updated for version 7.0073v7.0073

19 files changed, 277 insertions, 154 deletions

diff --git a/src/digraph.c b/src/digraph.c
index 31d7f3788..06b227ae1 100644
--- a/src/digraph.c
+++ b/src/digraph.c
@@ -2459,7 +2459,7 @@ ex_loadkeymap(eap)
      */
     for (i = 0; i < curbuf->b_kmap_ga.ga_len; ++i)
     {
-	sprintf((char *)buf, "<buffer> %s %s",
+	vim_snprintf((char *)buf, sizeof(buf), "<buffer> %s %s",
 				((kmap_T *)curbuf->b_kmap_ga.ga_data)[i].from,
 				 ((kmap_T *)curbuf->b_kmap_ga.ga_data)[i].to);
 	(void)do_map(2, buf, LANGMAP, FALSE);
@@ -2492,8 +2492,8 @@ keymap_unload()
     /* clear the ":lmap"s */
     for (i = 0; i < curbuf->b_kmap_ga.ga_len; ++i)
     {
-	sprintf((char *)buf, "<buffer> %s",
-		((kmap_T *)curbuf->b_kmap_ga.ga_data)[i].from);
+	vim_snprintf((char *)buf, sizeof(buf), "<buffer> %s",
+			       ((kmap_T *)curbuf->b_kmap_ga.ga_data)[i].from);
 	(void)do_map(1, buf, LANGMAP, FALSE);
     }
 
diff --git a/src/edit.c b/src/edit.c
index 33a6f62cf..42b459d38 100644
--- a/src/edit.c
+++ b/src/edit.c
@@ -2218,8 +2218,8 @@ ins_compl_dictionaries(dict, pat, dir, flags, thesaurus)
 	    fp = mch_fopen((char *)files[i], "r");  /* open dictionary file */
 	    if (flags != DICT_EXACT)
 	    {
-		sprintf((char*)IObuff, _("Scanning dictionary: %s"),
-							    (char *)files[i]);
+		vim_snprintf((char *)IObuff, IOSIZE,
+			      _("Scanning dictionary: %s"), (char *)files[i]);
 		msg_trunc_attr(IObuff, TRUE, hl_attr(HLF_R));
 	    }
 
@@ -2827,7 +2827,7 @@ ins_compl_get_exp(ini, dir)
 		    dict = ins_buf->b_fname;
 		    dict_f = DICT_EXACT;
 		}
-		sprintf((char *)IObuff, _("Scanning: %s"),
+		vim_snprintf((char *)IObuff, IOSIZE, _("Scanning: %s"),
 			ins_buf->b_fname == NULL
 			    ? buf_spname(ins_buf)
 			    : ins_buf->b_sfname == NULL
diff --git a/src/eval.c b/src/eval.c
index e2d3d9340..c73d774b4 100644
--- a/src/eval.c
+++ b/src/eval.c
@@ -11414,7 +11414,7 @@ remote_common(argvars, rettv, expr)
     if (argvars[2].v_type != VAR_UNKNOWN)
     {
 	dictitem_T	v;
-	char_u	str[30];
+	char_u		str[30];
 
 	sprintf((char *)str, "0x%x", (unsigned int)w);
 	v.di_tv.v_type = VAR_STRING;
@@ -16867,7 +16867,7 @@ call_user_func(fp, argcount, argvars, rettv, firstline, lastline, selfdict)
 	{
 	    ++no_wait_return;
 	    msg_scroll = TRUE;	    /* always scroll up, don't overwrite */
-	    msg_str((char_u *)_("calling %s"), sourcing_name);
+	    smsg((char_u *)_("calling %s"), sourcing_name);
 	    if (p_verbose >= 14)
 	    {
 		char_u	buf[MSG_BUF_LEN];
@@ -16950,30 +16950,26 @@ call_user_func(fp, argcount, argvars, rettv, firstline, lastline, selfdict)
     /* when being verbose, mention the return value */
     if (p_verbose >= 12)
     {
-	char_u	*sn;
-
 	++no_wait_return;
 	msg_scroll = TRUE;	    /* always scroll up, don't overwrite */
 
-	/* Make sure the output fits in IObuff. */
-	sn = sourcing_name;
-	if (STRLEN(sourcing_name) > IOSIZE / 2 - 50)
-	    sn = sourcing_name + STRLEN(sourcing_name) - (IOSIZE / 2 - 50);
-
 	if (aborting())
-	    smsg((char_u *)_("%s aborted"), sn);
+	    smsg((char_u *)_("%s aborted"), sourcing_name);
 	else if (fc.rettv->v_type == VAR_NUMBER)
-	    smsg((char_u *)_("%s returning #%ld"), sn,
-					      (long)fc.rettv->vval.v_number);
+	    smsg((char_u *)_("%s returning #%ld"), sourcing_name,
+					       (long)fc.rettv->vval.v_number);
 	else
 	{
 	    char_u	buf[MSG_BUF_LEN];
 	    char_u	numbuf[NUMBUFLEN];
 	    char_u	*tofree;
 
+	    /* The value may be very long.  Skip the middle part, so that we
+	     * have some idea how it starts and ends. smsg() would always
+	     * truncate it at the end. */
 	    trunc_string(tv2string(fc.rettv, &tofree, numbuf),
 							   buf, MSG_BUF_CLEN);
-	    smsg((char_u *)_("%s returning %s"), sn, buf);
+	    smsg((char_u *)_("%s returning %s"), sourcing_name, buf);
 	    vim_free(tofree);
 	}
 	msg_puts((char_u *)"\n");   /* don't overwrite this either */
@@ -16994,7 +16990,7 @@ call_user_func(fp, argcount, argvars, rettv, firstline, lastline, selfdict)
     {
 	++no_wait_return;
 	msg_scroll = TRUE;	    /* always scroll up, don't overwrite */
-	msg_str((char_u *)_("continuing in %s"), sourcing_name);
+	smsg((char_u *)_("continuing in %s"), sourcing_name);
 	msg_puts((char_u *)"\n");   /* don't overwrite this either */
 	cmdline_row = msg_row;
 	--no_wait_return;
diff --git a/src/ex_cmds.c b/src/ex_cmds.c
index 680188d93..fd55605a1 100644
--- a/src/ex_cmds.c
+++ b/src/ex_cmds.c
@@ -89,8 +89,9 @@ do_ascii(eap)
 	else
 #endif
 	    buf2[0] = NUL;
-	sprintf((char *)IObuff, _("<%s>%s%s  %d,  Hex %02x,  Octal %03o"),
-		transchar(c), buf1, buf2, c, c, c);
+	vim_snprintf((char *)IObuff, IOSIZE,
+		_("<%s>%s%s  %d,  Hex %02x,  Octal %03o"),
+					   transchar(c), buf1, buf2, c, c, c);
 #ifdef FEAT_MBYTE
 	c = c1;
 	c1 = c2;
@@ -113,8 +114,8 @@ do_ascii(eap)
 #endif
 		)
 	    IObuff[len++] = ' '; /* draw composing char on top of a space */
-	IObuff[len + (*mb_char2bytes)(c, IObuff + len)] = NUL;
-	sprintf((char *)IObuff + STRLEN(IObuff),
+	len += (*mb_char2bytes)(c, IObuff + len);
+	vim_snprintf((char *)IObuff + len, IOSIZE - len,
 			c < 0x10000 ? _("> %d, Hex %04x, Octal %o")
 				    : _("> %d, Hex %08x, Octal %o"), c, c, c);
 	c = c1;
@@ -974,8 +975,8 @@ do_filter(line1, line2, eap, cmd, do_in, do_out)
 	{
 	    if (do_in)
 	    {
-		sprintf((char *)msg_buf, _("%ld lines filtered"),
-							     (long)linecount);
+		vim_snprintf((char *)msg_buf, sizeof(msg_buf),
+				    _("%ld lines filtered"), (long)linecount);
 		if (msg(msg_buf) && !msg_scroll)
 		{
 		    /* save message to display it after redraw */
@@ -1337,7 +1338,8 @@ viminfo_error(errnum, message, line)
     char    *message;
     char_u  *line;
 {
-    sprintf((char *)IObuff, _("%sviminfo: %s in line: "), errnum, message);
+    vim_snprintf((char *)IObuff, IOSIZE, _("%sviminfo: %s in line: "),
+							     errnum, message);
     STRNCAT(IObuff, line, IOSIZE - STRLEN(IObuff));
     if (IObuff[STRLEN(IObuff) - 1] == '\n')
 	IObuff[STRLEN(IObuff) - 1] = NUL;
@@ -1373,17 +1375,11 @@ read_viminfo(file, want_info, want_marks, forceit)
     fp = mch_fopen((char *)fname, READBIN);
 
