 32));
 
-	i = readlink (p, buffer, MC_MAXPATHLEN);
+	i = readlink (p, buffer, MC_MAXPATHLEN - 1);
 	if (i > 0) {
 	    buffer [i] = 0;
 	    dest = input_expand_dialog (_(" Edit symlink "), q, buffer);
--- mc-4.6.0/src/command.c
+++ mc-4.6.0/src/command.c
@@ -258,7 +258,7 @@ command_callback (WInput *cmd, int msg, 
 WInput *
 command_new (int y, int x, int cols)
 {
-    WInput *cmd = g_new (WInput, 1);
+    WInput *cmd;
 
     cmd = input_new (y, x, DEFAULT_COLOR, cols, "", "cmdline");
 
--- mc-4.6.0/src/complete.c
+++ mc-4.6.0/src/complete.c
@@ -270,7 +270,7 @@ variable_completion_function (char *text
 	*temp = '$';
 	if (isbrace)
 	    temp [1] = '{';
-        strncpy (temp + 1 + isbrace, *env_p, p - *env_p);
+        memcpy (temp + 1 + isbrace, *env_p, p - *env_p);
         if (isbrace)
             strcpy (temp + 2 + (p - *env_p), "}");
         else
@@ -605,8 +605,7 @@ completion_matches (char *text, Completi
 	    matches = i;
             match_list [matches + 1] = NULL;
 	    match_list[0] = g_malloc (low + 1);
-	    strncpy (match_list[0], match_list[1], low);
-	    match_list[0][low] = 0;
+	    g_strlcpy (match_list[0], match_list[1], low + 1);
 	}
     } else {				/* There were no matches. */
         g_free (match_list);
@@ -806,7 +805,7 @@ static int insert_text (WInput *in, char
 	    	*(p++) = *(q++);
 	    *p = 0;
 	}
-	strncpy (in->buffer + start, text, len - start + end);
+	memcpy (in->buffer + start, text, len - start + end);
 	in->point += len;
 	update_input (in, 1);
 	end += len;
--- mc-4.6.0/src/dir.c
+++ mc-4.6.0/src/dir.c
@@ -503,9 +503,11 @@ do_load_dir (dir_list *list, sortfn *sor
     }
 
     if (next_free) {
+	char *path = vfs_canon (".");
 	/* Add ".." except the root directory */
-	if (strcmp (vfs_canon ("."), "/") != 0)
+	if (strcmp (path, "/") != 0)
 	    add_dotdot_to_list (list, next_free++);
+	g_free (path);
 	do_sort (list, sort, next_free - 1, reverse, case_sensitive);
     } else {
 	tree_store_end_check ();
@@ -576,7 +578,7 @@ do_reload_dir (dir_list * list, sortfn *
     int i, status, link_to_dir, stale_link;
     struct stat buf;
     int marked_cnt;
-    GHashTable *marked_files = g_hash_table_new (g_str_hash, g_str_equal);
+    GHashTable *marked_files;
 
     tree_store_start_check_cwd ();
     dirp = mc_opendir (".");
@@ -587,6 +589,7 @@ do_reload_dir (dir_list * list, sortfn *
 	return set_zero_dir (list);
     }
 
+    marked_files = g_hash_table_new (g_str_hash, g_str_equal);
     alloc_dir_copy (list->size);
     for (marked_cnt = i = 0; i < count; i++) {
 	dir_copy.list[i].fnamelen = list->list[i].fnamelen;
@@ -622,6 +625,7 @@ do_reload_dir (dir_list * list, sortfn *
 	       clean_dir (&dir_copy, count);
 	     */
 	    tree_store_end_check ();
+	    g_hash_table_destroy (marked_files);
 	    return next_free;
 	}
 
@@ -655,9 +659,11 @@ do_reload_dir (dir_list * list, sortfn *
     tree_store_end_check ();
     g_hash_table_destroy (marked_files);
     if (next_free) {
+	char *path = vfs_canon (".");
 	/* Add ".." except the root directory */
-	if (strcmp (vfs_canon ("."), "/") != 0)
+	if (strcmp (path, "/") != 0)
 	    add_dotdot_to_list (list, next_free++);
+	g_free (path);
 	do_sort (list, sort, next_free - 1, rev, case_sensitive);
     } else
 	next_free = set_zero_dir (list);
--- mc-4.6.0/src/ext.c
+++ mc-4.6.0/src/ext.c
@@ -484,7 +484,6 @@ regex_command (char *filename, char *act
     int found = 0;
     int error_flag = 0;
     int ret = 0;
-    int old_patterns;
     struct stat mystat;
     int view_at_line_number;
     char *include_target;
@@ -566,8 +565,6 @@ regex_command (char *filename, char *act
     }
     mc_stat (filename, &mystat);
 
-    old_patterns = easy_patterns;
-    easy_patterns = 0;		/* Real regular expressions are needed :) */
     include_target = NULL;
     include_target_len = 0;
     for (p = data; *p; p++) {
@@ -600,11 +597,11 @@ regex_command (char *filename, char *act
 		/* Do not transform shell patterns, you can use shell/ for
 		 * that
 		 */
-		if (regexp_match (p, filename, match_normal))
+		if (regexp_match (p, filename, match_regex))
 		    found = 1;
 	    } else if (!strncmp (p, "directory/", 10)) {
 		if (S_ISDIR (mystat.st_mode)
-		    && regexp_match (p + 10, filename, match_normal))
+		    && regexp_match (p + 10, filename, match_regex))
 		    found = 1;
 	    } else if (!strncmp (p, "shell/", 6)) {
 		p += 6;
@@ -690,7 +687,6 @@ regex_command (char *filename, char *act
 		break;
 	}
     }
-    easy_patterns = old_patterns;
     if (error_flag)
 	return -1;
     return ret;
--- mc-4.6.0/src/file.c
+++ mc-4.6.0/src/file.c
@@ -366,7 +366,7 @@ make_symlink (FileOpContext *ctx, char *
 	dst_is_symlink = 0;
 
   retry_src_readlink:
-    len = mc_readlink (src_path, link_target, MC_MAXPATHLEN);
+    len = mc_readlink (src_path, link_target, MC_MAXPATHLEN - 1);
     if (len < 0) {
 	return_status =
 	    file_error (_(" Cannot read source link \"%s\" \n %s "),
@@ -715,6 +715,7 @@ copy_file_file (FileOpContext *ctx, char
 	    gettimeofday (&tv_current, NULL);
 
 	    if (n_read > 0) {
+		char *t = buf;
 		n_read_total += n_read;
 
 		/* Windows NT ftp servers report that files have no
@@ -729,9 +730,10 @@ copy_file_file (FileOpContext *ctx, char
 
 		/* dst_write */
 		while ((n_written =
-			mc_write (dest_desc, buf, n_read)) < n_read) {
+			mc_write (dest_desc, t, n_read)) < n_read) {
 		    if (n_written > 0) {
 			n_read -= n_written;
+			t += n_written;
 			continue;
 		    }
 		    return_status =
--- mc-4.6.0/src/find.c
+++ mc-4.6.0/src/find.c
@@ -312,7 +312,7 @@ push_directory (char *dir)
     dir_stack *new;
 
     new = g_new (dir_stack, 1);
-    new->name = g_strdup (dir);
+    new->name = concat_dir_and_file (dir, "");
     new->prev = dir_stack_base;
     dir_stack_base = new;
 }
@@ -338,17 +338,9 @@ insert_file (char *dir, char *file)
 {
     char *tmp_name;
     static char *dirname;
-    int i;
 
-    if (dir [0] == PATH_SEP && dir [1] == PATH_SEP)
+    while (dir [0] == PATH_SEP && dir [1] == PATH_SEP)
 	dir++;
-    i = strlen (dir);
-    if (i){
-	if (dir [i - 1] != PATH_SEP){
-	    dir [i] = PATH_SEP;
-	    dir [i + 1] = 0;
-	}
-    }
 
     if (old_dir){
 	if (strcmp (old_dir, dir)){
@@ -401,7 +393,7 @@ get_line_at (int file_fd, char *buf, int
     char ch = 0;
     int  i = 0;
 
-    do {
+    for (;;) {
 	if (*pos >= *n_read){
 	    *pos = 0;
 	    if ((*n_read = mc_read (file_fd, buf, buf_size)) <= 0)
@@ -420,10 +412,12 @@ get_line_at (int file_fd, char *buf, int
 	if (i >= buffer_size - 1){
 	    buffer = g_realloc (buffer, buffer_size += 80);
 	}
+	/* Strip newline to fix $ matching */
+	if (ch == '\n')
+	    break;
 
 	buffer [i++] = ch;
-
-    } while (ch != '\n');
+    }
 
     *has_newline = ch ? 1 : 0;
 
@@ -502,7 +496,7 @@ do_search (struct Dlg_head *h)
 {
     static struct dirent *dp   = 0;
     static DIR  *dirp = 0;
-    static char directory [MC_MAXPATHLEN+2];
+    static char *directory;
     struct stat tmp_stat;
     static int pos;
     static int subdirs_left = 0;
@@ -513,6 +507,10 @@ do_search (struct Dlg_head *h)
 	    mc_closedir (dirp);
 	    dirp = 0;
 	}
+	if (directory) {
+	    g_free (directory);
+	    directory = NULL;
+	}
         dp = 0;
 	return 1;
     }
@@ -550,8 +548,9 @@ do_search (struct Dlg_head *h)
 		    break;
 	    } 
 	    
