11 files changed, 339 insertions, 307 deletions

diff --git a/src/OS/Makefile-Base b/src/OS/Makefile-Base
index cba5cd359..2e77adbd5 100644
--- a/src/OS/Makefile-Base
+++ b/src/OS/Makefile-Base
@@ -447,7 +447,13 @@ MONBIN = em_StripChart.o $(EXIMON_TEXTPOP) em_globals.o em_init.o \
 # The complete modules list also includes some specially compiled versions of
 # code from the main Exim source tree.
 
-OBJ_MONBIN = util-spool_in.o util-store.o util-string.o tod.o tree.o $(MONBIN)
+OBJ_MONBIN = util-spool_in.o \
+	     util-store.o \
+	     util-string.o \
+	     util-queue.o \
+	     tod.o \
+	     tree.o \
+	     $(MONBIN)
 
 eximon.bin: $(EXIMON_EDITME) eximon $(OBJ_MONBIN) \
             ../exim_monitor/em_version.c
@@ -564,6 +570,10 @@ util-string.o:   $(HDRS) string.c
 	@echo "$(CC) -DCOMPILE_UTILITY string.c"
 	$(FE)$(CC) -c $(CFLAGS) $(INCLUDE) -DCOMPILE_UTILITY -o util-string.o string.c
 
+util-queue.o:   $(HDRS) queue.c
+	@echo "$(CC) -DCOMPILE_UTILITY queue.c"
+	$(FE)$(CC) -c $(CFLAGS) $(INCLUDE) -DCOMPILE_UTILITY -o util-queue.o queue.c
+
 util-os.o:       $(HDRS) os.c
 	@echo "$(CC) -DCOMPILE_UTILITY os.c"
 	$(FE)$(CC) -c $(CFLAGS) $(INCLUDE) \
diff --git a/src/exim_monitor/em_menu.c b/src/exim_monitor/em_menu.c
index ccdfa05ba..dc24e3dfa 100644
--- a/src/exim_monitor/em_menu.c
+++ b/src/exim_monitor/em_menu.c
@@ -133,11 +133,12 @@ menu_is_up = FALSE;
 *          Display the message log               *
 *************************************************/
 
-static void msglogAction(Widget w, XtPointer client_data, XtPointer call_data)
+static void
+msglogAction(Widget w, XtPointer client_data, XtPointer call_data)
 {
 int i;
-uschar buffer[256];
 Widget text = text_create((uschar *)client_data, text_depth);
+uschar * fname;
 FILE *f = NULL;
 
 w = w;      /* Keep picky compilers happy */
@@ -147,18 +148,18 @@ call_data = call_data;
 
 for (i = 0; i < (spool_is_split? 2:1); i++)
   {
-  message_subdir[0] = (i != 0)? ((uschar *)client_data)[5] : 0;
-  snprintf(CS buffer, sizeof(buffer), "%s/msglog/%s/%s/%s",
-    spool_directory, queue_name, message_subdir, (uschar *)client_data);
-  if ((f = fopen(CS buffer, "r")))
+  message_subdir[0] = i != 0 ? ((uschar *)client_data)[5] : 0;
+  fname = spool_fname(US"msglog", message_subdir, US client_data, US"");
+  if ((f = fopen(CS fname, "r")))
     break;
   }
 
 if (f == NULL)
-  text_showf(text, "%s: %s\n", buffer, strerror(errno));
+  text_showf(text, "%s: %s\n", fname, strerror(errno));
 else
   {
-  while (Ufgets(buffer, 256, f) != NULL) text_show(text, buffer);
+  uschar buffer[256];
+  while (Ufgets(buffer, sizeof(buffer), f) != NULL) text_show(text, buffer);
   fclose(f);
   }
 }
@@ -169,10 +170,10 @@ else
 *          Display the message body               *
 *************************************************/
 
-static void bodyAction(Widget w, XtPointer client_data, XtPointer call_data)
+static void
+bodyAction(Widget w, XtPointer client_data, XtPointer call_data)
 {
 int i;
-uschar buffer[256];
 Widget text = text_create((uschar *)client_data, text_depth);
 FILE *f = NULL;
 
@@ -181,10 +182,10 @@ call_data = call_data;
 
 for (i = 0; i < (spool_is_split? 2:1); i++)
   {
+  uschar * fname;
   message_subdir[0] = i != 0 ? ((uschar *)client_data)[5] : 0;
-  snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s-D",
-    spool_directory, queue_name, message_subdir, (uschar *)client_data);
-  if ((f = fopen(CS buffer, "r")))
+  fname = spool_fname(US"input", message_subdir, US client_data, US"-D");
+  if ((f = fopen(CS fname, "r")))
     break;
   }
 
@@ -192,8 +193,10 @@ if (f == NULL)
   text_showf(text, "Failed to open file: %s\n", strerror(errno));
 else
   {
+  uschar buffer[256];
   int count = 0;
-  while (Ufgets(buffer, 256, f) != NULL)
+
+  while (Ufgets(buffer, sizeof(buffer), f) != NULL)
     {
     text_show(text, buffer);
     count += Ustrlen(buffer);
diff --git a/src/src/dcc.c b/src/src/dcc.c
index 2d9c16528..1841e733d 100644
--- a/src/src/dcc.c
+++ b/src/src/dcc.c
@@ -72,7 +72,6 @@ dcc_process(uschar **listptr)
   uschar sendbuf[4096];
   uschar recvbuf[4096];
   uschar dcc_return_text[1024];
-  uschar mbox_path[1024];
   uschar message_subdir[2];
   struct header_line *dcchdr;
   uschar *dcc_acl_options;
@@ -103,9 +102,10 @@ dcc_process(uschar **listptr)
   for (i = 0; i < 2; i++)
     {
     message_subdir[0] = split_spool_directory == (i == 0) ? message_id[5] : 0;
-    snprintf(CS mbox_path, sizeof(mbox_path), "%s/input/%s/%s/%s-D",
-	       spool_directory, queue_name, message_subdir, message_id);
-    if ((data_file = Ufopen(mbox_path,"rb")))
+
+    if ((data_file = Ufopen(
+	    spool_fname(US"input", message_subdir, message_id, US"-D"),
+	    "rb")))
       break;
     }
 
diff --git a/src/src/deliver.c b/src/src/deliver.c
index 1fd3d46c0..0a8d70002 100644
--- a/src/src/deliver.c
+++ b/src/src/deliver.c
@@ -76,8 +76,6 @@ static int  return_count;
 static uschar *frozen_info = US"";
 static uschar *used_return_path = NULL;
 
