diff --git a/client/account.C b/client/account.C
index 8db49f4464..8173e785f5 100644
--- a/client/account.C
+++ b/client/account.C
@@ -31,6 +31,7 @@ int write_account_file(
 ) {
     char path[256];
     FILE* f;
+    int retval;
 
     get_account_filename(master_url, path);
     f = fopen(TEMP_FILE_NAME, "w");
@@ -48,7 +49,8 @@ int write_account_file(
     }
     fprintf(f, "</account>\n");
     fclose(f);
-    boinc_rename(TEMP_FILE_NAME, path);
+    retval = boinc_rename(TEMP_FILE_NAME, path);
+    if (retval) return ERR_RENAME;
     return 0;
 }
 
@@ -85,7 +87,8 @@ int CLIENT_STATE::add_project(char* master_url, char* authenticator) {
 
     // create project state
     //
-    write_account_file(master_url, authenticator);
+    retval = write_account_file(master_url, authenticator);
+    if (retval) return retval;
     get_account_filename(master_url, path);
     f = fopen(path, "r");
     if (!f) return ERR_FOPEN;
@@ -126,7 +129,8 @@ int CLIENT_STATE::change_project(
 
     // create project state
     //
-    write_account_file(master_url, authenticator);
+    retval = write_account_file(master_url, authenticator);
+    if (retval) return retval;
     get_account_filename(master_url, path);
     f = fopen(path, "r");
     if (!f) return ERR_FOPEN;
diff --git a/client/app.C b/client/app.C
index a36eb420a2..273bd36413 100644
--- a/client/app.C
+++ b/client/app.C
@@ -91,7 +91,7 @@ ACTIVE_TASK::ACTIVE_TASK() {
     state = PROCESS_UNINITIALIZED;
     exit_status = 0;
     signal = 0;
-    strcpy(slot_dir, "");
+    safe_strncpy(slot_dir, "", sizeof(slot_dir));
 }
 
 int ACTIVE_TASK::init(RESULT* rp) {
@@ -160,7 +160,8 @@ int ACTIVE_TASK::start(bool first_time) {
         }
         return ERR_FOPEN;
     }
-    write_init_data_file(f, aid);
+    retval = write_init_data_file(f, aid);
+    if (retval) return retval;
     
     fclose(f);
 
@@ -190,8 +191,8 @@ int ACTIVE_TASK::start(bool first_time) {
         fip = app_version->app_files[i].file_info;
         get_pathname(fip, file_path);
         if (i == 0) {
-            strcpy(exec_name, fip->name);
-            strcpy(exec_path, file_path);
+            safe_strncpy(exec_name, fip->name, sizeof(exec_name));
+            safe_strncpy(exec_path, file_path, sizeof(exec_path));
         }
         if (first_time) {
             sprintf(link_path, "%s%s%s", slot_dir, PATH_SEPARATOR, fip->name);
@@ -229,7 +230,8 @@ int ACTIVE_TASK::start(bool first_time) {
             }
         } else {
             sprintf(temp, "..%s..%s%s", PATH_SEPARATOR, PATH_SEPARATOR, file_path);
-            write_fd_init_file(f, temp, file_ref.fd, 1);
+            retval = write_fd_init_file(f, temp, file_ref.fd, 1);
+            if (retval) return retval;
         }
     }
 
@@ -257,7 +259,8 @@ int ACTIVE_TASK::start(bool first_time) {
             }
         } else {
             sprintf(temp, "..%s..%s%s", PATH_SEPARATOR, PATH_SEPARATOR, file_path);
-            write_fd_init_file(f, temp, file_ref.fd, 0);
+            retval = write_fd_init_file(f, temp, file_ref.fd, 0);
+            if (retval) return retval;
         }
     }
 
@@ -358,13 +361,15 @@ int ACTIVE_TASK::start(bool first_time) {
 //
 int ACTIVE_TASK::request_exit() {
     char quit_file[256];
+    int retval;
 
     get_slot_dir(slot, slot_dir);
     sprintf(quit_file, "%s%s%s", slot_dir, PATH_SEPARATOR, QUIT_FILE);
     FILE *fp = fopen(quit_file, "w");
     if (!fp) return ERR_FOPEN;
-    write_quit_file(fp);
+    retval = write_quit_file(fp);
     fclose(fp);
+    if (retval) return retval;
     return 0;
 }
 
@@ -678,8 +683,9 @@ bool ACTIVE_TASK::check_app_status_files() {
     f = fopen(path, "r");
     if (f) {
         found = true;
-        parse_fraction_done_file(f, fraction_done, current_cpu_time, checkpoint_cpu_time);
+        retval = parse_fraction_done_file(f, fraction_done, current_cpu_time, checkpoint_cpu_time);
         fclose(f);
+        if (retval) return false;
         retval = file_delete(path);
         if (retval) {
             fprintf(stderr,
@@ -788,8 +794,8 @@ int ACTIVE_TASK::parse(FILE* fin, CLIENT_STATE* cs) {
     int app_version_num=0;
     PROJECT* project;
 
