Merge 8.6

43 files changed, 132 insertions, 123 deletions

diff --git a/compat/zlib/contrib/minizip/minizip.c b/compat/zlib/contrib/minizip/minizip.c
index be1774f..0f0112b 100644
--- a/compat/zlib/contrib/minizip/minizip.c
+++ b/compat/zlib/contrib/minizip/minizip.c
@@ -66,6 +66,9 @@
 #ifdef _WIN32
         #define USEWIN32IOAPI
         #include "iowin32.h"
+#       if defined(_MSC_VER)
+#           define snprintf _snprintf
+#       endif
 #endif
 
 
@@ -375,7 +378,7 @@ void addPathToZip(zipFile zf, const char *filenameinzip, const char *password, i
         tinydir_readfile_n(&dir, &file, i);
         if(strcmp(file.name,".")==0) continue;
         if(strcmp(file.name,"..")==0) continue;
-        sprintf(newname,"%.*s/%.*s", MAXFILENAME, dir.path, MAXFILENAME, file.name);
+        snprintf(newname, sizeof(newname), "%.*s/%.*s", MAXFILENAME, dir.path, MAXFILENAME, file.name);
         if (file.is_dir)
         {
             addPathToZip(zf,newname,password,opt_exclude_path,opt_compress_level);
diff --git a/doc/refchan.n b/doc/refchan.n
index 77e742c..ae900c5 100644
--- a/doc/refchan.n
+++ b/doc/refchan.n
@@ -54,7 +54,7 @@ here, then the \fBfinalize\fR subcommand will not be called.
 The \fImode\fR argument tells the handler whether the channel was
 opened for reading, writing, or both. It is a list containing any of
 the strings \fBread\fR or \fBwrite\fR. The list may be empty, but
-will usually contain at least one element. 
+will usually contain at least one element.
 .PP
 The subcommand must throw an error if the chosen mode is not
 supported by the \fIcmdPrefix\fR.
diff --git a/generic/regcomp.c b/generic/regcomp.c
index c1ceb51..983cd7a 100644
--- a/generic/regcomp.c
+++ b/generic/regcomp.c
@@ -2185,9 +2185,9 @@ stid(
 	return "unable";
     }
     if (t->id != 0) {
-	sprintf(buf, "%d", t->id);
+	snprintf(buf, bufsize, "%d", t->id);
     } else {
-	sprintf(buf, "%p", t);
+	snprintf(buf, bufsize, "%p", t);
     }
     return buf;
 }
diff --git a/generic/regerror.c b/generic/regerror.c
index 6606d41..775c640 100644
--- a/generic/regerror.c
+++ b/generic/regerror.c
@@ -73,7 +73,7 @@ regerror(
 		break;
 	    }
 	}
-	sprintf(convbuf, "%d", r->code); /* -1 for unknown */
+	snprintf(convbuf, sizeof(convbuf), "%d", r->code); /* -1 for unknown */
 	msg = convbuf;
 	break;
     case REG_ITOA:		/* Convert number to name */
@@ -86,7 +86,7 @@ regerror(
 	if (r->code >= 0) {
 	    msg = r->name;
 	} else {		/* Unknown; tell him the number */
-	    sprintf(convbuf, "REG_%u", (unsigned)icode);
+	    snprintf(convbuf, sizeof(convbuf), "REG_%u", (unsigned)icode);
 	    msg = convbuf;
 	}
 	break;
@@ -99,7 +99,7 @@ regerror(
 	if (r->code >= 0) {
 	    msg = r->explain;
 	} else {		/* Unknown; say so */
-	    sprintf(convbuf, unk, code);
+	    snprintf(convbuf, sizeof(convbuf), unk, code);
 	    msg = convbuf;
 	}
 	break;
diff --git a/generic/tclBasic.c b/generic/tclBasic.c
index b10a338..616600f 100644
--- a/generic/tclBasic.c
+++ b/generic/tclBasic.c
@@ -1533,7 +1533,7 @@ Tcl_CallWhenDeleted(
     AssocData *dPtr = (AssocData *)ckalloc(sizeof(AssocData));
     Tcl_HashEntry *hPtr;
 