     if (p_verbose > 0)
-    {
-	char_u	*s;
-
-	s = fname;
-	if (STRLEN(fname) > IOSIZE - 100)
-	    s = fname + STRLEN(fname) - (IOSIZE - 100);
-	smsg((char_u *)_("Reading viminfo file \"%s\"%s%s%s"), s,
-		    want_info ? _(" info") : "",
-		    want_marks ? _(" marks") : "",
-		    fp == NULL ? _(" FAILED") : "");
-    }
+	smsg((char_u *)_("Reading viminfo file \"%s\"%s%s%s"),
+		fname,
+		want_info ? _(" info") : "",
+		want_marks ? _(" marks") : "",
+		fp == NULL ? _(" FAILED") : "");
 
     vim_free(fname);
     if (fp == NULL)
@@ -1607,7 +1603,7 @@ write_viminfo(file, forceit)
     }
 
     if (p_verbose > 0)
-	msg_str((char_u *)_("Writing viminfo file \"%s\""), fname);
+	smsg((char_u *)_("Writing viminfo file \"%s\""), fname);
 
     viminfo_errcnt = 0;
     do_viminfo(fp_in, fp_out, !forceit, !forceit, FALSE);
@@ -4529,6 +4525,8 @@ outofmem:
 do_sub_msg(count_only)
     int	    count_only;		/* used 'n' flag for ":s" */
 {
+    int	    len = 0;
+
     /*
      * Only report substitutions when:
      * - more than 'report' substitutions
@@ -4540,20 +4538,24 @@ do_sub_msg(count_only)
 	    && messaging())
     {
 	if (got_int)
+	{
 	    STRCPY(msg_buf, _("(Interrupted) "));
-	else
-	    msg_buf[0] = NUL;
+	    len = STRLEN(msg_buf);
+	}
 	if (sub_nsubs == 1)
-	    STRCAT(msg_buf, count_only ? _("1 match") : _("1 substitution"));
+	    vim_snprintf((char *)msg_buf + len, sizeof(msg_buf) - len,
+		    "%s", count_only ? _("1 match") : _("1 substitution"));
 	else
-	    sprintf((char *)msg_buf + STRLEN(msg_buf),
+	    vim_snprintf((char *)msg_buf + len, sizeof(msg_buf) - len,
 		    count_only ? _("%ld matches") : _("%ld substitutions"),
 								   sub_nsubs);
+	len = STRLEN(msg_buf);
 	if (sub_nlines == 1)
-	    STRCAT(msg_buf, _(" on 1 line"));
+	    vim_snprintf((char *)msg_buf + len, sizeof(msg_buf) - len,
+		    "%s", _(" on 1 line"));
 	else
-	    sprintf((char *)msg_buf + STRLEN(msg_buf), _(" on %ld lines"),
-							    (long)sub_nlines);
+	    vim_snprintf((char *)msg_buf + len, sizeof(msg_buf) - len,
+		    _(" on %ld lines"), (long)sub_nlines);
 	if (msg(msg_buf))
 	{
 	    /* save message to display it after redraw */
@@ -4686,9 +4688,9 @@ ex_global(eap)
     else if (ndone == 0)
     {
 	if (type == 'v')
-	    msg_str((char_u *)_("Pattern found in every line: %s"), pat);
+	    smsg((char_u *)_("Pattern found in every line: %s"), pat);
 	else
-	    msg_str((char_u *)_(e_patnotf2), pat);
+	    smsg((char_u *)_(e_patnotf2), pat);
     }
     else
 	global_exe(cmd);
@@ -4955,8 +4957,7 @@ ex_help(eap)
 	     */
 	    if ((helpfd = mch_fopen((char *)p_hf, READBIN)) == NULL)
 	    {
-		msg_str((char_u *)_("Sorry, help file \"%s\" not found"),
-									p_hf);
+		smsg((char_u *)_("Sorry, help file \"%s\" not found"), p_hf);
 		goto erret;
 	    }
 	    fclose(helpfd);
@@ -5660,7 +5661,7 @@ helptags_one(dir, ext, tagfname)
 	    got_int = TRUE;
 	else
 	{
-	    s = alloc(30);
+	    s = alloc(18 + STRLEN(tagfname));
 	    if (s == NULL)
 		got_int = TRUE;
 	    else
@@ -5793,7 +5794,7 @@ helptags_one(dir, ext, tagfname)
 		if (*p2 == '\t')
 		{
 		    *p2 = NUL;
-		    sprintf((char *)NameBuff,
+		    vim_snprintf((char *)NameBuff, MAXPATHL,
 			    _("E154: Duplicate tag \"%s\" in file %s/%s"),
 				     ((char_u **)ga.ga_data)[i], dir, p2 + 1);
 		    EMSG(NameBuff);
@@ -6307,7 +6308,7 @@ sign_list_defined(sp)
 {
     char_u	*p;
 
-    msg_str((char_u *)"sign %s", sp->sn_name);
+    smsg((char_u *)"sign %s", sp->sn_name);
     if (sp->sn_icon != NULL)
     {
 	MSG_PUTS(" icon=");
diff --git a/src/ex_cmds.h b/src/ex_cmds.h
index 417945d29..8eada96b9 100644
--- a/src/ex_cmds.h
+++ b/src/ex_cmds.h
@@ -532,7 +532,7 @@ EX(CMD_mkview,		"mkview",	ex_mkrc,
 EX(CMD_mode,		"mode",		ex_mode,
 			WORD1|TRLBAR|CMDWIN),
 EX(CMD_mzscheme,	"mzscheme",	ex_mzscheme,
-			RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN),
+			RANGE|EXTRA|DFLALL|NEEDARG|CMDWIN|SBOXOK),
 EX(CMD_mzfile,		"mzfile",	ex_mzfile,
 			RANGE|FILE1|NEEDARG|CMDWIN),
 EX(CMD_next,		"next",		ex_next,
diff --git a/src/ex_cmds2.c b/src/ex_cmds2.c
index f9e1e5a93..c22414e4d 100644
--- a/src/ex_cmds2.c
+++ b/src/ex_cmds2.c
@@ -141,16 +141,9 @@ do_debug(cmd)
     if (sourcing_name != NULL)
 	msg(sourcing_name);
     if (sourcing_lnum != 0)
-    {
-	char_u	    buf[IOSIZE];
-
-	/* Truncate the command, the whole must fit in IObuff. */
-	STRNCPY(buf, cmd, IOSIZE - 50);
-	buf[IOSIZE - 50] = NUL;
-	smsg((char_u *)_("line %ld: %s"), (long)sourcing_lnum, buf);
-    }
+	smsg((char_u *)_("line %ld: %s"), (long)sourcing_lnum, cmd);
     else
-	msg_str((char_u *)_("cmd: %s"), cmd);
+	smsg((char_u *)_("cmd: %s"), cmd);
 