-    strcpy(result_name, "");
-    strcpy(project_master_url, "");
+    safe_strncpy(result_name, "", sizeof(result_name));
+    safe_strncpy(project_master_url, "", sizeof(project_master_url));
     while (fgets(buf, 256, fin)) {
         if (match_tag(buf, "</active_task>")) {
             project = cs->lookup_project(project_master_url);
@@ -829,10 +835,12 @@ int ACTIVE_TASK::parse(FILE* fin, CLIENT_STATE* cs) {
 //
 int ACTIVE_TASK_SET::write(FILE* fout) {
     unsigned int i;
+    int retval;
 
     fprintf(fout, "<active_task_set>\n");
     for (i=0; i<active_tasks.size(); i++) {
-        active_tasks[i]->write(fout);
+        retval = active_tasks[i]->write(fout);
+        if (retval) return retval;
     }
     fprintf(fout, "</active_task_set>\n");
     return 0;
diff --git a/client/client_state.C b/client/client_state.C
index 1c51c2247e..a3b86d4040 100644
--- a/client/client_state.C
+++ b/client/client_state.C
@@ -79,11 +79,11 @@ CLIENT_STATE::CLIENT_STATE() {
     user_idle = true;
     use_http_proxy = false;
     use_socks_proxy = false;
-    strcpy(proxy_server_name,"");
+    safe_strncpy(proxy_server_name, "", sizeof(proxy_server_name));
     proxy_server_port = 80;
-    strcpy(socks_user_name,"");
-    strcpy(socks_user_passwd,"");
-    strcpy(host_venue,"");
+    safe_strncpy(socks_user_name, "", sizeof(socks_user_name));
+    safe_strncpy(socks_user_passwd, "", sizeof(socks_user_passwd));
+    safe_strncpy(host_venue,"", sizeof(host_venue));
     suspend_requested = false;
     start_saver = false;
 #ifdef _WIN32
@@ -175,8 +175,10 @@ int CLIENT_STATE::init() {
 
     // set up the project and slot directories
     //
-    make_project_dirs();
-    make_slot_dirs();
+    retval = make_project_dirs();
+    if (retval) return retval;
+    retval = make_slot_dirs();
+    if (retval) return retval;
 
     // Restart any tasks that were running when we last quit the client
     //
@@ -273,6 +275,8 @@ int CLIENT_STATE::time_tests() {
 //
 int CLIENT_STATE::check_time_tests() {
     FILE* finfo;
+    int retval;
+    
     if (time_tests_id) {
 #ifdef _WIN32
         DWORD exit_code = 0;
@@ -293,7 +297,7 @@ int CLIENT_STATE::check_time_tests() {
         }
         CloseHandle(time_tests_handle);
 #else
-        int retval, exit_code = 0;
+        int exit_code = 0;
         retval = waitpid(time_tests_id, &exit_code, WNOHANG);
         if(retval == 0) {
             if((unsigned int)time(NULL) > time_tests_start + MAX_TIME_TESTS_SECONDS) {
@@ -320,8 +324,9 @@ int CLIENT_STATE::check_time_tests() {
             host_info.m_cache = 1e6;
             return TIME_TESTS_ERROR;
         }
-        host_info.parse_time_tests(finfo);
+        retval = host_info.parse_time_tests(finfo);
         fclose(finfo);
+        if (retval) return TIME_TESTS_ERROR;
         file_delete(TIME_TESTS_FILE_NAME);
         return TIME_TESTS_COMPLETE;
     }
@@ -570,13 +575,17 @@ int CLIENT_STATE::parse_state_file() {
                 delete rp;
             }
         } else if (match_tag(buf, "<host_info>")) {
-            host_info.parse(f);
+            retval = host_info.parse(f);
+            if (retval) goto done;
         } else if (match_tag(buf, "<time_stats>")) {
-            time_stats.parse(f);
+            retval = time_stats.parse(f);
+            if (retval) goto done;
         } else if (match_tag(buf, "<net_stats>")) {
-            net_stats.parse(f);
+            retval = net_stats.parse(f);
+            if (retval) goto done;
         } else if (match_tag(buf, "<active_task_set>")) {
-            active_tasks.parse(f, this);
+            retval = active_tasks.parse(f, this);
+            if (retval) goto done;
         } else if (match_tag(buf, "<platform_name>")) {
             // should match our current platform name
         } else if (match_tag(buf, "<version>")) {
@@ -615,18 +624,26 @@ int CLIENT_STATE::write_state_file() {
         return ERR_FOPEN;
     }
     fprintf(f, "<client_state>\n");
-    host_info.write(f);
-    time_stats.write(f, false);
-    net_stats.write(f, false);
+    retval = host_info.write(f);
+    if (retval) return retval;
+    retval = time_stats.write(f, false);
+    if (retval) return retval;
+    retval = net_stats.write(f, false);
+    if (retval) return retval;
     for (j=0; j<projects.size(); j++) {
         PROJECT* p = projects[j];
-        p->write_state(f);
+        retval = p->write_state(f);
+        if (retval) return retval;
         for (i=0; i<apps.size(); i++) {
-            if (apps[i]->project == p) apps[i]->write(f);
+            if (apps[i]->project == p) {
+                retval = apps[i]->write(f);
+                if (retval) return retval;
+            }
         }
         for (i=0; i<file_infos.size(); i++) {
             if (file_infos[i]->project == p) {
-                file_infos[i]->write(f, false);
+                retval = file_infos[i]->write(f, false);
+                if (retval) return retval;
             }
         }
         for (i=0; i<app_versions.size(); i++) {
@@ -1215,11 +1232,11 @@ void CLIENT_STATE::parse_env_vars() {
     }
 
     if ((p = getenv("SOCKS_USER"))) {
-        strcpy(socks_user_name, p);
+        safe_strncpy(socks_user_name, p, sizeof(socks_user_name));
     }
 
     if ((p = getenv("SOCKS_PASSWD"))) {
-        strcpy(socks_user_name, p);
+        safe_strncpy(socks_user_passwd, p, sizeof(socks_user_passwd));
     }
 }
 
diff --git a/client/client_types.C b/client/client_types.C
index f409e51b75..f7a4452327 100644
--- a/client/client_types.C
+++ b/client/client_types.C
@@ -26,18 +26,19 @@
 #include "file_names.h"
 #include "filesys.h"
 #include "parse.h"
+#include "util.h"
 #include "pers_file_xfer.h"
 