-	    strcpy (directory, tmp);
-	    g_free (tmp);
+	    if (directory)
+		g_free (directory);
+	    directory = tmp;
 
 	    if (verbose){
 		    char buffer [BUF_SMALL];
@@ -582,8 +581,8 @@ do_search (struct Dlg_head *h)
     tmp_name = concat_dir_and_file (directory, dp->d_name);
 
     if (subdirs_left){
-	mc_lstat (tmp_name, &tmp_stat);
-	if (S_ISDIR (tmp_stat.st_mode)){
+	if (!mc_lstat (tmp_name, &tmp_stat)
+	    && S_ISDIR (tmp_stat.st_mode)){
 	    push_directory (tmp_name);
 	    subdirs_left--;
 	}
--- mc-4.6.0/src/info.c
+++ mc-4.6.0/src/info.c
@@ -120,7 +120,7 @@ info_show_info (WInfo *info)
 	    size_trunc_len (buffer1, 5, myfs_stats.avail, 1);
 	    size_trunc_len (buffer2, 5, myfs_stats.total, 1);
 	    printw (_("Free space: %s (%d%%) of %s"), buffer1, myfs_stats.total ?
-		    100 * myfs_stats.avail / myfs_stats.total : 0, buffer2);
+		    (int) (100.0 * myfs_stats.avail / myfs_stats.total) : 0, buffer2);
 	} else
 	    addstr (_("No space information"));
 
@@ -167,7 +167,7 @@ info_show_info (WInfo *info)
 	    printw (_("Size:      %s"), buffer);
 #ifdef HAVE_ST_BLOCKS
 	    printw ((buf.st_blocks==1) ?
-		_(" (%d block)") : _(" (%d blocks)"), buf.st_blocks);
+		_(" (%ld block)") : _(" (%ld blocks)"), (long) buf.st_blocks);
 #endif
 	}
 	
--- mc-4.6.0/src/main.c
+++ mc-4.6.0/src/main.c
@@ -1300,7 +1300,7 @@ copy_readlink (WPanel *panel)
 	    concat_dir_and_file (panel->cwd, selection (panel)->fname);
 	int i;
 
-	i = mc_readlink (p, buffer, MC_MAXPATHLEN);
+	i = mc_readlink (p, buffer, MC_MAXPATHLEN - 1);
 	g_free (p);
 	if (i > 0) {
 	    buffer[i] = 0;
--- mc-4.6.0/src/man2hlp.c
+++ mc-4.6.0/src/man2hlp.c
@@ -611,8 +611,7 @@ handle_link (char *buffer)
 	/* Bold text or italics text */
 	if (buffer[0] == '.' && (buffer[1] == 'I' || buffer[1] == 'B'))
 	    for (buffer += 2; *buffer == ' ' || *buffer == '\t'; buffer++);
-	strncpy (old, buffer, sizeof (old) - 1);
-	old[sizeof (old) - 1] = 0;
+	g_strlcpy (old, buffer, sizeof (old));
 	link_flag = 3;
 	break;
     case 3:
--- mc-4.6.0/src/profile.c
+++ mc-4.6.0/src/profile.c
@@ -325,8 +325,7 @@ static short GetSetProfile (int set, con
     
     s = GetSetProfileChar (set, AppName, KeyName, Default, FileName);
     if (!set){
-	ReturnedString [Size-1] = 0;
-	strncpy (ReturnedString, s, Size-1);
+	g_strlcpy (ReturnedString, s, Size);
    }
     return 1;
 }
--- mc-4.6.0/src/screen.c
+++ mc-4.6.0/src/screen.c
@@ -779,7 +779,7 @@ display_mini_info (WPanel *panel)
 	int  len;
 
 	link = concat_dir_and_file (panel->cwd, panel->dir.list [panel->selected].fname);
-	len = mc_readlink (link, link_target, MC_MAXPATHLEN);
+	len = mc_readlink (link, link_target, MC_MAXPATHLEN - 1);
 	g_free (link);
 	if (len > 0){
 	    link_target[len] = 0;
@@ -1152,14 +1152,11 @@ paint_frame (WPanel *panel) 
     int  spaces, extra;
     int  side, width;
 
-    char *txt;
 #ifdef UTF8
     char buffer[30 * sizeof (wchar_t)];
     mbstate_t s;
 
     memset (&s, 0, sizeof (s));
-#else
-    char buffer[30]; /*Hope that this is enough ;-) */
 #endif
     if (!panel->split)
 	adjust_top_file (panel);
@@ -1183,13 +1180,12 @@ paint_frame (WPanel *panel) 
 
 	for (format = panel->format; format; format = format->next){
             if (format->string_fn){
-                txt = format->title;
 
                 attrset (MARKED_COLOR);
 		width -= format->field_len;
 #ifdef UTF8
 		if (SLsmg_Is_Unicode) {
-		    const char *str = txt;
+		    const char *str = format->title;
 		    header_len = mbsrtowcs ((wchar_t *) buffer, &str,
 					    sizeof (buffer) / sizeof (wchar_t),
 					    &s);
@@ -1208,18 +1204,15 @@ paint_frame (WPanel *panel) 
 		    continue;
 		}
 #endif
-		header_len = strlen (txt);
+		header_len = strlen (format->title);
 		if (header_len > format->field_len){
-		    strncpy (buffer, txt, format->field_len);
-		    txt = buffer;
-		    txt [format->field_len] = 0;
 		    header_len = format->field_len;
 		}
 
                 spaces = (format->field_len - header_len) / 2;
                 extra  = (format->field_len - header_len) % 2;
-		printw ("%*s%-s%*s", spaces, "",
-			 txt, spaces+extra, "");
+		printw ("%*s%.*s%*s", spaces, "",
+			header_len, format->title, spaces+extra, "");
 	    } else {
 		attrset (NORMAL_COLOR);
 		one_vline ();
@@ -2157,7 +2150,7 @@ chdir_to_readlink (WPanel *panel)
 	int i;
 	struct stat mybuf;
 
-	i = readlink (selection (panel)->fname, buffer, MC_MAXPATHLEN);
+	i = readlink (selection (panel)->fname, buffer, MC_MAXPATHLEN - 1);
 	if (i < 0)
 	    return;
 	if (mc_stat (selection (panel)->fname, &mybuf) < 0)
--- mc-4.6.0/src/subshell.c
+++ mc-4.6.0/src/subshell.c
@@ -710,7 +710,9 @@ int exit_subshell (void)
     }
 
     g_free (subshell_prompt);
+    g_free (pty_buffer);
     subshell_prompt = NULL;
+    pty_buffer = NULL;
 
     return quit;
 }
--- mc-4.6.0/src/user.c
+++ mc-4.6.0/src/user.c
@@ -138,19 +138,14 @@ int check_format_var (const char *p, cha
 	}
 	
 	/* Copy the variable name */
-	var_name = g_malloc (dots - p);
-	strncpy (var_name, p+4, dots-2 - (p+3));
-	var_name [dots-2 - (p+3)] = 0;
-
+	var_name = g_strndup (p + 4, dots - p - 5);
 	value = getenv (var_name);
 	g_free (var_name);
 	if (value){
 	    *v = g_strdup (value);
 	    return q-p;
 	}
-	var_name = g_malloc (q - dots + 1);
-	strncpy (var_name, dots, q - dots + 1);
-	var_name [q-dots] = 0;
+	var_name = g_strndup (dots, q - dots);
 	*v = var_name;
 	return q-p;
     }
@@ -300,13 +295,15 @@ check_patterns (char *p)
 
 /* Copies a whitespace separated argument from p to arg. Returns the
    point after argument. */
-static char *extract_arg (char *p, char *arg)
+static char *extract_arg (char *p, char *arg, size_t size)
 {
     while (*p && (*p == ' ' || *p == '\t' || *p == '\n'))
 	p++;
                 /* support quote space .mnu */
-    while (*p && (*p != ' ' || *(p-1) == '\\') && *p != '\t' && *p != '\n')
+    while (size > 1 && *p && (*p != ' ' || *(p-1) == '\\') && *p != '\t' && *p != '\n') {
 	*arg++ = *p++;
+	size--;
+    }
     *arg = 0;
     if (!*p || *p == '\n')
 	p --;
@@ -389,29 +386,29 @@ static char *test_condition (WEdit *edit
 	    p--;
 	    break;
 	case 'f': /* file name pattern */
-	    p = extract_arg (p, arg);
+	    p = extract_arg (p, arg, sizeof (arg));
 	    *condition = panel && regexp_match (arg, panel->dir.list [panel->selected].fname, match_file);
 	    break;
 	case 'y': /* syntax pattern */
             if (edit_widget && edit_widget->syntax_type) {
-	        p = extract_arg (p, arg);
+	        p = extract_arg (p, arg, sizeof (arg));
 	        *condition = panel &&
                     regexp_match (arg, edit_widget->syntax_type, match_normal);
 	    }
                 break;
 	case 'd':
-	    p = extract_arg (p, arg);
+	    p = extract_arg (p, arg, sizeof (arg));
 	    *condition = panel && regexp_match (arg, panel->cwd, match_file);
 	    break;
 	case 't':
-	    p = extract_arg (p, arg);
+	    p = extract_arg (p, arg, sizeof (arg));
 	    *condition = panel && test_type (panel, arg);
 	    break;
 	case 'x': /* executable */
 	{
 	    struct stat status;
 	    
