WT-3136 bug fix: WiredTiger doesn't check sprintf calls for error return (#3340)

* WT-3136 bug fix: WiredTiger doesn't check sprintf calls for error return

Make a pass through the source base to check sprintf, snprintf, vsprintf
and vsnprintf calls for errors.

* A WiredTiger key is a uint64_t.
Use sizeof(), don't hard-wire buffer sizes into the code.

* More (u_int) vs. (uint64_t) fixes.

* Use CONFIG_APPEND instead of FORMAT_APPEND, it makes more sense.

* revert part of 4475ae9, there's an explicit allocation of the size of
the buffer.

* MVSC complaints:
test\format\config.c(765): warning C4018: '<': signed/unsigned mismatch
test\format\config.c(765): warning C4018: '>': signed/unsigned mismatch

* Change Windows testing shim to correctly use __wt_snprintf

* Change Windows test shim to use the __wt_XXX functions

* MSDN's _vscprintf API returns the number of characters excluding the
termininating nul byte, return that value.

84 files changed, 893 insertions, 671 deletions

diff --git a/bench/wtperf/config.c b/bench/wtperf/config.c
index 9eea99eeec4..e4eee66e4cb 100644
--- a/bench/wtperf/config.c
+++ b/bench/wtperf/config.c
@@ -438,14 +438,13 @@ config_opt(WTPERF *wtperf, WT_CONFIG_ITEM *k, WT_CONFIG_ITEM *v)
 			return (EINVAL);
 		}
 		strp = (char **)valueloc;
-		newlen = v->len + 1;
 		if (*strp == NULL)
 			begin = newstr = dstrdup(v->str);
 		else {
-			newlen += strlen(*strp) + 1;
-			newstr = dcalloc(newlen, sizeof(char));
-			snprintf(newstr, newlen,
-			    "%s,%*s", *strp, (int)v->len, v->str);
+			newlen = strlen(*strp) + v->len + strlen(",") + 1;
+			newstr = dmalloc(newlen);
+			testutil_check(__wt_snprintf(newstr, newlen,
+			    "%s,%.*s", *strp, (int)v->len, v->str));
 			/* Free the old value now we've copied it. */
 			free(*strp);
 			begin = &newstr[(newlen - 1) - v->len];
@@ -712,7 +711,7 @@ config_opt_name_value(WTPERF *wtperf, const char *name, const char *value)
 							/* name="value" */
 	len = strlen(name) + strlen(value) + 4;
 	optstr = dmalloc(len);
-	snprintf(optstr, len, "%s=\"%s\"", name, value);
+	testutil_check(__wt_snprintf(optstr, len, "%s=\"%s\"", name, value));
 	ret = config_opt_str(wtperf, optstr);
 	free(optstr);
 	return (ret);
diff --git a/bench/wtperf/idle_table_cycle.c b/bench/wtperf/idle_table_cycle.c
index bb44cfbde59..4387860cfb2 100644
--- a/bench/wtperf/idle_table_cycle.c
+++ b/bench/wtperf/idle_table_cycle.c
@@ -80,8 +80,8 @@ cycle_idle_tables(void *arg)
 	}
 
 	for (cycle_count = 0; wtperf->idle_cycle_run; ++cycle_count) {
-		snprintf(uri, sizeof(uri),
-		    "%s_cycle%07d", wtperf->uris[0], cycle_count);
+		testutil_check(__wt_snprintf(uri, sizeof(uri),
+		    "%s_cycle%07d", wtperf->uris[0], cycle_count));
 		/* Don't busy cycle in this loop. */
 		__wt_sleep(1, 0);
 
diff --git a/bench/wtperf/misc.c b/bench/wtperf/misc.c
index 24b3323a49a..0874794e01e 100644
--- a/bench/wtperf/misc.c
+++ b/bench/wtperf/misc.c
@@ -46,8 +46,8 @@ setup_log_file(WTPERF *wtperf)
 	len = strlen(wtperf->monitor_dir) +
 	    strlen(opts->table_name) + strlen(".stat") + 2;
 	fname = dmalloc(len);
-	snprintf(fname, len,
-	    "%s/%s.stat", wtperf->monitor_dir, opts->table_name);
+	testutil_check(__wt_snprintf(fname, len,
+	    "%s/%s.stat", wtperf->monitor_dir, opts->table_name));
 	if ((wtperf->logf = fopen(fname, "w")) == NULL) {
 		ret = errno;
 		fprintf(stderr, "%s: %s\n", fname, strerror(ret));
diff --git a/bench/wtperf/track.c b/bench/wtperf/track.c
index 822bdaa4b4a..86a26120a6a 100644
--- a/bench/wtperf/track.c
+++ b/bench/wtperf/track.c
@@ -288,8 +288,8 @@ latency_print_single(WTPERF *wtperf, TRACK *total, const char *name)
 	uint64_t cumops;
 	char path[1024];
 
-	snprintf(path, sizeof(path),
-	    "%s/latency.%s", wtperf->monitor_dir, name);
+	testutil_check(__wt_snprintf(path, sizeof(path),
+	    "%s/latency.%s", wtperf->monitor_dir, name));
 	if ((fp = fopen(path, "w")) == NULL) {
 		lprintf(wtperf, errno, 0, "%s", path);
 		return;
diff --git a/bench/wtperf/wtperf.c b/bench/wtperf/wtperf.c
index 772dedac8c8..1eedaba4f32 100644
--- a/bench/wtperf/wtperf.c
+++ b/bench/wtperf/wtperf.c
@@ -551,7 +551,8 @@ worker(void *arg)
 		goto err;
 	}
 	for (i = 0; i < opts->table_count_idle; i++) {
-		snprintf(buf, 512, "%s_idle%05d", wtperf->uris[0], (int)i);
+		testutil_check(__wt_snprintf(
+		    buf, 512, "%s_idle%05d", wtperf->uris[0], (int)i));
 		if ((ret = session->open_cursor(
 		    session, buf, NULL, NULL, &tmp_cursor)) != 0) {
 			lprintf(wtperf, ret, 0,
@@ -1297,7 +1298,8 @@ monitor(void *arg)
 	/* Open the logging file. */
 	len = strlen(wtperf->monitor_dir) + 100;
 	path = dmalloc(len);
-	snprintf(path, len, "%s/monitor", wtperf->monitor_dir);
+	testutil_check(__wt_snprintf(
+	    path, len, "%s/monitor", wtperf->monitor_dir));
 	if ((fp = fopen(path, "w")) == NULL) {
 		lprintf(wtperf, errno, 0, "%s", path);
 		goto err;
@@ -1937,19 +1939,19 @@ create_uris(WTPERF *wtperf)
 		/* If there is only one table, just use the base name. */
 		wtperf->uris[i] = dmalloc(len);
 		if (opts->table_count == 1)
-			snprintf(wtperf->uris[i],
-			    len, "table:%s", opts->table_name);
+			testutil_check(__wt_snprintf(wtperf->uris[i],
+			    len, "table:%s", opts->table_name));
 		else
-			snprintf(wtperf->uris[i],
-			    len, "table:%s%05d", opts->table_name, i);
+			testutil_check(__wt_snprintf(wtperf->uris[i],
+			    len, "table:%s%05d", opts->table_name, i));
 	}
 
 	/* Create the log-like-table URI. */
 	len = strlen("table:") +
 	    strlen(opts->table_name) + strlen("_log_table") + 1;
 	wtperf->log_table_uri = dmalloc(len);
-	snprintf(
-	    wtperf->log_table_uri, len, "table:%s_log_table", opts->table_name);
+	testutil_check(__wt_snprintf(wtperf->log_table_uri,
+	    len, "table:%s_log_table", opts->table_name));
 }
 
 static int
@@ -1971,7 +1973,8 @@ create_tables(WTPERF *wtperf)
 	}
 
 	for (i = 0; i < opts->table_count_idle; i++) {
-		snprintf(buf, 512, "%s_idle%05d", wtperf->uris[0], (int)i);
+		testutil_check(__wt_snprintf(
+		    buf, 512, "%s_idle%05d", wtperf->uris[0], (int)i));
 		if ((ret = session->create(
 		    session, buf, opts->table_config)) != 0) {
 			lprintf(wtperf, ret, 0,
@@ -2000,8 +2003,9 @@ create_tables(WTPERF *wtperf)
 			return (ret);
 		}
 		if (opts->index) {
-			snprintf(buf, 512, "index:%s:val_idx",
-			    wtperf->uris[i] + strlen("table:"));
+			testutil_check(__wt_snprintf(buf, 512,
+			    "index:%s:val_idx",
+			    wtperf->uris[i] + strlen("table:")));
 			if ((ret = session->create(
 			    session, buf, "columns=(val)")) != 0) {
 				lprintf(wtperf, ret, 0,
@@ -2186,15 +2190,15 @@ start_all_runs(WTPERF *wtperf)
 		 */
 		len = strlen(wtperf->home) + 5;
 		next_wtperf->home = dmalloc(len);
-		snprintf(
-		    next_wtperf->home, len, "%s/D%02d", wtperf->home, (int)i);
+		testutil_check(__wt_snprintf(
+		    next_wtperf->home, len, "%s/D%02d", wtperf->home, (int)i));
 		if (opts->create != 0)
 			recreate_dir(next_wtperf->home);
 
 		len = strlen(wtperf->monitor_dir) + 5;
 		next_wtperf->monitor_dir = dmalloc(len);
-		snprintf(next_wtperf->monitor_dir,
-		    len, "%s/D%02d", wtperf->monitor_dir, (int)i);
+		testutil_check(__wt_snprintf(next_wtperf->monitor_dir,
+		    len, "%s/D%02d", wtperf->monitor_dir, (int)i));
 		if (opts->create != 0 &&
 		    strcmp(next_wtperf->home, next_wtperf->monitor_dir) != 0)
 			recreate_dir(next_wtperf->monitor_dir);
@@ -2543,9 +2547,9 @@ main(int argc, char *argv[])
 		 */
 		req_len = strlen(",async=(enabled=true,threads=)") + 4;
 		wtperf->async_config = dmalloc(req_len);
-		snprintf(wtperf->async_config, req_len,
+		testutil_check(__wt_snprintf(wtperf->async_config, req_len,
 		    ",async=(enabled=true,threads=%" PRIu32 ")",
-		    opts->async_threads);
+		    opts->async_threads));
 	}
 	if ((ret = config_compress(wtperf)) != 0)
 		goto err;
@@ -2578,10 +2582,10 @@ main(int argc, char *argv[])
 			sreq_len = strlen("session_max=") + 6;
 			req_len += sreq_len;
 			sess_cfg = dmalloc(sreq_len);
-			snprintf(sess_cfg, sreq_len,
+			testutil_check(__wt_snprintf(sess_cfg, sreq_len,
 			    "session_max=%" PRIu32,
 			    opts->session_count_idle +
-			    wtperf->workers_cnt + opts->populate_threads + 10);
+			    wtperf->workers_cnt + opts->populate_threads + 10));
 		}
 		req_len += opts->in_memory ? strlen("in_memory=true") : 0;
 		req_len += user_cconfig != NULL ? strlen(user_cconfig) : 0;
@@ -2591,16 +2595,16 @@ main(int argc, char *argv[])
 		append_comma = "";
 		if (wtperf->async_config != NULL &&
 		    strlen(wtperf->async_config) != 0) {
-			pos += (size_t)snprintf(
-			    cc_buf + pos, req_len - pos, "%s%s",
-			    append_comma, wtperf->async_config);
+			testutil_check(__wt_snprintf_len_incr(
+			    cc_buf + pos, req_len - pos, &pos, "%s%s",
+			    append_comma, wtperf->async_config));
 			append_comma = ",";
 		}
 		if (wtperf->compress_ext != NULL &&
 		    strlen(wtperf->compress_ext) != 0) {
-			pos += (size_t)snprintf(
-			    cc_buf + pos, req_len - pos, "%s%s",
-			    append_comma, wtperf->compress_ext);
+			testutil_check(__wt_snprintf_len_incr(
+			    cc_buf + pos, req_len - pos, &pos, "%s%s",
+			    append_comma, wtperf->compress_ext));
 			append_comma = ",";
 		}
 		if (opts->in_memory) {
@@ -2610,15 +2614,15 @@ main(int argc, char *argv[])
 			append_comma = ",";
 		}
 		if (sess_cfg != NULL && strlen(sess_cfg) != 0) {
-			pos += (size_t)snprintf(
-			    cc_buf + pos, req_len - pos, "%s%s",
-			    append_comma, sess_cfg);
+			testutil_check(__wt_snprintf_len_incr(
+			    cc_buf + pos, req_len - pos, &pos, "%s%s",
+			    append_comma, sess_cfg));
 			append_comma = ",";
 		}
 		if (user_cconfig != NULL && strlen(user_cconfig) != 0) {
-			pos += (size_t)snprintf(
-			    cc_buf + pos, req_len - pos, "%s%s",
-			    append_comma, user_cconfig);
+			testutil_check(__wt_snprintf_len_incr(
+			    cc_buf + pos, req_len - pos, &pos, "%s%s",
+			    append_comma, user_cconfig));
 			append_comma = ",";
 		}
 
@@ -2639,21 +2643,21 @@ main(int argc, char *argv[])
 		append_comma = "";
 		if (wtperf->compress_table != NULL &&
 		    strlen(wtperf->compress_table) != 0) {
-			pos += (size_t)snprintf(
-			    tc_buf + pos, req_len - pos, "%s%s",
-			    append_comma, wtperf->compress_table);
+			testutil_check(__wt_snprintf_len_incr(
+			    tc_buf + pos, req_len - pos, &pos, "%s%s",
+			    append_comma, wtperf->compress_table));
 			append_comma = ",";
 		}
 		if (opts->index) {
-			pos += (size_t)snprintf(
-			    tc_buf + pos, req_len - pos, "%s%s",
-			    append_comma, INDEX_COL_NAMES);
+			testutil_check(__wt_snprintf_len_incr(
+			    tc_buf + pos, req_len - pos, &pos, "%s%s",
+			    append_comma, INDEX_COL_NAMES));
 			append_comma = ",";
 		}
 		if (user_tconfig != NULL && strlen(user_tconfig) != 0) {
-			pos += (size_t)snprintf(
-			    tc_buf + pos, req_len - pos, "%s%s",
-			    append_comma, user_tconfig);
+			testutil_check(__wt_snprintf_len_incr(
+			    tc_buf + pos, req_len - pos, &pos, "%s%s",
+			    append_comma, user_tconfig));
 			append_comma = ",";
 		}
 
@@ -2665,8 +2669,9 @@ main(int argc, char *argv[])
 		req_len = strlen(opts->table_config) +
 		    strlen(LOG_PARTIAL_CONFIG) + 1;
 		wtperf->partial_config = dmalloc(req_len);
-		snprintf(wtperf->partial_config, req_len, "%s%s",
-		    opts->table_config, LOG_PARTIAL_CONFIG);
+		testutil_check(__wt_snprintf(
+		    wtperf->partial_config, req_len, "%s%s",
+		    opts->table_config, LOG_PARTIAL_CONFIG));
 	}
 	/*
 	 * Set the config for reopen.  If readonly add in that string.
@@ -2679,11 +2684,12 @@ main(int argc, char *argv[])
 		req_len = strlen(opts->conn_config) + 1;
 	wtperf->reopen_config = dmalloc(req_len);
 	if (opts->readonly)
-		snprintf(wtperf->reopen_config, req_len, "%s%s",
-		    opts->conn_config, READONLY_CONFIG);
+		testutil_check(__wt_snprintf(
+		    wtperf->reopen_config, req_len, "%s%s",
+		    opts->conn_config, READONLY_CONFIG));
 	else
-		snprintf(wtperf->reopen_config,
-		    req_len, "%s", opts->conn_config);
+		testutil_check(__wt_snprintf(
+		    wtperf->reopen_config, req_len, "%s", opts->conn_config));
 
 	/* Sanity-check the configuration. */
 	if ((ret = config_sanity(wtperf)) != 0)
@@ -2696,7 +2702,8 @@ main(int argc, char *argv[])
 	/* Write a copy of the config. */
 	req_len = strlen(wtperf->home) + strlen("/CONFIG.wtperf") + 1;
 	path = dmalloc(req_len);
-	snprintf(path, req_len, "%s/CONFIG.wtperf", wtperf->home);
+	testutil_check(__wt_snprintf(
+	    path, req_len, "%s/CONFIG.wtperf", wtperf->home));
 	config_opt_log(opts, path);
 	free(path);
 
@@ -2821,7 +2828,8 @@ recreate_dir(const char *name)
 
 	len = strlen(name) * 2 + 100;
 	buf = dmalloc(len);
-	(void)snprintf(buf, len, "rm -rf %s && mkdir %s", name, name);
+	testutil_check(__wt_snprintf(
+	    buf, len, "rm -rf %s && mkdir %s", name, name));
 	testutil_checkfmt(system(buf), "system: %s", buf);
 	free(buf);
 }
diff --git a/dist/filelist b/dist/filelist
index 3886035eaa9..5a3348b940a 100644
--- a/dist/filelist
+++ b/dist/filelist
@@ -133,6 +133,7 @@ src/os_posix/os_path.c			POSIX_HOST
 src/os_posix/os_priv.c			POSIX_HOST
 src/os_posix/os_setvbuf.c		POSIX_HOST
 src/os_posix/os_sleep.c			POSIX_HOST
+src/os_posix/os_snprintf.c		POSIX_HOST
 src/os_posix/os_thread.c		POSIX_HOST
 src/os_posix/os_time.c			POSIX_HOST
 src/os_posix/os_yield.c			POSIX_HOST
@@ -152,7 +153,6 @@ src/os_win/os_snprintf.c		WINDOWS_HOST
 src/os_win/os_thread.c			WINDOWS_HOST
 src/os_win/os_time.c			WINDOWS_HOST
 src/os_win/os_utf8.c			WINDOWS_HOST
-src/os_win/os_vsnprintf.c		WINDOWS_HOST
 src/os_win/os_winerr.c			WINDOWS_HOST
 src/os_win/os_yield.c			WINDOWS_HOST
 src/packing/pack_api.c
diff --git a/examples/c/ex_async.c b/examples/c/ex_async.c
index f7531a5c3d8..5cfafca0418 100644
--- a/examples/c/ex_async.c
+++ b/examples/c/ex_async.c
@@ -170,12 +170,12 @@ main(void)
 		 * an asynchronous insert.
 		 */
 		/*! [async set the operation's string key] */
-		snprintf(k[i], sizeof(k), "key%d", i);
+		(void)snprintf(k[i], sizeof(k), "key%d", i);
 		op->set_key(op, k[i]);
 		/*! [async set the operation's string key] */
 
 		/*! [async set the operation's string value] */
-		snprintf(v[i], sizeof(v), "value%d", i);
+		(void)snprintf(v[i], sizeof(v), "value%d", i);
 		op->set_value(op, v[i]);
 		/*! [async set the operation's string value] */
 
@@ -218,7 +218,7 @@ main(void)
 		 * Set the operation's string key and value, and then do
 		 * an asynchronous search.
 		 */
-		snprintf(k[i], sizeof(k), "key%d", i);
+		(void)snprintf(k[i], sizeof(k), "key%d", i);
 		op->set_key(op, k[i]);
 		ret = op->search(op);
 		/*! [async search] */
diff --git a/examples/c/ex_backup.c b/examples/c/ex_backup.c
index 0697cbb3458..83cc9b22ecc 100644
--- a/examples/c/ex_backup.c
+++ b/examples/c/ex_backup.c
@@ -96,7 +96,7 @@ compare_backups(int i)
 	if (i == 0)
 		(void)strncpy(msg, "MAIN", sizeof(msg));
 	else
-		snprintf(msg, sizeof(msg), "%d", i);
+		(void)snprintf(msg, sizeof(msg), "%d", i);
 	printf(
 	    "Iteration %s: Tables %s.%d and %s.%d %s\n",
 	    msg, full_out, i, incr_out, i, ret == 0 ? "identical" : "differ");
@@ -131,8 +131,8 @@ setup_directories(void)
 		 * For incremental backups we need 0-N.  The 0 incremental
 		 * directory will compare with the original at the end.
 		 */
-		snprintf(buf, sizeof(buf), "rm -rf %s.%d && mkdir %s.%d",
-		    home_incr, i, home_incr, i);
+		(void)snprintf(buf, sizeof(buf),
+		    "rm -rf %s.%d && mkdir %s.%d", home_incr, i, home_incr, i);
 		if ((ret = system(buf)) != 0) {
 			fprintf(stderr, "%s: failed ret %d\n", buf, ret);
 			return (ret);
@@ -142,8 +142,8 @@ setup_directories(void)
 		/*
 		 * For full backups we need 1-N.
 		 */
-		snprintf(buf, sizeof(buf), "rm -rf %s.%d && mkdir %s.%d",
-		    home_full, i, home_full, i);
+		(void)snprintf(buf, sizeof(buf),
+		    "rm -rf %s.%d && mkdir %s.%d", home_full, i, home_full, i);
 		if ((ret = system(buf)) != 0) {
 			fprintf(stderr, "%s: failed ret %d\n", buf, ret);
 			return (ret);
@@ -164,8 +164,8 @@ add_work(WT_SESSION *session, int iter)
 	 * Perform some operations with individual auto-commit transactions.
 	 */
 	for (i = 0; i < MAX_KEYS; i++) {
-		snprintf(k, sizeof(k), "key.%d.%d", iter, i);
-		snprintf(v, sizeof(v), "value.%d.%d", iter, i);
+		(void)snprintf(k, sizeof(k), "key.%d.%d", iter, i);
+		(void)snprintf(v, sizeof(v), "value.%d.%d", iter, i);
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		ret = cursor->insert(cursor);
@@ -187,7 +187,7 @@ take_full_backup(WT_SESSION *session, int i)
 	 * directories.  Otherwise only into the appropriate full directory.
 	 */
 	if (i != 0) {
-		snprintf(h, sizeof(h), "%s.%d", home_full, i);
+		(void)snprintf(h, sizeof(h), "%s.%d", home_full, i);
 		hdir = h;
 	} else
 		hdir = home_incr;
@@ -200,14 +200,15 @@ take_full_backup(WT_SESSION *session, int i)
 			 * Take a full backup into each incremental directory.
 			 */
 			for (j = 0; j < MAX_ITERATIONS; j++) {
-				snprintf(h, sizeof(h), "%s.%d", home_incr, j);
+				(void)snprintf(h, sizeof(h),
+				    "%s.%d", home_incr, j);
 				(void)snprintf(buf, sizeof(buf),
 				    "cp %s/%s %s/%s",
 				    home, filename, h, filename);
 				ret = system(buf);
 			}
 		else {
-			snprintf(h, sizeof(h), "%s.%d", home_full, i);
+			(void)snprintf(h, sizeof(h), "%s.%d", home_full, i);
 			(void)snprintf(buf, sizeof(buf), "cp %s/%s %s/%s",
 			    home, filename, hdir, filename);
 			ret = system(buf);
@@ -237,12 +238,12 @@ take_incr_backup(WT_SESSION *session, int i)
 		 * Copy into the 0 incremental directory and then each of the
 		 * incremental directories for this iteration and later.
 		 */
-		snprintf(h, sizeof(h), "%s.0", home_incr);
+		(void)snprintf(h, sizeof(h), "%s.0", home_incr);
 		(void)snprintf(buf, sizeof(buf), "cp %s/%s %s/%s",
 		    home, filename, h, filename);
 		ret = system(buf);
 		for (j = i; j < MAX_ITERATIONS; j++) {
-			snprintf(h, sizeof(h), "%s.%d", home_incr, j);
+			(void)snprintf(h, sizeof(h), "%s.%d", home_incr, j);
 			(void)snprintf(buf, sizeof(buf), "cp %s/%s %s/%s",
 			    home, filename, h, filename);
 			ret = system(buf);
@@ -270,7 +271,8 @@ main(void)
 	int i, ret;
 	char cmd_buf[256];
 