 #include "client_types.h"
 
 PROJECT::PROJECT() {
-    strcpy(master_url,"");
-    strcpy(authenticator,"");
-    strcpy(project_specific_prefs, "");
+    safe_strncpy(master_url, "", sizeof(master_url));
+    safe_strncpy(authenticator, "", sizeof(authenticator));
+    safe_strncpy(project_specific_prefs, "", sizeof(project_specific_prefs));
     resource_share = 100;
-    strcpy(project_name,"");
-    strcpy(user_name,"");
-    strcpy(team_name,"");
+    safe_strncpy(project_name, "", sizeof(project_name));
+    safe_strncpy(user_name, "", sizeof(user_name));
+    safe_strncpy(team_name, "", sizeof(team_name));
     user_total_credit = 0;
     user_expavg_credit = 0;
     user_create_time = 0;
@@ -48,7 +49,7 @@ PROJECT::PROJECT() {
     host_create_time = 0;
     exp_avg_cpu = 0;
     exp_avg_mod_time = 0;
-    strcpy(code_sign_key, "");
+    safe_strncpy(code_sign_key, "", sizeof(code_sign_key));
     nrpc_failures = 0;
     min_rpc_time = 0;
     master_fetch_failures = 0;
@@ -72,8 +73,8 @@ int PROJECT::parse_account(FILE* in) {
     //
     master_url_fetch_pending = true;
     sched_rpc_pending = true;
-    strcpy(master_url, "");
-    strcpy(authenticator, "");
+    safe_strncpy(master_url, "", sizeof(master_url));
+    safe_strncpy(authenticator, "", sizeof(authenticator));
     while (fgets(buf, 256, in)) {
         if (match_tag(buf, "<account>")) continue;
         if (match_tag(buf, "</account>")) return 0;
@@ -103,9 +104,9 @@ int PROJECT::parse_state(FILE* in) {
     char buf[256];
     STRING256 string;
 
-    strcpy(project_name, "");
-    strcpy(user_name, "");
-    strcpy(team_name, "");
+    safe_strncpy(project_name, "", sizeof(project_name));
+    safe_strncpy(user_name, "", sizeof(user_name));
+    safe_strncpy(team_name, "", sizeof(team_name));
     resource_share = 100;
     exp_avg_cpu = 0;
     exp_avg_mod_time = 0;
@@ -220,9 +221,9 @@ int PROJECT::write_state(FILE* out) {
 //
 void PROJECT::copy_state_fields(PROJECT& p) {
     scheduler_urls = p.scheduler_urls;
-    strcpy(project_name, p.project_name);
-    strcpy(user_name, p.user_name);
-    strcpy(team_name, p.team_name);
+    safe_strncpy(project_name, p.project_name, sizeof(project_name));
+    safe_strncpy(user_name, p.user_name, sizeof(user_name));
+    safe_strncpy(team_name, p.team_name, sizeof(team_name));
     user_total_credit = p.user_total_credit;
     user_expavg_credit = p.user_expavg_credit;
     user_create_time = p.user_create_time;
@@ -238,13 +239,13 @@ void PROJECT::copy_state_fields(PROJECT& p) {
     min_rpc_time = p.min_rpc_time;
     master_url_fetch_pending = p.master_url_fetch_pending;
     sched_rpc_pending = p.sched_rpc_pending;
-    strcpy(code_sign_key, p.code_sign_key);
+    safe_strncpy(code_sign_key, p.code_sign_key, sizeof(code_sign_key));
 }
 
 int APP::parse(FILE* in) {
     char buf[256];
 
-    strcpy(name, "");
+    safe_strncpy(name, "", sizeof(name));
     project = NULL;
     while (fgets(buf, 256, in)) {
         if (match_tag(buf, "</app>")) return 0;
@@ -299,8 +300,8 @@ int FILE_INFO::parse(FILE* in, bool from_server) {
     PERS_FILE_XFER *pfxp;
     int retval;
 
-    strcpy(name, "");
-    strcpy(md5_cksum, "");
+    safe_strncpy(name, "", sizeof(name));
+    safe_strncpy(md5_cksum, "", sizeof(md5_cksum));
     max_nbytes = 0;
     nbytes = 0;
     upload_offset = -1;
@@ -317,9 +318,9 @@ int FILE_INFO::parse(FILE* in, bool from_server) {
     urls.clear();
     start_url = -1;
     current_url = -1;
-    strcpy(signed_xml, "");
-    strcpy(xml_signature, "");
-    strcpy(file_signature, "");
+    safe_strncpy(signed_xml, "", sizeof(signed_xml));
+    safe_strncpy(xml_signature, "", sizeof(xml_signature));
+    safe_strncpy(file_signature, "", sizeof(file_signature));
     while (fgets(buf, 256, in)) {
         if (match_tag(buf, "</file_info>")) return 0;
         else if (match_tag(buf, "<xml_signature>")) {
@@ -385,6 +386,7 @@ int FILE_INFO::parse(FILE* in, bool from_server) {
 //
 int FILE_INFO::write(FILE* out, bool to_server) {
     unsigned int i;
+    int retval;
 
     fprintf(out,
         "<file_info>\n"
@@ -408,7 +410,8 @@ int FILE_INFO::write(FILE* out, bool to_server) {
         fprintf(out, "    <url>%s</url>\n", urls[i].text);
     }
     if (!to_server && pers_file_xfer) {
-        pers_file_xfer->write(out);
+        retval = pers_file_xfer->write(out);
+        if (retval) return retval;
     }
     if (!to_server) {
         if (signed_xml && xml_signature) {
@@ -467,7 +470,7 @@ int APP_VERSION::parse(FILE* in) {
     char buf[256];
     FILE_REF file_ref;
 
