--- xnu/xnu-792.22.5/iokit/Kernel/IONVRAM.cpp
+++ xnu/xnu-1228/iokit/Kernel/IONVRAM.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998-2000 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 1998-2006 Apple Computer, Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
@@ -114,7 +114,7 @@
 	freePartitionSize = currentLength;
       } else {
 	// Construct the partition ID from the signature and name.
-	sprintf(partitionID, "0x%02x,",
+	snprintf(partitionID, sizeof(partitionID), "0x%02x,",
 		*(UInt8 *)(_nvramImage + currentOffset));
 	strncpy(partitionID + 5,
 		(const char *)(_nvramImage + currentOffset + 4), 12);
@@ -562,9 +562,15 @@
   *(UInt32 *)_piImage = length;
   
   _nvramImageDirty = true;
-  
+  /* 
+   * This prevents OF variables from being committed if the system has panicked
+   */
   _systemPaniced = true;
-  
+  /* The call to sync() forces the NVRAM controller to write the panic info
+   * partition to NVRAM.
+   */
+  sync();
+
   return length;
 }
 
@@ -662,7 +668,7 @@
     // Create the 'aapl,panic-info' property if needed.
     if (_piImage != 0) {
       propDataLength = *(UInt32 *)_piImage;
-      if ((propDataLength != 0) && (propDataLength < (_piPartitionSize - 4))) {
+      if ((propDataLength != 0) && (propDataLength <= (_piPartitionSize - 4))) {
 	propObject = OSData::withBytes(_piImage + 4, propDataLength);
 	_ofDict->setObject(kIODTNVRAMPanicInfoKey, propObject);
 	propObject->release();
@@ -1088,31 +1094,30 @@
   if ((propNameLength + propDataLength + 2) > *length) return false;
   
   // Copy the property name equal sign.
-  sprintf((char *)buffer, "%s=", propName);
-  buffer += propNameLength + 1;
+  buffer += snprintf((char *)buffer, *length, "%s=", propName);
   
   switch (propType) {
   case kOFVariableTypeBoolean :
     if (tmpBoolean->getValue()) {
-      strcpy((char *)buffer, "true");
+      strlcpy((char *)buffer, "true", *length - propNameLength);
     } else {
-      strcpy((char *)buffer, "false");
+      strlcpy((char *)buffer, "false", *length - propNameLength);
     }
     break;
     
   case kOFVariableTypeNumber :
     tmpValue = tmpNumber->unsigned32BitValue();
     if (tmpValue == 0xFFFFFFFF) {
-      strcpy((char *)buffer, "-1");
+      strlcpy((char *)buffer, "-1", *length - propNameLength);
     } else if (tmpValue < 1000) {
-      sprintf((char *)buffer, "%ld", tmpValue);
+      snprintf((char *)buffer, *length - propNameLength, "%ld", tmpValue);
     } else {
-      sprintf((char *)buffer, "0x%lx", tmpValue);
+      snprintf((char *)buffer, *length - propNameLength, "0x%lx", tmpValue);
     }
     break;
     
   case kOFVariableTypeString :
-    strcpy((char *)buffer, tmpString->getCStringNoCopy());
+    strlcpy((char *)buffer, tmpString->getCStringNoCopy(), *length - propNameLength);
     break;
     
   case kOFVariableTypeData :
@@ -1205,9 +1210,8 @@
     tmpData = IONew(UInt8, tmpDataLength + 1);
     if (tmpData == 0) return;
     
-    strncpy((char *)tmpData, (const char *)bootCommandData, cnt);
-    tmpData[cnt] = '\0';
-    strcat((char *)tmpData, (const char *)bootArgsData);
+    cnt -= strlcpy((char *)tmpData, (const char *)bootCommandData, cnt);
+    strlcat((char *)tmpData, (const char *)bootArgsData, cnt);
     
     bootCommand = OSString::withCString((const char *)tmpData);
     if (bootCommand != 0) {
@@ -1610,8 +1614,8 @@
 
 			name = entry->getName(gIODTPlane);
 			comp = entry->getLocation(gIODTPlane);
-			if( comp && (0 == strcmp("pci", name))
-			 && (0 == strcmp("80000000", comp))) {
+			if( comp && (0 == strncmp("pci", name, sizeof("pci")))
+			 && (0 == strncmp("80000000", comp, sizeof("80000000")))) {
 				// yosemite hack
 				comp = "/pci@80000000";
 			} else {