--- a/src/hotspot/os/aix/os_perf_aix.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/os/aix/os_perf_aix.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -859,11 +859,7 @@
 
 char* SystemProcessInterface::SystemProcesses::ProcessIterator::allocate_string(const char* str) const {
   if (str != NULL) {
-    size_t len = strlen(str);
-    char* tmp = NEW_C_HEAP_ARRAY(char, len+1, mtInternal);
-    strncpy(tmp, str, len);
-    tmp[len] = '\0';
-    return tmp;
+    return os::strdup_check_oom(str, mtInternal);
   }
   return NULL;
 }

--- a/src/hotspot/os/linux/os_perf_linux.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/os/linux/os_perf_linux.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -861,11 +861,7 @@
 
 char* SystemProcessInterface::SystemProcesses::ProcessIterator::allocate_string(const char* str) const {
   if (str != NULL) {
-    size_t len = strlen(str);
-    char* tmp = NEW_C_HEAP_ARRAY(char, len+1, mtInternal);
-    strncpy(tmp, str, len);
-    tmp[len] = '\0';
-    return tmp;
+    return os::strdup_check_oom(str, mtInternal);
   }
   return NULL;
 }

--- a/src/hotspot/os/posix/os_posix.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/os/posix/os_posix.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -180,13 +180,14 @@
 
   const char name_template[] = "/jvmheap.XXXXXX";
 
-  char *fullname = (char*)os::malloc((strlen(dir) + strlen(name_template) + 1), mtInternal);
+  size_t fullname_len = strlen(dir) + strlen(name_template);
+  char *fullname = (char*)os::malloc(fullname_len + 1, mtInternal);
   if (fullname == NULL) {
     vm_exit_during_initialization(err_msg("Malloc failed during creation of backing file for heap (%s)", os::strerror(errno)));
     return -1;
   }
-  (void)strncpy(fullname, dir, strlen(dir)+1);
-  (void)strncat(fullname, name_template, strlen(name_template));
+  int n = snprintf(fullname, fullname_len + 1, "%s%s", dir, name_template);
+  assert((size_t)n == fullname_len, "Unexpected number of characters in string");
 
   os::native_path(fullname);
 

--- a/src/hotspot/os/solaris/os_perf_solaris.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/os/solaris/os_perf_solaris.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -544,11 +544,7 @@
 
 char* SystemProcessInterface::SystemProcesses::ProcessIterator::allocate_string(const char* str) const {
   if (str != NULL) {
-    size_t len = strlen(str);
-    char* tmp = NEW_C_HEAP_ARRAY(char, len+1, mtInternal);
-    strncpy(tmp, str, len);
-    tmp[len] = '\0';
-    return tmp;
+    return os::strdup_check_oom(str, mtInternal);
   }
   return NULL;
 }

--- a/src/hotspot/os/windows/os_perf_windows.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/os/windows/os_perf_windows.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -1253,14 +1253,7 @@
 
 char* SystemProcessInterface::SystemProcesses::ProcessIterator::allocate_string(const char* str) const {
   if (str != NULL) {
-    size_t len = strlen(str);
-    char* tmp = NEW_C_HEAP_ARRAY(char, len+1, mtInternal);
-    if (NULL == tmp) {
-      return NULL;
-    }
-    strncpy(tmp, str, len);
-    tmp[len] = '\0';
-    return tmp;
+    return os::strdup_check_oom(str, mtInternal);
   }
   return NULL;
 }