-    strcpy(app_name, "");
+    safe_strncpy(app_name, "", sizeof(app_name));
     version_num = 0;
     app = NULL;
     project = NULL;
@@ -487,6 +490,7 @@ int APP_VERSION::parse(FILE* in) {
 
 int APP_VERSION::write(FILE* out) {
     unsigned int i;
+    int retval;
 
     fprintf(out,
         "<app_version>\n"
@@ -496,7 +500,8 @@ int APP_VERSION::write(FILE* out) {
         version_num
     );
     for (i=0; i<app_files.size(); i++) {
-        app_files[i].write(out);
+        retval = app_files[i].write(out);
+        if (retval) return retval;
     }
     fprintf(out,
         "</app_version>\n"
@@ -507,8 +512,8 @@ int APP_VERSION::write(FILE* out) {
 int FILE_REF::parse(FILE* in) {
     char buf[256];
 
-    strcpy(file_name, "");
-    strcpy(open_name, "");
+    safe_strncpy(file_name, "", sizeof(file_name));
+    safe_strncpy(open_name, "", sizeof(open_name));
     fd = -1;
     main_program = false;
     while (fgets(buf, 256, in)) {
@@ -546,11 +551,11 @@ int WORKUNIT::parse(FILE* in) {
     char buf[256];
     FILE_REF file_ref;
 
-    strcpy(name, "");
-    strcpy(app_name, "");
+    safe_strncpy(name, "", sizeof(name));
+    safe_strncpy(app_name, "", sizeof(app_name));
     version_num = 0;
-    strcpy(command_line, "");
-    strcpy(env_vars, "");
+    safe_strncpy(command_line, "", sizeof(command_line));
+    safe_strncpy(env_vars, "", sizeof(env_vars));
     app = NULL;
     project = NULL;
     seconds_to_complete = 0;
@@ -620,7 +625,7 @@ bool WORKUNIT::had_failure(int& failnum) {
 int RESULT::parse_ack(FILE* in) {
     char buf[256];
 
-    strcpy(name, "");
+    safe_strncpy(name, "", sizeof(name));
     while (fgets(buf, 256, in)) {
         if (match_tag(buf, "</result_ack>")) return 0;
         else if (parse_str(buf, "<name>", name, sizeof(name))) continue;
@@ -630,8 +635,8 @@ int RESULT::parse_ack(FILE* in) {
 }
 
 void RESULT::clear() {
-    strcpy(name, "");
-    strcpy(wu_name, "");
+    safe_strncpy(name, "", sizeof(name));
+    safe_strncpy(wu_name, "", sizeof(wu_name));
     report_deadline = 0;
     output_files.clear();
     is_active = false;
@@ -642,7 +647,7 @@ void RESULT::clear() {
     exit_status = 0;
     active_task_state = 0;
     signal = 0;
-    strcpy(stderr_out, "");
+    safe_strncpy(stderr_out, "", sizeof(stderr_out));
     app = NULL;
     wup = NULL;
     project = NULL;
@@ -705,7 +710,7 @@ int RESULT::parse_state(FILE* in) {
 int RESULT::write(FILE* out, bool to_server) {
     unsigned int i;
     FILE_INFO* fip;
-    int n;
+    int n, retval;
 
     // If we didn't have an error with this result, (in which case
     // we would have called report_project_error():
@@ -739,13 +744,15 @@ int RESULT::write(FILE* out, bool to_server) {
             report_deadline
         );
         for (i=0; i<output_files.size(); i++) {
-            output_files[i].write(out);
+            retval = output_files[i].write(out);
+            if (retval) return retval;
         }
     } else {
         for (i=0; i<output_files.size(); i++) {
             fip = output_files[i].file_info;
             if (fip->uploaded) {
-                fip->write(out, to_server);
+                retval = fip->write(out, to_server);
+                if (retval) return retval;
             }
         }
     }
diff --git a/client/cs_apps.C b/client/cs_apps.C
index 0db82d5466..3db232343a 100644
--- a/client/cs_apps.C
+++ b/client/cs_apps.C
@@ -30,8 +30,10 @@
 //
 int CLIENT_STATE::make_slot_dirs() {
     unsigned int i;
+    int retval;
     for (i=0; i<nslots; i++) {
-        make_slot_dir(i);
+        retval = make_slot_dir(i);
+        if (retval) return retval;
     }
     return 0;
 }
diff --git a/client/cs_files.C b/client/cs_files.C
index edc20b2d36..1cb09cbfbf 100644
--- a/client/cs_files.C
+++ b/client/cs_files.C
@@ -51,8 +51,10 @@ bool CLIENT_STATE::start_new_file_xfer() {
 //
 int CLIENT_STATE::make_project_dirs() {
     unsigned int i;
+    int retval;
     for (i=0; i<projects.size(); i++) {
-        make_project_dir(*projects[i]);
+        retval = make_project_dir(*projects[i]);
+        if (retval) return retval;
     }
     return 0;
 }
@@ -84,8 +86,8 @@ int verify_downloaded_file(char* pathname, FILE_INFO& file_info) {
             return ERR_RSA_FAILED;
         }
     } else if (file_info.md5_cksum) {
-        md5_file(pathname, cksum, file_info.nbytes);
-        if (strcmp(cksum, file_info.md5_cksum)) {
+        retval = md5_file(pathname, cksum, file_info.nbytes);
+        if (strcmp(cksum, file_info.md5_cksum) || retval) {
             fprintf(stderr, "error: verify_file2: MD5 check failed\n");
             return ERR_MD5_FAILED;
         }
diff --git a/client/cs_scheduler.C b/client/cs_scheduler.C
index 73834dadcd..b474ebac14 100644
--- a/client/cs_scheduler.C
+++ b/client/cs_scheduler.C
@@ -184,6 +184,7 @@ int CLIENT_STATE::make_scheduler_request(PROJECT* p, double work_req) {
     FILE* f = fopen(SCHED_OP_REQUEST_FILE, "wb");
     unsigned int i;
     RESULT* rp;
+    int retval;
 
     if (!f) return ERR_FOPEN;
     fprintf(f,
@@ -215,9 +216,12 @@ int CLIENT_STATE::make_scheduler_request(PROJECT* p, double work_req) {
         fclose(fprefs);
     }
 