-	snprintf(cmd_buf, sizeof(cmd_buf), "rm -rf %s && mkdir %s", home, home);
+	(void)snprintf(cmd_buf, sizeof(cmd_buf),
+	    "rm -rf %s && mkdir %s", home, home);
 	if ((ret = system(cmd_buf)) != 0) {
 		fprintf(stderr, "%s: failed ret %d\n", cmd_buf, ret);
 		return (EXIT_FAILURE);
diff --git a/examples/c/ex_encrypt.c b/examples/c/ex_encrypt.c
index 00dc66fc24d..1520bd286cd 100644
--- a/examples/c/ex_encrypt.c
+++ b/examples/c/ex_encrypt.c
@@ -507,12 +507,12 @@ main(void)
 	 * we decrypt on read.
 	 */
 	for (i = 0; i < MAX_KEYS; i++) {
-		snprintf(keybuf, sizeof(keybuf), "key%d", i);
+		(void)snprintf(keybuf, sizeof(keybuf), "key%d", i);
 		c1->set_key(c1, keybuf);
 		c2->set_key(c2, keybuf);
 		nc->set_key(nc, keybuf);
 
-		snprintf(valbuf, sizeof(valbuf), "value%d", i);
+		(void)snprintf(valbuf, sizeof(valbuf), "value%d", i);
 		c1->set_value(c1, valbuf);
 		c2->set_value(c2, valbuf);
 		nc->set_value(nc, valbuf);
diff --git a/examples/c/ex_log.c b/examples/c/ex_log.c
index fdbc39412ae..0d8fbf97233 100644
--- a/examples/c/ex_log.c
+++ b/examples/c/ex_log.c
@@ -291,8 +291,8 @@ main(void)
 	char cmd_buf[256], k[16], v[16];
 
 	count_min = 0;
-	snprintf(cmd_buf, sizeof(cmd_buf), "rm -rf %s %s && mkdir %s %s",
-	    home1, home2, home1, home2);
+	(void)snprintf(cmd_buf, sizeof(cmd_buf),
+	    "rm -rf %s %s && mkdir %s %s", home1, home2, home1, home2);
 	if ((ret = system(cmd_buf)) != 0) {
 		fprintf(stderr, "%s: failed ret %d\n", cmd_buf, ret);
 		return (EXIT_FAILURE);
@@ -312,8 +312,8 @@ main(void)
 	 * Perform some operations with individual auto-commit transactions.
 	 */
 	for (record_count = 0, i = 0; i < MAX_KEYS; i++, record_count++) {
-		snprintf(k, sizeof(k), "key%d", i);
-		snprintf(v, sizeof(v), "value%d", i);
+		(void)snprintf(k, sizeof(k), "key%d", i);
+		(void)snprintf(v, sizeof(v), "value%d", i);
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		ret = cursor->insert(cursor);
@@ -324,8 +324,8 @@ main(void)
 	 * Perform some operations within a single transaction.
 	 */
 	for (i = MAX_KEYS; i < MAX_KEYS+5; i++, record_count++) {
-		snprintf(k, sizeof(k), "key%d", i);
-		snprintf(v, sizeof(v), "value%d", i);
+		(void)snprintf(k, sizeof(k), "key%d", i);
+		(void)snprintf(v, sizeof(v), "value%d", i);
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		ret = cursor->insert(cursor);
diff --git a/examples/c/ex_sync.c b/examples/c/ex_sync.c
index 2c610b1e570..b2d74b52f7f 100644
--- a/examples/c/ex_sync.c
+++ b/examples/c/ex_sync.c
@@ -59,8 +59,8 @@ main(void)
 	char cmd_buf[256], k[16], v[16];
 	const char *conf;
 
-	snprintf(cmd_buf, sizeof(cmd_buf), "rm -rf %s && mkdir %s",
-	    home, home);
+	(void)snprintf(cmd_buf, sizeof(cmd_buf),
+	    "rm -rf %s && mkdir %s", home, home);
 	if ((ret = system(cmd_buf)) != 0) {
 		fprintf(stderr, "%s: failed ret %d\n", cmd_buf, ret);
 		return (EXIT_FAILURE);
@@ -98,8 +98,8 @@ main(void)
 			ret = session->commit_transaction(session, conf);
 			ret = session->begin_transaction(session, NULL);
 		}
-		snprintf(k, sizeof(k), "key%d", i);
-		snprintf(v, sizeof(v), "value%d", i);
+		(void)snprintf(k, sizeof(k), "key%d", i);
+		(void)snprintf(v, sizeof(v), "value%d", i);
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		ret = cursor->insert(cursor);
@@ -113,8 +113,8 @@ main(void)
 	 * Perform some operations within a single transaction.
 	 */
 	for (i = MAX_KEYS; i < MAX_KEYS+5; i++, record_count++) {
-		snprintf(k, sizeof(k), "key%d", i);
-		snprintf(v, sizeof(v), "value%d", i);
+		(void)snprintf(k, sizeof(k), "key%d", i);
+		(void)snprintf(v, sizeof(v), "value%d", i);
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		ret = cursor->insert(cursor);
@@ -129,8 +129,8 @@ main(void)
 	 * Demonstrate using log_flush to force the log to disk.
 	 */
 	for (i = 0; i < MAX_KEYS; i++, record_count++) {
-		snprintf(k, sizeof(k), "key%d", record_count);
-		snprintf(v, sizeof(v), "value%d", record_count);
+		(void)snprintf(k, sizeof(k), "key%d", record_count);
+		(void)snprintf(v, sizeof(v), "value%d", record_count);
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		ret = cursor->insert(cursor);
@@ -138,8 +138,8 @@ main(void)
 	ret = session->log_flush(session, "sync=on");
 
 	for (i = 0; i < MAX_KEYS; i++, record_count++) {
-		snprintf(k, sizeof(k), "key%d", record_count);
-		snprintf(v, sizeof(v), "value%d", record_count);
+		(void)snprintf(k, sizeof(k), "key%d", record_count);
+		(void)snprintf(v, sizeof(v), "value%d", record_count);
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		ret = cursor->insert(cursor);
diff --git a/src/block/block_ext.c b/src/block/block_ext.c
index e9357d73d1d..da7a06d873d 100644
--- a/src/block/block_ext.c
+++ b/src/block/block_ext.c
@@ -1378,8 +1378,8 @@ __wt_block_extlist_init(WT_SESSION_IMPL *session,
 	size = (name == NULL ? 0 : strlen(name)) +
 	    strlen(".") + (extname == NULL ? 0 : strlen(extname) + 1);
 	WT_RET(__wt_calloc_def(session, size, &el->name));
-	(void)snprintf(el->name, size, "%s.%s",
-	    name == NULL ? "" : name, extname == NULL ? "" : extname);
+	WT_RET(__wt_snprintf(el->name, size, "%s.%s",
+	    name == NULL ? "" : name, extname == NULL ? "" : extname));
 
 	el->offset = WT_BLOCK_INVALID_OFFSET;
 	el->track_size = track_size;
diff --git a/src/bloom/bloom.c b/src/bloom/bloom.c
index be3230437d3..b8d75678835 100644
--- a/src/bloom/bloom.c
+++ b/src/bloom/bloom.c
@@ -37,8 +37,8 @@ __bloom_init(WT_SESSION_IMPL *session,
 		len += strlen(config);
 	WT_ERR(__wt_calloc_def(session, len, &bloom->config));
 	/* Add the standard config at the end, so it overrides user settings. */
-	(void)snprintf(bloom->config, len,
-	    "%s,%s", config == NULL ? "" : config, WT_BLOOM_TABLE_CONFIG);
+	WT_ERR(__wt_snprintf(bloom->config, len,
+	    "%s,%s", config == NULL ? "" : config, WT_BLOOM_TABLE_CONFIG));
 
 	bloom->session = session;
 
diff --git a/src/btree/bt_debug.c b/src/btree/bt_debug.c
index 4989301468f..d3f02e29b90 100644
--- a/src/btree/bt_debug.c
+++ b/src/btree/bt_debug.c
@@ -64,7 +64,7 @@ __wt_debug_set_verbose(WT_SESSION_IMPL *session, const char *v)
 	const char *cfg[2] = { NULL, NULL };
 	char buf[256];
 
-	snprintf(buf, sizeof(buf), "verbose=[%s]", v);
+	WT_RET(__wt_snprintf(buf, sizeof(buf), "verbose=[%s]", v));
 	cfg[0] = buf;
 	return (__wt_verbose_config(session, cfg));
 }
@@ -87,6 +87,7 @@ __debug_hex_byte(WT_DBG *ds, uint8_t v)
 static int
 __dmsg_event(WT_DBG *ds, const char *fmt, ...)
 {
+	WT_DECL_RET;
 	WT_ITEM *msg;
 	WT_SESSION_IMPL *session;
 	size_t len, space;
@@ -107,8 +108,9 @@ __dmsg_event(WT_DBG *ds, const char *fmt, ...)
 		p = (char *)msg->mem + msg->size;
 		space = msg->memsize - msg->size;
 		va_start(ap, fmt);
-		len = (size_t)vsnprintf(p, space, fmt, ap);
+		ret = __wt_vsnprintf_len_set(p, space, &len, fmt, ap);
 		va_end(ap);
+		WT_RET(ret);
 
 		/* Check if there was enough space. */
 		if (len < space) {
@@ -447,13 +449,14 @@ __debug_tree_shape_info(WT_PAGE *page)
 
 	v = page->memory_footprint;
 	if (v >= WT_GIGABYTE)
-		snprintf(buf, sizeof(buf),
+		(void)__wt_snprintf(buf, sizeof(buf),
 		    "(%p %" PRIu64 "G)", (void *)page, v / WT_GIGABYTE);
 	else if (v >= WT_MEGABYTE)
-		snprintf(buf, sizeof(buf),
+		(void)__wt_snprintf(buf, sizeof(buf),
 		    "(%p %" PRIu64 "M)", (void *)page, v / WT_MEGABYTE);
 	else
-		snprintf(buf, sizeof(buf), "(%p %" PRIu64 ")", (void *)page, v);
+		(void)__wt_snprintf(buf, sizeof(buf),
+		    "(%p %" PRIu64 ")", (void *)page, v);
 	return (buf);
 }
 
@@ -838,7 +841,8 @@ __debug_page_col_var(WT_DBG *ds, WT_REF *ref)
 			__wt_cell_unpack(cell, unpack);
 			rle = __wt_cell_rle(unpack);
 		}
-		snprintf(tag, sizeof(tag), "%" PRIu64 " %" PRIu64, recno, rle);
+		WT_RET(__wt_snprintf(
+		    tag, sizeof(tag), "%" PRIu64 " %" PRIu64, recno, rle));
 		WT_RET(
 		    __debug_cell_data(ds, page, WT_PAGE_COL_VAR, tag, unpack));
 
diff --git a/src/config/config_api.c b/src/config/config_api.c
index 9f70ba65e9b..88e173459f9 100644
--- a/src/config/config_api.c
+++ b/src/config/config_api.c
@@ -278,7 +278,7 @@ __wt_configure_method(WT_SESSION_IMPL *session,
 	entry->method = (*epp)->method;
 	len = strlen((*epp)->base) + strlen(",") + strlen(config) + 1;
 	WT_ERR(__wt_calloc_def(session, len, &p));
-	snprintf(p, len, "%s,%s", (*epp)->base, config);
+	WT_ERR(__wt_snprintf(p, len, "%s,%s", (*epp)->base, config));
 	entry->base = p;
 
 	/*
diff --git a/src/conn/conn_api.c b/src/conn/conn_api.c
index 124250a7a7d..68d45678965 100644
--- a/src/conn/conn_api.c
+++ b/src/conn/conn_api.c
@@ -1662,8 +1662,8 @@ __conn_single(WT_SESSION_IMPL *session, const char *cfg[])
 			WT_ERR_MSG(session, EINVAL,
 			    "Creating a new database is incompatible with "
 			    "read-only configuration");
-		len = (size_t)snprintf(buf, sizeof(buf),
-		    "%s\n%s\n", WT_WIREDTIGER, WIREDTIGER_VERSION_STRING);
+		WT_ERR(__wt_snprintf_len_set(buf, sizeof(buf), &len,
+		    "%s\n%s\n", WT_WIREDTIGER, WIREDTIGER_VERSION_STRING));
 		WT_ERR(__wt_write(session, fh, (wt_off_t)0, len, buf));
 		WT_ERR(__wt_fsync(session, fh, true));
 	} else {
@@ -2250,10 +2250,9 @@ wiredtiger_open(const char *home, WT_EVENT_HANDLER *event_handler,
 	WT_ERR(__wt_scr_alloc(session, 0, &i3));
 	cfg[0] = WT_CONFIG_BASE(session, wiredtiger_open_all);
 	cfg[1] = NULL;
-	WT_ERR_TEST(snprintf(version, sizeof(version),
+	WT_ERR(__wt_snprintf(version, sizeof(version),
 	    "version=(major=%d,minor=%d)",
-	    WIREDTIGER_VERSION_MAJOR, WIREDTIGER_VERSION_MINOR) >=
-	    (int)sizeof(version), ENOMEM);
+	    WIREDTIGER_VERSION_MAJOR, WIREDTIGER_VERSION_MINOR));
 	__conn_config_append(cfg, version);
 
 	/* Ignore the base_config file if config_base_set is false. */
diff --git a/src/cursor/cur_join.c b/src/cursor/cur_join.c
index 6135132601b..80afaf798dc 100644
--- a/src/cursor/cur_join.c
+++ b/src/cursor/cur_join.c
@@ -185,7 +185,7 @@ __curjoin_iter_set_entry(WT_CURSOR_JOIN_ITER *iter, u_int entry_pos)
 
 		size = strlen(to_dup->internal_uri) + 3;
 		WT_ERR(__wt_calloc(session, size, 1, &uri));
-		snprintf(uri, size, "%s()", to_dup->internal_uri);
+		WT_ERR(__wt_snprintf(uri, size, "%s()", to_dup->internal_uri));
 		if ((c = iter->cursor) == NULL || !WT_STREQ(c->uri, uri)) {
 			iter->cursor = NULL;
 			if (c != NULL)
@@ -929,7 +929,7 @@ __curjoin_init_next(WT_SESSION_IMPL *session, WT_CURSOR_JOIN *cjoin,
 	if ((proj = cjoin->projection) != NULL) {
 		size = strlen(urimain) + strlen(proj) + 1;
 		WT_ERR(__wt_calloc(session, size, 1, &mainbuf));
-		snprintf(mainbuf, size, "%s%s", urimain, proj);
+		WT_ERR(__wt_snprintf(mainbuf, size, "%s%s", urimain, proj));
 		urimain = mainbuf;
 	}
 	WT_ERR(__wt_open_cursor(session, urimain, (WT_CURSOR *)cjoin, config,
@@ -1148,8 +1148,8 @@ __curjoin_open_main(WT_SESSION_IMPL *session, WT_CURSOR_JOIN *cjoin,
 
 	newsize = strlen(cjoin->table->name) + idx->colconf.len + 1;
 	WT_ERR(__wt_calloc(session, 1, newsize, &main_uri));
-	snprintf(main_uri, newsize, "%s%.*s",
-	    cjoin->table->name, (int)idx->colconf.len, idx->colconf.str);
+	WT_ERR(__wt_snprintf(main_uri, newsize, "%s%.*s",
+	    cjoin->table->name, (int)idx->colconf.len, idx->colconf.str));
 	WT_ERR(__wt_open_cursor(session, main_uri,
 	    (WT_CURSOR *)cjoin, raw_cfg, &entry->main));
 	if (idx->extractor == NULL) {
@@ -1162,7 +1162,8 @@ __curjoin_open_main(WT_SESSION_IMPL *session, WT_CURSOR_JOIN *cjoin,
 		 */
 		len = strlen(entry->main->value_format) + 3;
 		WT_ERR(__wt_calloc(session, len, 1, &newformat));
-		snprintf(newformat, len, "%s0x", entry->main->value_format);
+		WT_ERR(__wt_snprintf(
+		    newformat, len, "%s0x", entry->main->value_format));
 		__wt_free(session, entry->main->value_format);
 		entry->main->value_format = newformat;
 	}
@@ -1531,8 +1532,8 @@ __wt_curjoin_join(WT_SESSION_IMPL *session, WT_CURSOR_JOIN *cjoin,
 			len = strlen(cindex->iface.key_format) + 3;
 			WT_RET(__wt_calloc(session, len, 1,
 			    &entry->repack_format));
-			snprintf(entry->repack_format, len, "%s0x",
-			    cindex->iface.key_format);
+			WT_RET(__wt_snprintf(entry->repack_format,
+			    len, "%s0x", cindex->iface.key_format));
 		}
 	}
 	return (0);
diff --git a/src/cursor/cur_json.c b/src/cursor/cur_json.c
index 0ad3c4f4201..e8ddb767863 100644
--- a/src/cursor/cur_json.c
+++ b/src/cursor/cur_json.c
@@ -8,8 +8,8 @@
 
 #include "wt_internal.h"
 
-static size_t __json_unpack_put(WT_SESSION_IMPL *, void *, u_char *, size_t,
-    WT_CONFIG_ITEM *);
+static int __json_unpack_put(
+    WT_SESSION_IMPL *, void *, u_char *, size_t, WT_CONFIG_ITEM *, size_t *);
 static inline int __json_struct_size(WT_SESSION_IMPL *, const void *, size_t,
     const char *, WT_CONFIG_ITEM *, bool, size_t *);
 static inline int __json_struct_unpackv(WT_SESSION_IMPL *, const void *, size_t,
@@ -61,22 +61,22 @@ static int __json_pack_size(WT_SESSION_IMPL *, const char *, WT_CONFIG_ITEM *,
  * __json_unpack_put --
  *	Calculate the size of a packed byte string as formatted for JSON.
  */
-static size_t
+static int
 __json_unpack_put(WT_SESSION_IMPL *session, void *voidpv,
-    u_char *buf, size_t bufsz, WT_CONFIG_ITEM *name)
+    u_char *buf, size_t bufsz, WT_CONFIG_ITEM *name, size_t *retsizep)
 {
 	WT_PACK_VALUE *pv;
 	const u_char *p, *end;
 	size_t s, n;
 
 	pv = (WT_PACK_VALUE *)voidpv;
-	s = (size_t)snprintf((char *)buf, bufsz, "\"%.*s\" : ",
-	    (int)name->len, name->str);
+
+	WT_RET(__wt_snprintf_len_set(
+	    (char *)buf, bufsz, &s, "\"%.*s\" : ", (int)name->len, name->str));
 	if (s <= bufsz) {
 		bufsz -= s;
 		buf += s;
-	}
-	else
+	} else
 		bufsz = 0;
 
 	switch (pv->type) {
@@ -118,7 +118,8 @@ __json_unpack_put(WT_SESSION_IMPL *session, void *voidpv,
 			}
 		if (bufsz > 0)
 			*buf++ = '"';
-		return (s);
+		*retsizep += s;
+		return (0);
 	case 'U':
 	case 'u':
 		s += 2;
@@ -140,14 +141,17 @@ __json_unpack_put(WT_SESSION_IMPL *session, void *voidpv,
 		}
 		if (bufsz > 0)
 			*buf++ = '"';
-		return (s);
+		*retsizep += s;
+		return (0);
 	case 'b':
 	case 'h':
 	case 'i':
 	case 'l':
 	case 'q':
-		return (s +
-		    (size_t)snprintf((char *)buf, bufsz, "%" PRId64, pv->u.i));
+		WT_RET(__wt_snprintf_len_incr(
+		    (char *)buf, bufsz, &s, "%" PRId64, pv->u.i));
+		*retsizep += s;
+		return (0);
 	case 'B':
 	case 't':
 	case 'H':
@@ -156,11 +160,14 @@ __json_unpack_put(WT_SESSION_IMPL *session, void *voidpv,
 	case 'Q':
 	case 'r':
 	case 'R':
-		return (s +
-		    (size_t)snprintf((char *)buf, bufsz, "%" PRId64, pv->u.u));
+		WT_RET(__wt_snprintf_len_incr(
+		    (char *)buf, bufsz, &s, "%" PRId64, pv->u.u));
+		*retsizep += s;
+		return (0);
 	}
-	__wt_err(session, EINVAL, "unknown pack-value type: %c", (int)pv->type);
-	return ((size_t)-1);
+
+	WT_RET_MSG(session, EINVAL,
+	    "unknown pack-value type: %c", (int)pv->type);
 }
 