     /*
      * Repeat getting a command and executing it.
@@ -342,7 +335,8 @@ dbg_check_breakpoint(eap)
 		p = (char_u *)"<SNR>";
 	    else
 		p = (char_u *)"";
-	    smsg((char_u *)_("Breakpoint in \"%s%s\" line %ld"), p,
+	    smsg((char_u *)_("Breakpoint in \"%s%s\" line %ld"),
+		    p,
 		    debug_breakpoint_name + (*p == NUL ? 0 : 3),
 		    (long)debug_breakpoint_lnum);
 	    debug_breakpoint_name = NULL;
@@ -2473,13 +2467,8 @@ do_in_runtimepath(name, all, callback, cookie)
     if (buf != NULL && rtp_copy != NULL)
     {
 	if (p_verbose > 1)
-	{
-	    if (STRLEN(name) + STRLEN(p_rtp) > IOSIZE - 100)
-		MSG(_("Searching for a long name in 'runtimepath'"));
-	    else
-		smsg((char_u *)_("Searching for \"%s\" in \"%s\""),
+	    smsg((char_u *)_("Searching for \"%s\" in \"%s\""),
 						 (char *)name, (char *)p_rtp);
-	}
 
 	/* Loop over all entries in 'runtimepath'. */
 	rtp = rtp_copy;
@@ -2501,7 +2490,7 @@ do_in_runtimepath(name, all, callback, cookie)
 								       "\t ");
 
 		    if (p_verbose > 2)
-			msg_str((char_u *)_("Searching for \"%s\""), buf);
+			smsg((char_u *)_("Searching for \"%s\""), buf);
 
 		    /* Expand wildcards, invoke the callback for each match. */
 		    if (gen_expand_wildcards(1, &buf, &num_files, &files,
@@ -2523,7 +2512,7 @@ do_in_runtimepath(name, all, callback, cookie)
     vim_free(buf);
     vim_free(rtp_copy);
     if (p_verbose > 0 && !did_one)
-	msg_str((char_u *)_("not found in 'runtimepath': \"%s\""), name);
+	smsg((char_u *)_("not found in 'runtimepath': \"%s\""), name);
 
 #ifdef AMIGA
     proc->pr_WindowPtr = save_winptr;
@@ -2733,7 +2722,7 @@ do_source(fname, check_other, is_vimrc)
 #endif
     if (mch_isdir(fname_exp))
     {
-	msg_str((char_u *)_("Cannot source a directory: \"%s\""), fname);
+	smsg((char_u *)_("Cannot source a directory: \"%s\""), fname);
 	goto theend;
     }
 
@@ -2771,10 +2760,10 @@ do_source(fname, check_other, is_vimrc)
 	if (p_verbose > 0)
 	{
 	    if (sourcing_name == NULL)
-		msg_str((char_u *)_("could not source \"%s\""), fname);
+		smsg((char_u *)_("could not source \"%s\""), fname);
 	    else
 		smsg((char_u *)_("line %ld: could not source \"%s\""),
-			sourcing_lnum, fname);
+							sourcing_lnum, fname);
 	}
 	goto theend;
     }
@@ -2787,10 +2776,10 @@ do_source(fname, check_other, is_vimrc)
     if (p_verbose > 1)
     {
 	if (sourcing_name == NULL)
-	    msg_str((char_u *)_("sourcing \"%s\""), fname);
+	    smsg((char_u *)_("sourcing \"%s\""), fname);
 	else
 	    smsg((char_u *)_("line %ld: sourcing \"%s\""),
-		    sourcing_lnum, fname);
+							sourcing_lnum, fname);
     }
     if (is_vimrc)
 	vimrc_found();
@@ -2972,16 +2961,12 @@ do_source(fname, check_other, is_vimrc)
     sourcing_lnum = save_sourcing_lnum;
     if (p_verbose > 1)
     {
-	msg_str((char_u *)_("finished sourcing %s"), fname);
+	smsg((char_u *)_("finished sourcing %s"), fname);
 	if (sourcing_name != NULL)
-	    msg_str((char_u *)_("continuing in %s"), sourcing_name);
+	    smsg((char_u *)_("continuing in %s"), sourcing_name);
     }
 #ifdef STARTUPTIME
-# ifdef HAVE_SNPRINTF
-    snprintf(IObuff, IOSIZE, "sourcing %s", fname);
-# else
-    sprintf(IObuff, "sourcing %s", fname);
-# endif
+    vim_snprintf(IObuff, IOSIZE, "sourcing %s", fname);
     time_msg(IObuff, &tv_start);
     time_pop(&tv_rel);
 #endif
@@ -4263,14 +4248,15 @@ ex_hardcopy(eap)
 	    page_prtpos = prtpos;
 	}
 
-	sprintf((char *)IObuff, _("Printed: %s"), settings.jobname);
+	vim_snprintf((char *)IObuff, IOSIZE, _("Printed: %s"),
+							    settings.jobname);
 	prt_message(IObuff);
     }
 
 print_fail:
     if (got_int || settings.user_abort)
     {
-	sprintf((char *)IObuff, _("Printing aborted"));
+	sprintf((char *)IObuff, "%s", _("Printing aborted"));
 	prt_message(IObuff);
     }
     mch_print_end(&settings);
@@ -4954,7 +4940,7 @@ prt_write_file_len(buffer, bytes)
 prt_write_string(s)
     char	*s;
 {
-    sprintf((char *)prt_line_buffer, "%s", s);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer), "%s", s);
     prt_write_file(prt_line_buffer);
 }
 
@@ -4990,8 +4976,8 @@ prt_def_font(new_name, encoding, height, font)
     int		height;
     char	*font;
 {
-    sprintf((char *)prt_line_buffer, "/_%s /VIM-%s /%s ref\n",
-                                                     new_name, encoding, font);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+			  "/_%s /VIM-%s /%s ref\n", new_name, encoding, font);
     prt_write_file(prt_line_buffer);
 #ifdef FEAT_MBYTE
     if (prt_out_mbyte)
@@ -4999,8 +4985,8 @@ prt_def_font(new_name, encoding, height, font)
 		       new_name, height, 500./prt_ps_courier_font.wx, new_name);
     else
 #endif
-    sprintf((char *)prt_line_buffer, "/%s %d /_%s ffs\n",
-						    new_name, height, new_name);
+	vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+			     "/%s %d /_%s ffs\n", new_name, height, new_name);
     prt_write_file(prt_line_buffer);
 }
 
@@ -5014,11 +5000,11 @@ prt_def_cidfont(new_name, height, cidfont)
     int		height;
     char	*cidfont;
 {
-    sprintf((char *)prt_line_buffer, "/_%s /%s[/%s] vim_composefont\n",
-                                                new_name, prt_cmap, cidfont);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+	      "/_%s /%s[/%s] vim_composefont\n", new_name, prt_cmap, cidfont);
     prt_write_file(prt_line_buffer);
-    sprintf((char *)prt_line_buffer, "/%s %d /_%s ffs\n", new_name, height,
-                                                                    new_name);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+			     "/%s %d /_%s ffs\n", new_name, height, new_name);
     prt_write_file(prt_line_buffer);
 }
 