-static uschar spoolname[PATH_MAX];
-
 
 
 /*************************************************
@@ -285,10 +283,9 @@ int fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
 
 if (fd < 0 && errno == ENOENT)
   {
-  uschar * temp = string_sprintf("msglog%s%s%s%s",
-		    *queue_name ? "/" : "", queue_name,
-		    *message_subdir ? "/" : "", message_subdir);
-  (void)directory_make(spool_directory, temp, MSGLOG_DIRECTORY_MODE, TRUE);
+  (void)directory_make(spool_directory,
+			spool_sname(US"msglog", message_subdir),
+			MSGLOG_DIRECTORY_MODE, TRUE);
   fd = Uopen(filename, O_WRONLY|O_APPEND|O_CREAT, mode);
   }
 
@@ -1953,13 +1950,13 @@ if (  !shadowing
       || tp->log_output || tp->log_fail_output || tp->log_defer_output
    )  )
   {
-  uschar *error;
+  uschar * error;
+
   addr->return_filename =
-    string_sprintf("%s/msglog/%s/%s/%s-%d-%d",
-      spool_directory, queue_name, message_subdir,
-      message_id, getpid(), return_count++);
-  addr->return_file = open_msglog_file(addr->return_filename, 0400, &error);
-  if (addr->return_file < 0)
+    spool_fname(US"msglog", message_subdir, message_id,
+      string_sprintf("-%d-%d", getpid(), return_count++));
+  
+  if ((addr->return_file = open_msglog_file(addr->return_filename, 0400, &error)) < 0)
     {
     common_error(TRUE, addr, errno, US"Unable to %s file for %s transport "
       "to return message: %s", error, tp->name, strerror(errno));
@@ -4382,12 +4379,13 @@ for (delivery_count = 0; addr_remote; delivery_count++)
     a dup-with-new-file-pointer. */
 
     (void)close(deliver_datafile);
-    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
-      spool_directory, queue_name, message_subdir, message_id);
+    {
+    uschar * fname = spool_fname(US"input", message_subdir, message_id, US"-D");
 
-    if ((deliver_datafile = Uopen(spoolname, O_RDWR | O_APPEND, 0)) < 0)
+    if ((deliver_datafile = Uopen(fname, O_RDWR | O_APPEND, 0)) < 0)
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "Failed to reopen %s for remote "
-        "parallel delivery: %s", spoolname, strerror(errno));
+        "parallel delivery: %s", fname, strerror(errno));
+    }
 
     /* Set the close-on-exec flag */
 
@@ -5234,57 +5232,51 @@ store, and also the list of recipients and the tree of non-recipients and
 assorted flags. It updates message_size. If there is a reading or format error,
 give up; if the message has been around for sufficiently long, remove it. */
 
-sprintf(CS spoolname, "%s-H", id);
-if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK)
   {
-  if (errno == ERRNO_SPOOLFORMAT)
+  uschar * spoolname = string_sprintf("%s-H", id);
+  if ((rc = spool_read_header(spoolname, TRUE, TRUE)) != spool_read_OK)
     {
-    struct stat statbuf;
-    sprintf(CS big_buffer, "%s/input/%s/%s/%s",
-      spool_directory, queue_name, message_subdir, spoolname);
-    if (Ustat(big_buffer, &statbuf) == 0)
-      log_write(0, LOG_MAIN, "Format error in spool file %s: "
-        "size=" OFF_T_FMT, spoolname, statbuf.st_size);
-    else log_write(0, LOG_MAIN, "Format error in spool file %s", spoolname);
-    }
-  else
-    log_write(0, LOG_MAIN, "Error reading spool file %s: %s", spoolname,
-      strerror(errno));
+    if (errno == ERRNO_SPOOLFORMAT)
+      {
+      struct stat statbuf;
+      if (Ustat(spool_fname(US"input", message_subdir, spoolname, US""),
+		&statbuf) == 0)
+	log_write(0, LOG_MAIN, "Format error in spool file %s: "
+	  "size=" OFF_T_FMT, spoolname, statbuf.st_size);
+      else
+	log_write(0, LOG_MAIN, "Format error in spool file %s", spoolname);
+      }
+    else
+      log_write(0, LOG_MAIN, "Error reading spool file %s: %s", spoolname,
+	strerror(errno));
 
-  /* If we managed to read the envelope data, received_time contains the
-  time the message was received. Otherwise, we can calculate it from the
-  message id. */
+    /* If we managed to read the envelope data, received_time contains the
+    time the message was received. Otherwise, we can calculate it from the
+    message id. */
 
-  if (rc != spool_read_hdrerror)
-    {
-    received_time = 0;
-    for (i = 0; i < 6; i++)
-      received_time = received_time * BASE_62 + tab62[id[i] - '0'];
-    }
+    if (rc != spool_read_hdrerror)
+      {
+      received_time = 0;
+      for (i = 0; i < 6; i++)
+	received_time = received_time * BASE_62 + tab62[id[i] - '0'];
+      }
 
-  /* If we've had this malformed message too long, sling it. */
+    /* If we've had this malformed message too long, sling it. */
 
-  if (now - received_time > keep_malformed)
-    {
-    snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
-      spool_directory, queue_name, message_subdir, id);
-    Uunlink(spoolname);
-    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
-      spool_directory, queue_name, message_subdir, id);
-    Uunlink(spoolname);
-    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-H",
-      spool_directory, queue_name, message_subdir, id);
-    Uunlink(spoolname);
-    snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
-      spool_directory, queue_name, message_subdir, id);
-    Uunlink(spoolname);
-    log_write(0, LOG_MAIN, "Message removed because older than %s",
-      readconf_printtime(keep_malformed));
-    }
+    if (now - received_time > keep_malformed)
+      {
+      Uunlink(spool_fname(US"msglog", message_subdir, id, US""));
+      Uunlink(spool_fname(US"input", message_subdir, id, US"-D"));
+      Uunlink(spool_fname(US"input", message_subdir, id, US"-H"));
+      Uunlink(spool_fname(US"input", message_subdir, id, US"-J"));
+      log_write(0, LOG_MAIN, "Message removed because older than %s",
+	readconf_printtime(keep_malformed));
+      }
 
-  (void)close(deliver_datafile);
-  deliver_datafile = -1;
-  return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+    (void)close(deliver_datafile);
+    deliver_datafile = -1;
+    return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+    }
   }
 