 /*
@@ -194,7 +201,8 @@ __json_struct_size(WT_SESSION_IMPL *session, const void *buffer,
 		needcr = true;
 		WT_RET(__unpack_read(session, &pv, &p, (size_t)(end - p)));
 		WT_RET(__pack_name_next(&packname, &name));
-		result += __json_unpack_put(session, &pv, NULL, 0, &name);
+		WT_RET(
+		    __json_unpack_put(session, &pv, NULL, 0, &name, &result));
 	}
 	if (ret == WT_NOTFOUND)
 		ret = 0;
@@ -243,8 +251,9 @@ __json_struct_unpackv(WT_SESSION_IMPL *session,
 		needcr = true;
 		WT_RET(__unpack_read(session, &pv, &p, (size_t)(end - p)));
 		WT_RET(__pack_name_next(&packname, &name));
-		jsize = __json_unpack_put(session,
-		    (u_char *)&pv, jbuf, jbufsize, &name);
+		jsize = 0;
+		WT_RET(__json_unpack_put(session,
+		    (u_char *)&pv, jbuf, jbufsize, &name, &jsize));
 		WT_ASSERT(session, jsize <= jbufsize);
 		jbuf += jsize;
 		jbufsize -= jsize;
diff --git a/src/cursor/cur_stat.c b/src/cursor/cur_stat.c
index c5ccdb1b649..0bff642370d 100644
--- a/src/cursor/cur_stat.c
+++ b/src/cursor/cur_stat.c
@@ -477,8 +477,8 @@ __curstat_join_desc(WT_CURSOR_STAT *cst, int slot, const char **resultp)
 	len = strlen("join: ") + strlen(sgrp->desc_prefix) +
 	    strlen(static_desc) + 1;
 	WT_RET(__wt_realloc(session, NULL, len, &cst->desc_buf));
-	snprintf(cst->desc_buf, len, "join: %s%s", sgrp->desc_prefix,
-	    static_desc);
+	WT_RET(__wt_snprintf(
+	   cst->desc_buf, len, "join: %s%s", sgrp->desc_prefix, static_desc));
 	*resultp = cst->desc_buf;
 	return (0);
 }
diff --git a/src/include/extern_posix.h b/src/include/extern_posix.h
index fed7835ada1..57d94e392d1 100644
--- a/src/include/extern_posix.h
+++ b/src/include/extern_posix.h
@@ -24,8 +24,9 @@ extern bool __wt_has_priv(void) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")
 extern void __wt_stream_set_line_buffer(FILE *fp) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default")));
 extern void __wt_stream_set_no_buffer(FILE *fp) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default")));
 extern void __wt_sleep(uint64_t seconds, uint64_t micro_seconds) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default")));
+extern int __wt_vsnprintf_len_incr( char *buf, size_t size, size_t *retsizep, const char *fmt, va_list ap) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default"))) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result));
 extern int __wt_thread_create(WT_SESSION_IMPL *session, wt_thread_t *tidret, WT_THREAD_CALLBACK(*func)(void *), void *arg) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern int __wt_thread_join(WT_SESSION_IMPL *session, wt_thread_t tid) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
-extern void __wt_thread_id(char *buf, size_t buflen) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default")));
+extern int __wt_thread_id(char *buf, size_t buflen) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default"))) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result));
 extern void __wt_epoch(WT_SESSION_IMPL *session, struct timespec *tsp) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default")));
 extern void __wt_yield(void) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("default")));
diff --git a/src/include/extern_win.h b/src/include/extern_win.h
index 0bfc821c7a6..43127a0c79f 100644
--- a/src/include/extern_win.h
+++ b/src/include/extern_win.h
@@ -22,9 +22,10 @@ extern bool __wt_has_priv(void) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")
 extern void __wt_stream_set_line_buffer(FILE *fp) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern void __wt_stream_set_no_buffer(FILE *fp) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern void __wt_sleep(uint64_t seconds, uint64_t micro_seconds) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
+extern int __wt_vsnprintf_len_incr( char *buf, size_t size, size_t *retsizep, const char *fmt, va_list ap) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern int __wt_thread_create(WT_SESSION_IMPL *session, wt_thread_t *tidret, WT_THREAD_CALLBACK(*func)(void *), void *arg) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern int __wt_thread_join(WT_SESSION_IMPL *session, wt_thread_t tid) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
-extern void __wt_thread_id(char *buf, size_t buflen) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
+extern int __wt_thread_id(char *buf, size_t buflen) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern void __wt_epoch(WT_SESSION_IMPL *session, struct timespec *tsp) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern int __wt_to_utf16_string( WT_SESSION_IMPL *session, const char*utf8, WT_ITEM **outbuf) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
 extern int __wt_to_utf8_string( WT_SESSION_IMPL *session, const wchar_t*wide, WT_ITEM **outbuf) WT_GCC_FUNC_DECL_ATTRIBUTE((warn_unused_result)) WT_GCC_FUNC_DECL_ATTRIBUTE((visibility("hidden")));
diff --git a/src/include/misc.i b/src/include/misc.i
index d5692a3f9cf..7040886cf82 100644
--- a/src/include/misc.i
+++ b/src/include/misc.i
@@ -86,3 +86,94 @@ __wt_verbose(WT_SESSION_IMPL *session, int flag, const char *fmt, ...)
 	WT_UNUSED(fmt);
 #endif
 }
+
+/*
+ * __wt_snprintf --
+ *	snprintf convenience function, ignoring the returned size.
+ */
+static inline int
+__wt_snprintf(char *buf, size_t size, const char *fmt, ...)
+    WT_GCC_FUNC_ATTRIBUTE((format (printf, 3, 4)))
+{
+	WT_DECL_RET;
+	size_t len;
+	va_list ap;
+
+	len = 0;
+
+	va_start(ap, fmt);
+	ret = __wt_vsnprintf_len_incr(buf, size, &len, fmt, ap);
+	va_end(ap);
+	WT_RET(ret);
+
+	/* It's an error if the buffer couldn't hold everything. */
+	return (len >= size ? ERANGE : 0);
+}
+
+/*
+ * __wt_vsnprintf --
+ *	vsnprintf convenience function, ignoring the returned size.
+ */
+static inline int
+__wt_vsnprintf(char *buf, size_t size, const char *fmt, va_list ap)
+{
+	size_t len;
+
+	len = 0;
+
+	WT_RET(__wt_vsnprintf_len_incr(buf, size, &len, fmt, ap));
+
+	/* It's an error if the buffer couldn't hold everything. */
+	return (len >= size ? ERANGE : 0);
+}
+
+/*
+ * __wt_snprintf_len_set --
+ *	snprintf convenience function, setting the returned size.
+ */
+static inline int
+__wt_snprintf_len_set(
+    char *buf, size_t size, size_t *retsizep, const char *fmt, ...)
+    WT_GCC_FUNC_ATTRIBUTE((format (printf, 4, 5)))
+{
+	WT_DECL_RET;
+	va_list ap;
+
+	*retsizep = 0;
+
+	va_start(ap, fmt);
+	ret = __wt_vsnprintf_len_incr(buf, size, retsizep, fmt, ap);
+	va_end(ap);
+	return (ret);
+}
+
+/*
+ * __wt_vsnprintf_len_set --
+ *	vsnprintf convenience function, setting the returned size.
+ */
+static inline int
+__wt_vsnprintf_len_set(
+    char *buf, size_t size, size_t *retsizep, const char *fmt, va_list ap)
+{
+	*retsizep = 0;
+
+	return (__wt_vsnprintf_len_incr(buf, size, retsizep, fmt, ap));
+}
+
+/*
+ * __wt_snprintf_len_incr --
+ *	snprintf convenience function, incrementing the returned size.
+ */
+static inline int
+__wt_snprintf_len_incr(
+    char *buf, size_t size, size_t *retsizep, const char *fmt, ...)
+    WT_GCC_FUNC_ATTRIBUTE((format (printf, 4, 5)))
+{
+	WT_DECL_RET;
+	va_list ap;
+
+	va_start(ap, fmt);
+	ret = __wt_vsnprintf_len_incr(buf, size, retsizep, fmt, ap);
+	va_end(ap);
+	return (ret);
+}
diff --git a/src/include/os_windows.h b/src/include/os_windows.h
index 65938ac9f17..c1e5f788dc6 100644
--- a/src/include/os_windows.h
+++ b/src/include/os_windows.h
@@ -43,16 +43,6 @@ typedef uint32_t	u_int;
 typedef unsigned char	u_char;
 typedef uint64_t	u_long;
 
-/* <= VS 2013 is not C99 compat */
-#if _MSC_VER < 1900
-#define	snprintf _wt_snprintf
-
-_Check_return_opt_ int __cdecl _wt_snprintf(
-    _Out_writes_(_MaxCount) char * _DstBuf,
-    _In_ size_t _MaxCount,
-    _In_z_ _Printf_format_string_ const char * _Format, ...);
-#endif
-
 /*
  * Windows does have ssize_t
  * Python headers declare also though so we need to guard it
@@ -61,18 +51,6 @@ _Check_return_opt_ int __cdecl _wt_snprintf(
 typedef int ssize_t;
 #endif
 
-/*
- * Provide a custom version of vsnprintf that returns the
- * needed buffer length instead of -1 on truncation
- */
-#define	vsnprintf _wt_vsnprintf
-
-_Check_return_opt_ int __cdecl _wt_vsnprintf(
-    _Out_writes_(_MaxCount) char * _DstBuf,
-    _In_ size_t _MaxCount,
-    _In_z_ _Printf_format_string_ const char * _Format,
-    va_list _ArgList);
-
 /* Provide a custom version of localtime_r */
 struct tm *localtime_r(const time_t* timer, struct tm* result);
 
diff --git a/src/include/packing.i b/src/include/packing.i
index 6b4bcd49e04..0eadb2f2027 100644
--- a/src/include/packing.i
+++ b/src/include/packing.i
@@ -104,8 +104,8 @@ __pack_name_next(WT_PACK_NAME *pn, WT_CONFIG_ITEM *name)
 	WT_CONFIG_ITEM ignore;
 
 	if (pn->genname) {
-		(void)snprintf(pn->buf, sizeof(pn->buf),
-		    (pn->iskey ? "key%d" : "value%d"), pn->count);
+		WT_RET(__wt_snprintf(pn->buf, sizeof(pn->buf),
+		    (pn->iskey ? "key%d" : "value%d"), pn->count));
 		WT_CLEAR(*name);
 		name->str = pn->buf;
 		name->len = strlen(pn->buf);
diff --git a/src/log/log.c b/src/log/log.c
index 1a27120710b..5b24250fffc 100644
--- a/src/log/log.c
+++ b/src/log/log.c
@@ -2246,8 +2246,10 @@ __wt_log_vprintf(WT_SESSION_IMPL *session, const char *fmt, va_list ap)
 		return (0);
 
 	va_copy(ap_copy, ap);
-	len = (size_t)vsnprintf(NULL, 0, fmt, ap_copy) + 1;
+	len = 1;
+	ret = __wt_vsnprintf_len_incr(NULL, 0, &len, fmt, ap_copy);
 	va_end(ap_copy);
+	WT_RET(ret);
 
 	WT_RET(
 	    __wt_logrec_alloc(session, sizeof(WT_LOG_RECORD) + len, &logrec));
@@ -2264,7 +2266,8 @@ __wt_log_vprintf(WT_SESSION_IMPL *session, const char *fmt, va_list ap)
 	    rec_fmt, rectype));
 	logrec->size += (uint32_t)header_size;
 
-	(void)vsnprintf((char *)logrec->data + logrec->size, len, fmt, ap);
+	WT_ERR(__wt_vsnprintf(
+	    (char *)logrec->data + logrec->size, len, fmt, ap));
 
 	__wt_verbose(session, WT_VERB_LOG,
 	    "log_printf: %s", (char *)logrec->data + logrec->size);
diff --git a/src/lsm/lsm_stat.c b/src/lsm/lsm_stat.c
index ed760b6d5f3..411655878af 100644
--- a/src/lsm/lsm_stat.c
+++ b/src/lsm/lsm_stat.c
@@ -38,13 +38,13 @@ __curstat_lsm_init(
 
 	/* Propagate all, fast and/or clear to the cursors we open. */
 	if (cst->flags != 0) {
-		(void)snprintf(config, sizeof(config),
+		WT_ERR(__wt_snprintf(config, sizeof(config),
 		    "statistics=(%s%s%s%s)",
 		    F_ISSET(cst, WT_STAT_TYPE_ALL) ? "all," : "",
 		    F_ISSET(cst, WT_STAT_CLEAR) ? "clear," : "",
 		    !F_ISSET(cst, WT_STAT_TYPE_ALL) &&
 		    F_ISSET(cst, WT_STAT_TYPE_FAST) ? "fast," : "",
-		    F_ISSET(cst, WT_STAT_TYPE_SIZE) ? "size," : "");
+		    F_ISSET(cst, WT_STAT_TYPE_SIZE) ? "size," : ""));
 		cfg[1] = disk_cfg[1] = config;
 	}
 
diff --git a/src/os_common/filename.c b/src/os_common/filename.c
index 5aeb64bb51e..f803144a3fb 100644
--- a/src/os_common/filename.c
+++ b/src/os_common/filename.c
@@ -43,8 +43,8 @@ __wt_nfilename(
 	else {
 		len = strlen(S2C(session)->home) + 1 + namelen + 1;
 		WT_RET(__wt_calloc(session, 1, len, &buf));
-		snprintf(buf, len, "%s%s%.*s", S2C(session)->home,
-		    __wt_path_separator(), (int)namelen, name);
+		WT_RET(__wt_snprintf(buf, len, "%s%s%.*s", S2C(session)->home,
+		    __wt_path_separator(), (int)namelen, name));
 		*path = buf;
 	}
 
diff --git a/src/os_common/os_errno.c b/src/os_common/os_errno.c
index a8e56b7f1aa..7ac89536e79 100644
--- a/src/os_common/os_errno.c
+++ b/src/os_common/os_errno.c
@@ -44,7 +44,7 @@ __wt_strerror(WT_SESSION_IMPL *session, int error, char *errbuf, size_t errlen)
 	 * Fallback to a generic message.
 	 */
 	if (session == NULL &&
-	    snprintf(errbuf, errlen, "error return: %d", error) > 0)
+	    __wt_snprintf(errbuf, errlen, "error return: %d", error) == 0)
 		return (errbuf);
 	if (session != NULL && __wt_buf_fmt(
 	    session, &session->err, "error return: %d", error) == 0)
diff --git a/src/os_common/os_fstream.c b/src/os_common/os_fstream.c
index 5a368ea75e6..744da732d84 100644
--- a/src/os_common/os_fstream.c
+++ b/src/os_common/os_fstream.c
@@ -144,7 +144,7 @@ __fstream_printf(
 		p = (char *)((uint8_t *)buf->mem + buf->size);
 		WT_ASSERT(session, buf->memsize >= buf->size);
 		space = buf->memsize - buf->size;
-		len = (size_t)vsnprintf(p, space, fmt, ap_copy);
+		WT_RET(__wt_vsnprintf_len_set(p, space, &len, fmt, ap_copy));
 		va_end(ap_copy);
 
 		if (len < space) {
diff --git a/src/os_posix/os_snprintf.c b/src/os_posix/os_snprintf.c
new file mode 100644
index 00000000000..390e2e0334a
--- /dev/null
+++ b/src/os_posix/os_snprintf.c
@@ -0,0 +1,27 @@
+/*-
+ * Copyright (c) 2014-2016 MongoDB, Inc.
+ * Copyright (c) 2008-2014 WiredTiger, Inc.
+ *	All rights reserved.
+ *
+ * See the file LICENSE for redistribution information.
+ */
+
+#include "wt_internal.h"
+
+/*
+ * __wt_vsnprintf_len_incr --
+ *	POSIX vsnprintf convenience function, incrementing the returned size.
+ */
+int
+__wt_vsnprintf_len_incr(
+    char *buf, size_t size, size_t *retsizep, const char *fmt, va_list ap)
+    WT_GCC_FUNC_ATTRIBUTE((visibility("default")))
+{
+	WT_DECL_RET;
+
+	if ((ret = vsnprintf(buf, size, fmt, ap)) >= 0) {
+		*retsizep += (size_t)ret;
+		return (0);
+	}
+	return (__wt_errno());
+}
diff --git a/src/os_posix/os_thread.c b/src/os_posix/os_thread.c
index 9bf36cc2686..85d43f10a33 100644
--- a/src/os_posix/os_thread.c
+++ b/src/os_posix/os_thread.c
@@ -45,7 +45,7 @@ __wt_thread_join(WT_SESSION_IMPL *session, wt_thread_t tid)
  * __wt_thread_id --
  *	Fill in a printable version of the process and thread IDs.
  */
-void
+int
 __wt_thread_id(char *buf, size_t buflen)
     WT_GCC_FUNC_ATTRIBUTE((visibility("default")))
 {
@@ -57,10 +57,10 @@ __wt_thread_id(char *buf, size_t buflen)
 	 */
 	self = pthread_self();
 #ifdef __sun
-	(void)snprintf(buf, buflen,
-	    "%" PRIuMAX ":%u", (uintmax_t)getpid(), self);
+	return (__wt_snprintf(buf, buflen,
+	    "%" PRIuMAX ":%u", (uintmax_t)getpid(), self));
 #else
-	(void)snprintf(buf, buflen,
-	    "%" PRIuMAX ":%p", (uintmax_t)getpid(), (void *)self);
+	return (__wt_snprintf(buf, buflen,
+	    "%" PRIuMAX ":%p", (uintmax_t)getpid(), (void *)self));
 #endif
 }
diff --git a/src/os_win/os_snprintf.c b/src/os_win/os_snprintf.c
index a6056ff9342..f3025b12a60 100644
--- a/src/os_win/os_snprintf.c
+++ b/src/os_win/os_snprintf.c
@@ -8,17 +8,47 @@
 
 #include "wt_internal.h"
 
-_Check_return_opt_ int __cdecl _wt_snprintf(
-    _Out_writes_(_MaxCount) char * _DstBuf,
-    _In_ size_t _MaxCount,
-    _In_z_ _Printf_format_string_ const char * _Format, ...)
+/*
+ * __wt_vsnprintf_len_incr --
+ *	POSIX vsnprintf convenience function, incrementing the returned size.
+ */
+int
+__wt_vsnprintf_len_incr(
+    char *buf, size_t size, size_t *retsizep, const char *fmt, va_list ap)
 {
-	va_list args;
-	WT_DECL_RET;
+	int len;
+
+	/*
+	 * WiredTiger calls with length 0 to get the needed buffer size. Call
+	 * the count only version in this case, _vsnprintf_s will invoke the
+	 * invalid parameter handler if count is less than or equal to zero.
+	 */
+	if (size == 0) {
+		*retsizep += (size_t)_vscprintf(fmt, ap);
+		return (0);
+	}
+
+	/*
+	 * Additionally, the invalid parameter handler is invoked if buffer or
+	 * format is a NULL pointer.
+	 */
+	if (buf == NULL || fmt == NULL)
+		return (EINVAL);
+
+	/*
+	 * If the storage required to store the data and a terminating null
+	 * exceeds size, the invalid parameter handler is invoked, unless
+	 * count is _TRUNCATE, in which case as much of the string as will
+	 * fit in the buffer is written and -1 returned.
+	 */
+	if ((len = _vsnprintf_s(buf, size, _TRUNCATE, fmt, ap)) >= 0) {
+		*retsizep += (size_t)len;
+		return (0);
+	}
 
-	va_start(args, _Format);
-	ret = _wt_vsnprintf(_DstBuf, _MaxCount, _Format, args);
-	va_end(args);
+	/* Return the buffer size required. */
+	if (len == -1)
+		*retsizep += (size_t)_vscprintf(fmt, ap);
 
-	return (ret);
+	return (0);
 }
diff --git a/src/os_win/os_thread.c b/src/os_win/os_thread.c
index a34dff776b6..7442fb08a36 100644
--- a/src/os_win/os_thread.c
+++ b/src/os_win/os_thread.c
@@ -58,10 +58,10 @@ __wt_thread_join(WT_SESSION_IMPL *session, wt_thread_t tid)
  * __wt_thread_id --
  *	Fill in a printable version of the process and thread IDs.
  */
-void
+int
 __wt_thread_id(char *buf, size_t buflen)
 {
-	(void)snprintf(buf, buflen,
+	return (__wt_snprintf(buf, buflen,
 	    "%" PRIu64 ":%" PRIu64,
-	    (uint64_t)GetCurrentProcessId(), (uint64_t)GetCurrentThreadId);
+	    (uint64_t)GetCurrentProcessId(), (uint64_t)GetCurrentThreadId));
 }
diff --git a/src/os_win/os_vsnprintf.c b/src/os_win/os_vsnprintf.c
deleted file mode 100644
index 63f96e79d5b..00000000000
--- a/src/os_win/os_vsnprintf.c
+++ /dev/null
@@ -1,41 +0,0 @@
-/*-
- * Copyright (c) 2014-2016 MongoDB, Inc.
- * Copyright (c) 2008-2014 WiredTiger, Inc.
- *	All rights reserved.
- *
- * See the file LICENSE for redistribution information.
- */
-
-#include "wt_internal.h"
-
-_Check_return_opt_ int __cdecl _wt_vsnprintf(
-    _Out_writes_(_MaxCount) char * _DstBuf,
-    _In_ size_t _MaxCount,
-    _In_z_ _Printf_format_string_ const char * _Format,
-    va_list _ArgList)
-{
-	int len;
-
-	/*
-	 * WiredTiger will call with length 0 to get the needed buffer size
-	 * We call the count only version in this case since vsnprintf_s assumes
-	 * length is greater than zero or else it triggers the invalid_parameter
-	 * handler.
-	 */
-	if (_MaxCount == 0) {
-		return _vscprintf(_Format, _ArgList);
-	}
-
-	len = (size_t)_vsnprintf_s(
-		_DstBuf, _MaxCount, _TRUNCATE, _Format, _ArgList);
-
-	/*
-	 * The MSVC implementation returns -1 on truncation instead of what
-	 * it would have written.  We could let callers iteratively grow the
-	 * buffer, or just ask us how big a buffer they would like.
-	 */
-	if (len == -1)
-		len = _vscprintf(_Format, _ArgList) + 1;
-
-	return (len);
-}
diff --git a/src/schema/schema_create.c b/src/schema/schema_create.c
index a77ca51f9d2..0677fa711a5 100644
--- a/src/schema/schema_create.c
+++ b/src/schema/schema_create.c
@@ -601,7 +601,8 @@ __create_table(WT_SESSION_IMPL *session,
 		if (ncolgroups == 0) {
 			cgsize = strlen("colgroup:") + strlen(tablename) + 1;
 			WT_ERR(__wt_calloc_def(session, cgsize, &cgname));
-			snprintf(cgname, cgsize, "colgroup:%s", tablename);
+			WT_ERR(__wt_snprintf(
+			    cgname, cgsize, "colgroup:%s", tablename));
 			WT_ERR(__create_colgroup(
 			    session, cgname, exclusive, config));
 		}
diff --git a/src/support/err.c b/src/support/err.c
index 369997d38c0..57efde72b23 100644
--- a/src/support/err.c
+++ b/src/support/err.c
@@ -102,9 +102,10 @@ __handler_failure(WT_SESSION_IMPL *session,
 	 */
 	char s[256];
 
-	(void)snprintf(s, sizeof(s),
+	if (__wt_snprintf(s, sizeof(s),
 	    "application %s event handler failed: %s",
-	    which, __wt_strerror(session, error, NULL, 0));
+	    which, __wt_strerror(session, error, NULL, 0)) != 0)
+		return;
 
 	/*
 	 * Use the error handler to report the failure, unless it was the error
@@ -148,6 +149,23 @@ __wt_event_handler_set(WT_SESSION_IMPL *session, WT_EVENT_HANDLER *handler)
 	session->event_handler = handler;
 }
 
+#define	WT_ERROR_APPEND(p, remain, ...) do {				\
+	size_t __len;							\
+	WT_ERR(__wt_snprintf_len_set(p, remain, &__len, __VA_ARGS__));	\
+	if (__len > remain)						\
+		__len = remain;						\
+	p += __len;							\
+	remain -= __len;						\
+} while (0)
+#define	WT_ERROR_APPEND_AP(p, remain, ...) do {				\
+	size_t __len;							\
+	WT_ERR(__wt_vsnprintf_len_set(p, remain, &__len, __VA_ARGS__));	\
+	if (__len > remain)						\
+		__len = remain;						\
+	p += __len;							\
+	remain -= __len;						\
+} while (0)
+
 /*
  * __wt_eventv --
  * 	Report a message to an event handler.
@@ -161,9 +179,9 @@ __wt_eventv(WT_SESSION_IMPL *session, bool msg_event, int error,
 	WT_DECL_RET;
 	WT_SESSION *wt_session;
 	struct timespec ts;
-	size_t len, remain, wlen;
+	size_t len, remain;
 	const char *err, *prefix;
-	char *end, *p, tid[128];
+	char *p, tid[128];
 
 	/*
 	 * We're using a stack buffer because we want error messages no matter
@@ -174,6 +192,8 @@ __wt_eventv(WT_SESSION_IMPL *session, bool msg_event, int error,
 	 * Buffer placed at the end of the stack in case snprintf overflows.
 	 */
 	char s[2048];
+	p = s;
+	remain = sizeof(s);
 
 	/*
 	 * !!!
@@ -185,24 +205,8 @@ __wt_eventv(WT_SESSION_IMPL *session, bool msg_event, int error,
 	 * first session, but if the allocation of the first session fails, for
 	 * example, we can end up here without a session.)
 	 */
-	if (session == NULL) {
-		if (fprintf(stderr,
-		    "WiredTiger Error%s%s: ",
-		    error == 0 ? "" : ": ",
-		    error == 0 ? "" :
-		    __wt_strerror(session, error, NULL, 0)) < 0)
-			ret = EIO;
-		if (vfprintf(stderr, fmt, ap) < 0)
-			ret = EIO;
-		if (fprintf(stderr, "\n") < 0)
-			ret = EIO;
-		if (fflush(stderr) != 0)
-			ret = EIO;
-		return (ret);
-	}
-
-	p = s;
-	end = s + sizeof(s);
+	if (session == NULL)
+		goto err;
 
 	/*
 	 * We have several prefixes for the error message: a timestamp and the
@@ -211,42 +215,24 @@ __wt_eventv(WT_SESSION_IMPL *session, bool msg_event, int error,
 	 * followed by a colon.
 	 */
 	__wt_epoch(session, &ts);
-	__wt_thread_id(tid, sizeof(tid));
-	remain = WT_PTRDIFF(end, p);
-	wlen = (size_t)snprintf(p, remain, "[%" PRIuMAX ":%" PRIuMAX "][%s]",
+	WT_ERR(__wt_thread_id(tid, sizeof(tid)));
+	WT_ERROR_APPEND(p, remain,
+	    "[%" PRIuMAX ":%" PRIuMAX "][%s]",
 	    (uintmax_t)ts.tv_sec, (uintmax_t)ts.tv_nsec / WT_THOUSAND, tid);
-	p = wlen >= remain ? end : p + wlen;
 