@@ -5030,7 +5016,8 @@ prt_dup_cidfont(original_name, new_name)
     char	*original_name;
     char	*new_name;
 {
-    sprintf((char *)prt_line_buffer, "/%s %s d\n", new_name, original_name);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+				       "/%s %s d\n", new_name, original_name);
     prt_write_file(prt_line_buffer);
 }
 #endif
@@ -5105,7 +5092,8 @@ prt_def_var(name, value, prec)
     double	value;
     int		prec;
 {
-    sprintf((char *)prt_line_buffer, "/%s ", name);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+								"/%s ", name);
     prt_write_file(prt_line_buffer);
     prt_write_real(value, prec);
     sprintf((char *)prt_line_buffer, "d\n");
@@ -5532,7 +5520,8 @@ prt_dsc_start()
 prt_dsc_noarg(comment)
     char	*comment;
 {
-    sprintf((char *)prt_line_buffer, "%%%%%s\n", comment);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+							 "%%%%%s\n", comment);
     prt_write_file(prt_line_buffer);
 }
 
@@ -5541,7 +5530,8 @@ prt_dsc_textline(comment, text)
     char	*comment;
     char	*text;
 {
-    sprintf((char *)prt_line_buffer, "%%%%%s: %s\n", comment, text);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+					       "%%%%%s: %s\n", comment, text);
     prt_write_file(prt_line_buffer);
 }
 
@@ -5551,7 +5541,8 @@ prt_dsc_text(comment, text)
     char	*text;
 {
     /* TODO - should scan 'text' for any chars needing escaping! */
-    sprintf((char *)prt_line_buffer, "%%%%%s: (%s)\n", comment, text);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+					     "%%%%%s: (%s)\n", comment, text);
     prt_write_file(prt_line_buffer);
 }
 
@@ -5565,7 +5556,8 @@ prt_dsc_ints(comment, count, ints)
 {
     int		i;
 
-    sprintf((char *)prt_line_buffer, "%%%%%s:", comment);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+							  "%%%%%s:", comment);
     prt_write_file(prt_line_buffer);
 
     for (i = 0; i < count; i++)
@@ -5584,12 +5576,15 @@ prt_dsc_resources(comment, type, string)
     char	*string;
 {
     if (comment != NULL)
-	sprintf((char *)prt_line_buffer, "%%%%%s: %s", comment, type);
+	vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+						 "%%%%%s: %s", comment, type);
     else
-	sprintf((char *)prt_line_buffer, "%%%%+ %s", type);
+	vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+							    "%%%%+ %s", type);
     prt_write_file(prt_line_buffer);
 
-    sprintf((char *)prt_line_buffer, " %s\n", string);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+							     " %s\n", string);
     prt_write_file(prt_line_buffer);
 }
 
@@ -5654,7 +5649,8 @@ prt_dsc_docmedia(paper_name, width, height, weight, colour, type)
     char	*colour;
     char	*type;
 {
-    sprintf((char *)prt_line_buffer, "%%%%DocumentMedia: %s ", paper_name);
+    vim_snprintf((char *)prt_line_buffer, sizeof(prt_line_buffer),
+					"%%%%DocumentMedia: %s ", paper_name);
     prt_write_file(prt_line_buffer);
     prt_write_real(width, 2);
     prt_write_real(height, 2);
diff --git a/src/if_mzsch.c b/src/if_mzsch.c
index 1e2405ec0..c67c46de2 100644
--- a/src/if_mzsch.c
+++ b/src/if_mzsch.c
@@ -93,6 +93,11 @@ typedef struct
  *  Utility functions for the vim/mzscheme interface
  *========================================================================
  */
+#ifdef HAVE_SANDBOX
+static Scheme_Object *sandbox_file_guard(int, Scheme_Object **);
+static Scheme_Object *sandbox_network_guard(int, Scheme_Object **);
+static void sandbox_check();
+#endif
 /*  Buffer-related commands */
 static Scheme_Object *buffer_new(buf_T *buf);
 static Scheme_Object *get_buffer_by_name(void *, int, Scheme_Object **);
@@ -205,11 +210,15 @@ static void (*dll_scheme_add_global_symbol)(Scheme_Object *name,
 static Scheme_Object *(*dll_scheme_apply)(Scheme_Object *rator, int num_rands,
 	Scheme_Object **rands);
 static Scheme_Object *(*dll_scheme_builtin_value)(const char *name);
+# if MZSCHEME_VERSION_MAJOR >= 299
+static Scheme_Object *(*dll_scheme_byte_string_to_char_string)(Scheme_Object *s);
+# endif
 static void (*dll_scheme_close_input_port)(Scheme_Object *port);
 static void (*dll_scheme_count_lines)(Scheme_Object *port);
 static Scheme_Object *(*dll_scheme_current_continuation_marks)(void);
 static void (*dll_scheme_display)(Scheme_Object *obj, Scheme_Object *port);
 static char *(*dll_scheme_display_to_string)(Scheme_Object *obj, long *len);
+static int (*dll_scheme_eq)(Scheme_Object *obj1, Scheme_Object *obj2);
 static Scheme_Object *(*dll_scheme_do_eval)(Scheme_Object *obj,
 	int _num_rands, Scheme_Object **rands, int val);
 static void (*dll_scheme_dont_gc_ptr)(void *p);
@@ -225,6 +234,7 @@ static char *(*dll_scheme_format)(char *format, int flen, int argc,
 # else
 static char *(*dll_scheme_format_utf8)(char *format, int flen, int argc,
 	Scheme_Object **argv, long *rlen);
+static Scheme_Object *(*dll_scheme_get_param)(Scheme_Config *c, int pos);
 # endif
 static void (*dll_scheme_gc_ptr_ok)(void *p);
 # if MZSCHEME_VERSION_MAJOR < 299
@@ -245,6 +255,8 @@ static Scheme_Object *(*dll_scheme_make_namespace)(int argc,
 	Scheme_Object *argv[]);
 static Scheme_Object *(*dll_scheme_make_pair)(Scheme_Object *car, 
 	Scheme_Object *cdr);
+static Scheme_Object *(*dll_scheme_make_prim_w_arity)(Scheme_Prim *prim,
+	const char *name, mzshort mina, mzshort maxa);
 # if MZSCHEME_VERSION_MAJOR < 299
 static Scheme_Object *(*dll_scheme_make_string)(const char *chars);
 static Scheme_Object *(*dll_scheme_make_string_output_port)();
@@ -311,6 +323,9 @@ static Scheme_Object *(*dll_scheme_char_string_to_byte_string)
 # define scheme_apply dll_scheme_apply
 # define scheme_basic_env dll_scheme_basic_env
 # define scheme_builtin_value dll_scheme_builtin_value
+# if MZSCHEME_VERSION_MAJOR >= 299
+#  define scheme_byte_string_to_char_string dll_scheme_byte_string_to_char_string
+# endif
 # define scheme_check_threads dll_scheme_check_threads
 # define scheme_close_input_port dll_scheme_close_input_port
 # define scheme_count_lines dll_scheme_count_lines
@@ -320,6 +335,7 @@ static Scheme_Object *(*dll_scheme_char_string_to_byte_string)
 # define scheme_display_to_string dll_scheme_display_to_string
 # define scheme_do_eval dll_scheme_do_eval
 # define scheme_dont_gc_ptr dll_scheme_dont_gc_ptr
+# define scheme_eq dll_scheme_eq
 # define scheme_eval dll_scheme_eval
 # define scheme_eval_string dll_scheme_eval_string
 # define scheme_eval_string_all dll_scheme_eval_string_all
@@ -335,6 +351,7 @@ static Scheme_Object *(*dll_scheme_char_string_to_byte_string)
 # else
 #  define scheme_get_sized_byte_string_output \
     dll_scheme_get_sized_byte_string_output
+# define scheme_get_param dll_scheme_get_param
 # endif
 # define scheme_intern_symbol dll_scheme_intern_symbol
 # define scheme_lookup_global dll_scheme_lookup_global
@@ -342,6 +359,7 @@ static Scheme_Object *(*dll_scheme_char_string_to_byte_string)
 # define scheme_make_integer_value dll_scheme_make_integer_value
 # define scheme_make_namespace dll_scheme_make_namespace
 # define scheme_make_pair dll_scheme_make_pair
+# define scheme_make_prim_w_arity dll_scheme_make_prim_w_arity
 # if MZSCHEME_VERSION_MAJOR < 299
 #  define scheme_make_string dll_scheme_make_string
 #  define scheme_make_string_output_port dll_scheme_make_string_output_port
@@ -399,6 +417,9 @@ static Thunk_Info mzsch_imports[] = {
     {"scheme_add_global_symbol", (void **)&dll_scheme_add_global_symbol},
     {"scheme_apply", (void **)&dll_scheme_apply},
     {"scheme_basic_env", (void **)&dll_scheme_basic_env},
+# if MZSCHEME_VERSION_MAJOR >= 299
+    {"scheme_byte_string_to_char_string", (void **)&dll_scheme_byte_string_to_char_string},
+# endif
     {"scheme_builtin_value", (void **)&dll_scheme_builtin_value},
     {"scheme_check_threads", (void **)&dll_scheme_check_threads},
     {"scheme_close_input_port", (void **)&dll_scheme_close_input_port},
@@ -409,6 +430,7 @@ static Thunk_Info mzsch_imports[] = {
     {"scheme_display_to_string", (void **)&dll_scheme_display_to_string},
     {"scheme_do_eval", (void **)&dll_scheme_do_eval},
     {"scheme_dont_gc_ptr", (void **)&dll_scheme_dont_gc_ptr},
+    {"scheme_eq", (void **)&dll_scheme_eq},
     {"scheme_eval", (void **)&dll_scheme_eval},
     {"scheme_eval_string", (void **)&dll_scheme_eval_string},
     {"scheme_eval_string_all", (void **)&dll_scheme_eval_string_all},
@@ -418,6 +440,7 @@ static Thunk_Info mzsch_imports[] = {
     {"scheme_format", (void **)&dll_scheme_format},
 # else
     {"scheme_format_utf8", (void **)&dll_scheme_format_utf8},
+    {"scheme_get_param", (void **)&dll_scheme_get_param},
 #endif
     {"scheme_gc_ptr_ok", (void **)&dll_scheme_gc_ptr_ok},
 # if MZSCHEME_VERSION_MAJOR < 299
@@ -434,6 +457,7 @@ static Thunk_Info mzsch_imports[] = {
     {"scheme_make_integer_value", (void **)&dll_scheme_make_integer_value},
     {"scheme_make_namespace", (void **)&dll_scheme_make_namespace},
     {"scheme_make_pair", (void **)&dll_scheme_make_pair},
+    {"scheme_make_prim_w_arity", (void **)&dll_scheme_make_prim_w_arity},
 # if MZSCHEME_VERSION_MAJOR < 299
     {"scheme_make_string", (void **)&dll_scheme_make_string},
     {"scheme_make_string_output_port", 
@@ -727,6 +751,8 @@ mzscheme_end(void)
     static void
 startup_mzscheme(void)
 {
+    Scheme_Object *proc_make_security_guard;
+
     scheme_set_stack_base(NULL, 1);
 