 /* The spool header file has been read. Look to see if there is an existing
@@ -5296,38 +5288,39 @@ existence, as it will get further successful deliveries added to it in this
 run, and it will be deleted if this function gets to its end successfully.
 Otherwise it might be needed again. */
 
-snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
-  spool_directory, queue_name, message_subdir, id);
-
-if ((jread = Ufopen(spoolname, "rb")))
   {
-  while (Ufgets(big_buffer, big_buffer_size, jread))
+  uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+
+  if ((jread = Ufopen(fname, "rb")))
     {
-    int n = Ustrlen(big_buffer);
-    big_buffer[n-1] = 0;
-    tree_add_nonrecipient(big_buffer);
-    DEBUG(D_deliver) debug_printf("Previously delivered address %s taken from "
-      "journal file\n", big_buffer);
+    while (Ufgets(big_buffer, big_buffer_size, jread))
+      {
+      int n = Ustrlen(big_buffer);
+      big_buffer[n-1] = 0;
+      tree_add_nonrecipient(big_buffer);
+      DEBUG(D_deliver) debug_printf("Previously delivered address %s taken from "
+	"journal file\n", big_buffer);
+      }
+    (void)fclose(jread);
+    /* Panic-dies on error */
+    (void)spool_write_header(message_id, SW_DELIVERING, NULL);
+    }
+  else if (errno != ENOENT)
+    {
+    log_write(0, LOG_MAIN|LOG_PANIC, "attempt to open journal for reading gave: "
+      "%s", strerror(errno));
+    return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
     }
-  (void)fclose(jread);
-  /* Panic-dies on error */
-  (void)spool_write_header(message_id, SW_DELIVERING, NULL);
-  }
-else if (errno != ENOENT)
-  {
-  log_write(0, LOG_MAIN|LOG_PANIC, "attempt to open journal for reading gave: "
-    "%s", strerror(errno));
-  return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
-  }
 
-/* A null recipients list indicates some kind of disaster. */
+  /* A null recipients list indicates some kind of disaster. */
 
-if (!recipients_list)
-  {
-  (void)close(deliver_datafile);
-  deliver_datafile = -1;
-  log_write(0, LOG_MAIN, "Spool error: no recipients for %s", spoolname);
-  return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+  if (!recipients_list)
+    {
+    (void)close(deliver_datafile);
+    deliver_datafile = -1;
+    log_write(0, LOG_MAIN, "Spool error: no recipients for %s", fname);
+    return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
+    }
   }
 
 
@@ -5415,16 +5408,14 @@ done by rewriting the header spool file. */
 
 if (message_logs)
   {
-  uschar *error;
+  uschar * fname = spool_fname(US"msglog", message_subdir, id, US"");
+  uschar * error;
   int fd;
 
-  snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
-    spool_directory, queue_name, message_subdir, id);
-  
-  if ((fd = open_msglog_file(spoolname, SPOOL_MODE, &error)) < 0)
+  if ((fd = open_msglog_file(fname, SPOOL_MODE, &error)) < 0)
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't %s message log %s: %s", error,
-      spoolname, strerror(errno));
+      fname, strerror(errno));
     return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
     }
 
@@ -5433,7 +5424,7 @@ if (message_logs)
   if (!(message_log = fdopen(fd, "a")))
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't fdopen message log %s: %s",
-      spoolname, strerror(errno));
+      fname, strerror(errno));
     return continue_closedown();   /* yields DELIVER_NOT_ATTEMPTED */
     }
   }
@@ -6652,13 +6643,12 @@ therein are added to the non-recipients. */
 
 if (addr_local || addr_remote)
   {
-  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
-    spool_directory, queue_name, message_subdir, id);
+  uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
   
-  if ((journal_fd = Uopen(spoolname, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) <0)
+  if ((journal_fd = Uopen(fname, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) <0)
     {
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't open journal file %s: %s",
-      spoolname, strerror(errno));
+      fname, strerror(errno));
     return DELIVER_NOT_ATTEMPTED;
     }
 
@@ -6671,12 +6661,12 @@ if (addr_local || addr_remote)
     || fchmod(journal_fd, SPOOL_MODE)
     )
     {
-    int ret = Uunlink(spoolname);
+    int ret = Uunlink(fname);
     log_write(0, LOG_MAIN|LOG_PANIC, "Couldn't set perms on journal file %s: %s",
-      spoolname, strerror(errno));
+      fname, strerror(errno));
     if(ret  &&  errno != ENOENT)
       log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-        spoolname, strerror(errno));
+        fname, strerror(errno));
     return DELIVER_NOT_ATTEMPTED;
     }
   }
@@ -7517,43 +7507,43 @@ Then delete the message itself. */
 
 if (!addr_defer)
   {
+  uschar * fname;
+
   if (message_logs)
     {
-    snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
-      spool_directory, queue_name, message_subdir, id);
+    fname = spool_fname(US"msglog", message_subdir, id, US"");
     if (preserve_message_logs)
       {
       int rc;
-      sprintf(CS big_buffer, "%s/msglog.OLD/%s/%s",
-	spool_directory, queue_name, id);
-      if ((rc = Urename(spoolname, big_buffer)) < 0)
+      uschar * moname = spool_fname(US"msglog.OLD", US"", id, US"");
+
+      if ((rc = Urename(fname, moname)) < 0)
         {
-        (void)directory_make(spool_directory, US"msglog.OLD",
-          MSGLOG_DIRECTORY_MODE, TRUE);
-        rc = Urename(spoolname, big_buffer);
+        (void)directory_make(spool_directory,
+			      spool_sname(US"msglog.OLD", US""),
+			      MSGLOG_DIRECTORY_MODE, TRUE);
+        rc = Urename(fname, moname);
         }
       if (rc < 0)
         log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to move %s to the "
-          "msglog.OLD directory", spoolname);
+          "msglog.OLD directory", fname);
       }
     else
-      if (Uunlink(spoolname) < 0)
+      if (Uunlink(fname) < 0)
         log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-		  spoolname, strerror(errno));
+		  fname, strerror(errno));
     }
 
   /* Remove the two message files. */
 
-  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
-    spool_directory, queue_name, message_subdir, id);
-  if (Uunlink(spoolname) < 0)
+  fname = spool_fname(US"input", message_subdir, id, US"-D");
+  if (Uunlink(fname) < 0)
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-      spoolname, strerror(errno));
-  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-H",
-    spool_directory, queue_name, message_subdir, id);
-  if (Uunlink(spoolname) < 0)
+      fname, strerror(errno));
+  fname = spool_fname(US"input", message_subdir, id, US"-H");
+  if (Uunlink(fname) < 0)
     log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s",
-      spoolname, strerror(errno));
+      fname, strerror(errno));
 