-	if ((prefix = S2C(session)->error_prefix) != NULL) {
-		remain = WT_PTRDIFF(end, p);
-		wlen = (size_t)snprintf(p, remain, ", %s", prefix);
-		p = wlen >= remain ? end : p + wlen;
-	}
+	if ((prefix = S2C(session)->error_prefix) != NULL)
+		WT_ERROR_APPEND(p, remain, ", %s", prefix);
 	prefix = session->dhandle == NULL ? NULL : session->dhandle->name;
-	if (prefix != NULL) {
-		remain = WT_PTRDIFF(end, p);
-		wlen = (size_t)snprintf(p, remain, ", %s", prefix);
-		p = wlen >= remain ? end : p + wlen;
-	}
-	if ((prefix = session->name) != NULL) {
-		remain = WT_PTRDIFF(end, p);
-		wlen = (size_t)snprintf(p, remain, ", %s", prefix);
-		p = wlen >= remain ? end : p + wlen;
-	}
-	remain = WT_PTRDIFF(end, p);
-	wlen = (size_t)snprintf(p, remain, ": ");
-	p = wlen >= remain ? end : p + wlen;
-
-	if (file_name != NULL) {
-		remain = WT_PTRDIFF(end, p);
-		wlen = (size_t)
-		    snprintf(p, remain, "%s, %d: ", file_name, line_number);
-		p = wlen >= remain ? end : p + wlen;
-	}
+	if (prefix != NULL)
+		WT_ERROR_APPEND(p, remain, ", %s", prefix);
+	if ((prefix = session->name) != NULL)
+		WT_ERROR_APPEND(p, remain, ", %s", prefix);
+	WT_ERROR_APPEND(p, remain, ": ");
+
+	if (file_name != NULL)
+		WT_ERROR_APPEND(p, remain, "%s, %d: ", file_name, line_number);
 
-	remain = WT_PTRDIFF(end, p);
-	wlen = (size_t)vsnprintf(p, remain, fmt, ap);
-	p = wlen >= remain ? end : p + wlen;
+	WT_ERROR_APPEND_AP(p, remain, fmt, ap);
 
 	if (error != 0) {
 		/*
@@ -261,10 +247,8 @@ __wt_eventv(WT_SESSION_IMPL *session, bool msg_event, int error,
 		 */
 		err = __wt_strerror(session, error, NULL, 0);
 		len = strlen(err);
-		if (WT_PTRDIFF(p, s) < len || strcmp(p - len, err) != 0) {
-			remain = WT_PTRDIFF(end, p);
-			(void)snprintf(p, remain, ": %s", err);
-		}
+		if (WT_PTRDIFF(p, s) < len || strcmp(p - len, err) != 0)
+			WT_ERROR_APPEND(p, remain, ": %s", err);
 	}
 
 	/*
@@ -279,7 +263,7 @@ __wt_eventv(WT_SESSION_IMPL *session, bool msg_event, int error,
 	 *
 	 * If an application-specified error message handler fails, complain
 	 * using the default error handler.  If the default error handler fails,
-	 * there's nothing to do.
+	 * fallback to stderr.
 	 */
 	wt_session = (WT_SESSION *)session;
 	handler = session->event_handler;
@@ -293,6 +277,21 @@ __wt_eventv(WT_SESSION_IMPL *session, bool msg_event, int error,
 			__handler_failure(session, ret, "error", true);
 	}
 
+	if (ret != 0) {
+err:		if (fprintf(stderr,
+		    "WiredTiger Error%s%s: ",
+		    error == 0 ? "" : ": ",
+		    error == 0 ? "" :
+		    __wt_strerror(session, error, NULL, 0)) < 0)
+			WT_TRET(EIO);
+		if (vfprintf(stderr, fmt, ap) < 0)
+			WT_TRET(EIO);
+		if (fprintf(stderr, "\n") < 0)
+			WT_TRET(EIO);
+		if (fflush(stderr) != 0)
+			WT_TRET(EIO);
+	}
+
 	return (ret);
 }
 
@@ -376,7 +375,7 @@ info_msg(WT_SESSION_IMPL *session, const char *fmt, va_list ap)
 	 */
 	char s[2048];
 
-	(void)vsnprintf(s, sizeof(s), fmt, ap);
+	WT_RET(__wt_vsnprintf(s, sizeof(s), fmt, ap));
 
 	wt_session = (WT_SESSION *)session;
 	handler = session->event_handler;
diff --git a/src/support/scratch.c b/src/support/scratch.c
index 69987ebc852..485cea90e89 100644
--- a/src/support/scratch.c
+++ b/src/support/scratch.c
@@ -69,13 +69,16 @@ int
 __wt_buf_fmt(WT_SESSION_IMPL *session, WT_ITEM *buf, const char *fmt, ...)
     WT_GCC_FUNC_ATTRIBUTE((format (printf, 3, 4)))
 {
+	WT_DECL_RET;
 	va_list ap;
 	size_t len;
 
 	for (;;) {
 		va_start(ap, fmt);
-		len = (size_t)vsnprintf(buf->mem, buf->memsize, fmt, ap);
+		ret = __wt_vsnprintf_len_set(
+		    buf->mem, buf->memsize, &len, fmt, ap);
 		va_end(ap);
+		WT_RET(ret);
 
 		/* Check if there was enough space. */
 		if (len < buf->memsize) {
@@ -100,6 +103,7 @@ int
 __wt_buf_catfmt(WT_SESSION_IMPL *session, WT_ITEM *buf, const char *fmt, ...)
     WT_GCC_FUNC_ATTRIBUTE((format (printf, 3, 4)))
 {
+	WT_DECL_RET;
 	va_list ap;
 	size_t len, space;
 	char *p;
@@ -117,8 +121,9 @@ __wt_buf_catfmt(WT_SESSION_IMPL *session, WT_ITEM *buf, const char *fmt, ...)
 		p = (char *)((uint8_t *)buf->mem + buf->size);
 		WT_ASSERT(session, buf->memsize >= buf->size);
 		space = buf->memsize - buf->size;
-		len = (size_t)vsnprintf(p, space, fmt, ap);
+		ret = __wt_vsnprintf_len_set(p, space, &len, fmt, ap);
 		va_end(ap);
+		WT_RET(ret);
 
 		/* Check if there was enough space. */
 		if (len < space) {
diff --git a/src/utilities/util_backup.c b/src/utilities/util_backup.c
index 5dc9671fb45..f1b31f7621a 100644
--- a/src/utilities/util_backup.c
+++ b/src/utilities/util_backup.c
@@ -109,9 +109,14 @@ copy(WT_SESSION *session, const char *directory, const char *name)
 
 	/* Build the target pathname. */
 	len = strlen(directory) + strlen(name) + 2;
-	if ((to = malloc(len)) == NULL)
-		goto memerr;
-	(void)snprintf(to, len, "%s/%s", directory, name);
+	if ((to = malloc(len)) == NULL) {
+		fprintf(stderr, "%s: %s\n", progname, strerror(errno));
+		return (1);
+	}
+	if ((ret = __wt_snprintf(to, len, "%s/%s", directory, name)) != 0) {
+		fprintf(stderr, "%s: %s\n", progname, strerror(ret));
+		goto err;
+	}
 
 	if (verbose && printf("Backing up %s/%s to %s\n", home, name, to) < 0) {
 		fprintf(stderr, "%s: %s\n", progname, strerror(EIO));
@@ -126,11 +131,7 @@ copy(WT_SESSION *session, const char *directory, const char *name)
 		fprintf(stderr, "%s/%s to %s: backup copy: %s\n",
 		    home, name, to, session->strerror(session, ret));
 
-	if (0) {
-memerr:		fprintf(stderr, "%s: %s\n", progname, strerror(errno));
-	}
 err:	free(to);
-
 	return (ret);
 }
 
diff --git a/src/utilities/util_dump.c b/src/utilities/util_dump.c
index 947fa7bf9ef..238e2757099 100644
--- a/src/utilities/util_dump.c
+++ b/src/utilities/util_dump.c
@@ -259,14 +259,15 @@ dump_add_config(WT_SESSION *session, char **bufp, size_t *leftp,
     const char *fmt, ...)
 	WT_GCC_FUNC_ATTRIBUTE((format (printf, 4, 5)))
 {
-	int n;
+	WT_DECL_RET;
+	size_t n;
 	va_list ap;
 
 	va_start(ap, fmt);
-	n = vsnprintf(*bufp, *leftp, fmt, ap);
+	ret = __wt_vsnprintf_len_set(*bufp, *leftp, &n, fmt, ap);
 	va_end(ap);
-	if (n < 0)
-		return (util_err(session, EINVAL, NULL));
+	if (ret != 0)
+		return (util_err(session, ret, NULL));
 	*bufp += n;
 	*leftp -= (size_t)n;
 	return (0);
@@ -435,9 +436,9 @@ dump_table_parts_config(WT_SESSION *session, WT_CURSOR *cursor,
 
 	len = strlen(entry) + strlen(name) + 1;
 	if ((uriprefix = malloc(len)) == NULL)
-		return util_err(session, errno, NULL);
-
-	snprintf(uriprefix, len, "%s%s", entry, name);
+		return (util_err(session, errno, NULL));
+	if ((ret = __wt_snprintf(uriprefix, len, "%s%s", entry, name)) != 0)
+		return (util_err(session, ret, NULL));
 
 	/*
 	 * Search the file looking for column group and index key/value pairs:
diff --git a/src/utilities/util_load.c b/src/utilities/util_load.c
index d31fa4c9d08..d2f00402217 100644
--- a/src/utilities/util_load.c
+++ b/src/utilities/util_load.c
@@ -120,10 +120,12 @@ load_dump(WT_SESSION *session)
 		goto err;
 
 	/* Open the insert cursor. */
-	(void)snprintf(config, sizeof(config),
+	if ((ret = __wt_snprintf(config, sizeof(config),
 	    "dump=%s%s%s",
 	    hex ? "hex" : "print",
-	    append ? ",append" : "", no_overwrite ? ",overwrite=false" : "");
+	    append ? ",append" : "",
+	    no_overwrite ? ",overwrite=false" : "")) != 0)
+		return (util_err(session, ret, NULL));
 	if ((ret = session->open_cursor(
 	    session, uri, NULL, config, &cursor)) != 0) {
 		ret = util_err(session, ret, "%s: session.open_cursor", uri);
@@ -472,6 +474,7 @@ config_update(WT_SESSION *session, char **list)
 static int
 config_rename(WT_SESSION *session, char **urip, const char *name)
 {
+	WT_DECL_RET;
 	size_t len;
 	char *buf, *p;
 
@@ -490,7 +493,9 @@ config_rename(WT_SESSION *session, char **urip, const char *name)
 	}
 	*p = '\0';
 	p = strchr(p + 1, ':');
-	snprintf(buf, len, "%s:%s%s", *urip, name, p == NULL ? "" : p);
+	if ((ret = __wt_snprintf(
+	    buf, len, "%s:%s%s", *urip, name, p == NULL ? "" : p)) != 0)
+		return (util_err(session, ret, NULL));
 	*urip = buf;
 
 	return (0);
diff --git a/src/utilities/util_load_json.c b/src/utilities/util_load_json.c
index 1189d49a483..af5c2576b26 100644
--- a/src/utilities/util_load_json.c
+++ b/src/utilities/util_load_json.c
@@ -145,6 +145,7 @@ static int
 json_kvraw_append(WT_SESSION *session,
     JSON_INPUT_STATE *ins, const char *str, size_t len)
 {
+	WT_DECL_RET;
 	size_t needsize;
 	char *tmp;
 
@@ -152,7 +153,9 @@ json_kvraw_append(WT_SESSION *session,
 		needsize = strlen(ins->kvraw) + len + 2;
 		if ((tmp = malloc(needsize)) == NULL)
 			return (util_err(session, errno, NULL));
-		snprintf(tmp, needsize, "%s %.*s", ins->kvraw, (int)len, str);
+		if ((ret = __wt_snprintf(
+		    tmp, needsize, "%s %.*s", ins->kvraw, (int)len, str)) != 0)
+			return (util_err(session, ret, NULL));
 		free(ins->kvraw);
 		ins->kvraw = tmp;
 	}
@@ -181,7 +184,7 @@ json_strdup(WT_SESSION *session, JSON_INPUT_STATE *ins, char **resultp)
 		goto err;
 	}
 	resultlen += 1;
-	if ((result = (char *)malloc((size_t)resultlen)) == NULL) {
+	if ((result = malloc((size_t)resultlen)) == NULL) {
 		ret = util_err(session, errno, NULL);
 		goto err;
 	}
@@ -236,10 +239,13 @@ json_data(WT_SESSION *session,
 		goto err;
 
 	uri = clp->list[0];
-	(void)snprintf(config, sizeof(config),
+	if ((ret = __wt_snprintf(config, sizeof(config),
 	    "dump=json%s%s",
 	    LF_ISSET(LOAD_JSON_APPEND) ? ",append" : "",
-	    LF_ISSET(LOAD_JSON_NO_OVERWRITE) ? ",overwrite=false" : "");
+	    LF_ISSET(LOAD_JSON_NO_OVERWRITE) ? ",overwrite=false" : "")) != 0) {
+		ret = util_err(session, ret, NULL);
+		goto err;
+	}
 	if ((ret = session->open_cursor(
 	    session, uri, NULL, config, &cursor)) != 0) {
 		ret = util_err(session, ret, "%s: session.open_cursor", uri);
@@ -256,7 +262,7 @@ json_data(WT_SESSION *session,
 		nfield = 0;
 		JSON_EXPECT(session, ins, '{');
 		if (ins->kvraw == NULL) {
-			if ((ins->kvraw = (char *)malloc(1)) == NULL) {
+			if ((ins->kvraw = malloc(1)) == NULL) {
 				ret = util_err(session, errno, NULL);
 				goto err;
 			}
@@ -358,8 +364,11 @@ json_top_level(WT_SESSION *session, JSON_INPUT_STATE *ins, uint32_t flags)
 	while (json_peek(session, ins) == 's') {
 		JSON_EXPECT(session, ins, 's');
 		tableuri = realloc(tableuri, ins->toklen);
-		snprintf(tableuri, ins->toklen, "%.*s",
-		    (int)(ins->toklen - 2), ins->tokstart + 1);
+		if ((ret = __wt_snprintf(tableuri, ins->toklen,
+		    "%.*s", (int)(ins->toklen - 2), ins->tokstart + 1)) != 0) {
+			ret = util_err(session, ret, NULL);
+			goto err;
+		}
 		JSON_EXPECT(session, ins, ':');
 		if (!hasversion) {
 			if (strcmp(tableuri, DUMP_JSON_VERSION_MARKER) != 0) {
diff --git a/src/utilities/util_main.c b/src/utilities/util_main.c
index 68e3b0f1bc5..2b4ef36081a 100644
--- a/src/utilities/util_main.c
+++ b/src/utilities/util_main.c
@@ -257,9 +257,13 @@ main(int argc, char *argv[])
 		(void)util_err(NULL, errno, NULL);
 		goto err;
 	}
-	(void)snprintf(p, len, "%s,%s,%s%s%s%s",
+	if ((ret = __wt_snprintf(p, len, "%s,%s,%s%s%s%s",
 	    config == NULL ? "" : config,
-	    cmd_config == NULL ? "" : cmd_config, rec_config, p1, p2, p3);
+	    cmd_config == NULL ? "" : cmd_config,
+	    rec_config, p1, p2, p3)) != 0) {
+		(void)util_err(NULL, ret, NULL);
+		goto err;
+	}
 	config = p;
 
 	/* Open the database and a session. */
@@ -298,6 +302,7 @@ done:
 char *
 util_uri(WT_SESSION *session, const char *s, const char *type)
 {
+	WT_DECL_RET;
 	size_t len;
 	char *name;
 
@@ -321,8 +326,12 @@ util_uri(WT_SESSION *session, const char *s, const char *type)
 	 * the default type for the operation.
 	 */
 	if (strchr(s, ':') != NULL)
-		snprintf(name, len, "%s", s);
+		ret = __wt_snprintf(name, len, "%s", s);
 	else
-		snprintf(name, len, "%s:%s", type, s);
+		ret = __wt_snprintf(name, len, "%s:%s", type, s);
+	if (ret != 0) {
+		(void)util_err(session, ret, NULL);
+		return (NULL);
+	}
 	return (name);
 }
diff --git a/src/utilities/util_misc.c b/src/utilities/util_misc.c
index 0905bfa97be..e26185a0096 100644
--- a/src/utilities/util_misc.c
+++ b/src/utilities/util_misc.c
@@ -140,7 +140,10 @@ util_flush(WT_SESSION *session, const char *uri)
 	if ((buf = malloc(len)) == NULL)
 		return (util_err(session, errno, NULL));
 
-	(void)snprintf(buf, len, "target=(\"%s\")", uri);
+	if ((ret = __wt_snprintf(buf, len, "target=(\"%s\")", uri)) != 0) {
+		free(buf);
+		return (util_err(session, ret, NULL));
+	}
 	ret = session->checkpoint(session, buf);
 	free(buf);
 
diff --git a/src/utilities/util_stat.c b/src/utilities/util_stat.c
index 1b75d9ea8bf..0692afe2819 100644
--- a/src/utilities/util_stat.c
+++ b/src/utilities/util_stat.c
@@ -68,7 +68,10 @@ util_stat(WT_SESSION *session, int argc, char *argv[])
 		fprintf(stderr, "%s: %s\n", progname, strerror(errno));
 		goto err;
 	}
-	snprintf(uri, urilen, "statistics:%s", objname);
+	if ((ret = __wt_snprintf(uri, urilen, "statistics:%s", objname)) != 0) {
+		fprintf(stderr, "%s: %s\n", progname, strerror(ret));
+		goto err;
+	}
 
 	if ((ret =
 	    session->open_cursor(session, uri, NULL, config, &cursor)) != 0) {
diff --git a/src/utilities/util_verify.c b/src/utilities/util_verify.c
index d0587fcfc8c..ace1be7a5de 100644
--- a/src/utilities/util_verify.c
+++ b/src/utilities/util_verify.c
@@ -72,7 +72,7 @@ util_verify(WT_SESSION *session, int argc, char *argv[])
 			ret = util_err(session, errno, NULL);
 			goto err;
 		}
-		snprintf(config, size,
+		if ((ret = __wt_snprintf(config, size,
 		    "%s%s%s%s%s%s%s",
 		    dump_address ? "dump_address," : "",
 		    dump_blocks ? "dump_blocks," : "",
@@ -80,7 +80,10 @@ util_verify(WT_SESSION *session, int argc, char *argv[])
 		    dump_offsets != NULL ? "dump_offsets=[" : "",
 		    dump_offsets != NULL ? dump_offsets : "",
 		    dump_offsets != NULL ? "]," : "",
-		    dump_pages ? "dump_pages," : "");
+		    dump_pages ? "dump_pages," : "")) != 0) {
+			(void)util_err(session, ret, NULL);
+			goto err;
+		}
 	}
 	if ((ret = session->verify(session, uri, config)) != 0)
 		(void)util_err(session, ret, "session.verify: %s", uri);
diff --git a/src/utilities/util_write.c b/src/utilities/util_write.c
index b931fad064d..1d3e6937f8d 100644
--- a/src/utilities/util_write.c
+++ b/src/utilities/util_write.c
@@ -54,8 +54,12 @@ util_write(WT_SESSION *session, int argc, char *argv[])
 	 * Open the object; free allocated memory immediately to simplify
 	 * future error handling.
 	 */
-	(void)snprintf(config, sizeof(config), "%s,%s",
-	    append ? "append=true" : "", overwrite ? "overwrite=true" : "");
+	if ((ret = __wt_snprintf(config, sizeof(config), "%s,%s",
+	    append ? "append=true" : "",
+	    overwrite ? "overwrite=true" : "")) != 0) {
+		free(uri);
+		return (util_err(session, ret, NULL));
+	}
 	if ((ret =
 	    session->open_cursor(session, uri, NULL, config, &cursor)) != 0)
 		(void)util_err(session, ret, "%s: session.open_cursor", uri);
diff --git a/test/bloom/test_bloom.c b/test/bloom/test_bloom.c
index bef509e01d8..b6299bbbadc 100644
--- a/test/bloom/test_bloom.c
+++ b/test/bloom/test_bloom.c
@@ -121,9 +121,9 @@ setup(void)
 	 * Open configuration -- put command line configuration options at the
 	 * end so they can override "standard" configuration.
 	 */
-	snprintf(config, sizeof(config),
+	testutil_check(__wt_snprintf(config, sizeof(config),
 	    "create,error_prefix=\"%s\",cache_size=%" PRIu32 "MB,%s",
-	    progname, g.c_cache, g.config_open == NULL ? "" : g.config_open);
+	    progname, g.c_cache, g.config_open == NULL ? "" : g.config_open));
 
 	testutil_check(wiredtiger_open(NULL, NULL, config, &conn));
 
diff --git a/test/checkpoint/checkpointer.c b/test/checkpoint/checkpointer.c
index ef49a9492ce..84d2765843a 100644
--- a/test/checkpoint/checkpointer.c
+++ b/test/checkpoint/checkpointer.c
@@ -74,7 +74,7 @@ checkpointer(void *arg)
 
 	WT_UNUSED(arg);
 
-	__wt_thread_id(tid, sizeof(tid));
+	testutil_check(__wt_thread_id(tid, sizeof(tid)));
 	printf("checkpointer thread starting: tid: %s\n", tid);
 
 	(void)real_checkpointer();
@@ -107,8 +107,9 @@ real_checkpointer(void)
 	    "WiredTigerCheckpoint", strlen("WiredTigerCheckpoint")) == 0)
 		checkpoint_config = NULL;
 	else {
+		testutil_check(__wt_snprintf(
+		    _buf, sizeof(_buf), "name=%s", g.checkpoint_name));
 		checkpoint_config = _buf;
-		snprintf(checkpoint_config, 128, "name=%s", g.checkpoint_name);
 	}
 	while (g.running) {
 		/* Execute a checkpoint */
@@ -147,7 +148,8 @@ verify_checkpoint(WT_SESSION *session)
 
 	ret = t_ret = 0;
 	key_count = 0;
-	snprintf(ckpt, 128, "checkpoint=%s", g.checkpoint_name);
+	testutil_check(__wt_snprintf(
+	    ckpt, sizeof(ckpt), "checkpoint=%s", g.checkpoint_name));
 	cursors = calloc((size_t)g.ntables, sizeof(*cursors));
 	if (cursors == NULL)
 		return (log_print_err("verify_checkpoint", ENOMEM, 1));
@@ -159,7 +161,8 @@ verify_checkpoint(WT_SESSION *session)
 		 */
 		if (g.cookies[i].type == LSM)
 			continue;
-		snprintf(next_uri, 128, "table:__wt%04d", i);
+		testutil_check(__wt_snprintf(
+		    next_uri, sizeof(next_uri), "table:__wt%04d", i));
 		if ((ret = session->open_cursor(
 		    session, next_uri, NULL, ckpt, &cursors[i])) != 0) {
 			(void)log_print_err(
@@ -296,7 +299,8 @@ diagnose_key_error(
 	session = cursor1->session;
 	key1_orig = key2_orig = 0;
 
-	snprintf(ckpt, 128, "checkpoint=%s", g.checkpoint_name);
+	testutil_check(__wt_snprintf(
+	    ckpt, sizeof(ckpt), "checkpoint=%s", g.checkpoint_name));
 
