diff --git a/drivers/hfpmodem/voicecall.c b/drivers/hfpmodem/voicecall.c
index f8dbeddf..71866d84 100644
--- a/drivers/hfpmodem/voicecall.c
+++ b/drivers/hfpmodem/voicecall.c
@@ -374,9 +374,9 @@ static void hfp_dial(struct ofono_voicecall *vc,
 
 	cbd->user = vc;
 	if (ph->type == 145)
-		sprintf(buf, "ATD+%s", ph->number);
+		snprintf(buf, sizeof(buf), "ATD+%s", ph->number);
 	else
-		sprintf(buf, "ATD%s", ph->number);
+		snprintf(buf, sizeof(buf), "ATD%s", ph->number);
 
 	if ((clir != OFONO_CLIR_OPTION_DEFAULT) ||
 			(cug != OFONO_CUG_OPTION_DEFAULT))
@@ -526,7 +526,7 @@ static void hfp_release_specific(struct ofono_voicecall *vc, int id,
 	req->data = data;
 	req->id = id;
 
-	sprintf(buf, "AT+CHLD=1%d", id);
+	snprintf(buf, sizeof(buf), "AT+CHLD=1%d", id);
 
 	if (g_at_chat_send(vd->chat, buf, none_prefix,
 				release_id_cb, req, g_free) > 0)
@@ -546,7 +546,7 @@ static void hfp_private_chat(struct ofono_voicecall *vc, int id,
 	char buf[32];
 
 	if (vd->ag_mpty_features & AG_CHLD_2x) {
-		sprintf(buf, "AT+CHLD=2%d", id);
+		snprintf(buf, sizeof(buf), "AT+CHLD=2%d", id);
 
 		hfp_template(buf, vc, generic_cb, 0, cb, data);
 
diff --git a/plugins/hfp.c b/plugins/hfp.c
index 981b05b2..51f1d9a8 100644
--- a/plugins/hfp.c
+++ b/plugins/hfp.c
@@ -377,7 +377,7 @@ static int service_level_connection(struct ofono_modem *modem, int fd)
 	if (getenv("OFONO_AT_DEBUG"))
 		g_at_chat_set_debug(chat, hfp_debug, NULL);
 
-	sprintf(buf, "AT+BRSF=%d", data->hf_features);
+	snprintf(buf, sizeof(buf), "AT+BRSF=%d", data->hf_features);
 	g_at_chat_send(chat, buf, brsf_prefix,
 				brsf_cb, modem, NULL);
 	data->chat = chat;