   /* Log the end of this message, with queue time if requested. */
 
@@ -8020,10 +8010,10 @@ if (journal_fd >= 0) (void)close(journal_fd);
 
 if (remove_journal)
   {
-  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-J",
-    spool_directory, queue_name, message_subdir, id);
-  if (Uunlink(spoolname) < 0 && errno != ENOENT)
-    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", spoolname,
+  uschar * fname = spool_fname(US"input", message_subdir, id, US"-J");
+
+  if (Uunlink(fname) < 0 && errno != ENOENT)
+    log_write(0, LOG_MAIN|LOG_PANIC_DIE, "failed to unlink %s: %s", fname,
       strerror(errno));
 
   /* Move the message off the spool if reqested */
@@ -8098,6 +8088,7 @@ int rc;
 uschar * new_sender_address,
        * save_sender_address;
 BOOL save_qr = queue_running;
+uschar * spoolname;
 
 /* make spool_open_datafile non-noisy on fail */
 
@@ -8116,7 +8107,7 @@ spool_read_header() may change all of them. But OTOH, when this
 deliver_get_sender_address() gets called, the current message is done
 already and nobody needs the globals anymore. (HS12, 2015-08-21) */
 
-sprintf(CS spoolname, "%s-H", id);
+spoolname = string_sprintf("%s-H", id);
 save_sender_address = sender_address;
 
 rc = spool_read_header(spoolname, TRUE, TRUE);
diff --git a/src/src/functions.h b/src/src/functions.h
index f690e9fd9..0956c4069 100644
--- a/src/src/functions.h
+++ b/src/src/functions.h
@@ -406,6 +406,8 @@ extern int     spam(const uschar **);
 extern FILE   *spool_mbox(unsigned long *, const uschar *);
 #endif
 extern BOOL    spool_move_message(uschar *, uschar *, uschar *, uschar *);
+extern uschar *spool_fname(const uschar *, uschar *, uschar *, uschar *);
+extern uschar *spool_sname(const uschar *, uschar *);
 extern int     spool_open_datafile(uschar *);
 extern int     spool_open_temp(uschar *);
 extern int     spool_read_header(uschar *, BOOL, BOOL);
diff --git a/src/src/queue.c b/src/src/queue.c
index b6dff1107..d8c276013 100644
--- a/src/src/queue.c
+++ b/src/src/queue.c
@@ -20,6 +20,41 @@ Michael Haardt. */
 
 
 
+/* Routines with knowlege of spool layout */
+
+static void
+spool_pname_buf(uschar * buf, int len)
+{
+snprintf(CS buf, len, "%s/input/%s", spool_directory, queue_name);
+}
+
+static uschar *
+spool_dname(const uschar * purpose, uschar * subdir)
+{
+return string_sprintf("%s/%s/%s/%s",
+	spool_directory, purpose, queue_name, subdir);
+}
+
+uschar *
+spool_sname(const uschar * purpose, uschar * subdir)
+{
+return string_sprintf("%s%s%s%s%s",
+		    purpose,
+		    *queue_name ? "/" : "", queue_name,
+		    *message_subdir ? "/" : "", message_subdir);
+}
+
+uschar *
+spool_fname(const uschar * purpose, uschar * subdir, uschar * fname, uschar * suffix)
+{
+return string_sprintf("%s/%s/%s/%s/%s%s",
+	spool_directory, purpose, queue_name, subdir, fname, suffix);
+}
+
+
+
+
+#ifndef COMPILE_UTILITY
 /*************************************************
 *  Helper sort function for queue_get_spool_list *
 *************************************************/
@@ -142,7 +177,7 @@ else i = subdiroffset;
 
 /* Set up prototype for the directory name. */
 
-snprintf(CS buffer, sizeof(buffer), "%s/input/%s", spool_directory, queue_name);
+spool_pname_buf(buffer, sizeof(buffer));
 buffer[sizeof(buffer) - 3] = 0;
 subptr = Ustrlen(buffer);
 buffer[subptr+2] = 0;               /* terminator for lengthened name */
@@ -162,6 +197,7 @@ for (; i <= *subcount; i++)
     buffer[subptr+1] = subdirchar;
     }
 
+  DEBUG(D_queue_run) debug_printf("looking in %s\n", buffer);
   if (!(dd = opendir(CS buffer)))
     continue;
 
@@ -265,10 +301,11 @@ for (; i <= *subcount; i++)
     {
     if (!split_spool_directory && count <= 2)
       {
+      uschar subdir[2];
+
       rmdir(CS buffer);
-      sprintf(CS big_buffer, "%s/msglog/%s/%c",
-	       	spool_directory, queue_name, subdirchar);
-      rmdir(CS big_buffer);
+      subdir[0] = subdirchar; subdir[1] = 0;
+      rmdir(CS spool_dname(US"msglog", subdir));
       }
     if (subdiroffset > 0) break;    /* Single sub-directory */
     }
@@ -482,9 +519,8 @@ for (i  = (queue_run_in_order? -1 : 0);
     /* Check that the message still exists */
 
     message_subdir[0] = f->dir_uschar;
-    snprintf(CS buffer, sizeof(buffer), "%s/input/%s/%s/%s",
-      spool_directory, queue_name, message_subdir, f->text);
-    if (Ustat(buffer, &statbuf) < 0) continue;
+    if (Ustat(spool_fname(US"input", message_subdir, f->text, US""), &statbuf) < 0)
+      continue;
 
     /* There are some tests that require the reading of the header file. Ensure
     the store used is scavenged afterwards so that this process doesn't keep
@@ -852,17 +888,16 @@ for (; f != NULL; f = f->next)
     int ptr;
     FILE *jread;
     struct stat statbuf;
+    uschar * fname = spool_fname(US"input", message_subdir, f->text, US"");
 
-    sprintf(CS big_buffer, "%s/input/%s/%s/%s",
-      spool_directory, queue_name, message_subdir, f->text);
-    ptr = Ustrlen(big_buffer)-1;
-    big_buffer[ptr] = 'D';
+    ptr = Ustrlen(fname)-1;
+    fname[ptr] = 'D';
 
     /* Add the data size to the header size; don't count the file name
     at the start of the data file, but add one for the notional blank line
     that precedes the data. */
 