 	/* Save the failed keys. */
 	if (cursor1->get_key(cursor1, &key1_orig) != 0 ||
@@ -338,7 +342,8 @@ diagnose_key_error(
 	 * Now try opening new cursors on the checkpoints and see if we
 	 * get the same missing key via searching.
 	 */
-	snprintf(next_uri, 128, "table:__wt%04d", index1);
+	testutil_check(__wt_snprintf(
+	    next_uri, sizeof(next_uri), "table:__wt%04d", index1));
 	if (session->open_cursor(session, next_uri, NULL, ckpt, &c) != 0)
 		return (1);
 	c->set_key(c, key1_orig);
@@ -350,7 +355,8 @@ diagnose_key_error(
 	if (c->close(c) != 0)
 		return (1);
 
-	snprintf(next_uri, 128, "table:__wt%04d", index2);
+	testutil_check(__wt_snprintf(
+	    next_uri, sizeof(next_uri), "table:__wt%04d", index2));
 	if (session->open_cursor(session, next_uri, NULL, ckpt, &c) != 0)
 		return (1);
 	c->set_key(c, key1_orig);
@@ -367,7 +373,8 @@ live_check:
 	 * Now try opening cursors on the live checkpoint to see if we get the
 	 * same missing key via searching.
 	 */
-	snprintf(next_uri, 128, "table:__wt%04d", index1);
+	testutil_check(__wt_snprintf(
+	    next_uri, sizeof(next_uri), "table:__wt%04d", index1));
 	if (session->open_cursor(session, next_uri, NULL, NULL, &c) != 0)
 		return (1);
 	c->set_key(c, key1_orig);
@@ -376,7 +383,8 @@ live_check:
 	if (c->close(c) != 0)
 		return (1);
 
-	snprintf(next_uri, 128, "table:__wt%04d", index2);
+	testutil_check(__wt_snprintf(
+	    next_uri, sizeof(next_uri), "table:__wt%04d", index2));
 	if (session->open_cursor(session, next_uri, NULL, NULL, &c) != 0)
 		return (1);
 	c->set_key(c, key2_orig);
diff --git a/test/checkpoint/test_checkpoint.c b/test/checkpoint/test_checkpoint.c
index c7132b433d2..e7e1a0b81a5 100644
--- a/test/checkpoint/test_checkpoint.c
+++ b/test/checkpoint/test_checkpoint.c
@@ -199,11 +199,11 @@ wt_connect(const char *config_open)
 
 	testutil_make_work_dir(g.home);
 
-	snprintf(config, sizeof(config),
+	testutil_check(__wt_snprintf(config, sizeof(config),
 	    "create,statistics=(fast),error_prefix=\"%s\",cache_size=1GB%s%s",
 	    progname,
 	    config_open == NULL ? "" : ",",
-	    config_open == NULL ? "" : config_open);
+	    config_open == NULL ? "" : config_open));
 
 	if ((ret = wiredtiger_open(
 	    g.home, &event_handler, config, &g.conn)) != 0)
diff --git a/test/checkpoint/workers.c b/test/checkpoint/workers.c
index e4fe7bd1b29..82d1b8685c4 100644
--- a/test/checkpoint/workers.c
+++ b/test/checkpoint/workers.c
@@ -39,14 +39,12 @@ static int
 create_table(WT_SESSION *session, COOKIE *cookie)
 {
 	int ret;
-	char *p, *end, config[128];
+	char config[128];
 
-	p = config;
-	end = config + sizeof(config);
-	p += snprintf(p, (size_t)(end - p),
-	    "key_format=%s,value_format=S", cookie->type == COL ? "r" : "q");
-	if (cookie->type == LSM)
-		(void)snprintf(p, (size_t)(end - p), ",type=lsm");
+	testutil_check(__wt_snprintf(config, sizeof(config),
+	    "key_format=%s,value_format=S,%s",
+	    cookie->type == COL ? "r" : "q",
+	    cookie->type == LSM ? ",type=lsm" : ""));
 
 	if ((ret = session->create(session, cookie->uri, config)) != 0)
 		if (ret != EEXIST)
@@ -88,8 +86,9 @@ start_workers(table_type type)
 			    (table_type)((i % MAX_TABLE_TYPE) + 1);
 		else
 			g.cookies[i].type = type;
-		(void)snprintf(g.cookies[i].uri, 128,
-		    "%s%04d", URI_BASE, g.cookies[i].id);
+		testutil_check(__wt_snprintf(
+		    g.cookies[i].uri, sizeof(g.cookies[i].uri),
+		    "%s%04d", URI_BASE, g.cookies[i].id));
 
 		/* Should probably be atomic to avoid races. */
 		if ((ret = create_table(session, &g.cookies[i])) != 0)
@@ -132,7 +131,8 @@ worker_op(WT_CURSOR *cursor, uint64_t keyno, u_int new_val)
 	char valuebuf[64];
 
 	cursor->set_key(cursor, keyno);
-	(void)snprintf(valuebuf, sizeof(valuebuf), "%037u", new_val);
+	testutil_check(__wt_snprintf(
+	    valuebuf, sizeof(valuebuf), "%037u", new_val));
 	cursor->set_value(cursor, valuebuf);
 	if ((ret = cursor->insert(cursor)) != 0) {
 		if (ret == WT_ROLLBACK)
@@ -153,7 +153,7 @@ worker(void *arg)
 
 	WT_UNUSED(arg);
 
-	__wt_thread_id(tid, sizeof(tid));
+	testutil_check(__wt_thread_id(tid, sizeof(tid)));
 	printf("worker thread starting: tid: %s\n", tid);
 
 	(void)real_worker();
diff --git a/test/csuite/wt1965_col_efficiency/main.c b/test/csuite/wt1965_col_efficiency/main.c
index a7235d81b31..e5b73d5e642 100644
--- a/test/csuite/wt1965_col_efficiency/main.c
+++ b/test/csuite/wt1965_col_efficiency/main.c
@@ -132,7 +132,8 @@ main(int argc, char *argv[])
 	testutil_check(opts->conn->open_session(
 	    opts->conn, NULL, NULL, &session));
 
-	sprintf(table_format, "key_format=r,value_format=");
+	testutil_check(__wt_snprintf(
+	    table_format, sizeof(table_format), "key_format=r,value_format="));
 	for (i = 0; i < NR_FIELDS; i++)
 		strcat(table_format, "Q");
 
diff --git a/test/csuite/wt2246_col_append/main.c b/test/csuite/wt2246_col_append/main.c
index 976e2269da6..9876582fffa 100644
--- a/test/csuite/wt2246_col_append/main.c
+++ b/test/csuite/wt2246_col_append/main.c
@@ -68,8 +68,8 @@ page_init(uint64_t n)
 		else {
 			if (recno % 3 == 0)
 				++vrecno;
-			snprintf(buf,
-			    sizeof(buf), "%" PRIu64 " VALUE ------", vrecno);
+			testutil_check(__wt_snprintf(buf,
+			    sizeof(buf), "%" PRIu64 " VALUE ------", vrecno));
 			cursor->set_value(cursor, buf);
 		}
 		testutil_check(cursor->insert(cursor));
@@ -112,19 +112,19 @@ main(int argc, char *argv[])
 	testutil_check(testutil_parse_opts(argc, argv, opts));
 	testutil_make_work_dir(opts->home);
 
-	snprintf(buf, sizeof(buf),
+	testutil_check(__wt_snprintf(buf, sizeof(buf),
 	    "create,"
 	    "cache_size=%s,"
 	    "eviction=(threads_max=5),"
 	    "statistics=(fast)",
-	    opts->table_type == TABLE_FIX ? "500MB" : "2GB");
+	    opts->table_type == TABLE_FIX ? "500MB" : "2GB"));
 	testutil_check(wiredtiger_open(opts->home, NULL, buf, &opts->conn));
 	testutil_check(
 	    opts->conn->open_session(opts->conn, NULL, NULL, &session));
-	snprintf(buf, sizeof(buf),
+	testutil_check(__wt_snprintf(buf, sizeof(buf),
 	    "key_format=r,value_format=%s,"
 	    "allocation_size=4K,leaf_page_max=64K",
-	    opts->table_type == TABLE_FIX ? "8t" : "S");
+	    opts->table_type == TABLE_FIX ? "8t" : "S"));
 	testutil_check(session->create(session, opts->uri, buf));
 	testutil_check(session->close(session, NULL));
 
diff --git a/test/csuite/wt2323_join_visibility/main.c b/test/csuite/wt2323_join_visibility/main.c
index a61f707e008..617490fec4d 100644
--- a/test/csuite/wt2323_join_visibility/main.c
+++ b/test/csuite/wt2323_join_visibility/main.c
@@ -106,14 +106,18 @@ main(int argc, char *argv[])
 	tablename = strchr(opts->uri, ':');
 	testutil_assert(tablename != NULL);
 	tablename++;
-	snprintf(sharedopts->posturi, sizeof(sharedopts->posturi),
-	    "index:%s:post", tablename);
-	snprintf(sharedopts->baluri, sizeof(sharedopts->baluri),
-	    "index:%s:bal", tablename);
-	snprintf(sharedopts->flaguri, sizeof(sharedopts->flaguri),
-	    "index:%s:flag", tablename);
-	snprintf(sharedopts->joinuri, sizeof(sharedopts->joinuri),
-	    "join:%s", opts->uri);
+	testutil_check(__wt_snprintf(
+	    sharedopts->posturi, sizeof(sharedopts->posturi),
+	    "index:%s:post", tablename));
+	testutil_check(__wt_snprintf(
+	    sharedopts->baluri, sizeof(sharedopts->baluri),
+	    "index:%s:bal", tablename));
+	testutil_check(__wt_snprintf(
+	    sharedopts->flaguri, sizeof(sharedopts->flaguri),
+	    "index:%s:flag", tablename));
+	testutil_check(__wt_snprintf(
+	    sharedopts->joinuri, sizeof(sharedopts->joinuri),
+	    "join:%s", opts->uri));
 
 	testutil_check(wiredtiger_open(opts->home, NULL,
 	    "create,cache_size=1G", &opts->conn));
@@ -350,19 +354,21 @@ static void *thread_join(void *arg)
 		balcur->set_key(balcur, 0);
 		testutil_check(balcur->search(balcur));
 		if (sharedopts->bloom)
-			sprintf(cfg, "compare=lt,strategy=bloom,count=%d",
-			    N_RECORDS);
+			testutil_check(__wt_snprintf(cfg, sizeof(cfg),
+			    "compare=lt,strategy=bloom,count=%d", N_RECORDS));
 		else
-			sprintf(cfg, "compare=lt");
+			testutil_check(__wt_snprintf(
+			    cfg, sizeof(cfg), "compare=lt"));
 		testutil_check(session->join(session, joincur, balcur, cfg));
 
 		flagcur->set_key(flagcur, 0);
 		testutil_check(flagcur->search(flagcur));
 		if (sharedopts->bloom)
-			sprintf(cfg, "compare=eq,strategy=bloom,count=%d",
-			    N_RECORDS);
+			testutil_check(__wt_snprintf(cfg, sizeof(cfg),
+			    "compare=eq,strategy=bloom,count=%d", N_RECORDS));
 		else
-			sprintf(cfg, "compare=eq");
+			testutil_check(__wt_snprintf(
+			    cfg, sizeof(cfg), "compare=eq"));
 		testutil_check(session->join(session, joincur, flagcur, cfg));
 
 		/* Expect no values returned */
diff --git a/test/csuite/wt2447_join_main_table/main.c b/test/csuite/wt2447_join_main_table/main.c
index 1368e7c8c09..656cea04145 100644
--- a/test/csuite/wt2447_join_main_table/main.c
+++ b/test/csuite/wt2447_join_main_table/main.c
@@ -102,9 +102,12 @@ main(int argc, char *argv[])
 	tablename = strchr(opts->uri, ':');
 	testutil_assert(tablename != NULL);
 	tablename++;
-	snprintf(index1uri, sizeof(index1uri), "index:%s:index1", tablename);
-	snprintf(index2uri, sizeof(index2uri), "index:%s:index2", tablename);
-	snprintf(joinuri, sizeof(joinuri), "join:%s", opts->uri);
+	testutil_check(__wt_snprintf(
+	    index1uri, sizeof(index1uri), "index:%s:index1", tablename));
+	testutil_check(__wt_snprintf(
+	    index2uri, sizeof(index2uri), "index:%s:index2", tablename));
+	testutil_check(__wt_snprintf(
+	    joinuri, sizeof(joinuri), "join:%s", opts->uri));
 
 	testutil_check(wiredtiger_open(opts->home, NULL,
 	    "statistics=(all),create", &opts->conn));
@@ -150,7 +153,8 @@ main(int argc, char *argv[])
 	cursor2->set_key(cursor2, half + 1);
 	testutil_check(cursor2->search(cursor2));
 
-	sprintf(bloom_cfg, "compare=lt,strategy=bloom,count=%d", half);
+	testutil_check(__wt_snprintf(bloom_cfg, sizeof(bloom_cfg),
+	    "compare=lt,strategy=bloom,count=%d", half));
 
 	testutil_check(session->open_cursor(session, joinuri, NULL, NULL,
 	    &jcursor));
diff --git a/test/csuite/wt2592_join_schema/main.c b/test/csuite/wt2592_join_schema/main.c
index 0ec1c765d99..be3eff6136c 100644
--- a/test/csuite/wt2592_join_schema/main.c
+++ b/test/csuite/wt2592_join_schema/main.c
@@ -82,9 +82,12 @@ main(int argc, char *argv[])
 	tablename = strchr(opts->uri, ':');
 	testutil_assert(tablename != NULL);
 	tablename++;
-	snprintf(countryuri, sizeof(countryuri), "index:%s:country", tablename);
-	snprintf(yearuri, sizeof(yearuri), "index:%s:year", tablename);
-	snprintf(joinuri, sizeof(joinuri), "join:%s", opts->uri);
+	testutil_check(__wt_snprintf(
+	    countryuri, sizeof(countryuri), "index:%s:country", tablename));
+	testutil_check(__wt_snprintf(
+	    yearuri, sizeof(yearuri), "index:%s:year", tablename));
+	testutil_check(__wt_snprintf(
+	    joinuri, sizeof(joinuri), "join:%s", opts->uri));
 
 	testutil_check(wiredtiger_open(opts->home, NULL,
 	    "create,cache_size=200M", &opts->conn));
diff --git a/test/csuite/wt2834_join_bloom_fix/main.c b/test/csuite/wt2834_join_bloom_fix/main.c
index f2c54b942be..e128df29f41 100644
--- a/test/csuite/wt2834_join_bloom_fix/main.c
+++ b/test/csuite/wt2834_join_bloom_fix/main.c
@@ -83,10 +83,14 @@ main(int argc, char *argv[])
 	tablename = strchr(opts->uri, ':');
 	testutil_assert(tablename != NULL);
 	tablename++;
-	snprintf(posturi, sizeof(posturi), "index:%s:post", tablename);
-	snprintf(balanceuri, sizeof(balanceuri), "index:%s:balance", tablename);
-	snprintf(flaguri, sizeof(flaguri), "index:%s:flag", tablename);
-	snprintf(joinuri, sizeof(joinuri), "join:%s", opts->uri);
+	testutil_check(__wt_snprintf(
+	    posturi, sizeof(posturi), "index:%s:post", tablename));
+	testutil_check(__wt_snprintf(
+	    balanceuri, sizeof(balanceuri), "index:%s:balance", tablename));
+	testutil_check(__wt_snprintf(
+	    flaguri, sizeof(flaguri), "index:%s:flag", tablename));
+	testutil_check(__wt_snprintf(
+	    joinuri, sizeof(joinuri), "join:%s", opts->uri));
 
 	testutil_check(session->create(session, posturi, "columns=(post)"));
 	testutil_check(session->create(session, balanceuri,
@@ -126,14 +130,14 @@ main(int argc, char *argv[])
 
 	balancecur->set_key(balancecur, 0);
 	testutil_check(balancecur->search(balancecur));
-	sprintf(cfg, "compare=lt,strategy=bloom,count=%d",
-	    N_RECORDS / 100);
+	testutil_check(__wt_snprintf(cfg, sizeof(cfg),
+	    "compare=lt,strategy=bloom,count=%d", N_RECORDS / 100));
 	testutil_check(session->join(session, joincur, balancecur, cfg));
 
 	flagcur->set_key(flagcur, 0);
 	testutil_check(flagcur->search(flagcur));
-	sprintf(cfg, "compare=eq,strategy=bloom,count=%d",
-	    N_RECORDS / 100);
+	testutil_check(__wt_snprintf(cfg, sizeof(cfg),
+	    "compare=eq,strategy=bloom,count=%d", N_RECORDS / 100));
 	testutil_check(session->join(session, joincur, flagcur, cfg));
 
 	/* Expect no values returned */
diff --git a/test/csuite/wt2853_perf/main.c b/test/csuite/wt2853_perf/main.c
index b365b03493a..46ba71372e5 100644
--- a/test/csuite/wt2853_perf/main.c
+++ b/test/csuite/wt2853_perf/main.c
@@ -114,12 +114,15 @@ main(int argc, char *argv[])
 	tablename = strchr(opts->uri, ':');
 	testutil_assert(tablename != NULL);
 	tablename++;
-	snprintf(sharedopts->posturi, sizeof(sharedopts->posturi),
-	    "index:%s:post", tablename);
-	snprintf(sharedopts->baluri, sizeof(sharedopts->baluri),
-	    "index:%s:bal", tablename);
-	snprintf(sharedopts->flaguri, sizeof(sharedopts->flaguri),
-	    "index:%s:flag", tablename);
+	testutil_check(__wt_snprintf(
+	    sharedopts->posturi, sizeof(sharedopts->posturi),
+	    "index:%s:post", tablename));
+	testutil_check(__wt_snprintf(
+	    sharedopts->baluri, sizeof(sharedopts->baluri),
+	    "index:%s:bal", tablename));
+	testutil_check(__wt_snprintf(
+	    sharedopts->flaguri, sizeof(sharedopts->flaguri),
+	    "index:%s:flag", tablename));
 
 	testutil_check(session->create(session, sharedopts->posturi,
 	    "columns=(post)"));
diff --git a/test/csuite/wt2909_checkpoint_integrity/main.c b/test/csuite/wt2909_checkpoint_integrity/main.c
index 0ae81543050..ce7bd72fa3f 100644
--- a/test/csuite/wt2909_checkpoint_integrity/main.c
+++ b/test/csuite/wt2909_checkpoint_integrity/main.c
@@ -267,9 +267,11 @@ enable_failures(uint64_t allow_writes, uint64_t allow_reads)
 	char value[100];
 
 	testutil_check(setenv("WT_FAIL_FS_ENABLE", "1", 1));
-	snprintf(value, sizeof(value), "%" PRIu64, allow_writes);
+	testutil_check(__wt_snprintf(
+	    value, sizeof(value), "%" PRIu64, allow_writes));
 	testutil_check(setenv("WT_FAIL_FS_WRITE_ALLOW", value, 1));
-	snprintf(value, sizeof(value), "%" PRIu64, allow_reads);
+	testutil_check(__wt_snprintf(
+	    value, sizeof(value), "%" PRIu64, allow_reads));
 	testutil_check(setenv("WT_FAIL_FS_READ_ALLOW", value, 1));
 }
 
@@ -325,10 +327,11 @@ run_check_subtest(TEST_OPTS *opts, const char *debugger, uint64_t nops,
 	subtest_args[narg++] = (char *)"-v";	/* subtest is always verbose */
 	subtest_args[narg++] = (char *)"-p";
 	subtest_args[narg++] = (char *)"-o";
-	snprintf(sarg, sizeof(sarg), "%" PRIu64, nops);
+	testutil_check(__wt_snprintf(sarg, sizeof(sarg), "%" PRIu64, nops));
 	subtest_args[narg++] = sarg;		/* number of operations */
 	subtest_args[narg++] = (char *)"-n";
-	snprintf(rarg, sizeof(rarg), "%" PRIu64, opts->nrecords);
+	testutil_check(__wt_snprintf(
+	    rarg, sizeof(rarg), "%" PRIu64, opts->nrecords));
 	subtest_args[narg++] = rarg;		/* number of records */
 	subtest_args[narg++] = NULL;
 	testutil_assert(narg <= MAX_ARGS);
@@ -463,15 +466,17 @@ subtest_main(int argc, char *argv[], bool close_test)
 	testutil_make_work_dir(opts->home);
 
 	/* Redirect stderr, stdout. */
-	sprintf(filename, "%s/%s", opts->home, STDERR_FILE);
+	testutil_check(__wt_snprintf(
+	    filename, sizeof(filename), "%s/%s", opts->home, STDERR_FILE));
 	testutil_assert(freopen(filename, "a", stderr) != NULL);
-	sprintf(filename, "%s/%s", opts->home, STDOUT_FILE);
+	testutil_check(__wt_snprintf(
+	    filename, sizeof(filename), "%s/%s", opts->home, STDOUT_FILE));
 	testutil_assert(freopen(filename, "a", stdout) != NULL);
-	snprintf(config, sizeof(config),
+	testutil_check(__wt_snprintf(config, sizeof(config),
 	    "create,cache_size=250M,log=(enabled),"
 	    "transaction_sync=(enabled,method=none),extensions=("
 	    WT_FAIL_FS_LIB
-	    "=(early_load,config={environment=true,verbose=true})]");
+	    "=(early_load,config={environment=true,verbose=true})]"));
 
 	testutil_check(wiredtiger_open(opts->home, NULL, config, &opts->conn));
 	testutil_check(
diff --git a/test/csuite/wt3120_filesys/main.c b/test/csuite/wt3120_filesys/main.c
index 09dce624066..2fae85017d4 100644
--- a/test/csuite/wt3120_filesys/main.c
+++ b/test/csuite/wt3120_filesys/main.c
@@ -52,8 +52,8 @@ main(int argc, char *argv[])
 	testutil_check(testutil_parse_opts(argc, argv, opts));
 	testutil_make_work_dir(opts->home);
 
-	snprintf(buf, sizeof(buf),
-	    "create,extensions=(" WT_FAIL_FS_LIB "=(early_load=true))");
+	testutil_check(__wt_snprintf(buf, sizeof(buf),
+	    "create,extensions=(" WT_FAIL_FS_LIB "=(early_load=true))"));
 	testutil_check(wiredtiger_open(opts->home, NULL, buf, &opts->conn));
 	testutil_check(
 	    opts->conn->open_session(opts->conn, NULL, NULL, &session));
diff --git a/test/cursor_order/cursor_order.c b/test/cursor_order/cursor_order.c
index 62777f552bf..d3c64b54ab5 100644
--- a/test/cursor_order/cursor_order.c
+++ b/test/cursor_order/cursor_order.c
@@ -181,19 +181,15 @@ wt_connect(SHARED_CONFIG *cfg, char *config_open)
 	};
 	int ret;
 	char config[512];
-	size_t print_count;
 
 	testutil_clean_work_dir(home);
 	testutil_make_work_dir(home);
 
-	print_count = (size_t)snprintf(config, sizeof(config),
+	testutil_check(__wt_snprintf(config, sizeof(config),
 	    "create,statistics=(all),error_prefix=\"%s\",%s%s",
 	    progname,
 	    config_open == NULL ? "" : ",",
-	    config_open == NULL ? "" : config_open);
-
-	if (print_count >= sizeof(config))
-		testutil_die(EINVAL, "Config string too long");
+	    config_open == NULL ? "" : config_open));
 
 	if ((ret = wiredtiger_open(
 	    home, &event_handler, config, &cfg->conn)) != 0)
diff --git a/test/cursor_order/cursor_order_file.c b/test/cursor_order/cursor_order_file.c
index 5dc7194b5fb..42d7af54de4 100644
--- a/test/cursor_order/cursor_order_file.c
+++ b/test/cursor_order/cursor_order_file.c
@@ -34,23 +34,21 @@ file_create(SHARED_CONFIG *cfg, const char *name)
 	WT_CONNECTION *conn;
 	WT_SESSION *session;
 	int ret;
-	char *p, *end, config[128];
+	char config[128];
 
 	conn = cfg->conn;
 
 	if ((ret = conn->open_session(conn, NULL, NULL, &session)) != 0)
 		testutil_die(ret, "conn.session");
 