     MZ_REGISTER_STATIC(environment);
@@ -751,7 +777,24 @@ startup_mzscheme(void)
 	    scheme_make_pair(scheme_make_string(MZSCHEME_COLLECTS),
 		scheme_null));
 #endif
-
+#ifdef HAVE_SANDBOX
+    /* setup sandbox guards */
+    proc_make_security_guard = scheme_lookup_global(
+	    scheme_intern_symbol("make-security-guard"),
+	    environment);
+    if (proc_make_security_guard != NULL)
+    {
+	Scheme_Object *args[3];
+	Scheme_Object *guard;
+	args[0] = scheme_get_param(scheme_config, MZCONFIG_SECURITY_GUARD);
+	args[1] = scheme_make_prim_w_arity(sandbox_file_guard,
+		"sandbox-file-guard", 3, 3);
+	args[2] = scheme_make_prim_w_arity(sandbox_network_guard,
+		"sandbox-network-guard", 4, 4);
+	guard = scheme_apply(proc_make_security_guard, 3, args);
+	scheme_set_param(scheme_config, MZCONFIG_SECURITY_GUARD, guard);
+    }
+#endif
     /* Create buffer and window types for use in Scheme code */
     mz_buffer_type = scheme_make_type("<vim-buffer>");
     mz_window_type = scheme_make_type("<vim-window>");
@@ -1579,6 +1622,9 @@ set_cursor(void *data, int argc, Scheme_Object **argv)
     long	    lnum = 0;
     long	    col = 0;
 
+#ifdef HAVE_SANDBOX
+    sandbox_check();
+#endif
     win = get_window_arg(prim->name, 1, argc, argv);
     GUARANTEE_PAIR(prim->name, 0);
 
@@ -1615,6 +1661,9 @@ mzscheme_open_buffer(void *data, int argc, Scheme_Object **argv)
     int		    num = 0;
     Scheme_Object   *onum;
 
+#ifdef HAVE_SANDBOX
+    sandbox_check();
+#endif
     fname = SCHEME_STR_VAL(GUARANTEE_STRING(prim->name, 0));
     /* TODO make open existing file */
     num = buflist_add(fname, BLN_LISTED | BLN_CURBUF);
@@ -1869,6 +1918,9 @@ set_buffer_line(void *data, int argc, Scheme_Object **argv)
     buf_T	    *savebuf;
     int		    n;
 
+#ifdef HAVE_SANDBOX
+    sandbox_check();
+#endif
     n = SCHEME_INT_VAL(GUARANTEE_INTEGER(prim->name, 0));
     if (!SCHEME_STRINGP(argv[1]) && !SCHEME_FALSEP(argv[1]))
         scheme_wrong_type(prim->name, "string or #f", 1, argc, argv);
@@ -1958,6 +2010,9 @@ set_buffer_line_list(void *data, int argc, Scheme_Object **argv)
     int		    i, old_len, new_len, hi, lo;
     long	    extra;
 
+#ifdef HAVE_SANDBOX
+    sandbox_check();
+#endif
     lo = SCHEME_INT_VAL(GUARANTEE_INTEGER(prim->name, 0));
     hi = SCHEME_INT_VAL(GUARANTEE_INTEGER(prim->name, 1));
     if (!SCHEME_PAIRP(argv[2])
@@ -2121,6 +2176,9 @@ insert_buffer_line_list(void *data, int argc, Scheme_Object **argv)
     buf_T	    *savebuf;
     int		    i, n, size;
 