-    if (Ustat(big_buffer, &statbuf) == 0)
+    if (Ustat(fname, &statbuf) == 0)
       size = message_size + statbuf.st_size - SPOOL_DATA_START_OFFSET + 1;
     i = (now - received_time)/60;  /* minutes on queue */
     if (i > 90)
@@ -874,8 +909,8 @@ for (; f != NULL; f = f->next)
 
     /* Collect delivered addresses from any J file */
 
-    big_buffer[ptr] = 'J';
-    jread = Ufopen(big_buffer, "rb");
+    fname[ptr] = 'J';
+    jread = Ufopen(fname, "rb");
     if (jread != NULL)
       {
       while (Ufgets(big_buffer, big_buffer_size, jread) != NULL)
@@ -903,9 +938,9 @@ for (; f != NULL; f = f->next)
     if (save_errno == ERRNO_SPOOLFORMAT)
       {
       struct stat statbuf;
-      sprintf(CS big_buffer, "%s/input/%s/%s/%s",
-        spool_directory, queue_name, message_subdir, f->text);
-      if (Ustat(big_buffer, &statbuf) == 0)
+      uschar * fname = spool_fname(US"input", message_subdir, f->text, US"");
+
+      if (Ustat(fname, &statbuf) == 0)
         printf("*** spool format error: size=" OFF_T_FMT " ***",
           statbuf.st_size);
       else printf("*** spool format error ***");
@@ -970,7 +1005,7 @@ struct passwd *pw;
 uschar *doing = NULL;
 uschar *username;
 uschar *errmsg;
-uschar spoolname[256];
+uschar spoolname[32];
 
 /* Set the global message_id variable, used when re-writing spool files. This
 also causes message ids to be added to log messages. */
@@ -1016,10 +1051,8 @@ if (action >= MSG_SHOW_BODY)
   for (i = 0; i < 2; i++)
     {
     message_subdir[0] = split_spool_directory == (i == 0) ? id[5] : 0;
-    snprintf(CS spoolname, sizeof(spoolname), "%s/%s/%s/%s/%s%s",
-	      spool_directory, subdirectory, queue_name,
-	      message_subdir, id, suffix);
-    if ((fd = Uopen(spoolname, O_RDONLY, 0)) >= 0)
+    if ((fd = Uopen(spool_fname(subdirectory, message_subdir, id, suffix),
+		    O_RDONLY, 0)) >= 0)
       break;
     if (i == 0)
       continue;
@@ -1045,7 +1078,6 @@ only if the action is remove and the user is an admin user, to allow for
 tidying up broken states. */
 
 if ((deliver_datafile = spool_open_datafile(id)) < 0)
-  {
   if (errno == ENOENT)
     {
     yield = FALSE;
@@ -1060,7 +1092,6 @@ if ((deliver_datafile = spool_open_datafile(id)) < 0)
         strerror(errno));
     return FALSE;
     }
-  }
 
 /* Read the spool header file for the message. Again, continue after an
 error only in the case of deleting by an administrator. Setting the third
@@ -1173,50 +1204,70 @@ switch(action)
   operation, just run everything twice. */
 
   case MSG_REMOVE:
-  message_subdir[0] = id[5];
-  for (j = 0; j < 2; message_subdir[0] = 0, j++)
     {
-    snprintf(CS spoolname, sizeof(spoolname), "%s/msglog/%s/%s/%s",
-      spool_directory, queue_name, message_subdir, id);
-    if (Uunlink(spoolname) < 0)
-      {
-      if (errno != ENOENT)
-        {
-        yield = FALSE;
-        printf("Error while removing %s: %s\n", spoolname,
-          strerror(errno));
-        }
-      }
-    else removed = TRUE;
+    uschar suffix[3];
 
-    for (i = 0; i < 3; i++)
+    suffix[0] = '-';
+    suffix[2] = 0;
+    message_subdir[0] = id[5];
+
+    for (j = 0; j < 2; message_subdir[0] = 0, j++)
       {
-      snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-%c",
-        spool_directory, queue_name, message_subdir, id, "DHJ"[i]);
-      if (Uunlink(spoolname) < 0)
-        {
-        if (errno != ENOENT)
-          {
-          yield = FALSE;
-          printf("Error while removing %s: %s\n", spoolname,
-            strerror(errno));
-          }
-        }
-      else removed = TRUE;
+      uschar * fname = spool_fname(US"msglog", message_subdir, id, US"");
+
+      DEBUG(D_any) debug_printf(" removing %s", fname);
+      if (Uunlink(fname) < 0)
+	{
+	if (errno != ENOENT)
+	  {
+	  yield = FALSE;
+	  printf("Error while removing %s: %s\n", fname, strerror(errno));
+	  }
+	else DEBUG(D_any) debug_printf(" (no file)\n");
+	}
+      else
+	{
+	removed = TRUE;
+	DEBUG(D_any) debug_printf(" (ok)\n");
+	}
+
+      for (i = 0; i < 3; i++)
+	{
+	uschar * fname;
+
+	suffix[1] = (US"DHJ")[i];
+	fname = spool_fname(US"input", message_subdir, id, suffix);
+
+	DEBUG(D_any) debug_printf(" removing %s", fname);
+	if (Uunlink(fname) < 0)
+	  {
+	  if (errno != ENOENT)
+	    {
+	    yield = FALSE;
+	    printf("Error while removing %s: %s\n", fname, strerror(errno));
+	    }
+	  else DEBUG(D_any) debug_printf(" (no file)\n");
+	  }
+	else
+	  {
+	  removed = TRUE;
+	  DEBUG(D_any) debug_printf(" (done)\n");
+	  }
+	}
       }
-    }
 
-  /* In the common case, the datafile is open (and locked), so give the
-  obvious message. Otherwise be more specific. */
+    /* In the common case, the datafile is open (and locked), so give the
+    obvious message. Otherwise be more specific. */
 
-  if (deliver_datafile >= 0) printf("has been removed\n");
-    else printf("has been removed or did not exist\n");
-  if (removed)
-    {
-    log_write(0, LOG_MAIN, "removed by %s", username);
-    log_write(0, LOG_MAIN, "Completed");
+    if (deliver_datafile >= 0) printf("has been removed\n");
+      else printf("has been removed or did not exist\n");
+    if (removed)
+      {
+      log_write(0, LOG_MAIN, "removed by %s", username);
+      log_write(0, LOG_MAIN, "Completed");
+      }
+    break;
     }
-  break;
 
 
   case MSG_MARK_ALL_DELIVERED:
@@ -1395,4 +1446,6 @@ while ((ss = string_nextinlist(&s, &sep, buffer, sizeof(buffer))) != NULL)
   }
 }
 