-	p = config;
-	end = config + sizeof(config);
-	p += snprintf(p, (size_t)(end - p),
+	testutil_check(__wt_snprintf(config, sizeof(config),
 	    "key_format=%s,"
 	    "internal_page_max=%d,"
 	    "split_deepen_min_child=200,"
-	    "leaf_page_max=%d,",
-	    cfg->ftype == ROW ? "S" : "r", 16 * 1024, 128 * 1024);
-	if (cfg->ftype == FIX)
-		(void)snprintf(p, (size_t)(end - p), ",value_format=3t");
+	    "leaf_page_max=%d,"
+	    "%s",
+	    cfg->ftype == ROW ? "S" : "r", 16 * 1024, 128 * 1024,
+	    cfg->ftype == FIX ? ",value_format=3t" : ""));
 
 	if ((ret = session->create(session, name, config)) != 0)
 		if (ret != EEXIST)
@@ -67,9 +65,10 @@ load(SHARED_CONFIG *cfg, const char *name)
 	WT_CURSOR *cursor;
 	WT_ITEM *value, _value;
 	WT_SESSION *session;
-	char keybuf[64], valuebuf[64];
-	int64_t keyno;
+	size_t len;
+	uint64_t keyno;
 	int ret;
+	char keybuf[64], valuebuf[64];
 
 	conn = cfg->conn;
 
@@ -83,9 +82,10 @@ load(SHARED_CONFIG *cfg, const char *name)
 		testutil_die(ret, "cursor.open");
 
 	value = &_value;
-	for (keyno = 1; keyno <= (int64_t)cfg->nkeys; ++keyno) {
+	for (keyno = 1; keyno <= cfg->nkeys; ++keyno) {
 		if (cfg->ftype == ROW) {
-			snprintf(keybuf, sizeof(keybuf), "%016u", (u_int)keyno);
+			testutil_check(__wt_snprintf(
+			    keybuf, sizeof(keybuf), "%016" PRIu64, keyno));
 			cursor->set_key(cursor, keybuf);
 		} else
 			cursor->set_key(cursor, (uint32_t)keyno);
@@ -93,8 +93,10 @@ load(SHARED_CONFIG *cfg, const char *name)
 		if (cfg->ftype == FIX)
 			cursor->set_value(cursor, 0x01);
 		else {
-			value->size = (uint32_t)snprintf(
-			    valuebuf, sizeof(valuebuf), "%37u", (u_int)keyno);
+			testutil_check(__wt_snprintf_len_set(
+			    valuebuf, sizeof(valuebuf),
+			    &len, "%37" PRIu64, keyno));
+			value->size = (uint32_t)len;
 			cursor->set_value(cursor, value);
 		}
 		if ((ret = cursor->insert(cursor)) != 0)
diff --git a/test/cursor_order/cursor_order_ops.c b/test/cursor_order/cursor_order_ops.c
index 58da49b2991..299f22684c9 100644
--- a/test/cursor_order/cursor_order_ops.c
+++ b/test/cursor_order/cursor_order_ops.c
@@ -69,7 +69,8 @@ ops_start(SHARED_CONFIG *cfg)
 		run_info[i].cfg = cfg;
 		if (i == 0 || cfg->multiple_files) {
 			run_info[i].name = dmalloc(64);
-			snprintf(run_info[i].name, 64, FNAME, (int)i);
+			testutil_check(__wt_snprintf(
+			    run_info[i].name, 64, FNAME, (int)i));
 
 			/* Vary by orders of magnitude */
 			if (cfg->vary_nops)
@@ -93,8 +94,8 @@ ops_start(SHARED_CONFIG *cfg)
 			run_info[offset].name = dmalloc(64);
 			/* Have reverse scans read from tables with writes. */
 			name_index = i % cfg->append_inserters;
-			snprintf(
-			    run_info[offset].name, 64, FNAME, (int)name_index);
+			testutil_check(__wt_snprintf(
+			    run_info[offset].name, 64, FNAME, (int)name_index));
 
 			/* Vary by orders of magnitude */
 			if (cfg->vary_nops)
@@ -231,7 +232,7 @@ reverse_scan(void *arg)
 	id = (uintmax_t)arg;
 	s = &run_info[id];
 	cfg = s->cfg;
-	__wt_thread_id(tid, sizeof(tid));
+	testutil_check(__wt_thread_id(tid, sizeof(tid)));
 	__wt_random_init(&s->rnd);
 
 	printf(" reverse scan thread %2" PRIuMAX
@@ -272,6 +273,7 @@ append_insert_op(
 {
 	WT_ITEM *value, _value;
 	uint64_t keyno;
+	size_t len;
 	int ret;
 	char keybuf[64], valuebuf[64];
 
@@ -281,7 +283,8 @@ append_insert_op(
 
 	keyno = __wt_atomic_add64(&cfg->key_range, 1);
 	if (cfg->ftype == ROW) {
-		snprintf(keybuf, sizeof(keybuf), "%016u", (u_int)keyno);
+		testutil_check(__wt_snprintf(
+		    keybuf, sizeof(keybuf), "%016" PRIu64, keyno));
 		cursor->set_key(cursor, keybuf);
 	} else
 		cursor->set_key(cursor, (uint32_t)keyno);
@@ -291,8 +294,9 @@ append_insert_op(
 	if (cfg->ftype == FIX)
 		cursor->set_value(cursor, 0x10);
 	else {
-		value->size = (uint32_t)snprintf(
-		    valuebuf, sizeof(valuebuf), "XXX %37u", (u_int)keyno);
+		testutil_check(__wt_snprintf_len_set(
+		    valuebuf, sizeof(valuebuf), &len, "XXX %37" PRIu64, keyno));
+		value->size = (uint32_t)len;
 		cursor->set_value(cursor, value);
 	}
 	if ((ret = cursor->insert(cursor)) != 0)
@@ -318,7 +322,7 @@ append_insert(void *arg)
 	id = (uintmax_t)arg;
 	s = &run_info[id];
 	cfg = s->cfg;
-	__wt_thread_id(tid, sizeof(tid));
+	testutil_check(__wt_thread_id(tid, sizeof(tid)));
 	__wt_random_init(&s->rnd);
 
 	printf("write thread %2" PRIuMAX " starting: tid: %s, file: %s\n",
diff --git a/test/fops/file.c b/test/fops/file.c
index 66c23dfed3c..d1cd22ab391 100644
--- a/test/fops/file.c
+++ b/test/fops/file.c
@@ -71,7 +71,8 @@ obj_bulk_unique(int force)
 	/* Generate a unique object name. */
 	if ((ret = pthread_rwlock_wrlock(&single)) != 0)
 		testutil_die(ret, "pthread_rwlock_wrlock single");
-	(void)snprintf(new_uri, sizeof(new_uri), "%s.%u", uri, ++uid);
+	testutil_check(__wt_snprintf(
+	    new_uri, sizeof(new_uri), "%s.%u", uri, ++uid));
 	if ((ret = pthread_rwlock_unlock(&single)) != 0)
 		testutil_die(ret, "pthread_rwlock_unlock single");
 
@@ -152,7 +153,8 @@ obj_create_unique(int force)
 	/* Generate a unique object name. */
 	if ((ret = pthread_rwlock_wrlock(&single)) != 0)
 		testutil_die(ret, "pthread_rwlock_wrlock single");
-	(void)snprintf(new_uri, sizeof(new_uri), "%s.%u", uri, ++uid);
+	testutil_check(__wt_snprintf(
+	    new_uri, sizeof(new_uri), "%s.%u", uri, ++uid));
 	if ((ret = pthread_rwlock_unlock(&single)) != 0)
 		testutil_die(ret, "pthread_rwlock_unlock single");
 
diff --git a/test/fops/t.c b/test/fops/t.c
index 469d5acd33a..07ac07349e3 100644
--- a/test/fops/t.c
+++ b/test/fops/t.c
@@ -157,11 +157,11 @@ wt_startup(char *config_open)
 
 	testutil_make_work_dir(home);
 
-	snprintf(config_buf, sizeof(config_buf),
+	testutil_check(__wt_snprintf(config_buf, sizeof(config_buf),
 	    "create,error_prefix=\"%s\",cache_size=5MB%s%s",
 	    progname,
 	    config_open == NULL ? "" : ",",
-	    config_open == NULL ? "" : config_open);
+	    config_open == NULL ? "" : config_open));
 	if ((ret = wiredtiger_open(
 	    home, &event_handler, config_buf, &conn)) != 0)
 		testutil_die(ret, "wiredtiger_open");
diff --git a/test/format/backup.c b/test/format/backup.c
index 69fdf771de9..8aa614fa970 100644
--- a/test/format/backup.c
+++ b/test/format/backup.c
@@ -63,7 +63,7 @@ copy_file(WT_SESSION *session, const char *name)
 
 	len = strlen("BACKUP") + strlen(name) + 10;
 	first = dmalloc(len);
-	(void)snprintf(first, len, "BACKUP/%s", name);
+	testutil_check(__wt_snprintf(first, len, "BACKUP/%s", name));
 	testutil_check(__wt_copy_and_sync(session, name, first));
 
 	/*
@@ -72,7 +72,7 @@ copy_file(WT_SESSION *session, const char *name)
 	 */
 	len = strlen("BACKUP_COPY") + strlen(name) + 10;
 	second = dmalloc(len);
-	(void)snprintf(second, len, "BACKUP_COPY/%s", name);
+	testutil_check(__wt_snprintf(second, len, "BACKUP_COPY/%s", name));
 	testutil_check(__wt_copy_and_sync(session, first, second));
 
 	free(first);
diff --git a/test/format/config.c b/test/format/config.c
index 535dcd677e2..22b40f7164d 100644
--- a/test/format/config.c
+++ b/test/format/config.c
@@ -257,8 +257,8 @@ config_compression(const char *conf_name)
 	 */
 	cstr = "none";
 	if (strcmp(conf_name, "logging_compression") == 0 && g.c_logging == 0) {
-		(void)snprintf(
-		    confbuf, sizeof(confbuf), "%s=%s", conf_name, cstr);
+		testutil_check(__wt_snprintf(
+		    confbuf, sizeof(confbuf), "%s=%s", conf_name, cstr));
 		config_single(confbuf, 0);
 		return;
 	}
@@ -302,7 +302,8 @@ config_compression(const char *conf_name)
 		break;
 	}
 
-	(void)snprintf(confbuf, sizeof(confbuf), "%s=%s", conf_name, cstr);
+	testutil_check(__wt_snprintf(
+	    confbuf, sizeof(confbuf), "%s=%s", conf_name, cstr));
 	config_single(confbuf, 0);
 }
 
@@ -678,7 +679,8 @@ void
 config_single(const char *s, int perm)
 {
 	CONFIG *cp;
-	long v;
+	long vlong;
+	uint32_t v;
 	char *p;
 	const char *ep;
 
@@ -743,21 +745,22 @@ config_single(const char *s, int perm)
 		return;
 	}
 
-	v = -1;
+	vlong = -1;
 	if (F_ISSET(cp, C_BOOL)) {
 		if (strncmp(ep, "off", strlen("off")) == 0)
-			v = 0;
+			vlong = 0;
 		else if (strncmp(ep, "on", strlen("on")) == 0)
-			v = 1;
+			vlong = 1;
 	}
-	if (v == -1) {
-		v = strtol(ep, &p, 10);
+	if (vlong == -1) {
+		vlong = strtol(ep, &p, 10);
 		if (*p != '\0') {
 			fprintf(stderr, "%s: %s: illegal numeric value\n",
 			    progname, s);
 			exit(EXIT_FAILURE);
 		}
 	}
+	v = (uint32_t)vlong;
 	if (F_ISSET(cp, C_BOOL)) {
 		if (v != 0 && v != 1) {
 			fprintf(stderr, "%s: %s: value of boolean not 0 or 1\n",
@@ -770,7 +773,7 @@ config_single(const char *s, int perm)
 		    progname, s, cp->min, cp->maxset);
 		exit(EXIT_FAILURE);
 	}
-	*cp->v = (uint32_t)v;
+	*cp->v = v;
 }
 
 /*
diff --git a/test/format/ops.c b/test/format/ops.c
index 5309edf81c0..72e885bd0d6 100644
--- a/test/format/ops.c
+++ b/test/format/ops.c
@@ -530,8 +530,9 @@ ops(void *arg)
 			    pthread_rwlock_trywrlock(&g.backup_lock) == EBUSY)
 				ckpt_config = NULL;
 			else {
-				(void)snprintf(ckpt_name, sizeof(ckpt_name),
-				    "name=thread-%d", tinfo->id);
+				testutil_check(__wt_snprintf(
+				    ckpt_name, sizeof(ckpt_name),
+				    "name=thread-%d", tinfo->id));
 				ckpt_config = ckpt_name;
 			}
 
@@ -557,8 +558,9 @@ ops(void *arg)
 				strcpy(ckpt_name,
 				    "checkpoint=WiredTigerCheckpoint");
 			else
-				(void)snprintf(ckpt_name, sizeof(ckpt_name),
-				    "checkpoint=thread-%d", tinfo->id);
+				testutil_check(__wt_snprintf(
+				    ckpt_name, sizeof(ckpt_name),
+				    "checkpoint=thread-%d", tinfo->id));
 			ckpt_available = true;
 
 skip_checkpoint:	/* Pick the next checkpoint operation. */
diff --git a/test/format/rebalance.c b/test/format/rebalance.c
index 9849b7df82b..e35c62e7255 100644
--- a/test/format/rebalance.c
+++ b/test/format/rebalance.c
@@ -41,10 +41,10 @@ wts_rebalance(void)
 	track("rebalance", 0ULL, NULL);
 
 	/* Dump the current object. */
-	(void)snprintf(cmd, sizeof(cmd),
+	testutil_check(__wt_snprintf(cmd, sizeof(cmd),
 	    ".." DIR_DELIM_STR ".." DIR_DELIM_STR "wt"
 	    " -h %s dump -f %s/rebalance.orig %s",
-	    g.home, g.home, g.uri);
+	    g.home, g.home, g.uri));
 	testutil_checkfmt(system(cmd), "command failed: %s", cmd);
 
 	/* Rebalance, then verify the object. */
@@ -66,21 +66,21 @@ wts_rebalance(void)
 	wts_verify("post-rebalance verify");
 	wts_close();
 
-	(void)snprintf(cmd, sizeof(cmd),
+	testutil_check(__wt_snprintf(cmd, sizeof(cmd),
 	    ".." DIR_DELIM_STR ".." DIR_DELIM_STR "wt"
 	    " -h %s dump -f %s/rebalance.new %s",
-	    g.home, g.home, g.uri);
+	    g.home, g.home, g.uri));
 	testutil_checkfmt(system(cmd), "command failed: %s", cmd);
 
 	/* Compare the old/new versions of the object. */
 #ifdef _WIN32
-	(void)snprintf(cmd, sizeof(cmd),
+	testutil_check(__wt_snprintf(cmd, sizeof(cmd),
 	    "fc /b %s\\rebalance.orig %s\\rebalance.new > NUL",
-	    g.home, g.home);
+	    g.home, g.home));
 #else
-	(void)snprintf(cmd, sizeof(cmd),
+	testutil_check(__wt_snprintf(cmd, sizeof(cmd),
 	    "cmp %s/rebalance.orig %s/rebalance.new > /dev/null",
-	    g.home, g.home);
+	    g.home, g.home));
 #endif
 	testutil_checkfmt(system(cmd), "command failed: %s", cmd);
 }
diff --git a/test/format/salvage.c b/test/format/salvage.c
index 69805fb1018..f82dc34dd5f 100644
--- a/test/format/salvage.c
+++ b/test/format/salvage.c
@@ -70,29 +70,31 @@ corrupt(void)
 	 * It's a little tricky: if the data source is a file, we're looking
 	 * for "wt", if the data source is a table, we're looking for "wt.wt".
 	 */
-	(void)snprintf(buf, sizeof(buf), "%s/%s", g.home, WT_NAME);
+	testutil_check(__wt_snprintf(
+	    buf, sizeof(buf), "%s/%s", g.home, WT_NAME));
 	if ((fd = open(buf, O_RDWR)) != -1) {
 #ifdef _WIN32
-		(void)snprintf(copycmd, sizeof(copycmd),
+		testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
 		    "copy %s\\%s %s\\slvg.copy\\%s.corrupted",
-		    g.home, WT_NAME, g.home, WT_NAME);
+		    g.home, WT_NAME, g.home, WT_NAME));
 #else
-		(void)snprintf(copycmd, sizeof(copycmd),
+		testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
 		    "cp %s/%s %s/slvg.copy/%s.corrupted",
-		    g.home, WT_NAME, g.home, WT_NAME);
+		    g.home, WT_NAME, g.home, WT_NAME));
 #endif
 		goto found;
 	}
-	(void)snprintf(buf, sizeof(buf), "%s/%s.wt", g.home, WT_NAME);
+	testutil_check(__wt_snprintf(
+	    buf, sizeof(buf), "%s/%s.wt", g.home, WT_NAME));
 	if ((fd = open(buf, O_RDWR)) != -1) {
 #ifdef _WIN32
-		(void)snprintf(copycmd, sizeof(copycmd),
+		testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
 		    "copy %s\\%s.wt %s\\slvg.copy\\%s.wt.corrupted",
-		    g.home, WT_NAME, g.home, WT_NAME);
+		    g.home, WT_NAME, g.home, WT_NAME));
 #else
-		(void)snprintf(copycmd, sizeof(copycmd),
+		testutil_check(__wt_snprintf(copycmd, sizeof(copycmd),
 		    "cp %s/%s.wt %s/slvg.copy/%s.wt.corrupted",
-		    g.home, WT_NAME, g.home, WT_NAME);
+		    g.home, WT_NAME, g.home, WT_NAME));
 #endif
 		goto found;
 	}
@@ -103,7 +105,8 @@ found:	if (fstat(fd, &sb) == -1)
 
 	offset = mmrand(NULL, 0, (u_int)sb.st_size);
 	len = (size_t)(20 + (sb.st_size / 100) * 2);
-	(void)snprintf(buf, sizeof(buf), "%s/slvg.corrupt", g.home);
+	testutil_check(__wt_snprintf(
+	    buf, sizeof(buf), "%s/slvg.corrupt", g.home));
 	if ((fp = fopen(buf, "w")) == NULL)
 		testutil_die(errno, "salvage-corrupt: open: %s", buf);
 	(void)fprintf(fp,
diff --git a/test/format/util.c b/test/format/util.c
index b9788f1ac75..983d03e2525 100644
--- a/test/format/util.c
+++ b/test/format/util.c
@@ -241,20 +241,23 @@ val_gen(WT_RAND_STATE *rnd, WT_ITEM *value, uint64_t keyno)
 void
 track(const char *tag, uint64_t cnt, TINFO *tinfo)
 {
-	static int lastlen = 0;
-	int len;
+	static size_t lastlen = 0;
+	size_t len;
 	char msg[128];
 
 	if (g.c_quiet || tag == NULL)
 		return;
 
 	if (tinfo == NULL && cnt == 0)
-		len = snprintf(msg, sizeof(msg), "%4d: %s", g.run_cnt, tag);
+		testutil_check(__wt_snprintf_len_set(
+		    msg, sizeof(msg), &len, "%4d: %s", g.run_cnt, tag));
 	else if (tinfo == NULL)
-		len = snprintf(
-		    msg, sizeof(msg), "%4d: %s: %" PRIu64, g.run_cnt, tag, cnt);
+		testutil_check(__wt_snprintf_len_set(
+		    msg, sizeof(msg), &len,
+		    "%4d: %s: %" PRIu64, g.run_cnt, tag, cnt));
 	else
-		len = snprintf(msg, sizeof(msg),
+		testutil_check(__wt_snprintf_len_set(
+		    msg, sizeof(msg), &len,
 		    "%4d: %s: "
 		    "search %" PRIu64 "%s, "
 		    "insert %" PRIu64 "%s, "
@@ -268,7 +271,7 @@ track(const char *tag, uint64_t cnt, TINFO *tinfo)
 		    tinfo->update > M(9) ? tinfo->update / M(1) : tinfo->update,
 		    tinfo->update > M(9) ? "M" : "",
 		    tinfo->remove > M(9) ? tinfo->remove / M(1) : tinfo->remove,
-		    tinfo->remove > M(9) ? "M" : "");
+		    tinfo->remove > M(9) ? "M" : ""));
 
 	if (lastlen > len) {
 		memset(msg + len, ' ', (size_t)(lastlen - len));
@@ -297,27 +300,30 @@ path_setup(const char *home)
 	/* Log file. */
 	len = strlen(g.home) + strlen("log") + 2;
 	g.home_log = dmalloc(len);
-	snprintf(g.home_log, len, "%s/%s", g.home, "log");
+	testutil_check(__wt_snprintf(g.home_log, len, "%s/%s", g.home, "log"));
 
 	/* RNG log file. */
 	len = strlen(g.home) + strlen("rand") + 2;
 	g.home_rand = dmalloc(len);
-	snprintf(g.home_rand, len, "%s/%s", g.home, "rand");
+	testutil_check(__wt_snprintf(
+	    g.home_rand, len, "%s/%s", g.home, "rand"));
 
 	/* Run file. */
 	len = strlen(g.home) + strlen("CONFIG") + 2;
 	g.home_config = dmalloc(len);
-	snprintf(g.home_config, len, "%s/%s", g.home, "CONFIG");
+	testutil_check(__wt_snprintf(
+	    g.home_config, len, "%s/%s", g.home, "CONFIG"));
 
 	/* Statistics file. */
 	len = strlen(g.home) + strlen("stats") + 2;
 	g.home_stats = dmalloc(len);
-	snprintf(g.home_stats, len, "%s/%s", g.home, "stats");
+	testutil_check(__wt_snprintf(
+	    g.home_stats, len, "%s/%s", g.home, "stats"));
 
 	/* BDB directory. */
 	len = strlen(g.home) + strlen("bdb") + 2;
 	g.home_bdb = dmalloc(len);
-	snprintf(g.home_bdb, len, "%s/%s", g.home, "bdb");
+	testutil_check(__wt_snprintf(g.home_bdb, len, "%s/%s", g.home, "bdb"));
 
 	/*
 	 * Home directory initialize command: create the directory if it doesn't
@@ -336,21 +342,23 @@ path_setup(const char *home)
 	     "cd %s & mkdir KVS"
 	len = strlen(g.home) * 7 + strlen(CMD) + 1;
 	g.home_init = dmalloc(len);
-	snprintf(g.home_init, len, CMD,
-	    g.home, g.home, g.home, g.home, g.home, g.home, g.home);
+	testutil_check(__wt_snprintf(g.home_init, len, CMD,
+	    g.home, g.home, g.home, g.home, g.home, g.home, g.home));
 #else
 #define	CMD	"test -e %s || mkdir %s; "				\
 		"cd %s > /dev/null && rm -rf `ls | sed /rand/d`; "	\
 		"mkdir KVS"
 	len = strlen(g.home) * 3 + strlen(CMD) + 1;
 	g.home_init = dmalloc(len);
-	snprintf(g.home_init, len, CMD, g.home, g.home, g.home);
+	testutil_check(__wt_snprintf(
+	    g.home_init, len, CMD, g.home, g.home, g.home));
 #endif
 
 	/* Primary backup directory. */
 	len = strlen(g.home) + strlen("BACKUP") + 2;
 	g.home_backup = dmalloc(len);
-	snprintf(g.home_backup, len, "%s/%s", g.home, "BACKUP");
+	testutil_check(__wt_snprintf(
+	    g.home_backup, len, "%s/%s", g.home, "BACKUP"));
 
