- Added more calls to safe_fname().

- Improved safe_fname() so that it changes all non-printable chars
  into '?'s, and accomodates more simultaneous (and longer) names.

util.c

@@ -105,9 +105,9 @@ void print_child_argv(char **cmd)
 			   "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
 			   "0123456789"
 			   ",.-_=+@/") != strlen(*cmd)) {
-			rprintf(FINFO, "\"%s\" ", *cmd);
+			rprintf(FINFO, "\"%s\" ", safe_fname(*cmd));
 		} else {
-			rprintf(FINFO, "%s ", *cmd);
+			rprintf(FINFO, "%s ", safe_fname(*cmd));
 		}
 	}
 	rprintf(FINFO, "\n");
@@ -132,7 +132,7 @@ int set_modtime(char *fname, time_t modtime)
 {
 	if (verbose > 2) {
 		rprintf(FINFO, "set modtime of %s to (%ld) %s",
-			fname, (long)modtime,
+			safe_fname(fname), (long)modtime,
 			asctime(localtime(&modtime)));
 	}
 
@@ -350,7 +350,7 @@ int robust_unlink(char *fname)
 
 	if (verbose > 0) {
 		rprintf(FINFO,"renaming %s to %s because of text busy\n",
-			fname, path);
+			safe_fname(fname), safe_fname(path));
 	}
 
 	/* maybe we should return rename()'s exit status? Nah. */
@@ -883,21 +883,24 @@ int pop_dir(char *dir)
  **/
 const char *safe_fname(const char *fname)
 {
-	static char fbuf1[MAXPATHLEN], fbuf2[MAXPATHLEN];
-	static char *fbuf = fbuf2;
-	char *nl = strchr(fname, '\n');
-
-	if (!nl)
-		return fname;
-
-	fbuf = fbuf == fbuf1 ? fbuf2 : fbuf1;
-	strlcpy(fbuf, fname, MAXPATHLEN);
-	nl = fbuf + (nl - (char *)fname);
-	do {
-		*nl = '?';
-	} while ((nl = strchr(nl+1, '\n')) != NULL);
+#define MAX_SAFE_NAMES 4
+	static char fbuf[MAX_SAFE_NAMES][MAXPATHLEN*2];
+	static int ndx = 0;
+	int limit = sizeof fbuf / MAX_SAFE_NAMES - 1;
+	char *t;
+
+	ndx = (ndx + 1) % MAX_SAFE_NAMES;
+	for (t = fbuf[ndx]; *fname; fname++) {
+		if (!isprint(*fname))
+			*t++ = '?';
+		else
+			*t++ = *fname;
+		if (--limit == 0)
+			break;
+	}
+	*t = '\0';
 
-	return fbuf;
+	return fbuf[ndx];
 }
 
 /**