Index: src/rendergl.mm
==================================================================
--- src/rendergl.mm
+++ src/rendergl.mm
@@ -161,21 +161,22 @@
 
 // management of texture slots
 // each texture slot can have multople texture frames, of which currently only
 // the first is used additional frames can be used for various shaders
 
-const int MAXTEX = 1000;
-int texx[MAXTEX]; // ( loaded texture ) -> ( name, size )
-int texy[MAXTEX];
-string texname[MAXTEX];
-int curtex = 0;
-const int FIRSTTEX = 1000; // opengl id = loaded id + FIRSTTEX
+static const int MAXTEX = 1000;
+static int texx[MAXTEX]; // ( loaded texture ) -> ( name, size )
+static int texy[MAXTEX];
+static OFString *texname[MAXTEX];
+static int curtex = 0;
+static const int FIRSTTEX = 1000; // opengl id = loaded id + FIRSTTEX
 // std 1+, sky 14+, mdls 20+
 
-const int MAXFRAMES = 2;     // increase to allow more complex shader defs
-int mapping[256][MAXFRAMES]; // ( cube texture, frame ) -> ( opengl id, name )
-string mapname[256][MAXFRAMES];
+static const int MAXFRAMES = 2; // increase to allow more complex shader defs
+static int mapping[256]
+                  [MAXFRAMES]; // ( cube texture, frame ) -> ( opengl id, name )
+static OFString *mapname[256][MAXFRAMES];
 
 void
 purgetextures()
 {
 	loopi(256) loop(j, MAXFRAMES) mapping[i][j] = 0;
@@ -196,12 +197,11 @@
 	@autoreleasepool {
 		int num = curtexnum++, frame = (int)aframe.longLongValue;
 		if (num < 0 || num >= 256 || frame < 0 || frame >= MAXFRAMES)
 			return;
 		mapping[num][frame] = 1;
-		char *n = mapname[num][frame];
-		strcpy_s(n, name.UTF8String);
+		mapname[num][frame] = name;
 	}
 }
 COMMAND(texture, ARG_2STR)
 
 int
@@ -220,11 +220,11 @@
 	if (tid == 0)
 		return 1; // crosshair :)
 
 	loopi(curtex) // lazily happens once per "texture" command, basically
 	{
-		if (strcmp(mapname[tex][frame], texname[i]) == 0) {
+		if ([mapname[tex][frame] isEqual:texname[i]]) {
 			mapping[tex][frame] = tid = i + FIRSTTEX;
 			*xs = texx[i];
 			*ys = texy[i];
 			return tid;
 		}
@@ -232,15 +232,15 @@
 
 	if (curtex == MAXTEX)
 		fatal(@"loaded too many textures");
 
 	int tnum = curtex + FIRSTTEX;
-	strcpy_s(texname[curtex], mapname[tex][frame]);
+	texname[curtex] = mapname[tex][frame];
 
 	@autoreleasepool {
 		OFString *path =
-		    [OFString stringWithFormat:@"packages/%s", texname[curtex]];
+		    [OFString stringWithFormat:@"packages/%@", texname[curtex]];
 
 		if (installtex(tnum,
 		        [Cube.sharedInstance.gameDataIRI
 		            IRIByAppendingPathComponent:path],
 		        xs, ys, false)) {

Index: src/serverms.mm
==================================================================
--- src/serverms.mm
+++ src/serverms.mm
@@ -1,17 +1,20 @@
 // all server side masterserver and pinging functionality
 
 #include "cube.h"
 
-ENetSocket mssock = ENET_SOCKET_NULL;
+static ENetSocket mssock = ENET_SOCKET_NULL;
 
-void
-httpgetsend(ENetAddress &ad, char *hostname, char *req, char *ref, char *agent)
+static void
+httpgetsend(ENetAddress &ad, OFString *hostname, OFString *req, OFString *ref,
+    OFString *agent)
 {
 	if (ad.host == ENET_HOST_ANY) {
-		printf("looking up %s...\n", hostname);
-		enet_address_set_host(&ad, hostname);
+		[OFStdOut writeFormat:@"looking up %@...\n", hostname];
+		@autoreleasepool {
+			enet_address_set_host(&ad, hostname.UTF8String);
+		}
 		if (ad.host == ENET_HOST_ANY)
 			return;
 	}
 	if (mssock != ENET_SOCKET_NULL)
 		enet_socket_destroy(mssock);
@@ -23,20 +26,22 @@
 	if (enet_socket_connect(mssock, &ad) < 0) {
 		printf("could not connect\n");
 		return;
 	}
 	ENetBuffer buf;
-	sprintf_sd(httpget)(
-	    "GET %s HTTP/1.0\nHost: %s\nReferer: %s\nUser-Agent: %s\n\n", req,
-	    hostname, ref, agent);
-	buf.data = httpget;
-	buf.dataLength = strlen((char *)buf.data);
-	printf("sending request to %s...\n", hostname);
+	OFString *httpget = [OFString stringWithFormat:@"GET %@ HTTP/1.0\n"
+	                                               @"Host: %@\n"
+	                                               @"Referer: %@\n"
+	                                               @"User-Agent: %@\n\n",
+	                              req, hostname, ref, agent];
+	buf.data = (void *)httpget.UTF8String;
+	buf.dataLength = httpget.UTF8StringLength;
+	[OFStdOut writeFormat:@"sending request to %@...\n", hostname];
 	enet_socket_send(mssock, NULL, &buf, 1);
 }
 