-    time_stats.write(f, true);
-    net_stats.write(f, true);
-    host_info.write(f);
+    retval = time_stats.write(f, true);
+    if (retval) return retval;
+    retval = net_stats.write(f, true);
+    if (retval) return retval;
+    retval = host_info.write(f);
+    if (retval) return retval;
     for (i=0; i<results.size(); i++) {
         rp = results[i];
         if (rp->project == p && rp->ready_to_ack)
@@ -338,13 +342,13 @@ int CLIENT_STATE::handle_scheduler_reply(
     if (retval) return retval;
 
     if (strlen(sr.project_name)) {
-        strcpy(project->project_name, sr.project_name);
+        safe_strncpy(project->project_name, sr.project_name, sizeof(project->project_name));
     }
     if (strlen(sr.user_name)) {
-        strcpy(project->user_name, sr.user_name);
+        safe_strncpy(project->user_name, sr.user_name, sizeof(project->user_name));
     }
     if (strlen(sr.team_name)) {
-        strcpy(project->team_name, sr.team_name);
+        safe_strncpy(project->team_name, sr.team_name, sizeof(project->team_name));
     }
     project->user_total_credit = sr.user_total_credit;
     project->user_expavg_credit = sr.user_expavg_credit;
@@ -384,7 +388,8 @@ int CLIENT_STATE::handle_scheduler_reply(
         );
         fclose(f);
         safe_strncpy(host_venue, sr.host_venue, sizeof(host_venue));
-        global_prefs.parse_file(host_venue);
+        retval = global_prefs.parse_file(host_venue);
+        if (retval) return retval;
         install_global_prefs();
     }
 
@@ -393,9 +398,10 @@ int CLIENT_STATE::handle_scheduler_reply(
     if (sr.project_prefs_xml) {
         char path[256];
 
-        write_account_file(
+        retval = write_account_file(
             project->master_url, project->authenticator, sr.project_prefs_xml
         );
+        if (retval) return retval;
         get_account_filename(project->master_url, path);
         f = fopen(path, "r");
         if (!f) return ERR_FOPEN;
@@ -410,7 +416,7 @@ int CLIENT_STATE::handle_scheduler_reply(
 
     if (sr.code_sign_key) {
         if (!strlen(project->code_sign_key)) {
-            strcpy(project->code_sign_key, sr.code_sign_key);
+            safe_strncpy(project->code_sign_key, sr.code_sign_key, sizeof(project->code_sign_key));
         } else {
             if (sr.code_sign_key_signature) {
                 retval = verify_string2(
@@ -418,7 +424,7 @@ int CLIENT_STATE::handle_scheduler_reply(
                     project->code_sign_key, signature_valid
                 );
                 if (!retval && signature_valid) {
-                    strcpy(project->code_sign_key, sr.code_sign_key);
+                    safe_strncpy(project->code_sign_key, sr.code_sign_key, sizeof(project->code_sign_key));
                 } else {
                     fprintf(stdout,
                         "New code signing key from %s doesn't validate\n",
diff --git a/client/file_names.C b/client/file_names.C
index e1c5ae44f5..09ee13f48d 100644
--- a/client/file_names.C
+++ b/client/file_names.C
@@ -30,49 +30,7 @@
 #include "filesys.h"
 #include "error_numbers.h"
 #include "file_names.h"
-
-// Converts a character string of a decimal number to hexadecimal string
-//
-static void c2x(char *what) {
-    char buf[3];
-    char num = atoi(what);
-    char d1 = num / 16;
-    char d2 = num % 16;
-    int abase1, abase2;
-    if (d1 < 10) abase1 = 48;
-    else abase1 = 55;
-    if (d2 < 10) abase2 = 48;
-    else abase2 = 55;
-    buf[0] = d1+abase1;
-    buf[1] = d2+abase2;
-    buf[2] = 0;
-
-    strcpy(what, buf);
-}
-
-// Escape a URL, converting the non alphanumeric characters to
-// %XY where XY is their hexadecimal equivalent
-//
-/*static void escape_url(char *in, char* out) {
-    int x, y;
-    for (x=0, y=0; in[x]; ++x) {
-        if (isalnum(in[x]) || in[x]=='.' || in[x]=='-' || in[x]=='_') {
-            out[y] = in[x];
-            ++y;
-        }
-        else {
-            out[y] = '%';
-            ++y;
-            out[y] = 0;
-            char buf[256];
-            sprintf(buf, "%d", (char)in[x]);
-            c2x(buf);
-            strcat(out, buf);
-            y += 2;
-        }
-    }
-    out[y] = 0;
-}*/
+#include "util.h"
 