--- a/src/hotspot/os/windows/os_windows.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/os/windows/os_windows.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -2970,14 +2970,15 @@
 int os::create_file_for_heap(const char* dir) {
 
   const char name_template[] = "/jvmheap.XXXXXX";
-  char *fullname = (char*)os::malloc((strlen(dir) + strlen(name_template) + 1), mtInternal);
+
+  size_t fullname_len = strlen(dir) + strlen(name_template);
+  char *fullname = (char*)os::malloc(fullname_len + 1, mtInternal);
   if (fullname == NULL) {
     vm_exit_during_initialization(err_msg("Malloc failed during creation of backing file for heap (%s)", os::strerror(errno)));
     return -1;
   }
-
-  (void)strncpy(fullname, dir, strlen(dir)+1);
-  (void)strncat(fullname, name_template, strlen(name_template));
+  int n = snprintf(fullname, fullname_len + 1, "%s%s", dir, name_template);
+  assert((size_t)n == fullname_len, "Unexpected number of characters in string");
 
   os::native_path(fullname);
 

--- a/src/hotspot/share/classfile/classFileParser.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/share/classfile/classFileParser.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -5743,16 +5743,13 @@
     ClassLoader::package_from_name(unsafe_anonymous_host->name()->as_C_string(), NULL);
 
   if (host_pkg_name != NULL) {
-    size_t host_pkg_len = strlen(host_pkg_name);
+    int host_pkg_len = (int)strlen(host_pkg_name);
     int class_name_len = _class_name->utf8_length();
-    char* new_anon_name =
-      NEW_RESOURCE_ARRAY(char, host_pkg_len + 1 + class_name_len);
-    // Copy host package name and trailing /.
-    strncpy(new_anon_name, host_pkg_name, host_pkg_len);
-    new_anon_name[host_pkg_len] = '/';
-    // Append unsafe anonymous class name. The unsafe anonymous class name can contain odd
-    // characters.  So, do a strncpy instead of using sprintf("%s...").
-    strncpy(new_anon_name + host_pkg_len + 1, (char *)_class_name->base(), class_name_len);
+    int symbol_len = host_pkg_len + 1 + class_name_len;
+    char* new_anon_name = NEW_RESOURCE_ARRAY(char, symbol_len + 1);
+    int n = snprintf(new_anon_name, symbol_len + 1, "%s/%.*s",
+                     host_pkg_name, class_name_len, _class_name->base());
+    assert(n == symbol_len, "Unexpected number of characters in string");
 
     // Decrement old _class_name to avoid leaking.
     _class_name->decrement_refcount();
@@ -5761,9 +5758,7 @@
     // The new class name is created with a refcount of one. When installed into the InstanceKlass,
     // it'll be two and when the ClassFileParser destructor runs, it'll go back to one and get deleted
     // when the class is unloaded.
-    _class_name = SymbolTable::new_symbol(new_anon_name,
-                                          (int)host_pkg_len + 1 + class_name_len,
-                                          CHECK);
+    _class_name = SymbolTable::new_symbol(new_anon_name, symbol_len, CHECK);
   }
 }
 

--- a/src/hotspot/share/classfile/classLoaderExt.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/share/classfile/classLoaderExt.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2015, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -203,13 +203,13 @@
         file_end = end;
       }
 
-      int name_len = (int)strlen(file_start);
+      size_t name_len = strlen(file_start);
       if (name_len > 0) {
         ResourceMark rm(THREAD);
-        char* libname = NEW_RESOURCE_ARRAY(char, dir_len + name_len + 1);
-        *libname = 0;
-        strncat(libname, dir_name, dir_len);
-        strncat(libname, file_start, name_len);
+        size_t libname_len = dir_len + name_len;
+        char* libname = NEW_RESOURCE_ARRAY(char, libname_len + 1);
+        int n = snprintf(libname, libname_len + 1, "%.*s%s", dir_len, dir_name, file_start);
+        assert((size_t)n == libname_len, "Unexpected number of characters in string");
         trace_class_path("library = ", libname);
         ClassLoader::update_class_path_entry_list(libname, true, false);
       }