+#endif /*!COMPILE_UTILITY*/
+
 /* End of queue.c */
diff --git a/src/src/receive.c b/src/src/receive.c
index c783cedfd..a0d975897 100644
--- a/src/src/receive.c
+++ b/src/src/receive.c
@@ -23,7 +23,7 @@ extern int dcc_ok;
 
 static FILE   *data_file = NULL;
 static int     data_fd = -1;
-static uschar  spool_name[256];
+static uschar *spool_name = US"";
 
 
 
@@ -1542,7 +1542,7 @@ yet, initialize the size and warning count, and deal with no size limit. */
 message_id[0] = 0;
 data_file = NULL;
 data_fd = -1;
-spool_name[0] = 0;
+spool_name = US"";
 message_size = 0;
 warning_count = 0;
 received_count = 1;            /* For the one we will add */
@@ -2860,21 +2860,18 @@ if (cutthrough.fd >= 0)
 
 /* Open a new spool file for the data portion of the message. We need
 to access it both via a file descriptor and a stream. Try to make the
-directory if it isn't there. Note re use of sprintf: spool_directory
-is checked on input to be < 200 characters long. */
+directory if it isn't there. */
 
-snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-D",
-  spool_directory, queue_name, message_subdir, message_id);
+spool_name = spool_fname(US"input", message_subdir, message_id, US"-D");
 DEBUG(D_receive) debug_printf("Data file name: %s\n", spool_name);
 
 if ((data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE)) < 0)
   {
   if (errno == ENOENT)
     {
-    uschar * temp = string_sprintf("input%s%s%s%s",
-	    *queue_name ? "/" : "", queue_name,
-	    *message_subdir ? "/" : "", message_subdir);
-    (void)directory_make(spool_directory, temp, INPUT_DIRECTORY_MODE, TRUE);
+    (void)directory_make(spool_directory,
+		        spool_sname(US"input", message_subdir),
+			INPUT_DIRECTORY_MODE, TRUE);
     data_fd = Uopen(spool_name, O_RDWR|O_CREAT|O_EXCL, SPOOL_MODE);
     }
   if (data_fd < 0)
@@ -3861,17 +3858,15 @@ if (message_logs && blackholed_by == NULL)
   {
   int fd;
 
-  snprintf(CS spool_name, sizeof(spool_name), "%s/msglog/%s/%s/%s",
-    spool_directory, queue_name, message_subdir, message_id);
+  spool_name = spool_fname(US"msglog", message_subdir, message_id, US"");
   
   if (  (fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE)) < 0
      && errno == ENOENT
      )
     {
-    uschar * temp = string_sprintf("msglog%s%s%s%s",
-			*queue_name ? "/" : "", queue_name,
-			*message_subdir ? "/" : "", message_subdir);
-    (void)directory_make(spool_directory, temp, MSGLOG_DIRECTORY_MODE, TRUE);
+    (void)directory_make(spool_directory,
+			spool_sname(US"msglog", message_subdir),
+			MSGLOG_DIRECTORY_MODE, TRUE);
     fd = Uopen(spool_name, O_WRONLY|O_APPEND|O_CREAT, SPOOL_MODE);
     }
 
@@ -3956,17 +3951,9 @@ if (smtp_input && sender_host_address != NULL && !sender_host_notsocket &&
 
       /* Delete the files for this aborted message. */
 
-      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-D",
-	spool_directory, queue_name, message_subdir, message_id);
-      Uunlink(spool_name);
-
-      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-H",
-	spool_directory, queue_name, message_subdir, message_id);
-      Uunlink(spool_name);
-
-      snprintf(CS spool_name, sizeof(spool_name), "%s/msglog/%s/%s/%s",
-	spool_directory, queue_name, message_subdir, message_id);
-      Uunlink(spool_name);
+      Uunlink(spool_fname(US"input", message_subdir, message_id, US"-D"));
+      Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H"));
+      Uunlink(spool_fname(US"msglog", message_subdir, message_id, US""));
 
       goto TIDYUP;
       }
@@ -4120,16 +4107,11 @@ if (smtp_input)
     switch (cutthrough_done)
       {
       case ACCEPTED: log_write(0, LOG_MAIN, "Completed");/* Delivery was done */
-      case PERM_REJ: {					/* Delete spool files */
-	      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-D",
-		spool_directory, queue_name, message_subdir, message_id);
-	      Uunlink(spool_name);
-	      snprintf(CS spool_name, sizeof(spool_name), "%s/input/%s/%s/%s-H",
-		spool_directory, queue_name, message_subdir, message_id);
-	      Uunlink(spool_name);
-	      snprintf(CS spool_name, sizeof(spool_name), "%s/msglog/%s/%s/%s",
-		spool_directory, queue_name, message_subdir, message_id);
-	      Uunlink(spool_name);
+      case PERM_REJ:
+	      {						 /* Delete spool files */
+	      Uunlink(spool_fname(US"input", message_subdir, message_id, US"-D"));
+	      Uunlink(spool_fname(US"input", message_subdir, message_id, US"-H"));
+	      Uunlink(spool_fname(US"msglog", message_subdir, message_id, US""));
 	      }
       case TMP_REJ: message_id[0] = 0;	  /* Prevent a delivery from starting */
       default:break;
diff --git a/src/src/spool_in.c b/src/src/spool_in.c
index 6341387a2..8e3099d88 100644
--- a/src/src/spool_in.c
+++ b/src/src/spool_in.c
@@ -37,7 +37,6 @@ spool_open_datafile(uschar *id)
 int i;
 struct stat statbuf;
 flock_t lock_data;
-uschar spoolname[256];
 int fd;
 
 /* If split_spool_directory is set, first look for the file in the appropriate
@@ -49,13 +48,13 @@ splitting state. */
 
 for (i = 0; i < 2; i++)
   {
+  uschar * fname;
   int save_errno;
   message_subdir[0] = split_spool_directory == (i == 0) ? id[5] : 0;
-  snprintf(CS spoolname, sizeof(spoolname), "%s/input/%s/%s/%s-D",
-	    spool_directory, queue_name, message_subdir, id);
-  DEBUG(D_deliver) debug_printf("Trying spool file %s\n", spoolname);
+  fname = spool_fname(US"input", message_subdir, id, US"-D");
+  DEBUG(D_deliver) debug_printf("Trying spool file %s\n", fname);
 