 // Escape a URL for the project directory, cutting off the "http://",
 // converting '\' '/' and ' ' to '_',
@@ -121,7 +79,7 @@ void get_pathname(FILE_INFO* fip, char* path) {
         escape_project_url(p->master_url, buf);
         sprintf(path, "%s%s%s%s%s", PROJECTS_DIR, PATH_SEPARATOR, buf, PATH_SEPARATOR, fip->name);
     } else {
-        strcpy(path, fip->name);
+        safe_strncpy(path, fip->name, sizeof(fip->name));
     }
 }
 
diff --git a/client/file_xfer.C b/client/file_xfer.C
index 0fa32f5f43..21c677c7c4 100644
--- a/client/file_xfer.C
+++ b/client/file_xfer.C
@@ -31,8 +31,8 @@ FILE_XFER::FILE_XFER() {
     file_xfer_done = false;
     file_xfer_retval = 0;
     fip = NULL;
-    strcpy(pathname,"");
-    strcpy(header,"");
+    safe_strncpy(pathname, "", sizeof(pathname));
+    safe_strncpy(header, "", sizeof(header));
     file_size_query = false;
 }
 
diff --git a/client/hostinfo.C b/client/hostinfo.C
index 13d3936570..fc685f8cd5 100644
--- a/client/hostinfo.C
+++ b/client/hostinfo.C
@@ -49,24 +49,24 @@
 //
 void clear_host_info(HOST_INFO& host) {
     host.timezone = 0;        // seconds added to local time to get UTC
-    strcpy(host.domain_name,"");
-    strcpy(host.serialnum,"");
-    strcpy(host.ip_addr,"");
+    safe_strncpy(host.domain_name, "", sizeof(host.domain_name));
+    safe_strncpy(host.serialnum, "", sizeof(host.serialnum));
+    safe_strncpy(host.ip_addr, "", sizeof(host.ip_addr));
 
     host.on_frac = 0;
     host.conn_frac = 0;
     host.active_frac = 0;
 
     host.p_ncpus = 0;
-    strcpy(host.p_vendor,"");
-    strcpy(host.p_model,"");
+    safe_strncpy(host.p_vendor, "", sizeof(host.p_vendor));
+    safe_strncpy(host.p_model, "", sizeof(host.p_model));
     host.p_fpops = 0;
     host.p_iops = 0;
     host.p_membw = 0;
     host.p_calculated = 0;
     
-    strcpy(host.os_name,"");
-    strcpy(host.os_version,"");
+    safe_strncpy(host.os_name, "", sizeof(host.os_name));
+    safe_strncpy(host.os_version, "", sizeof(host.os_version));
 
     host.m_nbytes = 0;
     host.m_cache = 0;
@@ -196,7 +196,7 @@ int HOST_INFO::write_time_tests(FILE* out) {
 int get_local_domain_name(char* p, int len) {
     char buf[256];
 
-    gethostname(buf, 256);
+    if (gethostname(buf, 256)) return -1;
     struct hostent* he = gethostbyname(buf);
     if (!he) return -1;
     safe_strncpy(p, he->h_name, len);
@@ -205,8 +205,8 @@ int get_local_domain_name(char* p, int len) {
 
 // Returns the name of the local host
 //
-int get_local_ip_addr_str(char* p) {
-    strcpy( p,"" );
+int get_local_ip_addr_str(char* p, int len) {
+    safe_strncpy(p, "", len);
 #if HAVE_NETDB_H || _WIN32
     char buf[256];
     struct in_addr addr;
@@ -220,7 +220,7 @@ int get_local_ip_addr_str(char* p) {
         return -1;
     }
     memcpy(&addr, he->h_addr_list[0], sizeof(addr));
-    strcpy(p, inet_ntoa(addr));
+    safe_strncpy(p, inet_ntoa(addr), len);
 #endif
     return 0;
 }
diff --git a/client/hostinfo.h b/client/hostinfo.h
index 3aa49bda47..a7d4698e15 100644
--- a/client/hostinfo.h
+++ b/client/hostinfo.h
@@ -66,7 +66,7 @@ extern void clear_host_info(HOST_INFO&);
 extern void get_host_disk_info( double &total_space, double &free_space );
 
 extern int get_local_domain_name(char* p, int len);
-extern int get_local_ip_addr_str(char* p);
+extern int get_local_ip_addr_str(char* p, int len);
 extern int get_local_ip_addr(int& p);
 
 #endif
diff --git a/client/hostinfo_unix.C b/client/hostinfo_unix.C
index 662920b830..852462a355 100644
--- a/client/hostinfo_unix.C
+++ b/client/hostinfo_unix.C
@@ -186,8 +186,8 @@ void parse_cpuinfo(HOST_INFO& host) {
 void get_osinfo(HOST_INFO& host) {
     struct utsname u;
     uname(&u);
-    strcpy(host.os_name, u.sysname);
-    strcpy(host.os_version, u.release);
+    safe_strncpy(host.os_name, u.sysname, sizeof(host.os_name));
+    safe_strncpy(host.os_version, u.release, sizeof(host.os_version));
 }
 #endif
 
@@ -301,7 +301,7 @@ int get_host_info(HOST_INFO& host) {
 #endif
 
     get_local_domain_name(host.domain_name, sizeof(host.domain_name));
-    get_local_ip_addr_str(host.ip_addr);
+    get_local_ip_addr_str(host.ip_addr, sizeof(host.ip_addr));
     host.timezone = get_timezone();
 #ifdef HAVE_SYS_UTSNAME_H
     get_osinfo(host);
diff --git a/client/http.C b/client/http.C
index 8ca06b6e6e..94d7ef0e38 100644
--- a/client/http.C
+++ b/client/http.C
@@ -38,6 +38,7 @@
 #include "filesys.h"
 #include "log_flags.h"
 #include "http.h"
+#include "util.h"
 
 #define HTTP_BLOCKSIZE  16384
 
@@ -47,14 +48,14 @@ void parse_url(char* url, char* host, int &port, char* file) {
     char* p;
     char buf[256];
 