 	/*
 	 * Backup directory initialize command, remove and re-create the primary
@@ -365,9 +373,9 @@ path_setup(const char *home)
 	len = strlen(g.home) * 4 +
 	    strlen("BACKUP") * 2 + strlen("BACKUP_COPY") * 2 + strlen(CMD) + 1;
 	g.home_backup_init = dmalloc(len);
-	snprintf(g.home_backup_init, len, CMD,
+	testutil_check(__wt_snprintf(g.home_backup_init, len, CMD,
 	    g.home, "BACKUP", g.home, "BACKUP_COPY",
-	    g.home, "BACKUP", g.home, "BACKUP_COPY");
+	    g.home, "BACKUP", g.home, "BACKUP_COPY"));
 
 	/*
 	 * Salvage command, save the interesting files so we can replay the
@@ -390,7 +398,7 @@ path_setup(const char *home)
 #endif
 	len = strlen(g.home) + strlen(CMD) + 1;
 	g.home_salvage_copy = dmalloc(len);
-	snprintf(g.home_salvage_copy, len, CMD, g.home);
+	testutil_check(__wt_snprintf(g.home_salvage_copy, len, CMD, g.home));
 }
 
 /*
@@ -489,8 +497,9 @@ alter(void *arg)
 	while (!g.workers_finished) {
 		period = mmrand(NULL, 1, 10);
 
-		snprintf(buf, sizeof(buf),
-		    "access_pattern_hint=%s", access_value ? "random" : "none");
+		testutil_check(__wt_snprintf(buf, sizeof(buf),
+		    "access_pattern_hint=%s",
+		    access_value ? "random" : "none"));
 		access_value = !access_value;
 		if (session->alter(session, g.uri, buf) != 0)
 			break;
diff --git a/test/format/wts.c b/test/format/wts.c
index a87aa5b9f88..6aa4784d1c1 100644
--- a/test/format/wts.c
+++ b/test/format/wts.c
@@ -120,8 +120,15 @@ static WT_EVENT_HANDLER event_handler = {
 	NULL	/* Close handler. */
 };
 
-#undef	REMAIN
-#define	REMAIN(p, end)	(size_t)((p) >= (end) ? 0 : (end) - (p))
+#define	CONFIG_APPEND(p, ...) do {					\
+	size_t __len;							\
+	testutil_check(							\
+	    __wt_snprintf_len_set(p, max, &__len, __VA_ARGS__));	\
+	if (__len > max)						\
+		__len = max;						\
+	p += __len;							\
+	max -= __len;							\
+} while (0)
 
 /*
  * wts_open --
@@ -132,14 +139,15 @@ wts_open(const char *home, bool set_api, WT_CONNECTION **connp)
 {
 	WT_CONNECTION *conn;
 	WT_DECL_RET;
-	char *config, *end, *p, helium_config[1024];
+	size_t max;
+	char *config, *p, helium_config[1024];
 
 	*connp = NULL;
 
 	config = p = g.wiredtiger_open_config;
-	end = config + sizeof(g.wiredtiger_open_config);
+	max = sizeof(g.wiredtiger_open_config);
 
-	p += snprintf(p, REMAIN(p, end),
+	CONFIG_APPEND(p,
 	    "create=true,"
 	    "cache_size=%" PRIu32 "MB,"
 	    "checkpoint_sync=false,"
@@ -148,26 +156,25 @@ wts_open(const char *home, bool set_api, WT_CONNECTION **connp)
 
 	/* In-memory configuration. */
 	if (g.c_in_memory != 0)
-		p += snprintf(p, REMAIN(p, end), ",in_memory=1");
+		CONFIG_APPEND(p, ",in_memory=1");
 
 	/* LSM configuration. */
 	if (DATASOURCE("lsm"))
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    ",lsm_manager=(worker_thread_max=%" PRIu32 "),",
 		    g.c_lsm_worker_threads);
 
-	if (DATASOURCE("lsm") || g.c_cache < 20) {
-		p += snprintf(p, REMAIN(p, end), ",eviction_dirty_trigger=95");
-	}
+	if (DATASOURCE("lsm") || g.c_cache < 20)
+		CONFIG_APPEND(p, ",eviction_dirty_trigger=95");
 
 	/* Eviction worker configuration. */
 	if (g.c_evict_max != 0)
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    ",eviction=(threads_max=%" PRIu32 ")", g.c_evict_max);
 
 	/* Logging configuration. */
 	if (g.c_logging)
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    ",log=(enabled=true,archive=%d,prealloc=%d"
 		    ",compressor=\"%s\")",
 		    g.c_logging_archive ? 1 : 0,
@@ -175,21 +182,21 @@ wts_open(const char *home, bool set_api, WT_CONNECTION **connp)
 		    compressor(g.c_logging_compression_flag));
 
 	if (g.c_encryption)
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    ",encryption=(name=%s)", encryptor(g.c_encryption_flag));
 
 	/* Miscellaneous. */
 #ifdef HAVE_POSIX_MEMALIGN
-	p += snprintf(p, REMAIN(p, end), ",buffer_alignment=512");
+	CONFIG_APPEND(p, ",buffer_alignment=512");
 #endif
 
-	p += snprintf(p, REMAIN(p, end), ",mmap=%d", g.c_mmap ? 1 : 0);
+	CONFIG_APPEND(p, ",mmap=%d", g.c_mmap ? 1 : 0);
 
 	if (g.c_direct_io)
-		p += snprintf(p, REMAIN(p, end), ",direct_io=(data)");
+		CONFIG_APPEND(p, ",direct_io=(data)");
 
 	if (g.c_data_extend)
-		p += snprintf(p, REMAIN(p, end), ",file_extend=(data=8MB)");
+		CONFIG_APPEND(p, ",file_extend=(data=8MB)");
 
 	/*
 	 * Run the statistics server and/or maintain statistics in the engine.
@@ -198,18 +205,18 @@ wts_open(const char *home, bool set_api, WT_CONNECTION **connp)
 	if (g.c_statistics_server) {
 		if (mmrand(NULL, 0, 5) == 1 &&
 		    memcmp(g.uri, "file:", strlen("file:")) == 0)
-			p += snprintf(p, REMAIN(p, end),
+			CONFIG_APPEND(p,
 			    ",statistics=(fast)"
 			    ",statistics_log=(wait=5,sources=(\"file:\"))");
 		else
-			p += snprintf(p, REMAIN(p, end),
+			CONFIG_APPEND(p,
 			    ",statistics=(fast),statistics_log=(wait=5)");
 	} else
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    ",statistics=(%s)", g.c_statistics ? "fast" : "none");
 
 	/* Extensions. */
-	p += snprintf(p, REMAIN(p, end),
+	CONFIG_APPEND(p,
 	    ",extensions=["
 	    "\"%s\", \"%s\", \"%s\", \"%s\", \"%s\", \"%s\", \"%s\", \"%s\"],",
 	    g.c_reverse ? REVERSE_PATH : "",
@@ -227,11 +234,11 @@ wts_open(const char *home, bool set_api, WT_CONNECTION **connp)
 	 * override the standard configuration.
 	 */
 	if (g.c_config_open != NULL)
-		p += snprintf(p, REMAIN(p, end), ",%s", g.c_config_open);
+		CONFIG_APPEND(p, ",%s", g.c_config_open);
 	if (g.config_open != NULL)
-		p += snprintf(p, REMAIN(p, end), ",%s", g.config_open);
+		CONFIG_APPEND(p, ",%s", g.config_open);
 
-	if (REMAIN(p, end) == 0)
+	if (max == 0)
 		testutil_die(ENOMEM,
 		    "wiredtiger_open configuration buffer too small");
 
@@ -259,12 +266,13 @@ wts_open(const char *home, bool set_api, WT_CONNECTION **connp)
 	if (DATASOURCE("helium")) {
 		if (g.helium_mount == NULL)
 			testutil_die(EINVAL, "no Helium mount point specified");
-		(void)snprintf(helium_config, sizeof(helium_config),
+		testutil_check(
+		    __wt_snprintf(helium_config, sizeof(helium_config),
 		    "entry=wiredtiger_extension_init,config=["
 		    "helium_verbose=0,"
 		    "dev1=[helium_devices=\"he://./%s\","
 		    "helium_o_volume_truncate=1]]",
-		    g.helium_mount);
+		    g.helium_mount));
 		if ((ret = conn->load_extension(
 		    conn, HELIUM_PATH, helium_config)) != 0)
 			testutil_die(ret,
@@ -299,13 +307,13 @@ wts_init(void)
 {
 	WT_CONNECTION *conn;
 	WT_SESSION *session;
+	size_t max;
 	uint32_t maxintlpage, maxintlkey, maxleafpage, maxleafkey, maxleafvalue;
-	char config[4096], *end, *p;
+	char config[4096], *p;
 
 	conn = g.wts_conn;
-
 	p = config;
-	end = config + sizeof(config);
+	max = sizeof(config);
 
 	/*
 	 * Ensure that we can service at least one operation per-thread
@@ -326,7 +334,7 @@ wts_init(void)
 		if (maxleafpage > 512)
 			maxleafpage >>= 1;
 	}
-	p += snprintf(p, REMAIN(p, end),
+	CONFIG_APPEND(p,
 	    "key_format=%s,"
 	    "allocation_size=512,%s"
 	    "internal_page_max=%" PRIu32 ",leaf_page_max=%" PRIu32,
@@ -340,43 +348,35 @@ wts_init(void)
 	 */
 	maxintlkey = mmrand(NULL, maxintlpage / 50, maxintlpage / 40);
 	if (maxintlkey > 20)
-		p += snprintf(p, REMAIN(p, end),
-		    ",internal_key_max=%" PRIu32, maxintlkey);
+		CONFIG_APPEND(p, ",internal_key_max=%" PRIu32, maxintlkey);
 	maxleafkey = mmrand(NULL, maxleafpage / 50, maxleafpage / 40);
 	if (maxleafkey > 20)
-		p += snprintf(p, REMAIN(p, end),
-		    ",leaf_key_max=%" PRIu32, maxleafkey);
+		CONFIG_APPEND(p, ",leaf_key_max=%" PRIu32, maxleafkey);
 	maxleafvalue = mmrand(NULL, maxleafpage * 10, maxleafpage / 40);
 	if (maxleafvalue > 40 && maxleafvalue < 100 * 1024)
-		p += snprintf(p, REMAIN(p, end),
-		    ",leaf_value_max=%" PRIu32, maxleafvalue);
+		CONFIG_APPEND(p, ",leaf_value_max=%" PRIu32, maxleafvalue);
 
 	switch (g.type) {
 	case FIX:
-		p += snprintf(p, REMAIN(p, end),
-		    ",value_format=%" PRIu32 "t", g.c_bitcnt);
+		CONFIG_APPEND(p, ",value_format=%" PRIu32 "t", g.c_bitcnt);
 		break;
 	case ROW:
 		if (g.c_huffman_key)
-			p += snprintf(p, REMAIN(p, end),
-			    ",huffman_key=english");
+			CONFIG_APPEND(p, ",huffman_key=english");
 		if (g.c_prefix_compression)
-			p += snprintf(p, REMAIN(p, end),
+			CONFIG_APPEND(p,
 			    ",prefix_compression_min=%" PRIu32,
 			    g.c_prefix_compression_min);
 		else
-			p += snprintf(p, REMAIN(p, end),
-			    ",prefix_compression=false");
+			CONFIG_APPEND(p, ",prefix_compression=false");
 		if (g.c_reverse)
-			p += snprintf(p, REMAIN(p, end),
-			    ",collator=reverse");
+			CONFIG_APPEND(p, ",collator=reverse");
 		/* FALLTHROUGH */
 	case VAR:
 		if (g.c_huffman_value)
-			p += snprintf(p, REMAIN(p, end),
-			    ",huffman_value=english");
+			CONFIG_APPEND(p, ",huffman_value=english");
 		if (g.c_dictionary)
-			p += snprintf(p, REMAIN(p, end),
+			CONFIG_APPEND(p,
 			    ",dictionary=%" PRIu32, mmrand(NULL, 123, 517));
 		break;
 	}
@@ -384,66 +384,63 @@ wts_init(void)
 	/* Configure checksums. */
 	switch (g.c_checksum_flag) {
 	case CHECKSUM_OFF:
-		p += snprintf(p, REMAIN(p, end), ",checksum=\"off\"");
+		CONFIG_APPEND(p, ",checksum=\"off\"");
 		break;
 	case CHECKSUM_ON:
-		p += snprintf(p, REMAIN(p, end), ",checksum=\"on\"");
+		CONFIG_APPEND(p, ",checksum=\"on\"");
 		break;
 	case CHECKSUM_UNCOMPRESSED:
-		p += snprintf(p, REMAIN(p, end), ",checksum=\"uncompressed\"");
+		CONFIG_APPEND(p, ",checksum=\"uncompressed\"");
 		break;
 	}
 
 	/* Configure compression. */
 	if (g.c_compression_flag != COMPRESS_NONE)
-		p += snprintf(p, REMAIN(p, end), ",block_compressor=\"%s\"",
+		CONFIG_APPEND(p, ",block_compressor=\"%s\"",
 		    compressor(g.c_compression_flag));
 
 	/* Configure Btree internal key truncation. */
-	p += snprintf(p, REMAIN(p, end), ",internal_key_truncate=%s",
+	CONFIG_APPEND(p, ",internal_key_truncate=%s",
 	    g.c_internal_key_truncation ? "true" : "false");
 
 	/* Configure Btree page key gap. */
-	p += snprintf(p, REMAIN(p, end), ",key_gap=%" PRIu32, g.c_key_gap);
+	CONFIG_APPEND(p, ",key_gap=%" PRIu32, g.c_key_gap);
 
 	/* Configure Btree split page percentage. */
-	p += snprintf(p, REMAIN(p, end), ",split_pct=%" PRIu32, g.c_split_pct);
+	CONFIG_APPEND(p, ",split_pct=%" PRIu32, g.c_split_pct);
 
 	/* Configure LSM and data-sources. */
 	if (DATASOURCE("helium"))
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    ",type=helium,helium_o_compress=%d,helium_o_truncate=1",
 		    g.c_compression_flag == COMPRESS_NONE ? 0 : 1);
 
 	if (DATASOURCE("kvsbdb"))
-		p += snprintf(p, REMAIN(p, end), ",type=kvsbdb");
+		CONFIG_APPEND(p, ",type=kvsbdb");
 
 	if (DATASOURCE("lsm")) {
-		p += snprintf(p, REMAIN(p, end), ",type=lsm,lsm=(");
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p, ",type=lsm,lsm=(");
+		CONFIG_APPEND(p,
 		    "auto_throttle=%s,", g.c_auto_throttle ? "true" : "false");
-		p += snprintf(p, REMAIN(p, end),
-		    "chunk_size=%" PRIu32 "MB,", g.c_chunk_size);
+		CONFIG_APPEND(p, "chunk_size=%" PRIu32 "MB,", g.c_chunk_size);
 		/*
 		 * We can't set bloom_oldest without bloom, and we want to test
 		 * with Bloom filters on most of the time anyway.
 		 */
 		if (g.c_bloom_oldest)
 			g.c_bloom = 1;
-		p += snprintf(p, REMAIN(p, end),
-		    "bloom=%s,", g.c_bloom ? "true" : "false");
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p, "bloom=%s,", g.c_bloom ? "true" : "false");
+		CONFIG_APPEND(p,
 		    "bloom_bit_count=%" PRIu32 ",", g.c_bloom_bit_count);
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    "bloom_hash_count=%" PRIu32 ",", g.c_bloom_hash_count);
-		p += snprintf(p, REMAIN(p, end),
+		CONFIG_APPEND(p,
 		    "bloom_oldest=%s,", g.c_bloom_oldest ? "true" : "false");
-		p += snprintf(p, REMAIN(p, end),
-		    "merge_max=%" PRIu32 ",", g.c_merge_max);
-		p += snprintf(p, REMAIN(p, end), ",)");
+		CONFIG_APPEND(p, "merge_max=%" PRIu32 ",", g.c_merge_max);
+		CONFIG_APPEND(p, ",)");
 	}
 
-	if (REMAIN(p, end) == 0)
+	if (max == 0)
 		testutil_die(ENOMEM,
 		    "WT_SESSION.create configuration buffer too small");
 
@@ -490,14 +487,14 @@ wts_dump(const char *tag, int dump_bdb)
 
 	len = strlen(g.home) + strlen(BERKELEY_DB_PATH) + strlen(g.uri) + 100;
 	cmd = dmalloc(len);
-	(void)snprintf(cmd, len,
+	testutil_check(__wt_snprintf(cmd, len,
 	    "sh s_dumpcmp -h %s %s %s %s %s %s",
 	    g.home,
 	    dump_bdb ? "-b " : "",
 	    dump_bdb ? BERKELEY_DB_PATH : "",
 	    g.type == FIX || g.type == VAR ? "-c" : "",
 	    g.uri == NULL ? "" : "-n",
-	    g.uri == NULL ? "" : g.uri);
+	    g.uri == NULL ? "" : g.uri));
 
 	testutil_checkfmt(system(cmd), "%s: dump comparison failed", tag);
 	free(cmd);
@@ -587,7 +584,7 @@ wts_stats(void)
 	fprintf(fp, "\n\n====== Data source statistics:\n");
 	len = strlen("statistics:") + strlen(g.uri) + 1;
 	stat_name = dmalloc(len);
-	snprintf(stat_name, len, "statistics:%s", g.uri);
+	testutil_check(__wt_snprintf(stat_name, len, "statistics:%s", g.uri));
 	testutil_check(session->open_cursor(
 	    session, stat_name, NULL, NULL, &cursor));
 	free(stat_name);
diff --git a/test/manydbs/manydbs.c b/test/manydbs/manydbs.c
index 345c470ba90..42020d6ce9a 100644
--- a/test/manydbs/manydbs.c
+++ b/test/manydbs/manydbs.c
@@ -168,7 +168,8 @@ main(int argc, char *argv[])
 	testutil_make_work_dir(home);
 	__wt_random_init(&rnd);
 	for (i = 0; i < dbs; ++i) {
-		snprintf(hometmp, HOME_SIZE, "%s/%s.%d", home, HOME_BASE, i);
+		testutil_check(__wt_snprintf(
+		    hometmp, HOME_SIZE, "%s/%s.%d", home, HOME_BASE, i));
 		testutil_make_work_dir(hometmp);
 		/*
 		 * Open each database.  Rotate different configurations
diff --git a/test/readonly/readonly.c b/test/readonly/readonly.c
index 746aecbf6c5..66c7a0ca692 100644
--- a/test/readonly/readonly.c
+++ b/test/readonly/readonly.c
@@ -206,10 +206,12 @@ main(int argc, char *argv[])
 	 * Set up all the directory names.
 	 */
 	testutil_work_dir_from_path(home, sizeof(home), working_dir);
-	(void)snprintf(home_wr, sizeof(home_wr), "%s%s", home, HOME_WR_SUFFIX);
-	(void)snprintf(home_rd, sizeof(home_rd), "%s%s", home, HOME_RD_SUFFIX);
-	(void)snprintf(
-	    home_rd2, sizeof(home_rd2), "%s%s", home, HOME_RD2_SUFFIX);
+	testutil_check(__wt_snprintf(
+	    home_wr, sizeof(home_wr), "%s%s", home, HOME_WR_SUFFIX));
+	testutil_check(__wt_snprintf(
+	    home_rd, sizeof(home_rd), "%s%s", home, HOME_RD_SUFFIX));
+	testutil_check(__wt_snprintf(
+	    home_rd2, sizeof(home_rd2), "%s%s", home, HOME_RD2_SUFFIX));
 	if (!child) {
 		testutil_make_work_dir(home);
 		testutil_make_work_dir(home_wr);
@@ -268,22 +270,22 @@ main(int argc, char *argv[])
 	 * Copy the database.  Remove any lock file from one copy
 	 * and chmod the copies to be read-only permissions.
 	 */
-	(void)snprintf(cmd, sizeof(cmd),
+	testutil_check(__wt_snprintf(cmd, sizeof(cmd),
 	    "cp -rp %s/* %s; rm -f %s/WiredTiger.lock",
-	    home, home_wr, home_wr);
+	    home, home_wr, home_wr));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 
-	(void)snprintf(cmd, sizeof(cmd),
+	testutil_check(__wt_snprintf(cmd, sizeof(cmd),
 	    "cp -rp %s/* %s; chmod 0555 %s; chmod -R 0444 %s/*",
-	    home, home_rd, home_rd, home_rd);
+	    home, home_rd, home_rd, home_rd));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 
-	(void)snprintf(cmd, sizeof(cmd),
+	testutil_check(__wt_snprintf(cmd, sizeof(cmd),
 	    "cp -rp %s/* %s; rm -f %s/WiredTiger.lock; "
 	    "chmod 0555 %s; chmod -R 0444 %s/*",
-	    home, home_rd2, home_rd2, home_rd2, home_rd2);
+	    home, home_rd2, home_rd2, home_rd2, home_rd2));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 
@@ -327,8 +329,8 @@ main(int argc, char *argv[])
 	 *
 	 * The child will exit with success if its test passes.
 	 */
-	(void)snprintf(
-	    cmd, sizeof(cmd), "%s -h %s -R", saved_argv0, working_dir);
+	testutil_check(__wt_snprintf(
+	    cmd, sizeof(cmd), "%s -h %s -R", saved_argv0, working_dir));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 	if (WEXITSTATUS(status) != 0)
@@ -337,8 +339,8 @@ main(int argc, char *argv[])
 	/*
 	 * Scenario 2.  Run child with writable config.
 	 */
-	(void)snprintf(
-	    cmd, sizeof(cmd), "%s -h %s -W", saved_argv0, working_dir);
+	testutil_check(__wt_snprintf(
+	    cmd, sizeof(cmd), "%s -h %s -W", saved_argv0, working_dir));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 	if (WEXITSTATUS(status) != 0)
@@ -358,8 +360,8 @@ main(int argc, char *argv[])
 	/*
 	 * Scenario 3.  Child read-only.
 	 */
-	(void)snprintf(
-	    cmd, sizeof(cmd), "%s -h %s -R", saved_argv0, working_dir);
+	testutil_check(__wt_snprintf(
+	    cmd, sizeof(cmd), "%s -h %s -R", saved_argv0, working_dir));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 	if (WEXITSTATUS(status) != 0)
@@ -368,8 +370,8 @@ main(int argc, char *argv[])
 	/*
 	 * Scenario 4.  Run child with writable config.
 	 */
-	(void)snprintf(
-	    cmd, sizeof(cmd), "%s -h %s -W", saved_argv0, working_dir);
+	testutil_check(__wt_snprintf(
+	    cmd, sizeof(cmd), "%s -h %s -W", saved_argv0, working_dir));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 	if (WEXITSTATUS(status) != 0)
@@ -390,11 +392,12 @@ main(int argc, char *argv[])
 	 * We need to chmod the read-only databases back so that they can
 	 * be removed by scripts.
 	 */
-	(void)snprintf(cmd, sizeof(cmd), "chmod 0777 %s %s", home_rd, home_rd2);
+	testutil_check(__wt_snprintf(
+	    cmd, sizeof(cmd), "chmod 0777 %s %s", home_rd, home_rd2));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
-	(void)snprintf(cmd, sizeof(cmd), "chmod -R 0666 %s/* %s/*",
-	    home_rd, home_rd2);
+	testutil_check(__wt_snprintf(
+	    cmd, sizeof(cmd), "chmod -R 0666 %s/* %s/*", home_rd, home_rd2));
 	if ((status = system(cmd)) < 0)
 		testutil_die(status, "system: %s", cmd);
 	printf(" *** Readonly test successful ***\n");
diff --git a/test/recovery/random-abort.c b/test/recovery/random-abort.c
index 1d6599ce1b3..febe6530534 100644
--- a/test/recovery/random-abort.c
+++ b/test/recovery/random-abort.c
@@ -94,14 +94,16 @@ thread_run(void *arg)
 	/*
 	 * The value is the name of the record file with our id appended.
 	 */
-	snprintf(buf, sizeof(buf), RECORDS_FILE, td->id);
+	testutil_check(__wt_snprintf(buf, sizeof(buf), RECORDS_FILE, td->id));
 	/*
 	 * Set up a large value putting our id in it.  Write it in there a
 	 * bunch of times, but the rest of the buffer can just be zero.
 	 */
-	snprintf(lgbuf, sizeof(lgbuf), "th-%" PRIu32, td->id);
+	testutil_check(__wt_snprintf(
+	    lgbuf, sizeof(lgbuf), "th-%" PRIu32, td->id));
 	for (i = 0; i < 128; i += strlen(lgbuf))
-		snprintf(&large[i], lsize - i, "%s", lgbuf);
+		testutil_check(__wt_snprintf(
+		    &large[i], lsize - i, "%s", lgbuf));
 	/*
 	 * Keep a separate file with the records we wrote for checking.
 	 */
@@ -124,7 +126,8 @@ thread_run(void *arg)
 	 * Write our portion of the key space until we're killed.
 	 */
 	for (i = td->start; ; ++i) {
-		snprintf(kname, sizeof(kname), "%" PRIu64, i);
+		testutil_check(__wt_snprintf(
+		    kname, sizeof(kname), "%" PRIu64, i));
 		cursor->set_key(cursor, kname);
 		/*
 		 * Every 30th record write a very large record that exceeds the
@@ -313,7 +316,8 @@ main(int argc, char *argv[])
 		 * still exists in case the child aborts for some reason we
 		 * don't stay in this loop forever.
 		 */
-		snprintf(statname, sizeof(statname), "%s/%s", home, fs_main);
+		testutil_check(__wt_snprintf(
+		    statname, sizeof(statname), "%s/%s", home, fs_main));
 		while (stat(statname, &sb) != 0 && kill(pid, 0) == 0)
 			sleep(1);
 		sleep(timeout);
@@ -348,7 +352,8 @@ main(int argc, char *argv[])
 	fatal = false;
 	for (i = 0; i < nth; ++i) {
 		middle = 0;
-		snprintf(fname, sizeof(fname), RECORDS_FILE, i);
+		testutil_check(__wt_snprintf(
+		    fname, sizeof(fname), RECORDS_FILE, i));
 		if ((fp = fopen(fname, "r")) == NULL)
 			testutil_die(errno, "fopen: %s", fname);
 