-    sprintf(buffer, "Assoc Data Key #%d", *assocDataCounterPtr);
+    snprintf(buffer, sizeof(buffer), "Assoc Data Key #%d", *assocDataCounterPtr);
     (*assocDataCounterPtr)++;
 
     if (iPtr->assocData == NULL) {
@@ -6891,7 +6891,7 @@ ProcessUnexpectedResult(
 	Tcl_SetObjResult(interp, Tcl_ObjPrintf(
 		"command returned bad code: %d", returnCode));
     }
-    sprintf(buf, "%d", returnCode);
+    snprintf(buf, sizeof(buf), "%d", returnCode);
     Tcl_SetErrorCode(interp, "TCL", "UNEXPECTED_RESULT_CODE", buf, NULL);
 }
 
diff --git a/generic/tclCkalloc.c b/generic/tclCkalloc.c
index 0ad2c46..f0c625f 100644
--- a/generic/tclCkalloc.c
+++ b/generic/tclCkalloc.c
@@ -172,7 +172,7 @@ TclDumpMemoryInfo(
     if (clientData == NULL) {
         return 0;
     }
-    sprintf(buf,
+    snprintf(buf, sizeof(buf),
 	    "total mallocs             %10" TCL_Z_MODIFIER "u\n"
 	    "total frees               %10" TCL_Z_MODIFIER "u\n"
 	    "current packets allocated %10" TCL_Z_MODIFIER "u\n"
diff --git a/generic/tclClock.c b/generic/tclClock.c
index dd3e1c9..39fb073 100644
--- a/generic/tclClock.c
+++ b/generic/tclClock.c
@@ -1086,12 +1086,12 @@ ConvertUTCToLocalUsingC(
     } else {
 	*buffer = '+';
     }
-    sprintf(buffer+1, "%02d", diff / 3600);
+    snprintf(buffer+1, sizeof(buffer) - 1, "%02d", diff / 3600);
     diff %= 3600;
-    sprintf(buffer+3, "%02d", diff / 60);
+    snprintf(buffer+3, sizeof(buffer) - 3, "%02d", diff / 60);
     diff %= 60;
     if (diff > 0) {
-	sprintf(buffer+5, "%02d", diff);
+	snprintf(buffer+5, sizeof(buffer) - 5, "%02d", diff);
     }
     fields->tzName = Tcl_NewStringObj(buffer, -1);
     Tcl_IncrRefCount(fields->tzName);
diff --git a/generic/tclCompCmdsSZ.c b/generic/tclCompCmdsSZ.c
index 80afce6..ddc5c89 100644
--- a/generic/tclCompCmdsSZ.c
+++ b/generic/tclCompCmdsSZ.c
@@ -892,7 +892,7 @@ TclCompileStringLenCmd(
 	char buf[TCL_INTEGER_SPACE];
 	int len = TclGetCharLength(objPtr);
 
-	len = sprintf(buf, "%d", len);
+	len = snprintf(buf, sizeof(buf), "%d", len);
 	PushLiteral(envPtr, buf, len);
     } else {
 	SetLineInformation(1);
@@ -3114,7 +3114,7 @@ IssueTryClausesInstructions(
 
     for (i=0 ; i<numHandlers ; i++) {
 	noError[i] = -1;
-	sprintf(buf, "%d", matchCodes[i]);
+	snprintf(buf, sizeof(buf), "%d", matchCodes[i]);
 	OP(				DUP);
 	PushLiteral(envPtr, buf, strlen(buf));
 	OP(				EQ);
@@ -3326,7 +3326,7 @@ IssueTryClausesFinallyInstructions(
 	int noTrapError, trapError;
 	const char *p;
 