-    if (strncmp(url, "http://", 7) == 0) strcpy(buf, url+7);
-    else strcpy(buf, url);
+    if (strncmp(url, "http://", 7) == 0) safe_strncpy(buf, url+7, sizeof(buf));
+    else safe_strncpy(buf, url, sizeof(buf));
     p = strchr(buf, '/');
     if (p) {
         strcpy(file, p+1);
         *p = 0;
     } else {
-        strcpy(file, "");
+        safe_strncpy(file, "", 1);
     }
     p=strchr(buf,':');
     if (p) {
@@ -63,7 +64,7 @@ void parse_url(char* url, char* host, int &port, char* file) {
     } else {
         port=80;
     }
-    strcpy(host, buf);
+    safe_strncpy(host, buf, sizeof(buf));
 }
 
 // Prints an HTTP 1.1 GET request header into buf
@@ -174,20 +175,20 @@ static int read_reply(int socket, char* buf, int len) {
 }
 
 HTTP_OP::HTTP_OP() {
-    strcpy(hostname,"");
-    strcpy(filename,"");
+    safe_strncpy(hostname, "", sizeof(hostname));
+    safe_strncpy(filename, "", sizeof(filename));
     req1 = NULL;
-    strcpy(infile,"");
-    strcpy(outfile,"");
+    safe_strncpy(infile, "", sizeof(infile));
+    safe_strncpy(outfile, "", sizeof(outfile));
     content_length = 0;
     file_offset = 0;
-    strcpy(request_header,"");
+    safe_strncpy(request_header, "", sizeof(request_header));
     http_op_state = HTTP_STATE_IDLE;
     http_op_type = HTTP_OP_NONE;
     http_op_retval = 0;
     use_http_proxy = false;
     proxy_server_port = 0;
-    strcpy(proxy_server_name,"");
+    safe_strncpy(proxy_server_name, "", sizeof(proxy_server_name));
 }
 
 HTTP_OP::~HTTP_OP() {
@@ -221,7 +222,7 @@ int HTTP_OP::init_get(char* url, char* out, bool del_old_file, double off) {
     file_offset = off;
     parse_url(url, hostname, port, filename);
     NET_XFER::init(use_http_proxy?proxy_server_name:hostname, use_http_proxy?proxy_server_port:port, HTTP_BLOCKSIZE);
-    strcpy(outfile, out);
+    safe_strncpy(outfile, out, sizeof(outfile));
     http_op_type = HTTP_OP_GET;
     http_op_state = HTTP_STATE_CONNECTING;
     if (use_http_proxy) {
@@ -242,8 +243,8 @@ int HTTP_OP::init_post(char* url, char* in, char* out) {
 
     parse_url(url, hostname, port, filename);
     NET_XFER::init(use_http_proxy?proxy_server_name:hostname, use_http_proxy?proxy_server_port:port, HTTP_BLOCKSIZE);
-    strcpy(infile, in);
-    strcpy(outfile, out);
+    safe_strncpy(infile, in, sizeof(infile));
+    safe_strncpy(outfile, out, sizeof(outfile));
     retval = file_size(infile, size);
     if (retval) return retval;
     content_length = (int)size;
@@ -276,7 +277,7 @@ int HTTP_OP::init_post2(
     NET_XFER::init(use_http_proxy?proxy_server_name:hostname, use_http_proxy?proxy_server_port:port, HTTP_BLOCKSIZE);
     req1 = r1;
     if (in) {
-        strcpy(infile, in);
+        safe_strncpy(infile, in, sizeof(infile));
         file_offset = offset;
         retval = file_size(infile, size);
         if (retval) {
@@ -442,6 +443,7 @@ bool HTTP_OP_SET::poll() {
                     }
 
                     // Open connection to the redirected server
+                    // TODO: handle return value here
                     //
                     htp->open_server();
                     break;
diff --git a/client/net_xfer.C b/client/net_xfer.C
index fa480ab779..eae178a560 100644
--- a/client/net_xfer.C
+++ b/client/net_xfer.C
@@ -63,6 +63,7 @@
 #include "error_numbers.h"
 #include "log_flags.h"
 #include "net_xfer.h"
+#include "util.h"
 
 //  If socklen_t isn't defined, define it here as size_t
 #if !defined(socklen_t)
@@ -169,7 +170,7 @@ void NET_XFER::init(char* host, int p, int b) {
     file = NULL;
     io_ready = false;
     error = 0;
-    strcpy(hostname, host);
+    safe_strncpy(hostname, host, sizeof(hostname));
     port = p;
     blocksize = b;
     xfer_speed = 0;
diff --git a/client/pers_file_xfer.C b/client/pers_file_xfer.C
index bda7571552..41a9a6a55f 100644
--- a/client/pers_file_xfer.C
+++ b/client/pers_file_xfer.C
@@ -80,7 +80,7 @@ bool PERS_FILE_XFER::start_xfer() {
     file_xfer = new FILE_XFER;
     if (gstate.use_http_proxy) {
         file_xfer->use_http_proxy = true;
-        strcpy(file_xfer->proxy_server_name, gstate.proxy_server_name);
+        safe_strncpy(file_xfer->proxy_server_name, gstate.proxy_server_name, sizeof(file_xfer->proxy_server_name));
         file_xfer->proxy_server_port = gstate.proxy_server_port;
     }
     if (is_upload) {
@@ -231,7 +231,7 @@ void PERS_FILE_XFER::handle_xfer_failure(unsigned int cur_time) {
 // Cycle to the next URL, or if we've hit all URLs in this cycle,
 // backoff and try again later
 //
-int PERS_FILE_XFER::retry_and_backoff(unsigned int cur_time) {
+void PERS_FILE_XFER::retry_and_backoff(unsigned int cur_time) {
     double exp_backoff;
     struct tm *newtime;
     time_t aclock;
@@ -263,7 +263,6 @@ int PERS_FILE_XFER::retry_and_backoff(unsigned int cur_time) {
             (int) exp_backoff,asctime(newtime) 
         );
     }
-    return 0;
 }
 