+#ifdef HAVE_SANDBOX
+    sandbox_check();
+#endif
     /*
      * First of all, we check the type of the supplied MzScheme object.
      * It must be a string or a list, or the call is in error.
@@ -2380,8 +2438,9 @@ raise_vim_exn(const char *add_info)
     if (add_info != NULL)
     {
 	Scheme_Object   *info = scheme_make_string(add_info);
-	argv[0] = scheme_make_string(
-		scheme_format(fmt, strlen(fmt), 1, &info, NULL));
+	argv[0] = scheme_byte_string_to_char_string(scheme_make_string(
+		scheme_format(fmt, strlen(fmt), 1, &info, NULL)));
+	SCHEME_SET_IMMUTABLE(argv[0]);
     }
     else
 	argv[0] = scheme_make_string(_("Vim error"));
@@ -2596,3 +2655,66 @@ make_modules(Scheme_Env *env)
     scheme_add_global("global-namespace", (Scheme_Object *)environment, mod);
     scheme_finish_primitive_module(mod);
 }
+    
+#ifdef HAVE_SANDBOX
+static Scheme_Object *M_write = NULL;
+static Scheme_Object *M_read = NULL;
+static Scheme_Object *M_execute = NULL;
+static Scheme_Object *M_delete = NULL;
+
+    static void
+sandbox_check()
+{
+    if (sandbox)
+	raise_vim_exn(_("not allowed in the Vim sandbox"));
+}
+
+/* security guards to force Vim's sandbox restrictions on MzScheme level */ 
+    static Scheme_Object *
+sandbox_file_guard(int argc, Scheme_Object **argv)
+{
+    if (sandbox)
+    {
+	Scheme_Object *requested_access = argv[2];
+
+	if (M_write == NULL)
+	{
+	    MZ_REGISTER_STATIC(M_write);
+	    M_write = scheme_intern_symbol("write");
+	}
+	if (M_read == NULL)
+	{
+	    MZ_REGISTER_STATIC(M_read);
+	    M_read = scheme_intern_symbol("read");
+	}
+	if (M_execute == NULL)
+	{
+	    MZ_REGISTER_STATIC(M_execute);
+	    M_execute = scheme_intern_symbol("execute");
+	}
+	if (M_delete == NULL)
+	{
+	    MZ_REGISTER_STATIC(M_delete);
+	    M_delete = scheme_intern_symbol("delete");
+	}
+
+	while (!SCHEME_NULLP(requested_access))
+	{
+	    Scheme_Object *item = SCHEME_CAR(requested_access);
+	    if (scheme_eq(item, M_write) || scheme_eq(item, M_read)
+		    || scheme_eq(item, M_execute) || scheme_eq(item, M_delete))
+	    {
+		raise_vim_exn(_("not allowed in the Vim sandbox"));
+	    }
+	    requested_access = SCHEME_CDR(requested_access);
+	}
+    }
+    return scheme_void;
+}
+
+    static Scheme_Object *
+sandbox_network_guard(int argc, Scheme_Object **argv)
+{
+    return scheme_void;
+}
+#endif
diff --git a/src/if_mzsch.h b/src/if_mzsch.h
index 88f6a54f9..98bcf74b5 100644
--- a/src/if_mzsch.h
+++ b/src/if_mzsch.h
@@ -34,12 +34,13 @@
 # endif
 # define scheme_format scheme_format_utf8
 
-# define GET_BYTE_STRING(obj) (SCHEME_BYTE_STRINGP(obj) ? obj :   \
+# define SCHEME_GET_BYTE_STRING(obj) (SCHEME_BYTE_STRINGP(obj) ? obj :   \
 	scheme_char_string_to_byte_string(obj))
 #else
-# define GET_BYTE_STRING(obj) (obj)
+# define SCHEME_GET_BYTE_STRING(obj) (obj)
 # define SCHEME_BYTE_STRLEN_VAL SCHEME_STRLEN_VAL
 # define SCHEME_BYTE_STR_VAL SCHEME_STR_VAL
+# define scheme_byte_string_to_char_string(obj) (obj)
 #endif
 
 #endif /* _IF_MZSCH_H_ */
diff --git a/src/if_python.c b/src/if_python.c
index 02d6ac18f..b799047e9 100644
--- a/src/if_python.c
+++ b/src/if_python.c
@@ -1369,12 +1369,13 @@ BufferGetattr(PyObject *self, char *name)
     static PyObject *
 BufferRepr(PyObject *self)
 {
-    static char repr[50];
+    static char repr[100];
     BufferObject *this = (BufferObject *)(self);
 
     if (this->buf == INVALID_BUFFER_VALUE)
     {
-	sprintf(repr, _("<buffer object (deleted) at %8lX>"), (long)(self));
+	vim_snprintf(repr, 100, _("<buffer object (deleted) at %8lX>"),
+								(long)(self));
 	return PyString_FromString(repr);
     }
     else
@@ -1389,7 +1390,7 @@ BufferRepr(PyObject *self)
 	if (len > 35)
 	    name = name + (35 - len);
 
-	sprintf(repr, "<buffer %s%s>", len > 35 ? "..." : "", name);
+	vim_snprintf(repr, 100, "<buffer %s%s>", len > 35 ? "..." : "", name);
 
 	return PyString_FromString(repr);
     }
@@ -1588,12 +1589,12 @@ RangeGetattr(PyObject *self, char *name)
     static PyObject *
 RangeRepr(PyObject *self)
 {
-    static char repr[75];
+    static char repr[100];
     RangeObject *this = (RangeObject *)(self);
 
     if (this->buf->buf == INVALID_BUFFER_VALUE)
     {
-	sprintf(repr, "<range object (for deleted buffer) at %8lX>",
+	vim_snprintf(repr, 100, "<range object (for deleted buffer) at %8lX>",
 								(long)(self));
 	return PyString_FromString(repr);
     }
@@ -1609,7 +1610,7 @@ RangeRepr(PyObject *self)
 	if (len > 45)
 	    name = name + (45 - len);
 
-	sprintf(repr, "<range %s%s (%d:%d)>",
+	vim_snprintf(repr, 100, "<range %s%s (%d:%d)>",
 		len > 45 ? "..." : "", name,
 		this->start, this->end);
 
@@ -1963,12 +1964,13 @@ WindowSetattr(PyObject *self, char *name, PyObject *val)
     static PyObject *
 WindowRepr(PyObject *self)
 {
-    static char repr[50];
+    static char repr[100];
     WindowObject *this = (WindowObject *)(self);
 
     if (this->win == INVALID_WINDOW_VALUE)
     {
-	sprintf(repr, _("<window object (deleted) at %.8lX>"), (long)(self));
+	vim_snprintf(repr, 100, _("<window object (deleted) at %.8lX>"),
+								(long)(self));
 	return PyString_FromString(repr);
     }
     else
@@ -1980,9 +1982,10 @@ WindowRepr(PyObject *self)
 	    ++i;
 
 	if (w == NULL)
-	    sprintf(repr, _("<window object (unknown) at %.8lX>"), (long)(self));
+	    vim_snprintf(repr, 100, _("<window object (unknown) at %.8lX>"),
+								(long)(self));
 	else
-	    sprintf(repr, _("<window %d>"), i);
+	    vim_snprintf(repr, 100, _("<window %d>"), i);
 