-	sprintf(buf, "%d", matchCodes[i]);
+	snprintf(buf, sizeof(buf), "%d", matchCodes[i]);
 	OP(				DUP);
 	PushLiteral(envPtr, buf, strlen(buf));
 	OP(				EQ);
diff --git a/generic/tclCompile.h b/generic/tclCompile.h
index a5942de..2e5d3ac 100644
--- a/generic/tclCompile.h
+++ b/generic/tclCompile.h
@@ -1826,7 +1826,7 @@ MODULE_SCOPE void TclDTraceInfo(Tcl_Obj *info, const char **args, int *argsi);
     FILE *tclDTraceDebugLog = NULL;				\
     void TclDTraceOpenDebugLog(void) {				\
 	char n[35];						\
-	sprintf(n, "/tmp/tclDTraceDebug-%" TCL_Z_MODIFIER "u.log", \
+	snprintf(n, sizeof(n), "/tmp/tclDTraceDebug-%" TCL_Z_MODIFIER "u.log", \
 		(size_t) getpid());			\
 	tclDTraceDebugLog = fopen(n, "a");			\
     }
diff --git a/generic/tclDisassemble.c b/generic/tclDisassemble.c
index 10404e9..72c5bc8 100644
--- a/generic/tclDisassemble.c
+++ b/generic/tclDisassemble.c
@@ -571,22 +571,22 @@ FormatInstruction(
 	case OPERAND_UINT4:
 	    opnd = TclGetUInt4AtPtr(pc+numBytes); numBytes += 4;
 	    if (opCode == INST_START_CMD) {
-		sprintf(suffixBuffer+strlen(suffixBuffer),
+		snprintf(suffixBuffer+strlen(suffixBuffer), sizeof(suffixBuffer) - strlen(suffixBuffer),
 			", %u cmds start here", opnd);
 	    }
 	    Tcl_AppendPrintfToObj(bufferObj, "%u ", (unsigned) opnd);
 	    break;
 	case OPERAND_OFFSET1:
 	    opnd = TclGetInt1AtPtr(pc+numBytes); numBytes++;
-	    sprintf(suffixBuffer, "pc %u", pcOffset+opnd);
+	    snprintf(suffixBuffer, sizeof(suffixBuffer), "pc %u", pcOffset+opnd);
 	    Tcl_AppendPrintfToObj(bufferObj, "%+d ", opnd);
 	    break;
 	case OPERAND_OFFSET4:
 	    opnd = TclGetInt4AtPtr(pc+numBytes); numBytes += 4;
 	    if (opCode == INST_START_CMD) {
-		sprintf(suffixBuffer, "next cmd at pc %u", pcOffset+opnd);
+		snprintf(suffixBuffer, sizeof(suffixBuffer), "next cmd at pc %u", pcOffset+opnd);
 	    } else {
-		sprintf(suffixBuffer, "pc %u", pcOffset+opnd);
+		snprintf(suffixBuffer, sizeof(suffixBuffer), "pc %u", pcOffset+opnd);
 	    }
 	    Tcl_AppendPrintfToObj(bufferObj, "%+d ", opnd);
 	    break;
@@ -632,9 +632,9 @@ FormatInstruction(
 		    localPtr = localPtr->nextPtr;
 		}
 		if (TclIsVarTemporary(localPtr)) {
-		    sprintf(suffixBuffer, "temp var %u", (unsigned) opnd);
+		    snprintf(suffixBuffer, sizeof(suffixBuffer), "temp var %u", (unsigned) opnd);
 		} else {
-		    sprintf(suffixBuffer, "var ");
+		    snprintf(suffixBuffer, sizeof(suffixBuffer), "var ");
 		    suffixSrc = localPtr->name;
 		}
 	    }
@@ -836,7 +836,7 @@ UpdateStringOfInstName(
     if (inst > LAST_INST_OPCODE) {
 	dst = Tcl_InitStringRep(objPtr, NULL, TCL_INTEGER_SPACE + 5);
 	TclOOM(dst, TCL_INTEGER_SPACE + 5);
-        sprintf(dst, "inst_%" TCL_Z_MODIFIER "u", inst);
+        snprintf(dst, TCL_INTEGER_SPACE + 5, "inst_%" TCL_Z_MODIFIER "u", inst);
 	(void) Tcl_InitStringRep(objPtr, NULL, strlen(dst));
     } else {
 	const char *s = tclInstructionTable[inst].name;
diff --git a/generic/tclEncoding.c b/generic/tclEncoding.c
index fc2835d..41a84db 100644
--- a/generic/tclEncoding.c
+++ b/generic/tclEncoding.c
@@ -1333,7 +1333,7 @@ Tcl_ExternalToUtfDStringEx(
 		/* Caller wants error message on failure */
 		if (result != TCL_OK && interp != NULL) {
 		    char buf[TCL_INTEGER_SPACE];
-		    sprintf(buf, "%u", nBytesProcessed);
+		    snprintf(buf, sizeof(buf), "%u", nBytesProcessed);
 		    Tcl_SetObjResult(
 			interp,
 			Tcl_ObjPrintf("unexpected byte sequence starting at index %"
@@ -1634,7 +1634,7 @@ Tcl_UtfToExternalDStringEx(
 		    int ucs4;
 		    char buf[TCL_INTEGER_SPACE];
 		    TclUtfToUCS4(&srcStart[nBytesProcessed], &ucs4);
-		    sprintf(buf, "%u", nBytesProcessed);
+		    snprintf(buf, sizeof(buf), "%u", nBytesProcessed);
 		    Tcl_SetObjResult(
 			interp,
 			Tcl_ObjPrintf(
diff --git a/generic/tclHash.c b/generic/tclHash.c
index 37e45e7..ea1b20e 100644
--- a/generic/tclHash.c
+++ b/generic/tclHash.c
@@ -649,18 +649,18 @@ Tcl_HashStats(
      */
 