-	    p = extract_arg (p, arg);
+	    p = extract_arg (p, arg, sizeof (arg));
 	    if (stat (arg, &status) == 0)
 		*condition = is_exe (status.st_mode);
 	    else
@@ -431,50 +428,43 @@ static char *test_condition (WEdit *edit
 static void
 debug_out (char *start, char *end, int cond)
 {
-    static char msg [256];
+    static char *msg;
     int len;
 
     if (start == NULL && end == NULL){
-	if (cond == 0){
-	    /* Init */
-	    msg [0] = 0;
-	} else {
-	    /* Show output */
-	    if (!debug_flag)
-		return;
+	/* Show output */
+	if (debug_flag && msg) {
 	    len = strlen (msg);
 	    if (len)
 		msg [len - 1] = 0;
 	    message (0, _(" Debug "), "%s", msg);
-	    debug_flag = 0;
 	}
+	debug_flag = 0;
+	g_free (msg);
+	msg = NULL;
     } else {
+	char *type, *p;
+
 	/* Save debug info for later output */
 	if (!debug_flag)
 	    return;
 	/* Save the result of the condition */
 	if (debug_error){
-	    strcat (msg, _(" ERROR: "));
+	    type = _(" ERROR: ");
 	    debug_error = 0;
 	}
 	else if (cond)
-	    strcat (msg, _(" True:  "));
+	    type = _(" True:  ");
 	else
-	    strcat (msg, _(" False: "));
-	/* Copy condition statement */
-	len = strlen (msg);
-	if (end == NULL){
-	    /* Copy one character */
-	    msg [len] = *start;
-	    msg [len + 1] = 0;
-	} else {
-	    /* Copy many characters */
-	    while (start < end){
-		msg [len++] = *start++;
-	    }
-	    msg [len] = 0;
-	}
-	strcat (msg, " \n");
+	    type = _(" False: ");
+	/* This is for debugging, don't need to be super efficient.  */
+	if (end == NULL)
+	    p = g_strdup_printf ("%s%s%c \n", msg ? msg : "", type, *start);
+	else
+	    p = g_strdup_printf ("%s%s%.*s \n", msg ? msg : "", type,
+				 (int) (end - start), start);
+        g_free (msg);
+        msg = p;
     }
 }
 
@@ -486,8 +476,6 @@ static char *test_line (WEdit *edit_widg
     char operator;
     char *debug_start, *debug_end;
 
-    /* Init debugger */
-    debug_out (NULL, NULL, 0);
     /* Repeat till end of line */
     while (*p && *p != '\n') {
         /* support quote space .mnu */
@@ -578,6 +566,8 @@ execute_menu_command (WEdit *edit_widget
 		break;
 	    while (*commands == ' ' || *commands == '\t')
 	        commands++;
+	  if (*commands == '0')
+		break;
 	}
 	col++;
 	if (*commands == '\n')
@@ -734,7 +724,7 @@ user_menu_cmd (struct WEdit *edit_widget
 	    } else if (*p == '+'){
 		if (*(p+1) == '='){
 		    /* Combined adding and default */
-		    p = test_line (edit_widget, p, &accept_entry);
+		    p = test_line (edit_widget, p + 1, &accept_entry);
 		    if (selected == 0 && accept_entry)
 			selected = menu_lines;
 		} else {
@@ -744,7 +734,7 @@ user_menu_cmd (struct WEdit *edit_widget
 	    } else if (*p == '='){
 		if (*(p+1) == '+'){
 		    /* Combined adding and default */
-		    p = test_line (edit_widget, p, &accept_entry);
+		    p = test_line (edit_widget, p + 1, &accept_entry);
 		    if (selected == 0 && accept_entry)
 			selected = menu_lines;
 		} else {
--- mc-4.6.0/src/util.c
+++ mc-4.6.0/src/util.c
@@ -633,7 +633,7 @@ char *convert_pattern (char *pattern, in
     char *new_pattern;
     int was_wildcard = 0;
 
-    if (easy_patterns){
+    if ((match_type != match_regex) && easy_patterns){
 	new_pattern = g_malloc (MC_MAXPATHLEN);
 	d = new_pattern;
 	if (match_type == match_file)
@@ -1034,7 +1034,7 @@ char *get_current_wd (char *buffer, int 
 	return NULL;
     }
 
-    strncpy (buffer, p, len);
+    memcpy (buffer, p, len);
     g_free (p);
 
     return buffer;
@@ -1249,7 +1249,7 @@ static char *resolve_symlinks (char *pat
 	if (!S_ISLNK (mybuf.st_mode))
 	    strcpy (r, p + 1);
 	else {
-	    len = mc_readlink (path, buf2, MC_MAXPATHLEN);
+	    len = mc_readlink (path, buf2, MC_MAXPATHLEN - 1);
 	    if (len < 0) {
 		 g_free (buf);
 		 g_free (buf2);
--- mc-4.6.0/src/util.h
+++ mc-4.6.0/src/util.h
@@ -66,7 +66,7 @@ char *_icase_search (char *text, char *d
 #define icase_search(T,D) _icase_search((T), (D), NULL)
 
 /* Matching */
-enum { match_file, match_normal };
+enum { match_file, match_normal, match_regex };
 extern int easy_patterns;
 char *convert_pattern (char *pattern, int match_type, int do_group);
 int regexp_match (char *pattern, char *string, int match_type);
--- mc-4.6.0/src/utilunix.c
+++ mc-4.6.0/src/utilunix.c
@@ -280,9 +280,7 @@ char *tilde_expand (const char *director
 	if (!p){
 	    passwd = getpwnam (directory);
 	} else {
-	    name = g_malloc (p - directory + 1);
-	    strncpy (name, directory, p - directory);
-	    name [p - directory] = 0;
+	    name = g_strndup (directory, p - directory);
 	    passwd = getpwnam (name);
 	    g_free (name);
 	}
@@ -298,7 +296,7 @@ char *tilde_expand (const char *director
 
 /*
  * Return the directory where mc should keep its temporary files.
- * This directory is (in Bourne shell terms) "${TMPDIR=/tmp}-$USER"
+ * This directory is (in Bourne shell terms) "${TMPDIR=/tmp}/mc-$USER"
  * When called the first time, the directory is created if needed.
  * The first call should be done early, since we are using fprintf()
  * and not message() to report possible problems.
@@ -378,6 +376,7 @@ mc_tmpdir (void)
 	if (fallback_ok) {
 	    fprintf (stderr, _("Temporary files will be created in %s\n"),
 		     sys_tmp);
+	    error = NULL;
 	} else {
 	    fprintf (stderr, _("Temporary files will not be created\n"));
 	    tmpdir = "/dev/null/";
@@ -387,6 +386,9 @@ mc_tmpdir (void)
 	getc (stdin);
     }
 
+    if (!error)
+	setenv ("MC_TMPDIR", tmpdir, 1);
+
     return tmpdir;
 }
 
--- mc-4.6.0/src/view.c
+++ mc-4.6.0/src/view.c
@@ -342,7 +342,7 @@ get_byte (WView *view, unsigned int byte
 	    }
 	    view->blocks = page;
 	}
-	if (byte_index > view->bytes_read) {
+	if (byte_index >= view->bytes_read) {
 	    return -1;
 	} else
 	    return view->block_ptr[page - 1].data[offset];
@@ -834,7 +834,7 @@ view_status (WView *view, gboolean updat
 	if (w > 46) {
 	    widget_move (view, view->have_frame, 24 + view->have_frame);
 	    if (view->hex_mode)
-		printw (_("Offset 0x%08x"), view->edit_cursor);
+		printw (_("Offset 0x%08lx"), view->edit_cursor);
 	    else
 		printw (_("Col %d"), -view->start_col);
 	}
@@ -1581,33 +1581,41 @@ get_line_at (WView *view, unsigned long 
     long i = 0;
     int prev = 0;
 
+    if (!pos && direction == -1)
+	return 0;
+
     /* skip over all the possible zeros in the file */
     while ((ch = get_byte (view, pos)) == 0) {
+	if (!pos && direction == -1)
+	    return 0;
 	pos += direction;
 	i++;
     }
     *skipped = i;
 
-    if (pos) {
-	prev = get_byte (view, pos - 1);
+    if (!i && (pos || direction == -1)) {
+	prev = get_byte (view, pos - direction);
 	if ((prev == -1) || (prev == '\n'))
 	    prev = 0;
     }
 
-    for (i = 0; ch != -1; ch = get_byte (view, pos)) {
+    for (i = 1; ch != -1; ch = get_byte (view, pos)) {
 
-	if (i == usable_size) {
+	if (i >= usable_size) {
 	    buffer = grow_string_buffer (buffer, &buffer_size);
 	    usable_size = buffer_size - 2;
 	}
 
+	buffer[i++] = ch;
+	if (!pos && direction == -1)
+	    break;
+
 	pos += direction;
-	i++;
 
 	if (ch == '\n' || !ch) {
+	    i--;
 	    break;
 	}
-	buffer[i] = ch;
     }
     if (buffer) {
 	buffer[0] = prev;
--- mc-4.6.0/src/widget.c
+++ mc-4.6.0/src/widget.c
@@ -647,7 +647,7 @@ gauge_callback (WGauge *g, int Msg, int 
 	if (!g->shown)
 	    printw ("%*s", gauge_len, "");
 	else {
-	    long percentage, columns;
+	    int percentage, columns;
 	    long total = g->max, done = g->current;
 	    
 	    if (total <= 0 || done < 0) {
--- mc-4.6.0/src/wtools.c
+++ mc-4.6.0/src/wtools.c
@@ -412,8 +412,7 @@ real_input_dialog_help (char *header, ch
 /* we need a unique name for tkname because widget.c:history_tool()
    needs a unique name for each dialog - using the header is ideal */
 