@@ -376,7 +381,8 @@ main(int argc, char *argv[])
 				    fname, key, last_key);
 				break;
 			}
-			snprintf(kname, sizeof(kname), "%" PRIu64, key);
+			testutil_check(__wt_snprintf(
+			    kname, sizeof(kname), "%" PRIu64, key));
 			cursor->set_key(cursor, kname);
 			if ((ret = cursor->search(cursor)) != 0) {
 				if (ret != WT_NOTFOUND)
diff --git a/test/recovery/truncated-log.c b/test/recovery/truncated-log.c
index 1f0a0f7a7bd..a127d8c1c63 100644
--- a/test/recovery/truncated-log.c
+++ b/test/recovery/truncated-log.c
@@ -30,11 +30,6 @@
 
 #include <sys/wait.h>
 
-#ifdef _WIN32
-/* snprintf is not supported on <= VS2013 */
-#define	snprintf _snprintf
-#endif
-
 static char home[1024];			/* Program working dir */
 static const char * const uri = "table:main";
 
@@ -137,7 +132,8 @@ usage(void)
  * Child process creates the database and table, and then writes data into
  * the table until it is killed by the parent.
  */
-static void fill_db(void)WT_GCC_FUNC_DECL_ATTRIBUTE((noreturn));
+static void fill_db(void)
+    WT_GCC_FUNC_DECL_ATTRIBUTE((noreturn));
 static void
 fill_db(void)
 {
@@ -193,9 +189,9 @@ fill_db(void)
 	max_key = min_key * 2;
 	first = true;
 	for (i = 0; i < max_key; ++i) {
-		snprintf(k, sizeof(k), "key%03d", (int)i);
-		snprintf(v, sizeof(v), "value%0*d",
-		    (int)(V_SIZE - strlen("value")), (int)i);
+		testutil_check(__wt_snprintf(k, sizeof(k), "key%03d", (int)i));
+		testutil_check(__wt_snprintf(v, sizeof(v), "value%0*d",
+		    (int)(V_SIZE - (strlen("value") + 1)), (int)i));
 		cursor->set_key(cursor, k);
 		cursor->set_value(cursor, v);
 		if ((ret = cursor->insert(cursor)) != 0)
diff --git a/test/salvage/salvage.c b/test/salvage/salvage.c
index 942f7faba03..83f9c6349bc 100644
--- a/test/salvage/salvage.c
+++ b/test/salvage/salvage.c
@@ -440,7 +440,8 @@ run(int r)
 
 	process();
 
-	snprintf(buf, sizeof(buf), "cmp %s %s > /dev/null", DUMP, RSLT);
+	testutil_check(__wt_snprintf(
+	    buf, sizeof(buf), "cmp %s %s > /dev/null", DUMP, RSLT));
 	if (system(buf)) {
 		fprintf(stderr,
 		    "check failed, salvage results were incorrect\n");
@@ -485,28 +486,28 @@ build(int ikey, int ivalue, int cnt)
 
 	switch (page_type) {
 	case WT_PAGE_COL_FIX:
-		(void)snprintf(config, sizeof(config),
+		testutil_check(__wt_snprintf(config, sizeof(config),
 		    "key_format=r,value_format=7t,"
 		    "allocation_size=%d,"
 		    "internal_page_max=%d,internal_item_max=%d,"
 		    "leaf_page_max=%d,leaf_item_max=%d",
-		    PSIZE, PSIZE, OSIZE, PSIZE, OSIZE);
+		    PSIZE, PSIZE, OSIZE, PSIZE, OSIZE));
 		break;
 	case WT_PAGE_COL_VAR:
-		(void)snprintf(config, sizeof(config),
+		testutil_check(__wt_snprintf(config, sizeof(config),
 		    "key_format=r,"
 		    "allocation_size=%d,"
 		    "internal_page_max=%d,internal_item_max=%d,"
 		    "leaf_page_max=%d,leaf_item_max=%d",
-		    PSIZE, PSIZE, OSIZE, PSIZE, OSIZE);
+		    PSIZE, PSIZE, OSIZE, PSIZE, OSIZE));
 		break;
 	case WT_PAGE_ROW_LEAF:
-		(void)snprintf(config, sizeof(config),
+		testutil_check(__wt_snprintf(config, sizeof(config),
 		    "key_format=u,"
 		    "allocation_size=%d,"
 		    "internal_page_max=%d,internal_item_max=%d,"
 		    "leaf_page_max=%d,leaf_item_max=%d",
-		    PSIZE, PSIZE, OSIZE, PSIZE, OSIZE);
+		    PSIZE, PSIZE, OSIZE, PSIZE, OSIZE));
 		break;
 	default:
 		assert(0);
@@ -520,7 +521,8 @@ build(int ikey, int ivalue, int cnt)
 		case WT_PAGE_COL_VAR:
 			break;
 		case WT_PAGE_ROW_LEAF:
-			snprintf(kbuf, sizeof(kbuf), "%010d KEY------", ikey);
+			testutil_check(__wt_snprintf(
+			   kbuf, sizeof(kbuf), "%010d KEY------", ikey));
 			key.data = kbuf;
 			key.size = 20;
 			cursor->set_key(cursor, &key);
@@ -533,8 +535,8 @@ build(int ikey, int ivalue, int cnt)
 			break;
 		case WT_PAGE_COL_VAR:
 		case WT_PAGE_ROW_LEAF:
-			snprintf(vbuf, sizeof(vbuf),
-			    "%010d VALUE----", value_unique ? ivalue : 37);
+			testutil_check(__wt_snprintf(vbuf, sizeof(vbuf),
+			    "%010d VALUE----", value_unique ? ivalue : 37));
 			value.data = vbuf;
 			value.size = 20;
 			cursor->set_value(cursor, &value);
@@ -621,9 +623,9 @@ process(void)
 	/* Salvage. */
 	config[0] = '\0';
 	if (verbose)
-		snprintf(config, sizeof(config),
+		testutil_check(__wt_snprintf(config, sizeof(config),
 		    "error_prefix=\"%s\",verbose=[salvage,verify],",
-		    progname);
+		    progname));
 	strcat(config, "log=(enabled=false),");
 
 	CHECK(wiredtiger_open(NULL, NULL, config, &conn) == 0);
diff --git a/test/thread/file.c b/test/thread/file.c
index 81ec6ad44f8..7a7d16c4cd6 100644
--- a/test/thread/file.c
+++ b/test/thread/file.c
@@ -33,20 +33,18 @@ file_create(const char *name)
 {
 	WT_SESSION *session;
 	int ret;
-	char *p, *end, config[128];
+	char config[128];
 
 	if ((ret = conn->open_session(conn, NULL, NULL, &session)) != 0)
 		testutil_die(ret, "conn.session");
 
-	p = config;
-	end = config + sizeof(config);
-	p += snprintf(p, (size_t)(end - p),
+	testutil_check(__wt_snprintf(config, sizeof(config),
 	    "key_format=%s,"
 	    "internal_page_max=%d,"
-	    "leaf_page_max=%d,",
-	    ftype == ROW ? "u" : "r", 16 * 1024, 128 * 1024);
-	if (ftype == FIX)
-		(void)snprintf(p, (size_t)(end - p), ",value_format=3t");
+	    "leaf_page_max=%d,"
+	    "%s",
+	    ftype == ROW ? "u" : "r", 16 * 1024, 128 * 1024,
+	    ftype == FIX ? ",value_format=3t" : ""));
 
 	if ((ret = session->create(session, name, config)) != 0)
 		if (ret != EEXIST)
@@ -62,9 +60,10 @@ load(const char *name)
 	WT_CURSOR *cursor;
 	WT_ITEM *key, _key, *value, _value;
 	WT_SESSION *session;
-	char keybuf[64], valuebuf[64];
-	u_int keyno;
+	uint64_t keyno;
+	size_t len;
 	int ret;
+	char keybuf[64], valuebuf[64];
 
 	file_create(name);
 
@@ -79,18 +78,22 @@ load(const char *name)
 	value = &_value;
 	for (keyno = 1; keyno <= nkeys; ++keyno) {
 		if (ftype == ROW) {
+			testutil_check(__wt_snprintf_len_set(
+			    keybuf, sizeof(keybuf),
+			    &len, "%017" PRIu64, keyno));
 			key->data = keybuf;
-			key->size = (uint32_t)
-			    snprintf(keybuf, sizeof(keybuf), "%017u", keyno);
+			key->size = (uint32_t)len;
 			cursor->set_key(cursor, key);
 		} else
-			cursor->set_key(cursor, (uint32_t)keyno);
-		value->data = valuebuf;
+			cursor->set_key(cursor, keyno);
 		if (ftype == FIX)
 			cursor->set_value(cursor, 0x01);
 		else {
-			value->size = (uint32_t)
-			    snprintf(valuebuf, sizeof(valuebuf), "%37u", keyno);
+			testutil_check(__wt_snprintf_len_set(
+			    valuebuf, sizeof(valuebuf),
+			    &len, "%37" PRIu64, keyno));
+			value->data = valuebuf;
+			value->size = (uint32_t)len;
 			cursor->set_value(cursor, value);
 		}
 		if ((ret = cursor->insert(cursor)) != 0)
diff --git a/test/thread/rw.c b/test/thread/rw.c
index c6107a06c49..e8a2650ca51 100644
--- a/test/thread/rw.c
+++ b/test/thread/rw.c
@@ -66,7 +66,8 @@ rw_start(u_int readers, u_int writers)
 	for (i = 0; i < writers; ++i) {
 		if (i == 0 || multiple_files) {
 			run_info[i].name = dmalloc(64);
-			snprintf(run_info[i].name, 64, FNAME, i);
+			testutil_check(__wt_snprintf(
+			    run_info[i].name, 64, FNAME, i));
 
 			/* Vary by orders of magnitude */
 			if (vary_nops)
@@ -88,8 +89,8 @@ rw_start(u_int readers, u_int writers)
 			run_info[offset].name = dmalloc(64);
 			/* Have readers read from tables with writes. */
 			name_index = i % writers;
-			snprintf(
-			    run_info[offset].name, 64, FNAME, name_index);
+			testutil_check(__wt_snprintf(
+			    run_info[offset].name, 64, FNAME, name_index));
 
 			/* Vary by orders of magnitude */
 			if (vary_nops)
@@ -158,7 +159,8 @@ static inline void
 reader_op(WT_SESSION *session, WT_CURSOR *cursor, INFO *s)
 {
 	WT_ITEM *key, _key;
-	u_int keyno;
+	size_t len;
+	uint64_t keyno;
 	int ret;
 	char keybuf[64];
 
@@ -166,17 +168,18 @@ reader_op(WT_SESSION *session, WT_CURSOR *cursor, INFO *s)
 
 	keyno = __wt_random(&s->rnd) % nkeys + 1;
 	if (ftype == ROW) {
+		testutil_check(__wt_snprintf_len_set(
+		    keybuf, sizeof(keybuf), &len, "%017" PRIu64, keyno));
 		key->data = keybuf;
-		key->size = (uint32_t)
-		    snprintf(keybuf, sizeof(keybuf), "%017u", keyno);
+		key->size = (uint32_t)len;
 		cursor->set_key(cursor, key);
 	} else
-		cursor->set_key(cursor, (uint32_t)keyno);
+		cursor->set_key(cursor, keyno);
 	if ((ret = cursor->search(cursor)) != 0 && ret != WT_NOTFOUND)
 		testutil_die(ret, "cursor.search");
 	if (log_print)
 		testutil_check(session->log_printf(session,
-		    "Reader Thread %p key %017u", pthread_self(), keyno));
+		    "Reader Thread %p key %017" PRIu64, pthread_self(), keyno));
 }
 
 /*
@@ -195,7 +198,7 @@ reader(void *arg)
 
 	id = (int)(uintptr_t)arg;
 	s = &run_info[id];
-	__wt_thread_id(tid, sizeof(tid));
+	testutil_check(__wt_thread_id(tid, sizeof(tid)));
 	__wt_random_init(&s->rnd);
 
 	printf(" read thread %2d starting: tid: %s, file: %s\n",
@@ -242,7 +245,8 @@ static inline void
 writer_op(WT_SESSION *session, WT_CURSOR *cursor, INFO *s)
 {
 	WT_ITEM *key, _key, *value, _value;
-	u_int keyno;
+	uint64_t keyno;
+	size_t len;
 	int ret;
 	char keybuf[64], valuebuf[64];
 
@@ -251,12 +255,13 @@ writer_op(WT_SESSION *session, WT_CURSOR *cursor, INFO *s)
 
 	keyno = __wt_random(&s->rnd) % nkeys + 1;
 	if (ftype == ROW) {
+		testutil_check(__wt_snprintf_len_set(
+		    keybuf, sizeof(keybuf), &len, "%017" PRIu64, keyno));
 		key->data = keybuf;
-		key->size = (uint32_t)
-		    snprintf(keybuf, sizeof(keybuf), "%017u", keyno);
+		key->size = (uint32_t)len;
 		cursor->set_key(cursor, key);
 	} else
-		cursor->set_key(cursor, (uint32_t)keyno);
+		cursor->set_key(cursor, keyno);
 	if (keyno % 5 == 0) {
 		++s->remove;
 		if ((ret =
@@ -268,8 +273,10 @@ writer_op(WT_SESSION *session, WT_CURSOR *cursor, INFO *s)
 		if (ftype == FIX)
 			cursor->set_value(cursor, 0x10);
 		else {
-			value->size = (uint32_t)snprintf(
-			    valuebuf, sizeof(valuebuf), "XXX %37u", keyno);
+			testutil_check(__wt_snprintf_len_set(
+			    valuebuf, sizeof(valuebuf),
+			    &len, "XXX %37" PRIu64, keyno));
+			value->size = (uint32_t)len;
 			cursor->set_value(cursor, value);
 		}
 		if ((ret = cursor->update(cursor)) != 0)
@@ -277,7 +284,7 @@ writer_op(WT_SESSION *session, WT_CURSOR *cursor, INFO *s)
 	}
 	if (log_print)
 		testutil_check(session->log_printf(session,
-		    "Writer Thread %p key %017u", pthread_self(), keyno));
+		    "Writer Thread %p key %017" PRIu64, pthread_self(), keyno));
 }
 
 /*
@@ -296,7 +303,7 @@ writer(void *arg)
 
 	id = (int)(uintptr_t)arg;
 	s = &run_info[id];
-	__wt_thread_id(tid, sizeof(tid));
+	testutil_check(__wt_thread_id(tid, sizeof(tid)));
 	__wt_random_init(&s->rnd);
 
 	printf("write thread %2d starting: tid: %s, file: %s\n",
diff --git a/test/thread/stats.c b/test/thread/stats.c
index 67a2c02719b..839d65e8a4d 100644
--- a/test/thread/stats.c
+++ b/test/thread/stats.c
@@ -65,7 +65,8 @@ stats(void)
 
 	/* File statistics. */
 	if (!multiple_files) {
-		(void)snprintf(name, sizeof(name), "statistics:" FNAME, 0);
+		testutil_check(__wt_snprintf(
+		    name, sizeof(name), "statistics:" FNAME, 0));
 		if ((ret = session->open_cursor(
 		    session, name, NULL, NULL, &cursor)) != 0)
 			testutil_die(ret, "session.open_cursor");
diff --git a/test/thread/t.c b/test/thread/t.c
index 9dfd02bdad2..d2ed4c74bb7 100644
--- a/test/thread/t.c
+++ b/test/thread/t.c
@@ -185,19 +185,15 @@ wt_connect(char *config_open)
 	};
 	int ret;
 	char config[512];
-	size_t print_count;
 
 	testutil_clean_work_dir(home);
 	testutil_make_work_dir(home);
 
-	print_count = (size_t)snprintf(config, sizeof(config),
+	testutil_check(__wt_snprintf(config, sizeof(config),
 	    "create,statistics=(all),error_prefix=\"%s\",%s%s",
 	    progname,
 	    config_open == NULL ? "" : ",",
-	    config_open == NULL ? "" : config_open);
-
-	if (print_count >= sizeof(config))
-		testutil_die(EINVAL, "Config string too long");
+	    config_open == NULL ? "" : config_open));
 
 	if ((ret = wiredtiger_open(home, &event_handler, config, &conn)) != 0)
 		testutil_die(ret, "wiredtiger_open");
diff --git a/test/utility/misc.c b/test/utility/misc.c
index 61dad3d76c2..934dac86a7b 100644
--- a/test/utility/misc.c
+++ b/test/utility/misc.c
@@ -108,14 +108,14 @@ testutil_clean_work_dir(const char *dir)
 	if ((buf = malloc(len)) == NULL)
 		testutil_die(ENOMEM, "Failed to allocate memory");
 
-	snprintf(buf, len, "%s %s %s %s", DIR_EXISTS_COMMAND, dir,
-		 RM_COMMAND, dir);
+	testutil_check(__wt_snprintf(
+	    buf, len, "%s %s %s %s", DIR_EXISTS_COMMAND, dir, RM_COMMAND, dir));
 #else
 	len = strlen(dir) + strlen(RM_COMMAND) + 1;
 	if ((buf = malloc(len)) == NULL)
 		testutil_die(ENOMEM, "Failed to allocate memory");
 
-	snprintf(buf, len, "%s%s", RM_COMMAND, dir);
+	testutil_check(__wt_snprintf(buf, len, "%s%s", RM_COMMAND, dir));
 #endif
 
 	if ((ret = system(buf)) != 0 && ret != ENOENT)
@@ -142,7 +142,7 @@ testutil_make_work_dir(char *dir)
 		testutil_die(ENOMEM, "Failed to allocate memory");
 
 	/* mkdir shares syntax between Windows and Linux */
-	snprintf(buf, len, "%s%s", MKDIR_COMMAND, dir);
+	testutil_check(__wt_snprintf(buf, len, "%s%s", MKDIR_COMMAND, dir));
 	if ((ret = system(buf)) != 0)
 		testutil_die(ret, "%s", buf);
 	free(buf);
diff --git a/test/utility/parse_opts.c b/test/utility/parse_opts.c
index af9256b199a..c3eff3360de 100644
--- a/test/utility/parse_opts.c
+++ b/test/utility/parse_opts.c
@@ -115,13 +115,15 @@ testutil_parse_opts(int argc, char * const *argv, TEST_OPTS *opts)
 	if (opts->home == NULL) {
 		len = strlen("WT_TEST.")  + strlen(opts->progname) + 10;
 		opts->home = dmalloc(len);
-		snprintf(opts->home, len, "WT_TEST.%s", opts->progname);
+		testutil_check(__wt_snprintf(
+		    opts->home, len, "WT_TEST.%s", opts->progname));
 	}
 
 	/* Setup the default URI string */
 	len = strlen("table:") + strlen(opts->progname) + 10;
 	opts->uri = dmalloc(len);
-	snprintf(opts->uri, len, "table:%s", opts->progname);
+	testutil_check(__wt_snprintf(
+	    opts->uri, len, "table:%s", opts->progname));
 
 	return (0);
 }
diff --git a/test/utility/thread.c b/test/utility/thread.c
index 38465b2f02b..122ad554442 100644
--- a/test/utility/thread.c
+++ b/test/utility/thread.c
@@ -57,8 +57,8 @@ thread_append(void *arg)
 		if (opts->table_type == TABLE_FIX)
 			cursor->set_value(cursor, buf[0]);
 		else {
-			snprintf(buf, sizeof(buf),
-			    "%" PRIu64 " VALUE ------", recno);
+			testutil_check(__wt_snprintf(buf, sizeof(buf),
+			    "%" PRIu64 " VALUE ------", recno));
 			cursor->set_value(cursor, buf);
 		}
 		testutil_check(cursor->insert(cursor));
@@ -94,7 +94,8 @@ thread_insert_append(void *arg)
 	    session, opts->uri, NULL, NULL, &cursor));
 
 	for (i = 0; i < opts->nrecords; ++i) {
-		snprintf(kbuf, sizeof(kbuf), "%010d KEY------", (int)i);
+		testutil_check(__wt_snprintf(
+		    kbuf, sizeof(kbuf), "%010d KEY------", (int)i));
 		cursor->set_key(cursor, kbuf);
 		cursor->set_value(cursor, "========== VALUE =======");
 		testutil_check(cursor->insert(cursor));
diff --git a/test/windows/windows_shim.h b/test/windows/windows_shim.h
index 648b991b1a2..8985904fb19 100644
--- a/test/windows/windows_shim.h
+++ b/test/windows/windows_shim.h
@@ -36,6 +36,8 @@
 #include <io.h>
 #include <process.h>
 
+#include "wt_internal.h"
+
 #define	inline __inline
 
 /* Define some POSIX types */
@@ -52,12 +54,7 @@ typedef int u_int;
 
 /* snprintf does not exist on <= VS 2013 */
 #if _MSC_VER < 1900
-#define	snprintf _wt_snprintf
-
-_Check_return_opt_ int __cdecl _wt_snprintf(
-    _Out_writes_(_MaxCount) char * _DstBuf,
-    _In_ size_t _MaxCount,
-    _In_z_ _Printf_format_string_ const char * _Format, ...);
+#define	snprintf __wt_snprintf
 #endif
 
 /*