     result = (char *)ckalloc((NUM_COUNTERS * 60) + 300);
-    sprintf(result, "%u entries in table, %u buckets\n",
+    snprintf(result, 60, "%u entries in table, %u buckets\n",
 	    tablePtr->numEntries, tablePtr->numBuckets);
     p = result + strlen(result);
     for (i = 0; i < NUM_COUNTERS; i++) {
-	sprintf(p, "number of buckets with %u entries: %u\n",
+	snprintf(p, 60, "number of buckets with %u entries: %u\n",
 		i, count[i]);
 	p += strlen(p);
     }
-    sprintf(p, "number of buckets with %u or more entries: %u\n",
+    snprintf(p, 60, "number of buckets with %u or more entries: %u\n",
 	    NUM_COUNTERS, overflow);
     p += strlen(p);
-    sprintf(p, "average search distance for entry: %.1f", average);
+    snprintf(p, 60, "average search distance for entry: %.1f", average);
     return result;
 }
 
diff --git a/generic/tclIO.c b/generic/tclIO.c
index 6207f6e..db66b7a 100644
--- a/generic/tclIO.c
+++ b/generic/tclIO.c
@@ -7915,7 +7915,7 @@ Tcl_GetChannelOption(
     Tcl_DString *dsPtr)		/* Where to store value(s). */
 {
     size_t len;			/* Length of optionName string. */
-    char optionVal[128];	/* Buffer for sprintf. */
+    char optionVal[128];	/* Buffer for snprintf. */
     Channel *chanPtr = (Channel *) chan;
     ChannelState *statePtr = chanPtr->state;
 				/* State info for channel */
@@ -8022,9 +8022,10 @@ Tcl_GetChannelOption(
 	    if (statePtr->inEofChar == 0) {
 		Tcl_DStringAppendElement(dsPtr, "");
 	    } else {
-		char buf[4];
+		char buf[2];
 
-		sprintf(buf, "%c", statePtr->inEofChar);
+		buf[1] = '\0';
+		buf[0] = statePtr->inEofChar;
 		Tcl_DStringAppendElement(dsPtr, buf);
 	    }
 	}
@@ -8032,9 +8033,10 @@ Tcl_GetChannelOption(
 	    if (statePtr->outEofChar == 0) {
 		Tcl_DStringAppendElement(dsPtr, "");
 	    } else {
-		char buf[4];
+		char buf[2];
 
-		sprintf(buf, "%c", statePtr->outEofChar);
+		buf[1] = '\0';
+		buf[0] = statePtr->outEofChar;
 		Tcl_DStringAppendElement(dsPtr, buf);
 	    }
 	}
diff --git a/generic/tclIORChan.c b/generic/tclIORChan.c
index de0db21..3057595 100644
--- a/generic/tclIORChan.c
+++ b/generic/tclIORChan.c
@@ -3343,7 +3343,7 @@ ForwardProc(
 		 */
 
 		char *buf = (char *)ckalloc(200);
-		sprintf(buf,
+		snprintf(buf, 200,
 			"{Expected list with even number of elements, got %d %s instead}",
 			listc, (listc == 1 ? "element" : "elements"));
 
diff --git a/generic/tclInt.h b/generic/tclInt.h
index bf5310b..464909c 100644
--- a/generic/tclInt.h
+++ b/generic/tclInt.h
@@ -138,6 +138,7 @@
 