-  if ((fd = Uopen(spoolname, O_RDWR | O_APPEND, 0)) >= 0)
+  if ((fd = Uopen(fname, O_RDWR | O_APPEND, 0)) >= 0)
     break;
   save_errno = errno;
   if (errno == ENOENT)
@@ -64,7 +63,7 @@ for (i = 0; i < 2; i++)
     if (!queue_running)
       log_write(0, LOG_MAIN, "Spool file %s-D not found", id);
     }
-  else log_write(0, LOG_MAIN, "Spool error for %s: %s", spoolname,
+  else log_write(0, LOG_MAIN, "Spool error for %s: %s", fname,
     strerror(errno));
   errno = save_errno;
   return -1;
@@ -322,10 +321,11 @@ for (n = 0; n < 2; n++)
   {
   if (!subdir_set)
     message_subdir[0] = split_spool_directory == (n == 0) ? name[5] : 0;
-  sprintf(CS big_buffer, "%s/input/%s/%s/%s",
-	  spool_directory, queue_name, message_subdir, name);
-  if ((f = Ufopen(big_buffer, "rb"))) break;
-  if (n != 0 || subdir_set || errno != ENOENT) return spool_read_notopen;
+
+  if ((f = Ufopen(spool_fname(US"input", message_subdir, name, US""), "rb")))
+    break;
+  if (n != 0 || subdir_set || errno != ENOENT)
+    return spool_read_notopen;
   }
 
 errno = 0;
diff --git a/src/src/spool_mbox.c b/src/src/spool_mbox.c
index 7ee34b551..b7ab06127 100644
--- a/src/src/spool_mbox.c
+++ b/src/src/spool_mbox.c
@@ -114,8 +114,7 @@ if (!spool_mbox_ok)
     for (i = 0; i < 2; i++)
       {
       message_subdir[0] = split_spool_directory == (i == 0) ? message_id[5] : 0;
-      temp_string = string_sprintf("%s/input/%s/%s/%s-D",
-	    spool_directory, queue_name, message_subdir, message_id);
+      temp_string = spool_fname(US"input", message_subdir, message_id, US"-D");
       if ((data_file = Ufopen(temp_string, "rb"))) break;
       }
     }
diff --git a/src/src/spool_out.c b/src/src/spool_out.c
index c7a0043f5..82b606871 100644
--- a/src/src/spool_out.c
+++ b/src/src/spool_out.c
@@ -134,16 +134,16 @@ int size_correction;
 FILE *f;
 header_line *h;
 struct stat statbuf;
-uschar name[256];
-uschar temp_name[256];
+uschar * tname;
+uschar * fname;
 
-snprintf(CS temp_name, sizeof(temp_name), "%s/input/%s/%s/hdr.%d",
-  spool_directory, queue_name, message_subdir, (int)getpid());
+tname = spool_fname(US"input", message_subdir,
+		    string_sprintf("hdr.%d", (int)getpid()), US"");
 
-if ((fd = spool_open_temp(temp_name)) < 0)
+if ((fd = spool_open_temp(tname)) < 0)
   return spool_write_error(where, errmsg, US"open", NULL, NULL);
 f = fdopen(fd, "wb");
-DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file: %s\n", temp_name);
+DEBUG(D_receive|D_deliver) debug_printf("Writing spool header file: %s\n", tname);
 
 /* We now have an open file to which the header data is to be written. Start
 with the file's leaf name, to make the file self-identifying. Continue with the
@@ -303,7 +303,7 @@ to get the actual size of the headers. */
 
 fflush(f);
 if (fstat(fd, &statbuf))
-  return spool_write_error(where, errmsg, US"fstat", temp_name, f);
+  return spool_write_error(where, errmsg, US"fstat", tname, f);
 size_correction = statbuf.st_size;
 
 /* Finally, write out the message's headers. To make it easier to read them
@@ -324,31 +324,30 @@ for (h = header_list; h != NULL; h = h->next)
 /* Flush and check for any errors while writing */
 
 if (fflush(f) != 0 || ferror(f))
-  return spool_write_error(where, errmsg, US"write", temp_name, f);
+  return spool_write_error(where, errmsg, US"write", tname, f);
 
 /* Force the file's contents to be written to disk. Note that fflush()
 just pushes it out of C, and fclose() doesn't guarantee to do the write
 either. That's just the way Unix works... */
 
 if (EXIMfsync(fileno(f)) < 0)
-  return spool_write_error(where, errmsg, US"sync", temp_name, f);
+  return spool_write_error(where, errmsg, US"sync", tname, f);
 
 /* Get the size of the file, and close it. */
 
 if (fstat(fd, &statbuf) != 0)
-  return spool_write_error(where, errmsg, US"fstat", temp_name, NULL);
+  return spool_write_error(where, errmsg, US"fstat", tname, NULL);
 if (fclose(f) != 0)
-  return spool_write_error(where, errmsg, US"close", temp_name, NULL);
+  return spool_write_error(where, errmsg, US"close", tname, NULL);
 
 /* Rename the file to its correct name, thereby replacing any previous
 incarnation. */
 
-snprintf(CS name, sizeof(name), "%s/input/%s/%s/%s-H",
-  spool_directory, queue_name, message_subdir, id);
-DEBUG(D_receive|D_deliver) debug_printf("Renaming spool header file: %s\n", name);
+fname = spool_fname(US"input", message_subdir, id, US"-H");
+DEBUG(D_receive|D_deliver) debug_printf("Renaming spool header file: %s\n", fname);
 
-if (Urename(temp_name, name) < 0)
-  return spool_write_error(where, errmsg, US"rename", temp_name, NULL);
+if (Urename(tname, fname) < 0)
+  return spool_write_error(where, errmsg, US"rename", tname, NULL);
 
 /* Linux (and maybe other OS?) does not automatically sync a directory after
 an operation like rename. We therefore have to do it forcibly ourselves in
@@ -362,21 +361,20 @@ these cases. One hack on top of another... but that's life. */
 
 #ifdef NEED_SYNC_DIRECTORY
 
-snprintf(CS temp_name, sizeof(temp_name), "%s/input/%s/%s/.",
-  spool_directory, queue_name, message_subdir);
+tname = spool_fname(US"input", message_subdir, US".", US"");
 
-#ifndef O_DIRECTORY
-#define O_DIRECTORY 0
-#endif
+# ifndef O_DIRECTORY
+#  define O_DIRECTORY 0
+# endif
 
