diff --git a/src/librc.c b/src/librc.c
index e270bbe8..8557ba1c 100644
--- a/src/librc.c
+++ b/src/librc.c
@@ -271,6 +271,7 @@ bool rc_service_exists (const char *service)
 }
 librc_hidden_def(rc_service_exists)
 
+#define OPTSTR ". '%s'; echo \"${opts}\""
 char **rc_service_options (const char *service)
 {
 	char *svc;
@@ -280,11 +281,14 @@ char **rc_service_options (const char *service)
 	char *token;
 	char *p = buffer;
 	FILE *fp;
+	int l;
 
 	if (! (svc = rc_service_resolve (service)))
 		return (NULL);
 
-	asprintf (&cmd, ". '%s'; echo \"${opts}\"",  svc);
+	l = strlen (OPTSTR) + strlen (svc) + 1;
+	cmd = xmalloc (sizeof (char) * l);
+	snprintf (cmd, l, OPTSTR, svc);
 	free (svc);
 	if ((fp = popen (cmd, "r"))) {
 		buffer = xmalloc (sizeof (char) * RC_LINEBUFFER);
@@ -297,10 +301,12 @@ char **rc_service_options (const char *service)
 		pclose (fp);
 		free (buffer);
 	}
+	free (cmd);
 	return (opts);
 }
 librc_hidden_def(rc_service_options)
 
+#define DESCSTR ". '%s'; echo \"${description%s%s}\""
 char *rc_service_description (const char *service, const char *option)
 {
 	char *svc;
@@ -309,6 +315,7 @@ char *rc_service_description (const char *service, const char *option)
 	char *desc = NULL;
 	FILE *fp;
 	int i;
+	int l;
 
 	if (! (svc = rc_service_resolve (service)))
 		return (NULL);
@@ -316,8 +323,9 @@ char *rc_service_description (const char *service, const char *option)
 	if (! option)
 		option = "";
 
-	asprintf (&cmd, ". '%s'; echo \"${description%s%s}\"",
-			  svc, option ? "_" : "", option);
+	l = strlen (DESCSTR) + strlen (svc) + strlen (option) + 2;
+	cmd = xmalloc (sizeof (char) * l);
+	snprintf (cmd, l, DESCSTR, svc, option ? "_" : "", option);
 	free (svc);
 	if ((fp = popen (cmd, "r"))) {
 		buffer = xmalloc (sizeof (char) * RC_LINEBUFFER);
@@ -335,6 +343,7 @@ char *rc_service_description (const char *service, const char *option)
 		free (buffer);
 		pclose (fp);
 	}
+	free (cmd);
 	return (desc);
 }
 librc_hidden_def(rc_service_description)
diff --git a/src/mountinfo.c b/src/mountinfo.c
index ef3f636d..9121aa97 100644
--- a/src/mountinfo.c
+++ b/src/mountinfo.c
@@ -197,7 +197,9 @@ static char **find_mounts (struct args *args)
 					options = xstrdup (o->o_name);
 				else {
 					char *tmp = NULL;
-					asprintf (&tmp, "%s,%s", options, o->o_name);
+					int l = strlen (options) + strlen (o->o_name) + 2;
+					tmp = xmalloc (sizeof (char) * l);
+					snprintf (tmp, l, "%s,%s", options, o->o_name);
 					free (options);
 					options = tmp;
 				}
diff --git a/src/rc.c b/src/rc.c
index e61bdd57..243539f3 100644
--- a/src/rc.c
+++ b/src/rc.c
@@ -1038,7 +1038,9 @@ int main (int argc, char **argv)
 				(d->d_name[1] == '.' && d->d_name[2] == '\0')))
 				continue;
 
-			asprintf (&tmp, RC_SVCDIR "/failed/%s", d->d_name);
+			i = strlen (RC_SVCDIR "/failed/") + strlen (d->d_name) + 1;
+			tmp = xmalloc (sizeof (char) * i);
+			snprintf (tmp, i, RC_SVCDIR "/failed/%s", d->d_name);
 			if (tmp) {
 				if (unlink (tmp))
 					eerror ("%s: unlink `%s': %s", applet, tmp,
@@ -1067,7 +1069,9 @@ int main (int argc, char **argv)
 				rc_service_plugable (d->d_name))
 				rc_service_mark (d->d_name, RC_SERVICE_COLDPLUGGED);
 
-			asprintf (&tmp, DEVBOOT "/%s", d->d_name);
+			i = strlen (DEVBOOT "/") + strlen (d->d_name) + 1;
+			tmp = xmalloc (sizeof (char) * i);
+			snprintf (tmp, i, DEVBOOT "/%s", d->d_name);
 			if (tmp) {
 				if (unlink (tmp))
 					eerror ("%s: unlink `%s': %s", applet, tmp,
diff --git a/src/start-stop-daemon.c b/src/start-stop-daemon.c
index 0f1c8205..b0f2fabf 100644
--- a/src/start-stop-daemon.c
+++ b/src/start-stop-daemon.c
@@ -890,6 +890,8 @@ int start_stop_daemon (int argc, char **argv)
 				char *newpath = NULL;
 				char *p = path;
 				char *token;
+				char *np;
+				int l;
 
 				p += 5;
 				while ((token = strsep (&p, ":"))) {
@@ -897,10 +899,18 @@ int start_stop_daemon (int argc, char **argv)
 						strcmp (token, RC_LIBDIR "/sbin") == 0)
 						continue;
 					
-					if (newpath)
-						asprintf (&newpath, "%s:%s", newpath, token);
-					else
-						asprintf (&newpath, "PATH=%s", token);
+					if (newpath) {
+						l = strlen (newpath);
+						newpath = xrealloc (newpath, sizeof (char) *
+											(l + strlen (token) + 2));
+						np = newpath + l;
+						*np++ = ':';
+						memcpy (np, token, sizeof (char) * strlen (token));
+					} else {
+						l = strlen ("PATH=") + strlen (token) + 1;
+						newpath = xmalloc (sizeof (char) * l);
+						snprintf (newpath, l, "PATH=%s", token);
+					}
 				}
 				rc_strlist_add (&newenv, newpath);
 				free (path);