-    strncpy (tk_name + 3, header, 60);
-    tk_name[63] = '\0';
+    g_strlcpy (tk_name + 3, header, 61);
     quick_widgets[2].tkname = tk_name;
 
     len = max (mbstrlen (header), msglen (text, &lines)) + 4;
--- mc-4.6.0/vfs/cpio.c
+++ mc-4.6.0/vfs/cpio.c
@@ -103,9 +103,9 @@ static int cpio_read(void *fh, char *buf
 
 static struct defer_inode * defer_find(struct defer_inode *l, struct defer_inode *i)
 {
-    if(!l) return NULL;
-    return l->inumber == i->inumber && l->device == i->device ? l : 
-	   defer_find(l->next, i);
+    while (l && (l->inumber != i->inumber || l->device != i->device))
+	l = l->next;
+    return l;
 }
 
 static int cpio_skip_padding(vfs_s_super *super)
@@ -127,8 +127,14 @@ static int cpio_skip_padding(vfs_s_super
 
 static void cpio_free_archive(vfs *me, vfs_s_super *super)
 {
+    struct defer_inode *l, *lnext;
     if(super->u.cpio.fd != -1)
-	mc_close(super->u.cpio.fd);
+	mc_close(super->u.cpio.fd), super->u.cpio.fd = -1;
+    for (l = super->u.cpio.defered; l; l = lnext) {
+	lnext = l->next;
+	g_free (l);
+    }
+    super->u.cpio.defered = NULL;
 }
 
 static int cpio_open_cpio_file(vfs *me, vfs_s_super *super, char *name)
@@ -246,26 +252,34 @@ static int cpio_find_head(vfs *me, vfs_s
 #define HEAD_LENGTH (26)
 static int cpio_read_bin_head(vfs *me, vfs_s_super *super)
 {
-    struct old_cpio_header buf;
+    union {
+	struct old_cpio_header buf;
+	short shorts[HEAD_LENGTH >> 1];
+    } u;
     int len;
     char *name;
     struct stat stat;
 
-    if((len = mc_read(super->u.cpio.fd, (char *)&buf, HEAD_LENGTH)) < HEAD_LENGTH)
+    if((len = mc_read(super->u.cpio.fd, (char *)&u.buf, HEAD_LENGTH)) < HEAD_LENGTH)
 	return STATUS_EOF;
     CPIO_POS(super) += len;
     if(super->u.cpio.type == CPIO_BINRE) {
 	int i;
 	for(i = 0; i < (HEAD_LENGTH >> 1); i++)
-	    ((short *)&buf)[i] = GUINT16_SWAP_LE_BE(((short *)&buf)[i]);
+	    u.shorts[i] = GUINT16_SWAP_LE_BE(u.shorts[i]);
     }
-    g_assert(buf.c_magic == 070707);
+    g_assert(u.buf.c_magic == 070707);
 
-    name = g_malloc(buf.c_namesize);
-    if((len = mc_read(super->u.cpio.fd, name, buf.c_namesize)) < buf.c_namesize){
+    if (u.buf.c_namesize == 0 || u.buf.c_namesize > MC_MAXPATHLEN) {
+	message (1, MSG_ERROR, _("Corrupted cpio header encountered in\n%s"), super->name);
+	return STATUS_FAIL;
+    }
+    name = g_malloc(u.buf.c_namesize);
+    if((len = mc_read(super->u.cpio.fd, name, u.buf.c_namesize)) < u.buf.c_namesize){
 	g_free(name);
 	return STATUS_EOF;
     }
+    name[u.buf.c_namesize - 1] = '\0';
     CPIO_POS(super) += len;
     cpio_skip_padding(super);
 
@@ -274,15 +288,15 @@ static int cpio_read_bin_head(vfs *me, v
 	return STATUS_TRAIL;
     }
 
-    stat.st_dev = buf.c_dev;
-    stat.st_ino = buf.c_ino;
-    stat.st_mode = buf.c_mode;
-    stat.st_nlink = buf.c_nlink;
-    stat.st_uid = buf.c_uid;
-    stat.st_gid = buf.c_gid;
-    stat.st_rdev = buf.c_rdev;
-    stat.st_size = (buf.c_filesizes[0] << 16) | buf.c_filesizes[1];
-    stat.st_atime = stat.st_mtime = stat.st_ctime = (buf.c_mtimes[0] << 16) | buf.c_mtimes[1];
+    stat.st_dev = u.buf.c_dev;
+    stat.st_ino = u.buf.c_ino;
+    stat.st_mode = u.buf.c_mode;
+    stat.st_nlink = u.buf.c_nlink;
+    stat.st_uid = u.buf.c_uid;
+    stat.st_gid = u.buf.c_gid;
+    stat.st_rdev = u.buf.c_rdev;
+    stat.st_size = (u.buf.c_filesizes[0] << 16) | u.buf.c_filesizes[1];
+    stat.st_atime = stat.st_mtime = stat.st_ctime = (u.buf.c_mtimes[0] << 16) | u.buf.c_mtimes[1];
 
     return cpio_create_entry(me, super, &stat, name);
 }
@@ -310,11 +324,16 @@ static int cpio_read_oldc_head(vfs *me, 
 	return STATUS_FAIL;
     }
 
+    if (hd.c_namesize == 0 || hd.c_namesize > MC_MAXPATHLEN) {
+	message (1, MSG_ERROR, _("Corrupted cpio header encountered in\n%s"), super->name);
+	return STATUS_FAIL;
+    }
     name = g_malloc(hd.c_namesize);
     if((len = mc_read(super->u.cpio.fd, name, hd.c_namesize)) < hd.c_namesize) {
 	g_free (name);
 	return STATUS_EOF;
     }
+    name[hd.c_namesize - 1] = '\0';
     CPIO_POS(super) +=  len;
     cpio_skip_padding(super);
 
@@ -365,11 +384,16 @@ static int cpio_read_crc_head(vfs *me, v
        (super->u.cpio.type == CPIO_CRC && hd.c_magic != 070702))
 	return STATUS_FAIL;
 
+    if (hd.c_namesize == 0 || hd.c_namesize > MC_MAXPATHLEN) {
+	message (1, MSG_ERROR, _("Corrupted cpio header encountered in\n%s"), super->name);
+	return STATUS_FAIL;
+    }
     name = g_malloc(hd.c_namesize);
     if((len = mc_read(super->u.cpio.fd, name, hd.c_namesize)) < hd.c_namesize){
 	g_free (name);
 	return STATUS_EOF;
     }
+    name[hd.c_namesize - 1] = '\0';
     CPIO_POS(super) += len;
     cpio_skip_padding(super);
 
@@ -430,7 +454,8 @@ static int cpio_create_entry(vfs *me, vf
 		message_3s(1, MSG_ERROR, _("Inconsistent hardlinks of\n%s\nin cpio archive\n%s"),
 			   name, super->name);
 		inode = NULL;
-	    }
+	    } else if (!inode->st.st_size)
+		inode->st.st_size = stat->st_size;
 	}
     }
 
--- mc-4.6.0/vfs/direntry.c
+++ mc-4.6.0/vfs/direntry.c
@@ -217,13 +217,11 @@ vfs_s_automake (vfs *me, vfs_s_inode *di
 vfs_s_entry *
 vfs_s_find_entry_tree (vfs *me, vfs_s_inode *root, char *path, int follow, int flags)
 {
-    unsigned int pseg;
+    size_t pseg;
     vfs_s_entry *ent = NULL;
-    char p[MC_MAXPATHLEN] = "";
+    char p[MC_MAXPATHLEN] = "", *t = p;
 
     while (root){
-	int t;
-
 	while (*path == PATH_SEP)	/* Strip leading '/' */
 	    path++;
 
@@ -233,9 +231,14 @@ vfs_s_find_entry_tree (vfs *me, vfs_s_in
 	for (pseg = 0; path[pseg] && path[pseg] != PATH_SEP; pseg++)
 		;
 
-	strcat (p, PATH_SEP_STR);
-	strncpy (p + (t = strlen (p)), path, pseg);
-	p[t + pseg] = '\0';
+	if (t + pseg + sizeof (PATH_SEP_STR) > p + sizeof (p))
+	    ERRNOR (ENOMEM, NULL);
+
+	memcpy (t, PATH_SEP_STR, sizeof (PATH_SEP_STR) - 1);
+	t += sizeof (PATH_SEP_STR) - 1;
+	memcpy (t, path, pseg);
+	t += pseg;
+	*t = '\0';
 
 	for (ent = root->subdir; ent != NULL; ent = ent->next)
 	    if (strlen (ent->name) == pseg && (!strncmp (ent->name, path, pseg)))
@@ -624,8 +627,7 @@ vfs_s_readdir(void *data)
 	return NULL;
 
     if (info->cur->name) {
-	strncpy(dir.dent.d_name, info->cur->name, MC_MAXPATHLEN);
-	dir.dent.d_name[MC_MAXPATHLEN] = 0;
+	g_strlcpy(dir.dent.d_name, info->cur->name, MC_MAXPATHLEN);
     } else {
 	vfs_die("Null in structure-cannot happen");
     }
@@ -731,8 +733,7 @@ vfs_s_readlink (vfs *me, char *path, cha
     if (ino->linkname == NULL)
 	ERRNOR (EFAULT, -1);
 
-    strncpy (buf, ino->linkname, size);
-    *(buf+size-1) = 0;
+    g_strlcpy (buf, ino->linkname, size);
     return strlen (buf);
 }
 
@@ -1039,7 +1040,7 @@ vfs_s_getlocalcopy (vfs *me, char *path)
     struct vfs_s_inode *ino;
     char buf[MC_MAXPATHLEN];
 
-    strncpy (buf, path, MC_MAXPATHLEN);
+    g_strlcpy (buf, path, MC_MAXPATHLEN);
     ino = vfs_s_inode_from_path (me, path, FL_FOLLOW | FL_NONE);
 
     if (!ino->localname)
--- mc-4.6.0/vfs/extfs.c
+++ mc-4.6.0/vfs/extfs.c
@@ -888,8 +888,7 @@ static void * s_readdir(void *data)
     if (!*info)
 	return NULL;
 