-void
+static void
 httpgetrecieve(ENetBuffer &buf)
 {
 	if (mssock == ENET_SOCKET_NULL)
 		return;
 	enet_uint32 events = ENET_SOCKET_WAIT_RECEIVE;
@@ -51,42 +56,46 @@
 		((char *)buf.data)[0] = 0;
 		buf.dataLength -= len;
 	}
 }
 
-uchar *
+static uchar *
 stripheader(uchar *b)
 {
 	char *s = strstr((char *)b, "\n\r\n");
 	if (!s)
 		s = strstr((char *)b, "\n\n");
 	return s ? (uchar *)s : b;
 }
 
-ENetAddress masterserver = { ENET_HOST_ANY, 80 };
-int updmaster = 0;
-string masterbase;
-string masterpath;
-uchar masterrep[MAXTRANS];
-ENetBuffer masterb;
-
-void
+static ENetAddress masterserver = { ENET_HOST_ANY, 80 };
+static int updmaster = 0;
+static OFString *masterbase;
+static OFString *masterpath;
+static uchar masterrep[MAXTRANS];
+static ENetBuffer masterb;
+
+static void
 updatemasterserver(int seconds)
 {
 	// send alive signal to masterserver every hour of uptime
 	if (seconds > updmaster) {
-		sprintf_sd(path)("%sregister.do?action=add", masterpath);
-		httpgetsend(masterserver, masterbase, path, "cubeserver",
-		    "Cube Server");
+		@autoreleasepool {
+			OFString *path = [OFString
+			    stringWithFormat:@"%@register.do?action=add",
+			    masterpath];
+			httpgetsend(masterserver, masterbase, path,
+			    @"cubeserver", @"Cube Server");
+		}
 		masterrep[0] = 0;
 		masterb.data = masterrep;
 		masterb.dataLength = MAXTRANS - 1;
 		updmaster = seconds + 60 * 60;
 	}
 }
 
-void
+static void
 checkmasterreply()
 {
 	bool busy = mssock != ENET_SOCKET_NULL;
 	httpgetrecieve(masterb);
 	if (busy && mssock == ENET_SOCKET_NULL)
@@ -94,23 +103,26 @@
 }
 
 uchar *
 retrieveservers(uchar *buf, int buflen)
 {
-	sprintf_sd(path)("%sretrieve.do?item=list", masterpath);
-	httpgetsend(
-	    masterserver, masterbase, path, "cubeserver", "Cube Server");
+	@autoreleasepool {
+		OFString *path = [OFString
+		    stringWithFormat:@"%@retrieve.do?item=list", masterpath];
+		httpgetsend(masterserver, masterbase, path, @"cubeserver",
+		    @"Cube Server");
+	}
 	ENetBuffer eb;
 	buf[0] = 0;
 	eb.data = buf;
 	eb.dataLength = buflen - 1;
 	while (mssock != ENET_SOCKET_NULL)
 		httpgetrecieve(eb);
 	return stripheader(buf);
 }
 
-ENetSocket pongsock = ENET_SOCKET_NULL;
+static ENetSocket pongsock = ENET_SOCKET_NULL;
 static OFString *serverdesc;
 
 void
 serverms(int mode, int numplayers, int minremain, OFString *smapname,
     int seconds, bool isfull)
@@ -151,12 +163,13 @@
 	@autoreleasepool {
 		const char *master = master_.UTF8String;
 		const char *mid = strstr(master, "/");
 		if (!mid)
 			mid = master;
-		strcpy_s(masterpath, mid);
-		strn0cpy(masterbase, master, mid - master + 1);
+		masterpath = @(mid);
+		masterbase = [[OFString alloc] initWithUTF8String:master
+		                                           length:mid - master];
 		serverdesc = sdesc;
 
 		if (listen) {
 			ENetAddress address = { ENET_HOST_ANY,
 				CUBE_SERVINFO_PORT };