 #if defined(_WIN32) && defined(_MSC_VER)
 #   define vsnprintf _vsnprintf
+#   define snprintf _snprintf
 #endif
 
 #if !defined(TCL_THREADS)
diff --git a/generic/tclInterp.c b/generic/tclInterp.c
index e743931..e6f210c 100644
--- a/generic/tclInterp.c
+++ b/generic/tclInterp.c
@@ -827,7 +827,7 @@ NRInterpCmd(
 	    for (i = 0; ; i++) {
 		Tcl_CmdInfo cmdInfo;
 
-		sprintf(buf, "interp%d", i);
+		snprintf(buf, sizeof(buf), "interp%d", i);
 		if (Tcl_GetCommandInfo(interp, buf, &cmdInfo) == 0) {
 		    break;
 		}
diff --git a/generic/tclLiteral.c b/generic/tclLiteral.c
index 0c2c545..56ce848 100644
--- a/generic/tclLiteral.c
+++ b/generic/tclLiteral.c
@@ -1134,18 +1134,18 @@ TclLiteralStats(
      */
 
     result = (char *)ckalloc(NUM_COUNTERS*60 + 300);
-    sprintf(result, "%d entries in table, %d buckets\n",
+    snprintf(result, 60, "%d entries in table, %d buckets\n",
 	    tablePtr->numEntries, tablePtr->numBuckets);
     p = result + strlen(result);
     for (i=0 ; i<NUM_COUNTERS ; i++) {
-	sprintf(p, "number of buckets with %" TCL_Z_MODIFIER "u entries: %" TCL_Z_MODIFIER "u\n",
+	snprintf(p, 60, "number of buckets with %" TCL_Z_MODIFIER "u entries: %" TCL_Z_MODIFIER "u\n",
 		i, count[i]);
 	p += strlen(p);
     }
-    sprintf(p, "number of buckets with %d or more entries: %d\n",
+    snprintf(p, 60, "number of buckets with %d or more entries: %d\n",
 	    NUM_COUNTERS, overflow);
     p += strlen(p);
-    sprintf(p, "average search distance for entry: %.1f", average);
+    snprintf(p, 60, "average search distance for entry: %.1f", average);
     return result;
 }
 #endif /*TCL_COMPILE_STATS*/
diff --git a/generic/tclOO.c b/generic/tclOO.c
index 5bd687a..299ac4c 100644
--- a/generic/tclOO.c
+++ b/generic/tclOO.c
@@ -654,7 +654,7 @@ AllocObject(
     while (1) {
 	char objName[10 + TCL_INTEGER_SPACE];
 
-	sprintf(objName, "::oo::Obj%d", ++fPtr->tsdPtr->nsCount);
+	snprintf(objName, sizeof(objName), "::oo::Obj%d", ++fPtr->tsdPtr->nsCount);
 	oPtr->namespacePtr = Tcl_CreateNamespace(interp, objName, oPtr, NULL);
 	if (oPtr->namespacePtr != NULL) {
 	    creationEpoch = fPtr->tsdPtr->nsCount;
diff --git a/generic/tclRegexp.c b/generic/tclRegexp.c
index bb4ffc9..8e0681c 100644
--- a/generic/tclRegexp.c
+++ b/generic/tclRegexp.c
@@ -729,7 +729,7 @@ TclRegError(
     p = (n > sizeof(buf)) ? "..." : "";
     Tcl_SetObjResult(interp, Tcl_ObjPrintf("%s%s%s", msg, buf, p));
 