-    strncpy(dir.dent.d_name, (*info)->name, MC_MAXPATHLEN);
-    dir.dent.d_name[MC_MAXPATHLEN] = 0;
+    g_strlcpy(dir.dent.d_name, (*info)->name, MC_MAXPATHLEN);
 
     compute_namelen(&dir.dent);
     *info = (*info)->next_in_dir;
@@ -1002,10 +1001,10 @@ static int s_readlink (vfs *me, char *pa
     if (entry == NULL)
     	return -1;
     if (!S_ISLNK (entry->inode->mode)) ERRNOR (EINVAL, -1);
-    if (size > (i = strlen (entry->inode->linkname))) {
-    	size = i;
+    if (size < (i = strlen (entry->inode->linkname))) {
+    	i = size;
     }
-    strncpy (buf, entry->inode->linkname, i);
+    memcpy (buf, entry->inode->linkname, i);
     return i;
 }
 
--- mc-4.6.0/vfs/extfs/deb.in
+++ mc-4.6.0/vfs/extfs/deb.in
@@ -149,15 +149,10 @@ sub mcdebfs_run
 	}
 	else
 	{
-	        $suffix = "aaa";
-		while (1) {
-		    $tmpdir = "/tmp/mcdebfs.run".$$.$suffix;
-		    last if mkdir $tmpdir, 0700;
-		    $suffix++;
-		    # Somebody is being really nasty, give up
-		    exit 1 if $suffix eq "zzz";
-		}
-		
+		use File::Temp qw(mkdtemp);
+		my $template = "/tmp/mcdebfs.run.XXXXXX";
+		$template="$ENV{MC_TMPDIR}/mcdebfs.XXXXXX" if ($ENV{MC_TMPDIR});
+		$tmpdir = mkdtemp($template);
 		$tmpcmd="$tmpdir/run";
 		&mcdebfs_copyout($archive, $filename, $tmpcmd);
 		system("chmod u+x $tmpcmd");
--- mc-4.6.0/vfs/extfs/rpm
+++ mc-4.6.0/vfs/extfs/rpm
@@ -1,14 +1,17 @@
 #! /bin/sh
 #
 # Written by Erik Troan (ewt@redhat.com) 1996
-#            Jakub Jelinek (jj@sunsite.mff.cuni.cz) 1996
+#            Jakub Jelinek (jj@sunsite.mff.cuni.cz) 1996, 2004
 #            Tomasz K�oczko (kloczek@rudy.mif.pg.gda.pl) 1997
 # minor changes by Wojtek Pilorz (wpilorz@bdk.lublin.pl) 1997
 # minor changes by Michele Marziani (marziani@fe.infn.it) 1997
 # bug files by Marc Merlin (marcsoft@merlins.org) 1998
 # locale bugfix by Michal Svec (rebel@penguin.cz) 2000
-# (C) 1996 The Free Software Foundation.
+# Whitespace(s) & single quote(s) in filename workaround
+#   by Andrew V. Samoilov <sav@bcs.zp.ua> 2004
+# https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=64007
 #
+# (C) 1996-2004 The Free Software Foundation.
 #
 
 # override any locale for dates
@@ -22,6 +25,10 @@ else
   RPM="rpm"
 fi
 RPM2CPIO="rpm2cpio"
+SED=sed
+# Surround the whole filename with single quotes and handle specially
+# \', ' and \ at the end of the string.
+SEDCMD="s/\\(\\\\\\?\\)'/'\\1\\1\\\\''/g;s/\\\\\$/'\\\\\\\\'/;s/^/'/;s/\$/'/"
 
 mcrpmfs_list ()
 {
@@ -31,12 +38,13 @@ mcrpmfs_list ()
     if test -z "$MCFASTRPM"; then
       MCFASTRPM=$MCFASTRPM_DFLT
     fi
+    f="`echo "$1" | $SED "$SEDCMD"`"
     FILEPREF="-r--r--r--   1 root     root    "
-    DESC=`$RPM -qip "$1" 2>/dev/null` || {
+    DESC=`$RPM -qip "$f" 2>/dev/null` || {
 	echo "$FILEPREF 0 "`date +"%b %d %H:%M"`" ERROR"
 	exit 1
     }
-    DATE=`$RPM -qp --qf "%{BUILDTIME:date}\n" "$1" | cut -c 5-11,21-24`
+    DATE=`$RPM -qp --qf "%{BUILDTIME:date}\n" "$f" | cut -c 5-11,21-24`
     HEADERSIZE=`echo "$DESC" | wc -c`
     echo "-r--r--r--   1 root     root  $HEADERSIZE $DATE HEADER"
     echo "-r-xr-xr-x   1 root     root    39 $DATE INSTALL"
@@ -47,25 +55,25 @@ mcrpmfs_list ()
     echo "$FILEPREF 0 $DATE INFO/BUILDHOST"
     echo "$FILEPREF 0 $DATE INFO/SOURCERPM"
     if test "$MCFASTRPM" = 0 ; then
-     test "`$RPM -qp --qf \"%{DISTRIBUTION}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{DISTRIBUTION}\" \"$f\"`" = "(none)" ||
  	 echo "$FILEPREF 0 $DATE INFO/DISTRIBUTION"
-     test "`$RPM -qp --qf \"%{VENDOR}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{VENDOR}\" \"$f\"`" = "(none)" ||
 	 echo "$FILEPREF 0 $DATE INFO/VENDOR"
-     test "`$RPM -qp --qf \"%{DESCRIPTION}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{DESCRIPTION}\" \"$f\"`" = "(none)" ||
          echo "$FILEPREF 0 $DATE INFO/DESCRIPTION"
-     test "`$RPM -qp --qf \"%{SUMMARY}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{SUMMARY}\" \"$f\"`" = "(none)" ||
          echo "$FILEPREF 0 $DATE INFO/SUMMARY"
-     if test "`$RPM -qp --qf \"%{RPMTAG_PREIN}%{RPMTAG_POSTIN}%{RPMTAG_PREUN}%{RPMTAG_POSTUN}%{VERIFYSCRIPT}\" \"$1\"`" != "(none)(none)(none)(none)(none)"; then
+     if test "`$RPM -qp --qf \"%{RPMTAG_PREIN}%{RPMTAG_POSTIN}%{RPMTAG_PREUN}%{RPMTAG_POSTUN}%{VERIFYSCRIPT}\" \"$f\"`" != "(none)(none)(none)(none)(none)"; then
 	echo "dr-xr-xr-x   1 root     root     0 $DATE INFO/SCRIPTS"
-	test "`$RPM -qp --qf \"%{RPMTAG_PREIN}\" \"$1\"`" = '(none)' ||
+	test "`$RPM -qp --qf \"%{RPMTAG_PREIN}\" \"$f\"`" = '(none)' ||
 	   echo "$FILEPREF 0 $DATE INFO/SCRIPTS/PREIN"
-	test "`$RPM -qp --qf \"%{RPMTAG_POSTIN}\" \"$1\"`" = '(none)' ||
+	test "`$RPM -qp --qf \"%{RPMTAG_POSTIN}\" \"$f\"`" = '(none)' ||
 	   echo "$FILEPREF 0 $DATE INFO/SCRIPTS/POSTIN"
-	test "`$RPM -qp --qf \"%{RPMTAG_PREUN}\" \"$1\"`" = '(none)' ||
+	test "`$RPM -qp --qf \"%{RPMTAG_PREUN}\" \"$f\"`" = '(none)' ||
 	   echo "$FILEPREF 0 $DATE INFO/SCRIPTS/PREUN"
-	test "`$RPM -qp --qf \"%{RPMTAG_POSTUN}\" \"$1\"`" = '(none)' ||
+	test "`$RPM -qp --qf \"%{RPMTAG_POSTUN}\" \"$f\"`" = '(none)' ||
 	   echo "$FILEPREF 0 $DATE INFO/SCRIPTS/POSTUN"
-	test "`$RPM -qp --qf \"%{VERIFYSCRIPT}\" \"$1\"`" = '(none)' ||
+	test "`$RPM -qp --qf \"%{VERIFYSCRIPT}\" \"$f\"`" = '(none)' ||
 	   echo "$FILEPREF 0 $DATE INFO/SCRIPTS/VERIFYSCRIPT"
         echo "$FILEPREF 0 $DATE INFO/SCRIPTS/ALL"
      fi
@@ -83,15 +91,15 @@ mcrpmfs_list ()
      echo "$FILEPREF 0 $DATE INFO/SCRIPTS/ALL"
     fi
     if test "$MCFASTRPM" = 0 ; then
-     test "`$RPM -qp --qf \"%{PACKAGER}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{PACKAGER}\" \"$f\"`" = "(none)" ||
 	 echo "$FILEPREF 0 $DATE INFO/PACKAGER"
-     test "`$RPM -qp --qf \"%{URL}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{URL}\" \"$f\"`" = "(none)" ||
 	 echo "$FILEPREF 0 $DATE INFO/URL"
-     test "`$RPM -qp --qf \"%{SERIAL}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{SERIAL}\" \"$f\"`" = "(none)" ||
 	 echo "$FILEPREF 0 $DATE INFO/SERIAL"
-     test "`$RPM -qp --qf \"%{COPYRIGHT}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{COPYRIGHT}\" \"$f\"`" = "(none)" ||
 	 echo "$FILEPREF 0 $DATE INFO/COPYRIGHT"
-     test "`$RPM -qp --qf \"%{LICENSE}\" \"$1\"`" = "(none)" ||
+     test "`$RPM -qp --qf \"%{LICENSE}\" \"$f\"`" = "(none)" ||
 	 echo "$FILEPREF 0 $DATE INFO/LICENSE"
     else
 	 echo "$FILEPREF 0 $DATE INFO/PACKAGER"
@@ -105,13 +113,13 @@ mcrpmfs_list ()
     echo "$FILEPREF 0 $DATE INFO/OS"
     echo "$FILEPREF 0 $DATE INFO/SIZE"
     if test "$MCFASTRPM" != 0 ; then
-    $RPM -qp --qf "[%{REQUIRENAME}\n]" "$1" | grep "(none)" > /dev/null ||
+    $RPM -qp --qf "[%{REQUIRENAME}\n]" "$f" | grep "(none)" > /dev/null ||
 	echo "$FILEPREF 0 $DATE INFO/REQUIRENAME"
-    $RPM -qp --qf "[%{OBSOLETES}\n]" "$1" | grep "(none)" > /dev/null ||
+    $RPM -qp --qf "[%{OBSOLETES}\n]" "$f" | grep "(none)" > /dev/null ||
 	echo "$FILEPREF 0 $DATE INFO/OBSOLETES"
-    $RPM -qp --qf "[%{PROVIDES}\n]" "$1" | grep "(none)" > /dev/null ||
+    $RPM -qp --qf "[%{PROVIDES}\n]" "$f" | grep "(none)" > /dev/null ||
 	echo "$FILEPREF 0 $DATE INFO/PROVIDES"
-    test "`$RPM -qp --qf \"%{CHANGELOGTEXT}\" \"$1\"`" = "(none)" ||
+    test "`$RPM -qp --qf \"%{CHANGELOGTEXT}\" \"$f\"`" = "(none)" ||
        echo "$FILEPREF 0 $DATE INFO/CHANGELOG"
     else 
 	echo "$FILEPREF 0 $DATE INFO/REQUIRENAME"
@@ -126,41 +134,41 @@ mcrpmfs_list ()
 