 	return PyString_FromString(repr);
     }
diff --git a/src/if_tcl.c b/src/if_tcl.c
index 3c08325a2..8f75e0d08 100644
--- a/src/if_tcl.c
+++ b/src/if_tcl.c
@@ -852,7 +852,9 @@ bufselfcmd(ref, interp, objc, objv)
 	    else
 	    {
 		char rbuf[64];
-		sprintf(rbuf, _("row %d column %d"), (int)row2tcl(pos->lnum), (int)col2tcl(pos->col));
+
+		sprintf(rbuf, _("row %d column %d"),
+			     (int)row2tcl(pos->lnum), (int)col2tcl(pos->col));
 		Tcl_SetResult(interp, rbuf, TCL_VOLATILE);
 	    }
 	    break;
@@ -874,7 +876,8 @@ bufselfcmd(ref, interp, objc, objv)
 		--val1;
 	    if (u_save((linenr_T)val1, (linenr_T)(val1+1)) != OK)
 	    {
-		Tcl_SetResult(interp, _("cannot save undo information"), TCL_STATIC);
+		Tcl_SetResult(interp, _("cannot save undo information"),
+								  TCL_STATIC);
 		err = TCL_ERROR;
 		break;
 	    }
@@ -882,7 +885,8 @@ bufselfcmd(ref, interp, objc, objv)
 	    line = Tcl_GetStringFromObj(objv[3], NULL);
 	    if (ml_append((linenr_T)val1, (char_u *)line, 0, FALSE) != OK)
 	    {
-		Tcl_SetResult(interp, _("cannot insert/append line"), TCL_STATIC);
+		Tcl_SetResult(interp, _("cannot insert/append line"),
+								  TCL_STATIC);
 		err = TCL_ERROR;
 		break;
 	    }
@@ -1067,6 +1071,7 @@ winselfcmd(ref, interp, objc, objv)
 	    if (objc == 2)
 	    {
 		char buf[64];
+
 		sprintf(buf, _("row %d column %d"), (int)row2tcl(win->w_cursor.lnum), (int)col2tcl(win->w_cursor.col));
 		Tcl_SetResult(interp, buf, TCL_VOLATILE);
 		break;
@@ -1486,7 +1491,8 @@ tclgetref(interp, refstartP, prefix, vimobj, proc)
     }
 
     if (ref)
-	sprintf(name, "::vim::%s", Tcl_GetCommandName(interp, ref->cmd));
+	vim_snprintf(name, sizeof(name), "::vim::%s",
+					Tcl_GetCommandName(interp, ref->cmd));
     else
     {
 	if (unused)
@@ -1507,7 +1513,8 @@ tclgetref(interp, refstartP, prefix, vimobj, proc)
 	}
 
 	/* This might break on some exotic systems... */
-	sprintf(name, "::vim::%s_%lx", prefix, (unsigned long)vimobj);
+	vim_snprintf(name, sizeof(name), "::vim::%s_%lx",
+					       prefix, (unsigned long)vimobj);
 	cmd = Tcl_CreateObjCommand(interp, name, proc,
 	    (ClientData)ref, (Tcl_CmdDeleteProc *)delref);
 	if (!cmd)
@@ -1881,7 +1888,7 @@ tclexit(error)
     if (error == TCL_EXIT )
     {
 	int retval;
-	char buf[32];
+	char buf[50];
 	Tcl_Obj *robj;
 
 	robj = Tcl_GetObjResult(tclinfo.interp);
@@ -1892,7 +1899,7 @@ tclexit(error)
 	}
 	else
 	{
-	    sprintf(buf, "E572: exit code %d", retval);
+	    sprintf(buf, _("E572: exit code %d"), retval);
 	    tclerrmsg(buf);
 	    if (retval == 0 )
 	    {
diff --git a/src/memline.c b/src/memline.c
index d5175e4b5..9f9e3074f 100644
--- a/src/memline.c
+++ b/src/memline.c
@@ -1015,13 +1015,13 @@ ml_recover()
     }
 
     home_replace(NULL, mfp->mf_fname, NameBuff, MAXPATHL, TRUE);
-    msg_str((char_u *)_("Using swap file \"%s\""), NameBuff);
+    smsg((char_u *)_("Using swap file \"%s\""), NameBuff);
 
     if (buf_spname(curbuf) != NULL)
 	STRCPY(NameBuff, buf_spname(curbuf));
     else
 	home_replace(NULL, curbuf->b_ffname, NameBuff, MAXPATHL, TRUE);
-    msg_str((char_u *)_("Original file \"%s\""), NameBuff);
+    smsg((char_u *)_("Original file \"%s\""), NameBuff);
     msg_putchar('\n');
 
 /*
diff --git a/src/misc1.c b/src/misc1.c
index 6603c26d9..d4dabe634 100644
--- a/src/misc1.c
+++ b/src/misc1.c
@@ -3295,7 +3295,7 @@ init_homedir()
 	    if (exp != NULL && *exp != NUL
 					&& STRLEN(exp) + STRLEN(p) < MAXPATHL)
 	    {
-		sprintf((char *)NameBuff, "%s%s", exp, p + 1);
+		vim_snprintf((char *)NameBuff, MAXPATHL, "%s%s", exp, p + 1);
 		var = NameBuff;
 		/* Also set $HOME, it's needed for _viminfo. */
 		vim_setenv((char_u *)"HOME", NameBuff);
diff --git a/src/ops.c b/src/ops.c
index ecc9ad987..94dc39c82 100644
--- a/src/ops.c
+++ b/src/ops.c
@@ -5226,7 +5226,7 @@ write_viminfo_registers(fp)
 #endif
 	    default:
 		sprintf((char *)IObuff, _("E574: Unknown register type %d"),
-		    y_regs[i].y_type);
+							    y_regs[i].y_type);
 		emsg(IObuff);
 		type = (char_u *)"LINE";
 		break;
@@ -5943,8 +5943,8 @@ line_count_info(line, wc, cc, limit, eol_size)
 cursor_pos_info()
 {
     char_u	*p;
-    char_u	buf1[20];
-    char_u	buf2[20];
+    char_u	buf1[50];
+    char_u	buf2[40];
     linenr_T	lnum;
     long	byte_count = 0;
     long	byte_count_cursor = 0;
@@ -6106,7 +6106,7 @@ cursor_pos_info()
 		buf1[0] = NUL;
 
 	    if (char_count_cursor == byte_count_cursor
-		    && char_count == byte_count)
+						  && char_count == byte_count)
 		sprintf((char *)IObuff, _("Selected %s%ld of %ld Lines; %ld of %ld Words; %ld of %ld Bytes"),
 			buf1, line_count_selected,
 			(long)curbuf->b_ml.ml_line_count,
diff --git a/src/option.c b/src/option.c
index ee33df95e..1f4ce7433 100644
--- a/src/option.c
+++ b/src/option.c
@@ -2571,7 +2571,7 @@ static char_u *set_chars_option __ARGS((char_u **varp));
 static char_u *check_clipboard_option __ARGS((void));
 #endif
 static char_u *set_bool_option __ARGS((int opt_idx, char_u *varp, int value, int opt_flags));
-static char_u *set_num_option __ARGS((int opt_idx, char_u *varp, long value, char_u *errbuf, int opt_flags));
+static char_u *set_num_option __ARGS((int opt_idx, char_u *varp, long value, char_u *errbuf, size_t errbuflen, int opt_flags));
 static void check_redraw __ARGS((long_u flags));
 static int findoption __ARGS((char_u *));
 static int find_key_option __ARGS((char_u *));
@@ -3881,7 +3881,7 @@ do_set(arg, opt_flags)
 			if (removing)
 			    value = *(long *)varp - value;
 			errmsg = set_num_option(opt_idx, varp, value,
-							   errbuf, opt_flags);
+					   errbuf, sizeof(errbuf), opt_flags);
 		    }
 		    else if (opt_idx >= 0)		    /* string */
 		    {
@@ -4287,7 +4287,7 @@ illegal_char(errbuf, c)
     if (errbuf == NULL)
 	return (char_u *)"";
     sprintf((char *)errbuf, _("E539: Illegal character <%s>"),
-	    (char *)transchar(c));
+							(char *)transchar(c));
     return errbuf;
 }
 