-    sprintf(cbuf, "%d", status);
+    snprintf(cbuf, sizeof(cbuf), "%d", status);
     (void) TclReError(REG_ITOA, cbuf, sizeof(cbuf));
     Tcl_SetErrorCode(interp, "REGEXP", cbuf, buf, NULL);
 }
diff --git a/generic/tclStrToD.c b/generic/tclStrToD.c
index 206407e..92b2938 100644
--- a/generic/tclStrToD.c
+++ b/generic/tclStrToD.c
@@ -5341,7 +5341,7 @@ TclFormatNaN(
     *buffer++ = 'N';
     bitwhack.iv &= ((UINT64_C(1)) << 51) - 1;
     if (bitwhack.iv != 0) {
-	sprintf(buffer, "(%" PRIx64 ")", bitwhack.iv);
+	snprintf(buffer, TCL_DOUBLE_SPACE, "(%" PRIx64 ")", bitwhack.iv);
     } else {
 	*buffer = '\0';
     }
diff --git a/generic/tclStringObj.c b/generic/tclStringObj.c
index e1f5160..de6dc2f 100644
--- a/generic/tclStringObj.c
+++ b/generic/tclStringObj.c
@@ -2887,14 +2887,14 @@ Tcl_AppendFormatToObj(
 		*p++ = '+';
 	    }
 	    if (width) {
-		p += sprintf(p, "%d", width);
+		p += snprintf(p, TCL_INTEGER_SPACE, "%d", width);
 		if (width > length) {
 		    length = width;
 		}
 	    }
 	    if (gotPrecision) {
 		*p++ = '.';
-		p += sprintf(p, "%d", precision);
+		p += snprintf(p, TCL_INTEGER_SPACE, "%d", precision);
 		if (precision > INT_MAX - length) {
 		    msg = overflow;
 		    errCode = "OVERFLOW";
@@ -2918,7 +2918,7 @@ Tcl_AppendFormatToObj(
 		goto errorMsg;
 	    }
 	    bytes = TclGetString(segment);
-	    if (!Tcl_AttemptSetObjLength(segment, sprintf(bytes, spec, d))) {
+	    if (!Tcl_AttemptSetObjLength(segment, snprintf(bytes, segment->length, spec, d))) {
 		msg = overflow;
 		errCode = "OVERFLOW";
 		goto errorMsg;
diff --git a/generic/tclTest.c b/generic/tclTest.c
index 0d35b7a..53fa384 100644
--- a/generic/tclTest.c
+++ b/generic/tclTest.c
@@ -1295,7 +1295,7 @@ TestcmdtokenCmd(
 	nextCommandTokenRefId++;
 	refPtr->nextPtr = firstCommandTokenRef;
 	firstCommandTokenRef = refPtr;
-	sprintf(buf, "%d", refPtr->id);
+	snprintf(buf, sizeof(buf), "%d", refPtr->id);
 	Tcl_AppendResult(interp, buf, NULL);
     } else {
 	if (sscanf(argv[2], "%d", &id) != 1) {
@@ -2758,7 +2758,7 @@ ExitProcOdd(
     char buf[16 + TCL_INTEGER_SPACE];
     int len;
 
-    sprintf(buf, "odd %d\n", (int)PTR2INT(clientData));
+    snprintf(buf, sizeof(buf), "odd %d\n", (int)PTR2INT(clientData));
     len = strlen(buf);
     if (len != (int) write(1, buf, len)) {
 	Tcl_Panic("ExitProcOdd: unable to write to stdout");
@@ -2772,7 +2772,7 @@ ExitProcEven(
     char buf[16 + TCL_INTEGER_SPACE];
     int len;
 
-    sprintf(buf, "even %d\n", (int)PTR2INT(clientData));
+    snprintf(buf, sizeof(buf), "even %d\n", (int)PTR2INT(clientData));
     len = strlen(buf);
     if (len != (int) write(1, buf, len)) {
 	Tcl_Panic("ExitProcEven: unable to write to stdout");
@@ -2817,7 +2817,7 @@ TestexprlongCmd(
     if (result != TCL_OK) {
 	return result;
     }
-    sprintf(buf, ": %ld", exprResult);
+    snprintf(buf, sizeof(buf), ": %ld", exprResult);
     Tcl_AppendResult(interp, buf, NULL);
     return TCL_OK;
 }
@@ -2859,7 +2859,7 @@ TestexprlongobjCmd(
     if (result != TCL_OK) {
 	return result;
     }
-    sprintf(buf, ": %ld", exprResult);
+    snprintf(buf, sizeof(buf), ": %ld", exprResult);
     Tcl_AppendResult(interp, buf, NULL);
     return TCL_OK;
 }
@@ -4533,7 +4533,7 @@ TestregexpObjCmd(
 