--- a/src/hotspot/share/classfile/verifier.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/share/classfile/verifier.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1998, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1998, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -2981,18 +2981,16 @@
     }
     // add one dimension to component
     length++;
-    arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
-    arr_sig_str[0] = '[';
-    strncpy(&arr_sig_str[1], component_name, length - 1);
+    arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length + 1);
+    int n = snprintf(arr_sig_str, length + 1, "[%s", component_name);
+    assert(n == length, "Unexpected number of characters in string");
   } else {         // it's an object or interface
     const char* component_name = component_type.name()->as_utf8();
     // add one dimension to component with 'L' prepended and ';' postpended.
     length = (int)strlen(component_name) + 3;
-    arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length);
-    arr_sig_str[0] = '[';
-    arr_sig_str[1] = 'L';
-    strncpy(&arr_sig_str[2], component_name, length - 2);
-    arr_sig_str[length - 1] = ';';
+    arr_sig_str = NEW_RESOURCE_ARRAY_IN_THREAD(THREAD, char, length + 1);
+    int n = snprintf(arr_sig_str, length + 1, "[L%s;", component_name);
+    assert(n == length, "Unexpected number of characters in string");
   }
   Symbol* arr_sig = create_temporary_symbol(
     arr_sig_str, length, CHECK_VERIFY(this));

--- a/src/hotspot/share/runtime/arguments.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/share/runtime/arguments.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -2454,9 +2454,15 @@
           (is_absolute_path = match_option(option, "-agentpath:", &tail))) {
       if(tail != NULL) {
         const char* pos = strchr(tail, '=');
-        size_t len = (pos == NULL) ? strlen(tail) : pos - tail;
-        char* name = strncpy(NEW_C_HEAP_ARRAY(char, len + 1, mtArguments), tail, len);
-        name[len] = '\0';
+        char* name;
+        if (pos == NULL) {
+          name = os::strdup_check_oom(tail, mtArguments);
+        } else {
+          size_t len = pos - tail;
+          name = NEW_C_HEAP_ARRAY(char, len + 1, mtArguments);
+          memcpy(name, tail, len);
+          name[len] = '\0';
+        }
 
         char *options = NULL;
         if(pos != NULL) {

--- a/src/hotspot/share/services/diagnosticArgument.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/share/services/diagnosticArgument.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -179,9 +179,9 @@
   if (str == NULL) {
     _value = NULL;
   } else {
-    _value = NEW_C_HEAP_ARRAY(char, len+1, mtInternal);
-    strncpy(_value, str, len);
-    _value[len] = 0;
+    _value = NEW_C_HEAP_ARRAY(char, len + 1, mtInternal);
+    int n = snprintf(_value, len + 1, "%.*s", (int)len, str);
+    assert((size_t)n <= len, "Unexpected number of characters in string");
   }
 }
 

--- a/src/hotspot/share/utilities/xmlstream.cpp	Thu Feb 21 15:17:42 2019 -0800
+++ b/src/hotspot/share/utilities/xmlstream.cpp	Thu Feb 21 16:56:06 2019 -0800
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2002, 2017, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2002, 2019, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -353,11 +353,15 @@
   guarantee(format_len + 10 < sizeof(buffer), "bigger format buffer");
   const char* kind = format;
   const char* kind_end = strchr(kind, ' ');
-  size_t kind_len = (kind_end != NULL) ? (kind_end - kind) : format_len;
-  strncpy(buffer, kind, kind_len);
-  strcpy(buffer + kind_len, "_done");
+  size_t kind_len;
   if (kind_end != NULL) {
-    strncat(buffer, format + kind_len, sizeof(buffer) - (kind_len + 5 /* _done */) - 1);
+    kind_len = kind_end - kind;
+    int n = snprintf(buffer, sizeof(buffer), "%.*s_done", (int)kind_len, kind);
+    assert((size_t)n < sizeof(buffer), "Unexpected number of characters in string");
+  } else {
+    kind_len = format_len;
+    int n = snprintf(buffer, sizeof(buffer), "%s_done%s", kind, kind + kind_len);
+    assert((size_t)n < sizeof(buffer), "Unexpected number of characters in string");
   }
   // Output the trailing event with the timestamp.
   va_begin_elem(buffer, ap);