 mcrpmfs_copyout ()
 {
+    f="`echo "$1" | $SED "$SEDCMD"`"
     case "$2" in
-	HEADER) $RPM -qip "$1" > "$3"; exit 0;;
-	INSTALL) echo "# Run this to install this RPM package" > "$3"; exit 0;;
-	UPGRADE) echo "# Run this to upgrade this RPM package" > "$3"; exit 0;;
-	ERROR) $RPM -qip "$1" > /dev/null 2> "$3"; exit 0;;
-	INFO/NAME-VERSION-RELEASE)	$RPM -qp --qf "%{NAME}-%{VERSION}-%{RELEASE}\n" "$1" > "$3"; exit 0;;
-	INFO/RELEASE)		$RPM -qp --qf "%{RELEASE}\n" "$1" > "$3"; exit 0;;
-	INFO/GROUP)		$RPM -qp --qf "%{GROUP}\n" "$1" > "$3"; exit 0;;
-	INFO/DISTRIBUTION) 	$RPM -qp --qf "%{DISTRIBUTION}\n" "$1" > "$3"; exit 0;;
-	INFO/VENDOR)		$RPM -qp --qf "%{VENDOR}\n" "$1" > "$3"; exit 0;;
-	INFO/BUILDHOST)		$RPM -qp --qf "%{BUILDHOST}\n" "$1" > "$3"; exit 0;;
-	INFO/SOURCERPM)		$RPM -qp --qf "%{SOURCERPM}\n" "$1" > "$3"; exit 0;;
-	INFO/DESCRIPTION)	$RPM -qp --qf "%{DESCRIPTION}\n" "$1" > "$3"; exit 0;;
-	INFO/PACKAGER)		$RPM -qp --qf "%{PACKAGER}\n" "$1" > "$3"; exit 0;;
-	INFO/URL)		$RPM -qp --qf "%{URL}\n" "$1" >"$3"; exit 0;;
-	INFO/BUILDTIME)		$RPM -qp --qf "%{BUILDTIME:date}\n" "$1" >"$3"; exit 0;;
-	INFO/SERIAL)		$RPM -qp --qf "%{SERIAL}\n" "$1" >"$3"; exit 0;;
-	INFO/COPYRIGHT)		$RPM -qp --qf "%{COPYRIGHT}\n" "$1" >"$3"; exit 0;;
-	INFO/RPMVERSION)	$RPM -qp --qf "%{RPMVERSION}\n" "$1" >"$3"; exit 0;;
-	INFO/REQUIRENAME)	$RPM -qp --qf "[%{REQUIRENAME} %{REQUIREFLAGS:depflags} %{REQUIREVERSION}\n]" "$1" >"$3"; exit 0;;
-	INFO/PROVIDES)		$RPM -qp --qf "[%{PROVIDES}\n]" "$1" >"$3"; exit 0;;
-	INFO/SCRIPTS/PREIN)	$RPM -qp --qf "%{RPMTAG_PREIN}\n" "$1" >"$3"; exit 0;;
-	INFO/SCRIPTS/POSTIN)	$RPM -qp --qf "%{RPMTAG_POSTIN}\n" "$1" >"$3"; exit 0;;
-	INFO/SCRIPTS/PREUN)	$RPM -qp --qf "%{RPMTAG_PREUN}\n" "$1" >"$3"; exit 0;;
-	INFO/SCRIPTS/POSTUN)	$RPM -qp --qf "%{RPMTAG_POSTUN}\n" "$1" >"$3"; exit 0;;
-	INFO/SCRIPTS/VERIFYSCRIPT)	$RPM -qp --qf "%{VERIFYSCRIPT}\n" "$1" >"$3"; exit 0;;
-	INFO/SCRIPTS/ALL)		$RPM -qp --scripts "$1" > "$3"; exit 0;;
-	INFO/SUMMARY)		$RPM -qp --qf "%{SUMMARY}\n" "$1" > "$3"; exit 0;;
-	INFO/OS)		$RPM -qp --qf "%{OS}\n" "$1" > "$3"; exit 0;;
-	INFO/CHANGELOG)		$RPM -qp --qf "[* %{CHANGELOGTIME:date} %{CHANGELOGNAME}\n%{CHANGELOGTEXT}\n\n]\n" "$1" > "$3"; exit 0;;
-	INFO/SIZE)		$RPM -qp --qf "%{SIZE} bytes\n" "$1" > "$3"; exit 0;;
-	CONTENTS.cpio)		$RPM2CPIO "$1" > "$3"; exit 0;;
+	HEADER) $RPM -qip "$f" > "$3"; exit 0;;
+  	INSTALL) echo "# Run this to install this RPM package" > "$3"; exit 0;;
+  	UPGRADE) echo "# Run this to upgrade this RPM package" > "$3"; exit 0;;
+	ERROR) $RPM -qip "$f" > /dev/null 2> "$3"; exit 0;;
+	INFO/NAME-VERSION-RELEASE)	$RPM -qp --qf "%{NAME}-%{VERSION}-%{RELEASE}\n" "$f" > "$3"; exit 0;;
+	INFO/RELEASE)		$RPM -qp --qf "%{RELEASE}\n" "$f" > "$3"; exit 0;;
+	INFO/GROUP)		$RPM -qp --qf "%{GROUP}\n" "$f" > "$3"; exit 0;;
+	INFO/DISTRIBUTION) 	$RPM -qp --qf "%{DISTRIBUTION}\n" "$f" > "$3"; exit 0;;
+	INFO/VENDOR)		$RPM -qp --qf "%{VENDOR}\n" "$f" > "$3"; exit 0;;
+	INFO/BUILDHOST)		$RPM -qp --qf "%{BUILDHOST}\n" "$f" > "$3"; exit 0;;
+	INFO/SOURCERPM)		$RPM -qp --qf "%{SOURCERPM}\n" "$f" > "$3"; exit 0;;
+	INFO/DESCRIPTION)	$RPM -qp --qf "%{DESCRIPTION}\n" "$f" > "$3"; exit 0;;
+	INFO/PACKAGER)		$RPM -qp --qf "%{PACKAGER}\n" "$f" > "$3"; exit 0;;
+	INFO/URL)		$RPM -qp --qf "%{URL}\n" "$f" >"$3"; exit 0;;
+	INFO/BUILDTIME)		$RPM -qp --qf "%{BUILDTIME:date}\n" "$f" >"$3"; exit 0;;
+	INFO/SERIAL)		$RPM -qp --qf "%{SERIAL}\n" "$f" >"$3"; exit 0;;
+	INFO/COPYRIGHT)		$RPM -qp --qf "%{COPYRIGHT}\n" "$f" >"$3"; exit 0;;
+	INFO/RPMVERSION)	$RPM -qp --qf "%{RPMVERSION}\n" "$f" >"$3"; exit 0;;
+	INFO/REQUIRENAME)	$RPM -qp --qf "[%{REQUIRENAME} %{REQUIREFLAGS:depflags} %{REQUIREVERSION}\n]" "$f" >"$3"; exit 0;;
+	INFO/PROVIDES)		$RPM -qp --qf "[%{PROVIDES}\n]" "$f" >"$3"; exit 0;;
+	INFO/SCRIPTS/PREIN)	$RPM -qp --qf "%{RPMTAG_PREIN}\n" "$f" >"$3"; exit 0;;
+	INFO/SCRIPTS/POSTIN)	$RPM -qp --qf "%{RPMTAG_POSTIN}\n" "$f" >"$3"; exit 0;;
+	INFO/SCRIPTS/PREUN)	$RPM -qp --qf "%{RPMTAG_PREUN}\n" "$f" >"$3"; exit 0;;
+	INFO/SCRIPTS/POSTUN)	$RPM -qp --qf "%{RPMTAG_POSTUN}\n" "$f" >"$3"; exit 0;;
+	INFO/SCRIPTS/VERIFYSCRIPT)	$RPM -qp --qf "%{VERIFYSCRIPT}\n" "$f" >"$3"; exit 0;;
+	INFO/SCRIPTS/ALL)		$RPM -qp --scripts "$f" > "$3"; exit 0;;
+	INFO/SUMMARY)		$RPM -qp --qf "%{SUMMARY}\n" "$f" > "$3"; exit 0;;
+	INFO/OS)		$RPM -qp --qf "%{OS}\n" "$f" > "$3"; exit 0;;
+	INFO/CHANGELOG)		$RPM -qp --qf "[* %{CHANGELOGTIME:date} %{CHANGELOGNAME}\n%{CHANGELOGTEXT}\n\n]\n" "$f" > "$3"; exit 0;;
+	INFO/SIZE)		$RPM -qp --qf "%{SIZE} bytes\n" "$f" > "$3"; exit 0;;
+  	CONTENTS.cpio)		$RPM2CPIO "$1" > "$3"; exit 0;;
 	*)
-	    TMPDIR=/tmp/mctmpdir.$$
-	    mkdir $TMPDIR || exit 1
+	    TMPDIR=`mktemp -d ${MC_TMPDIR:-/tmp}/mctmpdir-rpm.XXXXXX` || exit 1
 	    cd $TMPDIR
 	    # Files in RPM version 4 and above start with "./" - try both
 	    $RPM2CPIO "$1" | cpio -iumd --quiet "$2" "./$2" >/dev/null
@@ -172,9 +180,10 @@ mcrpmfs_copyout ()
 