 	    varName = Tcl_GetString(objv[2]);
 	    TclRegExpRangeUniChar(regExpr, TCL_INDEX_NONE, &start, &end);
-	    sprintf(resinfo, "%d %d", start, end-1);
+	    snprintf(resinfo, sizeof(resinfo), "%d %d", start, end-1);
 	    value = Tcl_SetVar2(interp, varName, NULL, resinfo, 0);
 	    if (value == NULL) {
 		Tcl_AppendResult(interp, "couldn't set variable \"",
@@ -4547,7 +4547,7 @@ TestregexpObjCmd(
 
 	    Tcl_RegExpGetInfo(regExpr, &info);
 	    varName = Tcl_GetString(objv[2]);
-	    sprintf(resinfo, "%ld", info.extendStart);
+	    snprintf(resinfo, sizeof(resinfo), "%ld", info.extendStart);
 	    value = Tcl_SetVar2(interp, varName, NULL, resinfo, 0);
 	    if (value == NULL) {
 		Tcl_AppendResult(interp, "couldn't set variable \"",
@@ -5320,7 +5320,7 @@ TestgetvarfullnameCmd(
  *
  *	This procedure implements the "gettimes" command.  It is used for
  *	computing the time needed for various basic operations such as reading
- *	variables, allocating memory, sprintf, converting variables, etc.
+ *	variables, allocating memory, snprintf, converting variables, etc.
  *
  * Results:
  *	A standard Tcl result.
@@ -5439,15 +5439,15 @@ GetTimesObjCmd(
     fprintf(stderr, "   %.3f usec per Tcl_GetInt of \"12345\"\n",
 	    timePer/100000);
 
-    /* sprintf 100000 times */
-    fprintf(stderr, "sprintf of 12345 100000 times\n");
+    /* snprintf 100000 times */
+    fprintf(stderr, "snprintf of 12345 100000 times\n");
     Tcl_GetTime(&start);
     for (i = 0;  i < 100000;  i++) {
-	sprintf(newString, "%d", 12345);
+	snprintf(newString, sizeof(newString), "%d", 12345);
     }
     Tcl_GetTime(&stop);
     timePer = (stop.sec - start.sec)*1000000 + (stop.usec - start.usec);
-    fprintf(stderr, "   %.3f usec per sprintf of 12345\n",
+    fprintf(stderr, "   %.3f usec per snprintf of 12345\n",
 	    timePer/100000);
 
     /* hashtable lookup 100000 times */
@@ -6124,7 +6124,7 @@ TestChannelCmd(
     Tcl_Channel chan;		/* The opaque type. */
     size_t len;			/* Length of subcommand string. */
     int IOQueued;		/* How much IO is queued inside channel? */
-    char buf[TCL_INTEGER_SPACE];/* For sprintf. */
+    char buf[TCL_INTEGER_SPACE];/* For snprintf. */
     int mode;			/* rw mode of the channel */
 
     if (argc < 2) {
@@ -7038,10 +7038,10 @@ TestGetIndexFromObjStructObjCmd(
 	return TCL_ERROR;
     } else if (idx[1] != target) {
 	char buffer[64];
-	sprintf(buffer, "%d", idx[1]);
+	snprintf(buffer, sizeof(buffer), "%d", idx[1]);
 	Tcl_AppendResult(interp, "index value comparison failed: got ",
 		buffer, NULL);
-	sprintf(buffer, "%d", target);
+	snprintf(buffer, sizeof(buffer), "%d", target);
 	Tcl_AppendResult(interp, " when ", buffer, " expected", NULL);
 	return TCL_ERROR;
     }
diff --git a/generic/tclTestObj.c b/generic/tclTestObj.c
index b4c6ac3..e5b8a55 100644
--- a/generic/tclTestObj.c
+++ b/generic/tclTestObj.c
@@ -1634,7 +1634,7 @@ CheckIfVarUnset(
     if (varPtr[varIndex] == NULL) {
 	char buf[32 + TCL_INTEGER_SPACE];
 