 // Parse XML information about a single persistent file transfer
diff --git a/client/pers_file_xfer.h b/client/pers_file_xfer.h
index 142c5fd873..16da25e6c3 100644
--- a/client/pers_file_xfer.h
+++ b/client/pers_file_xfer.h
@@ -61,7 +61,7 @@ public:
     int init(FILE_INFO*, bool is_file_upload);
     bool poll(unsigned int now);
     void handle_xfer_failure(unsigned int cur_time);
-    int retry_and_backoff(unsigned int cur_time);
+    void retry_and_backoff(unsigned int cur_time);
     int write(FILE* fout);
     int parse(FILE* fin);
     bool start_xfer();
diff --git a/client/scheduler_op.C b/client/scheduler_op.C
index 8ccbc3e19b..b52cdc9fbd 100644
--- a/client/scheduler_op.C
+++ b/client/scheduler_op.C
@@ -50,7 +50,7 @@ int SCHEDULER_OP::init_get_work() {
     if (project) {
         retval = init_op_project(ns);
         if (retval) {
-            sprintf(err_msg, "init_get_work failed, error %d\n", retval);
+            sprintf(err_msg, "init_op_project failed, error %d\n", retval);
             backoff(project, err_msg);
             return retval;
         }
@@ -148,8 +148,7 @@ int SCHEDULER_OP::set_min_rpc_time(PROJECT* p) {
 
 // Back off on the scheduler and output an error msg if needed
 //
-
-int SCHEDULER_OP::backoff( PROJECT* p, char *error_msg ) {
+void SCHEDULER_OP::backoff( PROJECT* p, char *error_msg ) {
     if (log_flags.sched_op_debug) {
         printf(error_msg);
     }
@@ -157,7 +156,7 @@ int SCHEDULER_OP::backoff( PROJECT* p, char *error_msg ) {
     if (p->master_fetch_failures >= MASTER_FETCH_RETRY_CAP) {
         p->master_url_fetch_pending = true;
         set_min_rpc_time(p);
-        return 0;
+        return;
     }
 
     // if nrpc failures a multiple of master_fetch_period,
@@ -172,8 +171,6 @@ int SCHEDULER_OP::backoff( PROJECT* p, char *error_msg ) {
     
     p->nrpc_failures++;
     set_min_rpc_time(p);
-    
-    return 0;
 }
 
 // low-level routine to initiate an RPC
@@ -183,7 +180,7 @@ int SCHEDULER_OP::start_rpc() {
     FILE *f;
     int retval;
 
-    strcpy(scheduler_url, project->scheduler_urls[url_index].text);
+    safe_strncpy(scheduler_url, project->scheduler_urls[url_index].text, sizeof(scheduler_url));
     if (log_flags.sched_ops) {
         printf("Sending request to scheduler: %s\n", scheduler_url);
     }
@@ -196,7 +193,7 @@ int SCHEDULER_OP::start_rpc() {
     }
     if (gstate.use_http_proxy) {
         http_op.use_http_proxy = true;
-        strcpy(http_op.proxy_server_name, gstate.proxy_server_name);
+        safe_strncpy(http_op.proxy_server_name, gstate.proxy_server_name, sizeof(http_op.proxy_server_name));
         http_op.proxy_server_port = gstate.proxy_server_port;
     }
     retval = http_op.init_post(
@@ -222,7 +219,7 @@ int SCHEDULER_OP::init_master_fetch(PROJECT* p) {
     }
     if (gstate.use_http_proxy) {
         http_op.use_http_proxy = true;
-        strcpy(http_op.proxy_server_name, gstate.proxy_server_name);
+        safe_strncpy(http_op.proxy_server_name, gstate.proxy_server_name, sizeof(http_op.proxy_server_name));
         http_op.proxy_server_port = gstate.proxy_server_port;
     }
     retval = http_op.init_get(project->master_url, MASTER_FILE_NAME, true);
@@ -499,15 +496,15 @@ int SCHEDULER_REPLY::parse(FILE* in) {
     host_expavg_credit = 0;
     host_create_time = 0;
     request_delay = 0;
-    strcpy(message, "");
-    strcpy(message_priority, "");
-    strcpy(project_name, "");
+    safe_strncpy(message, "", sizeof(message));
+    safe_strncpy(message_priority, "", sizeof(message_priority));
+    safe_strncpy(project_name, "", sizeof(project_name));
     global_prefs_xml = 0;
     project_prefs_xml = 0;
-    strcpy(user_name, "");
+    safe_strncpy(user_name, "", sizeof(user_name));
     user_total_credit = 0;
     user_expavg_credit = 0;
-    strcpy(host_venue, "");
+    safe_strncpy(host_venue, "", sizeof(host_venue));
     user_create_time = 0;
     code_sign_key = 0;
     code_sign_key_signature = 0;
diff --git a/client/scheduler_op.h b/client/scheduler_op.h
index 51f90e8c64..92dd743f6f 100644
--- a/client/scheduler_op.h
+++ b/client/scheduler_op.h
@@ -87,7 +87,7 @@ struct SCHEDULER_OP {
     int set_min_rpc_time(PROJECT*);
     bool update_urls(PROJECT& project, vector<STRING256> &urls);
     int start_op(PROJECT*);
-    int backoff(PROJECT* p, char *error_msg);
+    void backoff(PROJECT* p, char *error_msg);
     int start_rpc();
     int parse_master_file(vector<STRING256>&);
 };