 mcrpmfs_run ()
 {
+    f="`echo "$1" | $SED "$SEDCMD"`"
     case "$2" in
-	INSTALL) echo "Installing \"$1\""; $RPM -ivh "$1"; exit 0;;
-	UPGRADE) echo "Upgrading \"$1\""; $RPM -iUvh "$1"; exit 0;;
+	INSTALL) echo "Installing \"$1\""; $RPM -ivh "$f"; exit 0;;
+	UPGRADE) echo "Upgrading \"$1\""; $RPM -Uvh "$f"; exit 0;;
     esac
 }
 
--- mc-4.6.0/vfs/extfs/uar.in
+++ mc-4.6.0/vfs/extfs/uar.in
@@ -22,8 +22,7 @@ mcarfs_copyout ()
 
 mcarfs_copyin ()
 {
-    TMPDIR=/tmp/mctmpdir-uar.$$
-    mkdir $TMPDIR || exit 1
+    TMPDIR=`mktemp -d ${MC_TMPDIR:-/tmp}/mctmpdir-uar.XXXXXX` || exit 1
     name=`basename "$2"`
     (cd $TMPDIR && cp -fp "$3" $name && $XAR r "$1" $name)
     rm -rf $TMPDIR
--- mc-4.6.0/vfs/extfs/uha.in
+++ mc-4.6.0/vfs/extfs/uha.in
@@ -31,8 +31,7 @@ mchafs_list ()
 
 mchafs_copyout ()
 {
-    TMPDIR="/tmp/mctmpdir-uha.$$"
-    mkdir $TMPDIR || exit 1
+    TMPDIR=`mktemp -d ${MC_TMPDIR:-/tmp}/mctmpdir-uha.XXXXXX` || exit 1
     cd $TMPDIR
 
     $HA xyq "$1" "$2" >/dev/null
--- mc-4.6.0/vfs/extfs/ulha.in
+++ mc-4.6.0/vfs/extfs/ulha.in
@@ -35,12 +35,6 @@ LHA_LIST="lha lq"
 LHA_GET="lha pq"
 LHA_PUT="lha aq"
 
-# Define a directory to create a temporary file for when
-# running a command to be run from the archive
-TMPDIR="/tmp/mctmpdir-uha.$$"
-# Temporary file within the directory
-TMPCMD=$TMPDIR/run
-
 # The 'list' command executive
 
 mc_lha_fs_list()
@@ -121,9 +115,9 @@ mc_lha_fs_copyin ()
 
 mc_lha_fs_run()
 {
+   TMPDIR=`mktemp -d ${MC_TMPDIR:-/tmp}/mctmpdir-ulha.XXXXXX` || exit 1
    trap "rm -rf $TMPDIR; exit 0" 1 2 3 4 15
-   # FIXME: Try harder to generate a unique directory if this fails
-   mkdir -m 0700 $TMPDIR || exit 1
+   TMPCMD=$TMPDIR/run
    $LHA_GET "$1" "$2" > $TMPCMD  
    chmod a+x $TMPCMD
    $TMPCMD
--- mc-4.6.0/vfs/extfs/urar.in
+++ mc-4.6.0/vfs/extfs/urar.in
@@ -77,8 +77,7 @@ mcrarfs_mkdir ()
 # preserve pwd. It is clean, but is it necessary?
     pwd=`pwd`
 # Create a directory and create in it a tmp directory with the good name     
-    dir=tmpdir.${RANDOM}
-    mkdir $dir
+    dir=`mktemp -d ${MC_TMPDIR:-/tmp}/mctmpdir-urar.XXXXXX` || exit 1
     cd $dir
     mkdir -p "$2"  
 # rar cannot create an empty directory    
--- mc-4.6.0/vfs/extfs/uzip.in
+++ mc-4.6.0/vfs/extfs/uzip.in
@@ -344,10 +344,10 @@ sub cleandirs {
 
 # Make a temporary directory with mode 0700.
 sub mktmpdir {
-	while (1) {
-		my $dir = POSIX::tmpnam();
-		return $dir if mkdir ($dir, 0700);
-	}
+	use File::Temp qw(mkdtemp);
+	my $template = "/tmp/mcuzipfs.XXXXXX";
+	$template="$ENV{MC_TMPDIR}/mcuzipfs.XXXXXX" if ($ENV{MC_TMPDIR});
+	return mkdtemp($template);
 }
 
 # Make a filename absolute and return it.
--- mc-4.6.0/vfs/extfs/uzoo.in
+++ mc-4.6.0/vfs/extfs/uzoo.in
@@ -13,8 +13,7 @@ ZOO=zoo
 # it to a temporary directory.
 mklink ()
 {
-    TMPDIR="/tmp/mctmpdir-uzoo.$$"
-    mkdir $TMPDIR || exit 1
+    TMPDIR=`mktemp -d ${MC_TMPDIR:-/tmp}/mctmpdir-uzoo.XXXXXX` || exit 1
     trap 'cd /; rm -rf $TMPDIR' 0 1 2 3 5 13 15
     ARCHIVE=$TMPDIR/tmp.zoo
     ln -sf "$1" "$ARCHIVE"
--- mc-4.6.0/vfs/fish.c
+++ mc-4.6.0/vfs/fish.c
@@ -97,8 +97,7 @@ static int get_reply (vfs *me, int sock,
 	if (strncmp(answer, "### ", 4)) {
 	    was_garbage = 1;
 	    if (string_buf) {
-	        strncpy(string_buf, answer, string_len - 1);
-		*(string_buf + string_len - 1) = 0;
+	        g_strlcpy(string_buf, answer, string_len);
 	    }
 	} else return decode_reply(answer+4, was_garbage);
     }
@@ -669,7 +668,7 @@ send_fish_command(vfs *me, vfs_s_super *
 {
     int r;
 
-    r = command (me, super, WAIT_REPLY, cmd);
+    r = command (me, super, WAIT_REPLY, "%s", cmd);
     vfs_add_noncurrent_stamps (&vfs_fish_ops, (vfsid) super, NULL);
     if (r != COMPLETE) ERRNOR (E_REMOTE, -1);
     if (flags & OPT_FLUSH)
--- mc-4.6.0/vfs/ftpfs.c
+++ mc-4.6.0/vfs/ftpfs.c
@@ -266,8 +266,7 @@ get_reply (vfs *me, int sock, char *stri
 	switch (sscanf(answer, "%d", &code)){
 	    case 0:
 	        if (string_buf) {
-		    strncpy (string_buf, answer, string_len - 1);
-		    *(string_buf + string_len - 1) = 0;
+		    g_strlcpy (string_buf, answer, string_len);
 		}
 	        code = 500;
 	        return 5;
@@ -286,8 +285,7 @@ get_reply (vfs *me, int sock, char *stri
 		    }
 		}
 	        if (string_buf){
-		    strncpy (string_buf, answer, string_len - 1);
-		    *(string_buf + string_len - 1) = 0;
+		    g_strlcpy (string_buf, answer, string_len);
 		}
 		return code / 100;
 	}
@@ -321,28 +319,28 @@ command (vfs *me, vfs_s_super *super, in
     va_list ap;
     char *str, *fmt_str;
     int status;
-    int sock = SUP.sock;
+    int cmdlen;
     
     va_start (ap, fmt);
     fmt_str = g_strdup_vprintf (fmt, ap);
     va_end (ap);
 
-    status = strlen (fmt_str);
-    str = g_realloc (fmt_str, status + 3);
-    strcpy (str + status, "\r\n");
+    cmdlen = strlen (fmt_str);
+    str = g_realloc (fmt_str, cmdlen + 3);
+    strcpy (str + cmdlen, "\r\n");
 
     if (logfile){
         if (strncmp (str, "PASS ", 5) == 0){
             fputs ("PASS <Password not logged>\r\n", logfile);
         } else
-	    fwrite (str, status + 2, 1, logfile);
+	    fwrite (str, cmdlen + 2, 1, logfile);
 
 	fflush (logfile);
     }
 
     got_sigpipe = 0;
     enable_interrupt_key ();
-    status = write (SUP.sock, str, status + 2);
+    status = write (SUP.sock, str, cmdlen + 2);
     
     if (status < 0){
 	code = 421;
@@ -353,7 +351,7 @@ command (vfs *me, vfs_s_super *super, in
 		level = 1;
 		status = reconnect (me, super);
 		level = 0;
-		if (status && write (SUP.sock, str, status + 2) > 0)
+		if (status && write (SUP.sock, str, cmdlen + 2) > 0)
 		    goto ok;
 	    }
 	    got_sigpipe = 1;
@@ -367,7 +365,7 @@ command (vfs *me, vfs_s_super *super, in
     disable_interrupt_key ();
     
     if (wait_reply)
-	return get_reply (me, sock, (wait_reply & WANT_STRING) ? reply_str : NULL, sizeof (reply_str)-1);
+	return get_reply (me, SUP.sock, (wait_reply & WANT_STRING) ? reply_str : NULL, sizeof (reply_str)-1);
     return COMPLETE;
 }
 