-if ((fd = Uopen(temp_name, O_RDONLY|O_DIRECTORY, 0)) < 0)
-  return spool_write_error(where, errmsg, US"directory open", name, NULL);
+if ((fd = Uopen(tname, O_RDONLY|O_DIRECTORY, 0)) < 0)
+  return spool_write_error(where, errmsg, US"directory open", fname, NULL);
 
 if (EXIMfsync(fd) < 0 && errno != EINVAL)
-  return spool_write_error(where, errmsg, US"directory sync", name, NULL);
+  return spool_write_error(where, errmsg, US"directory sync", fname, NULL);
 
 if (close(fd) < 0)
-  return spool_write_error(where, errmsg, US"directory close", name, NULL);
+  return spool_write_error(where, errmsg, US"directory close", fname, NULL);
 
 #endif  /* NEED_SYNC_DIRECTORY */
 
@@ -417,13 +415,12 @@ static BOOL
 make_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
   uschar *to, BOOL noentok)
 {
-uschar f[256], t[256];
-sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
-sprintf(CS t, "%s/%s%s/%s/%s%s", spool_directory, to, dir, subdir, id, suffix);
-if (Ulink(f, t) < 0 && (!noentok || errno != ENOENT))
+uschar * fname = spool_fname(string_sprintf("%s%s", from, dir), subdir, id, suffix);
+uschar * tname = spool_fname(string_sprintf("%s%s", to,   dir), subdir, id, suffix);
+if (Ulink(fname, tname) < 0 && (!noentok || errno != ENOENT))
   {
   log_write(0, LOG_MAIN|LOG_PANIC, "link(\"%s\", \"%s\") failed while moving "
-    "message: %s", f, t, strerror(errno));
+    "message: %s", fname, tname, strerror(errno));
   return FALSE;
   }
 return TRUE;
@@ -455,12 +452,11 @@ static BOOL
 break_link(uschar *dir, uschar *subdir, uschar *id, uschar *suffix, uschar *from,
   BOOL noentok)
 {
-uschar f[256];
-sprintf(CS f, "%s/%s%s/%s/%s%s", spool_directory, from, dir, subdir, id, suffix);
-if (Uunlink(f) < 0 && (!noentok || errno != ENOENT))
+uschar * fname = spool_fname(string_sprintf("%s%s", from, dir), subdir, id, suffix);
+if (Uunlink(fname) < 0 && (!noentok || errno != ENOENT))
   {
   log_write(0, LOG_MAIN|LOG_PANIC, "unlink(\"%s\") failed while moving "
-    "message: %s", f, strerror(errno));
+    "message: %s", fname, strerror(errno));
   return FALSE;
   }
 return TRUE;
@@ -492,10 +488,12 @@ spool_move_message(uschar *id, uschar *subdir, uschar *from, uschar *to)
 {
 /* Create any output directories that do not exist. */
 
-sprintf(CS big_buffer, "%sinput/%s", to, subdir);
-(void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
-sprintf(CS big_buffer, "%smsglog/%s", to, subdir);
-(void)directory_make(spool_directory, big_buffer, INPUT_DIRECTORY_MODE, TRUE);
+(void) directory_make(spool_directory,
+  spool_sname(string_sprintf("%sinput", to), subdir),
+  INPUT_DIRECTORY_MODE, TRUE);
+(void) directory_make(spool_directory,
+  spool_sname(string_sprintf("%smsglog", to), subdir),
+  INPUT_DIRECTORY_MODE, TRUE);
 
 /* Move the message by first creating new hard links for all the files, and
 then removing the old links. When moving messages onto the main spool, the -H
diff --git a/src/src/transport.c b/src/src/transport.c
index 9737acc58..af453b04a 100644
--- a/src/src/transport.c
+++ b/src/src/transport.c
@@ -1013,7 +1013,7 @@ dkim_transport_write_message(address_item *addr, int fd, int options,
 int dkim_fd;
 int save_errno = 0;
 BOOL rc;
-uschar dkim_spool_name[256];
+uschar * dkim_spool_name;
 char sbuf[2048];
 int sread = 0;
 int wwritten = 0;
@@ -1027,9 +1027,8 @@ if (!(dkim_private_key && dkim_domain && dkim_selector))
 	    check_string, escape_string, rewrite_rules,
 	    rewrite_existflags);
 
-(void)string_format(dkim_spool_name, sizeof(dkim_spool_name),
-	"%s/input/%s/%s/%s-%d-K",
-	spool_directory, queue_name, message_subdir, message_id, (int)getpid());
+dkim_spool_name = spool_fname(US"input", message_subdir, message_id,
+		    string_sprintf("-%d-K", (int)getpid()));
 
 if ((dkim_fd = Uopen(dkim_spool_name, O_RDWR|O_CREAT|O_TRUNC, SPOOL_MODE)) < 0)
   {
@@ -1656,8 +1655,6 @@ open_db *dbm_file;
 uschar buffer[256];
 
 int         i;
-uschar      spool_dir [PATH_MAX];
-uschar      spool_file [PATH_MAX];
 struct stat statbuf;
 
 *more = FALSE;
@@ -1715,8 +1712,6 @@ emptied, delete it and continue with any continuation records that may exist.
 but the 1 off will remain without it.  This code now allows me to SKIP over
 a message I do not want to send out on this run.  */
 
-sprintf(CS spool_dir, "%s/input/", spool_directory);
-
 host_length = host_record->count * MESSAGE_ID_LENGTH;
 
 while (1)
@@ -1755,14 +1750,13 @@ while (1)
 
   for (i = msgq_count - 1; i >= 0; --i) if (msgq[i].bKeep)
     {
-    if (split_spool_directory)
-	snprintf(CS spool_file, sizeof(spool_file), "%s/%s/%c/%s-D",
-	      spool_dir, queue_name, msgq[i].message_id[5], msgq[i].message_id);
-    else
-	snprintf(CS spool_file, sizeof(spool_file), "%s/%s/%s-D",
-	      spool_dir, queue_name, msgq[i].message_id);
+    uschar subdir[2];
+
+    subdir[0] = split_spool_directory ? msgq[i].message_id[5] : 0;
+    subdir[1] = 0;
 
-    if (Ustat(spool_file, &statbuf) != 0)
+    if (Ustat(spool_fname(US"input", subdir, msgq[i].message_id, US"-D"),
+	      &statbuf) != 0)
       msgq[i].bKeep = FALSE;
     else if (!oicf_func || oicf_func(msgq[i].message_id, oicf_data))
       {