@@ -6822,11 +6822,12 @@ set_bool_option(opt_idx, varp, value, opt_flags)
  * Returns NULL for success, or an error message for an error.
  */
     static char_u *
-set_num_option(opt_idx, varp, value, errbuf, opt_flags)
+set_num_option(opt_idx, varp, value, errbuf, errbuflen, opt_flags)
     int		opt_idx;		/* index in options[] table */
     char_u	*varp;			/* pointer to the option variable */
     long	value;			/* new value */
     char_u	*errbuf;		/* buffer for error messages */
+    size_t	errbuflen;		/* length of "errbuf" */
     int		opt_flags;		/* OPT_LOCAL, OPT_GLOBAL and
 					   OPT_MODELINE */
 {
@@ -7116,8 +7117,8 @@ set_num_option(opt_idx, varp, value, errbuf, opt_flags)
     {
 	if (errbuf != NULL)
 	{
-	    sprintf((char *)errbuf, _("E593: Need at least %d lines"),
-								  min_rows());
+	    vim_snprintf((char *)errbuf, errbuflen,
+			       _("E593: Need at least %d lines"), min_rows());
 	    errmsg = errbuf;
 	}
 	Rows = min_rows();
@@ -7126,8 +7127,8 @@ set_num_option(opt_idx, varp, value, errbuf, opt_flags)
     {
 	if (errbuf != NULL)
 	{
-	    sprintf((char *)errbuf, _("E594: Need at least %d columns"),
-								 MIN_COLUMNS);
+	    vim_snprintf((char *)errbuf, errbuflen,
+			    _("E594: Need at least %d columns"), MIN_COLUMNS);
 	    errmsg = errbuf;
 	}
 	Columns = MIN_COLUMNS;
@@ -7453,7 +7454,8 @@ set_option_value(name, number, string, opt_flags)
 	    if (varp != NULL)	/* hidden option is not changed */
 	    {
 		if (flags & P_NUM)
-		    (void)set_num_option(opt_idx, varp, number, NULL, opt_flags);
+		    (void)set_num_option(opt_idx, varp, number,
+							  NULL, 0, opt_flags);
 		else
 		    (void)set_bool_option(opt_idx, varp, (int)number, opt_flags);
 	    }
diff --git a/src/po/it.po b/src/po/it.po
index 4a24a6cab..fe1d64d0c 100644
--- a/src/po/it.po
+++ b/src/po/it.po
@@ -1309,7 +1309,7 @@ msgid "1 substitution"
 msgstr "1 sostituzione"
 
 #: ex_cmds.c:4550
-#, fuzzy, c-format
+#, c-format
 msgid "%ld matches"
 msgstr "%ld corrisp."
 
@@ -1608,7 +1608,6 @@ msgid "Append File"
 msgstr "In aggiunta al File"
 
 #: ex_docmd.c:7225
-#, fuzzy
 msgid "E747: Cannot change directory, buffer is modifed (add ! to override)"
 msgstr ""
 "E747: Non posso cambiare directory, buffer modificato (aggiungi ! per "
@@ -2271,7 +2270,6 @@ msgid "W16: Warning: Mode of file \"%s\" has changed since editing started"
 msgstr "W16: Attenzione: Modo File \"%s\" modificato dopo l'apertura"
 
 #: fileio.c:6066
-#, fuzzy
 msgid "See \":help W16\" for more info."
 msgstr "Vedere \":help W16\" per ulteriori informazioni."
 
@@ -5600,7 +5598,6 @@ msgid "E382: Cannot write, 'buftype' option is set"
 msgstr "E382: Non posso scrivere, l'opzione 'buftype' è impostata"
 
 #: quickfix.c:2379
-#, fuzzy
 msgid "E682: Invalid search pattern or delimiter"
 msgstr "E682: Espressione o delimitatore di ricerca non validi"
 
@@ -6688,7 +6685,6 @@ msgid "with (classic) GUI."
 msgstr "con GUI (classica)."
 
 #: version.c:876
-#, fuzzy
 msgid "with KDE GUI."
 msgstr "con GUI KDE."
 
@@ -7002,7 +6998,6 @@ msgid "E588: :endwhile without :while"
 msgstr "E588: :endwhile senza :while"
 
 #: globals.h:1276
-#, fuzzy
 msgid "E588: :endfor without :for"
 msgstr "E588: :endfor senza :for"
 
diff --git a/src/proto/misc2.pro b/src/proto/misc2.pro
index 41479d0e9..f9aab8db4 100644
--- a/src/proto/misc2.pro
+++ b/src/proto/misc2.pro
@@ -92,5 +92,4 @@ int get_user_name __ARGS((char_u *buf, int len));
 void sort_strings __ARGS((char_u **files, int count));
 int pathcmp __ARGS((const char *p, const char *q, int maxlen));
 char_u *parse_list_options __ARGS((char_u *option_str, option_table_T *table, int table_size));
-void msg_str __ARGS((char_u *s, char_u *arg));
 /* vim: set ft=c : */
diff --git a/src/search.c b/src/search.c
index c9773b587..5ffcb3679 100644
--- a/src/search.c
+++ b/src/search.c
@@ -4278,8 +4278,9 @@ find_pattern_in_path(ptr, dir, len, whole, skip_comments,
 #ifdef FEAT_INS_EXPAND
 		    if (action == ACTION_EXPAND)
 		    {
-			sprintf((char*)IObuff, _("Scanning included file: %s"),
-			    (char *)new_fname);
+			vim_snprintf((char*)IObuff, IOSIZE,
+				_("Scanning included file: %s"),
+				(char *)new_fname);
 			msg_trunc_attr(IObuff, TRUE, hl_attr(HLF_R));
 		    }
 #endif
diff --git a/src/syntax.c b/src/syntax.c
index be79c2cc3..3ac43d719 100644
--- a/src/syntax.c
+++ b/src/syntax.c
@@ -3433,7 +3433,7 @@ syn_cmd_onoff(eap, name)
     if (!eap->skip)
     {
 	STRCPY(buf, "so ");
-	sprintf((char *)buf + 3, SYNTAX_FNAME, name);
+	vim_snprintf((char *)buf + 3, sizeof(buf) - 3, SYNTAX_FNAME, name);
 	do_cmdline_cmd(buf);
     }
 }
diff --git a/src/ui.c b/src/ui.c
index 15ab7cf97..3506c48b8 100644
--- a/src/ui.c
+++ b/src/ui.c
@@ -2140,7 +2140,7 @@ clip_x11_request_selection(myShell, dpy, cbd)
 	clip_yank_selection(MCHAR, buffer, (long)nbytes, cbd);
 	XFree((void *)buffer);
 	if (p_verbose > 0)
-	    smsg((char_u *)_("Used CUT_BUFFER0 instead of empty selection") );
+	    MSG(_("Used CUT_BUFFER0 instead of empty selection"));
     }
 }