@@ -903,23 +901,29 @@ initconn (vfs *me, vfs_s_super *super)
     int data, len = sizeof(data_addr);
     struct protoent *pe;
 
-    getsockname(SUP.sock, (struct sockaddr *) &data_addr, &len);
-    data_addr.sin_port = 0;
-    
     pe = getprotobyname("tcp");
     if (pe == NULL)
 	    ERRNOR (EIO, -1);
+again:
+    if (getsockname(SUP.sock, (struct sockaddr *) &data_addr, &len) == -1)
+	ERRNOR (EIO, -1);
+    data_addr.sin_port = 0;
+    
     data = socket (AF_INET, SOCK_STREAM, pe->p_proto);
     if (data < 0)
 	    ERRNOR (EIO, -1);
 
     if (SUP.use_passive_connection){
-	if ((SUP.use_passive_connection = setup_passive (me, super, data, &data_addr)))
+	if (setup_passive (me, super, data, &data_addr))
 	    return data;
 
 	SUP.use_source_route = 0;
 	SUP.use_passive_connection = 0;
 	print_vfs_message (_("ftpfs: could not setup passive mode"));
+
+	/* data or data_addr may be damaged by setup_passive */
+	close (data);
+	goto again;
     }
 
     /* If passive setup fails, fallback to active connections */
@@ -971,11 +975,12 @@ open_data_connection (vfs *me, vfs_s_sup
 	data = s;
     else {
 	data = accept (s, (struct sockaddr *)&from, &fromlen);
-	close(s);
 	if (data < 0) {
 	    my_errno = errno;
+	    close(s);
 	    return -1;
 	}
+	close(s);
     } 
     disable_interrupt_key();
     return data;
@@ -1019,6 +1024,7 @@ linear_abort (vfs *me, vfs_s_fh *fh)
 		gettimeofday (&tim, NULL);
 		if (tim.tv_sec > start_tim.tv_sec + ABORT_TIMEOUT) {
 		    /* server keeps sending, drop the connection and reconnect */
+		    close (dsock);
 		    reconnect (me, super);
 		    return;
 		}
--- mc-4.6.0/vfs/mcfs.c
+++ mc-4.6.0/vfs/mcfs.c
@@ -756,8 +756,7 @@ mcfs_readdir (void *info)
 	return NULL;
     }
     dirent_dest = mcfs_readdir_data.dent.d_name;
-    strncpy (dirent_dest, mcfs_info->current->text, MC_MAXPATHLEN);
-    dirent_dest[MC_MAXPATHLEN] = 0;
+    g_strlcpy (dirent_dest, mcfs_info->current->text, MC_MAXPATHLEN);
     cached_lstat_info = &mcfs_info->current->my_stat;
     mcfs_info->current = mcfs_info->current->next;
 
@@ -985,9 +984,12 @@ mcfs_readlink (vfs *me, char *path, char
     if (!rpc_get (mc->sock, RPC_STRING, &stat_str, RPC_END))
 	return the_error (-1, EIO);
 
-    strncpy (buf, stat_str, size);
+    status = strlen (stat_str);
+    if (status < size)
+	size = status;
+    memcpy (buf, stat_str, size);
     g_free (stat_str);
-    return strlen (buf);
+    return size;
 }
 
 static int
--- mc-4.6.0/vfs/mcserv.c
+++ mc-4.6.0/vfs/mcserv.c
@@ -582,7 +582,7 @@ do_readlink (void)
     int n;
 
     rpc_get (msock, RPC_STRING, &file, RPC_END);
-    n = readlink (file, buffer, 2048);
+    n = readlink (file, buffer, 2048 - 1);
     send_status (n, errno);
     if (n >= 0) {
 	buffer[n] = 0;
--- mc-4.6.0/vfs/names.c
+++ mc-4.6.0/vfs/names.c
@@ -31,6 +31,7 @@ GNU Library General Public License for m
 #include <stdio.h>
 #include <pwd.h>
 #include <grp.h>
+#include <glib.h>
 
 #include "names.h"
 
@@ -59,7 +60,7 @@ finduid (char *uname)
 
     if (uname[0] != saveuname[0]	/* Quick test w/o proc call */
 	||0 != strncmp (uname, saveuname, TUNMLEN)) {
-	strncpy (saveuname, uname, TUNMLEN);
+	g_strlcpy (saveuname, uname, TUNMLEN);
 	pw = getpwnam (uname);
 	if (pw) {
 	    saveuid = pw->pw_uid;
@@ -77,7 +78,7 @@ findgid (char *gname)
 
     if (gname[0] != savegname[0]	/* Quick test w/o proc call */
 	||0 != strncmp (gname, savegname, TUNMLEN)) {
-	strncpy (savegname, gname, TUNMLEN);
+	g_strlcpy (savegname, gname, TUNMLEN);
 	gr = getgrnam (gname);
 	if (gr) {
 	    savegid = gr->gr_gid;
--- mc-4.6.0/vfs/samba/lib/util.c
+++ mc-4.6.0/vfs/samba/lib/util.c
@@ -114,7 +114,7 @@ static char *filename_dos(char *path,cha
 char *tmpdir(void)
 {
   char *p;
-  if ((p = getenv("TMPDIR"))) {
+  if ((p = getenv("MC_TMPDIR")) || (p = getenv("TMPDIR"))) {
     return p;
   }
   return "/tmp";
@@ -1885,20 +1885,17 @@ static char *automount_lookup(char *user
  
   char *nis_map = (char *)lp_nis_home_map_name();
  
-  char nis_domain[NIS_MAXNAMELEN + 1];
   char buffer[NIS_MAXATTRVAL + 1];
   nis_result *result;
   nis_object *object;
   entry_obj  *entry;
  
-  strncpy(nis_domain, (char *)nis_local_directory(), NIS_MAXNAMELEN);
-  nis_domain[NIS_MAXNAMELEN] = '\0';
- 
-  DEBUG(5, ("NIS+ Domain: %s\n", nis_domain));
+  DEBUG(5, ("NIS+ Domain: %s\n", (char *)nis_local_directory()));
  
   if (strcmp(user_name, last_key))
   {
-    slprintf(buffer, sizeof(buffer)-1, "[%s=%s]%s.%s", "key", user_name, nis_map, nis_domain);
+    slprintf(buffer, sizeof(buffer)-1, "[%s=%s]%s.%s", "key", user_name, nis_map,
+	     (char *)nis_local_directory());
     DEBUG(5, ("NIS+ querystring: %s\n", buffer));
  
     if (result = nis_list(buffer, RETURN_RESULT, NULL, NULL))
--- mc-4.6.0/vfs/smbfs.c
+++ mc-4.6.0/vfs/smbfs.c
@@ -785,8 +785,7 @@ smbfs_readdir(void *info)
 #endif
 	return NULL;
     }
-    strncpy(dirent_dest, smbfs_info->current->text, MC_MAXPATHLEN);
-    dirent_dest[MC_MAXPATHLEN] = 0;
+    g_strlcpy(dirent_dest, smbfs_info->current->text, MC_MAXPATHLEN);
     smbfs_info->current = smbfs_info->current->next;
 
     compute_namelen(&smbfs_readdir_data.dent);
--- mc-4.6.0/vfs/tar.c
+++ mc-4.6.0/vfs/tar.c
@@ -264,19 +264,26 @@ read_header (vfs *me, vfs_s_super *archi
 	char *bp, *data;
 	int size, written;
 
+	if (hstat.st_size > MC_MAXPATHLEN) {
+	    message_1s (1, MSG_ERROR, _("Inconsistent tar archive"));
+	    return STATUS_BADCHECKSUM;
+	}
+
 	longp = ((header->header.linkflag == LF_LONGNAME)
 		 ? &next_long_name
 		 : &next_long_link);
 
 	if (*longp)
 	    g_free (*longp);
-	bp = *longp = g_malloc (hstat.st_size);
+	bp = *longp = g_malloc (hstat.st_size + 1);
 
 	for (size = hstat.st_size;
 	     size > 0;
 	     size -= written) {
 	    data = get_next_record (archive, tard)->charptr;
 	    if (data == NULL) {
+		g_free (*longp);
+		*longp = NULL;
 		message_1s (1, MSG_ERROR, _("Unexpected EOF on archive file"));
 		return STATUS_BADCHECKSUM;
 	    }
@@ -287,10 +294,14 @@ read_header (vfs *me, vfs_s_super *archi
 	    memcpy (bp, data, written);
 	    bp += written;
 	}
-#if 0
-	if (hstat.st_size > 1)
-	    bp [hstat.st_size - 1] = 0;	/* just to make sure */
-#endif
+
+	if (bp - *longp == MC_MAXPATHLEN && bp[-1] != '\0') {
+	    g_free (*longp);
+	    *longp = NULL;
+	    message_1s (1, MSG_ERROR, _("Inconsistent tar archive"));
+	    return STATUS_BADCHECKSUM;
+	}	 
+	*bp = 0;
 	goto recurse;
     } else {
 	struct stat st;
--- mc-4.6.0/vfs/vfs.c
+++ mc-4.6.0/vfs/vfs.c
@@ -637,8 +637,7 @@ mc_get_current_wd (char *buffer, int siz
 {
     const char *cwd = mc_return_cwd();
 
-    strncpy (buffer, cwd, size - 1);
-    buffer [size - 1] = 0;
+    g_strlcpy (buffer, cwd, size);
     return buffer;
 }