diff --git a/cpu_ref/rsCpuScript.cpp b/cpu_ref/rsCpuScript.cpp
index 508381f..16b3ec6 100644
--- a/cpu_ref/rsCpuScript.cpp
+++ b/cpu_ref/rsCpuScript.cpp
@@ -674,6 +674,12 @@
                                         const void * usr, uint32_t usrLen,
                                         const RsScriptCall *sc,
                                         MTLaunchStructForEach *mtls) {
+    if (ains == nullptr && inLen != 0) {
+        mCtx->getContext()->setError(RS_ERROR_BAD_SCRIPT,
+          "rsForEach called with none-zero inLen with null in allocations");
+        return false;
+    }
+
     memset(mtls, 0, sizeof(MTLaunchStructForEach));
     mtls->dimPtr = &mtls->fep.dim;
 
diff --git a/driver/rsdRuntimeStubs.cpp b/driver/rsdRuntimeStubs.cpp
index 5841991..2ac731d 100644
--- a/driver/rsdRuntimeStubs.cpp
+++ b/driver/rsdRuntimeStubs.cpp
@@ -138,7 +138,7 @@
 
     if (impl->getInForEach()) {
         char buf[256];
-        sprintf(buf, "Error: Call to unsupported function %s "
+        snprintf(buf, sizeof(buf), "Error: Call to unsupported function %s "
                          "in kernel", funcName);
         rsc->setError(RS_ERROR_FATAL_DRIVER, buf);
         return true;
@@ -441,32 +441,32 @@
 
     char buf[256];
     if (x && (x >= t->getLODDimX(0))) {
-        sprintf(buf, "Out range ElementAt X %i of %i", x, t->getLODDimX(0));
+        snprintf(buf, sizeof(buf), "Out range ElementAt X %i of %i", x, t->getLODDimX(0));
         rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
         return nullptr;
     }
 
     if (y && (y >= t->getLODDimY(0))) {
-        sprintf(buf, "Out range ElementAt Y %i of %i", y, t->getLODDimY(0));
+        snprintf(buf, sizeof(buf), "Out range ElementAt Y %i of %i", y, t->getLODDimY(0));
         rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
         return nullptr;
     }
 
     if (z && (z >= t->getLODDimZ(0))) {
-        sprintf(buf, "Out range ElementAt Z %i of %i", z, t->getLODDimZ(0));
+        snprintf(buf, sizeof(buf), "Out range ElementAt Z %i of %i", z, t->getLODDimZ(0));
         rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
         return nullptr;
     }
 
     if (vecSize > 0) {
         if (vecSize != e->getVectorSize()) {
-            sprintf(buf, "Vector size mismatch for ElementAt %i of %i", vecSize, e->getVectorSize());
+            snprintf(buf, sizeof(buf), "Vector size mismatch for ElementAt %i of %i", vecSize, e->getVectorSize());
             rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
             return nullptr;
         }
 
         if (dt != e->getType()) {
-            sprintf(buf, "Data type mismatch for ElementAt %i of %i", dt, e->getType());
+            snprintf(buf, sizeof(buf), "Data type mismatch for ElementAt %i of %i", dt, e->getType());
             rsc->setError(RS_ERROR_FATAL_DEBUG, buf);
             return nullptr;
         }