-	sprintf(buf, "variable %" TCL_Z_MODIFIER "u is unset (NULL)", varIndex);
+	snprintf(buf, sizeof(buf), "variable %" TCL_Z_MODIFIER "u is unset (NULL)", varIndex);
 	Tcl_ResetResult(interp);
 	Tcl_AppendToObj(Tcl_GetObjResult(interp), buf, -1);
 	return 1;
diff --git a/generic/tclTestProcBodyObj.c b/generic/tclTestProcBodyObj.c
index 9b6aa1d..b6dbc3f 100644
--- a/generic/tclTestProcBodyObj.c
+++ b/generic/tclTestProcBodyObj.c
@@ -144,14 +144,14 @@ RegisterCommand(
     char buf[128];
 
     if (cmdTablePtr->exportIt) {
-	sprintf(buf, "namespace eval %s { namespace export %s }",
+	snprintf(buf, sizeof(buf), "namespace eval %s { namespace export %s }",
 		namesp, cmdTablePtr->cmdName);
 	if (Tcl_EvalEx(interp, buf, -1, 0) != TCL_OK) {
 	    return TCL_ERROR;
 	}
     }
 
-    sprintf(buf, "%s::%s", namesp, cmdTablePtr->cmdName);
+    snprintf(buf, sizeof(buf), "%s::%s", namesp, cmdTablePtr->cmdName);
     Tcl_CreateObjCommand(interp, buf, cmdTablePtr->proc, 0, 0);
     return TCL_OK;
 }
diff --git a/generic/tclThreadAlloc.c b/generic/tclThreadAlloc.c
index 727f061..65bfb14 100644
--- a/generic/tclThreadAlloc.c
+++ b/generic/tclThreadAlloc.c
@@ -666,11 +666,11 @@ Tcl_GetMemoryInfo(
 	if (cachePtr == sharedPtr) {
 	    Tcl_DStringAppendElement(dsPtr, "shared");
 	} else {
-	    sprintf(buf, "thread%p", cachePtr->owner);
+	    snprintf(buf, sizeof(buf), "thread%p", cachePtr->owner);
 	    Tcl_DStringAppendElement(dsPtr, buf);
 	}
 	for (n = 0; n < NBUCKETS; ++n) {
-	    sprintf(buf, "%" TCL_Z_MODIFIER "u %" TCL_Z_MODIFIER "u %" TCL_Z_MODIFIER "u %"
+	    snprintf(buf, sizeof(buf), "%" TCL_Z_MODIFIER "u %" TCL_Z_MODIFIER "u %" TCL_Z_MODIFIER "u %"
 		    TCL_Z_MODIFIER "u %" TCL_Z_MODIFIER "u %" TCL_Z_MODIFIER "u",
 		    bucketInfo[n].blockSize,
 		    cachePtr->buckets[n].numFree,
diff --git a/generic/tclThreadTest.c b/generic/tclThreadTest.c
index 03446c2..ed887db 100644
--- a/generic/tclThreadTest.c
+++ b/generic/tclThreadTest.c
@@ -368,7 +368,7 @@ ThreadObjCmd(
 	} else {
 	    char buf[TCL_INTEGER_SPACE];
 
-	    sprintf(buf, "%" TCL_LL_MODIFIER "d", (long long)id);
+	    snprintf(buf, sizeof(buf), "%" TCL_LL_MODIFIER "d", (long long)id);
 	    Tcl_AppendResult(interp, "cannot join thread ", buf, NULL);
 	}
 	return result;
@@ -650,7 +650,7 @@ ThreadErrorProc(
     char *script;
     char buf[TCL_DOUBLE_SPACE+1];
 
-    sprintf(buf, "%p", Tcl_GetCurrentThread());
+    snprintf(buf, sizeof(buf), "%p", Tcl_GetCurrentThread());
 
     errorInfo = Tcl_GetVar2(interp, "errorInfo", NULL, TCL_GLOBAL_ONLY);
     if (errorProcString == NULL) {
diff --git a/generic/tclUtil.c b/generic/tclUtil.c
index 3639d30..60e37fc 100644
--- a/generic/tclUtil.c
+++ b/generic/tclUtil.c
@@ -3334,9 +3334,9 @@ Tcl_PrintDouble(
 	 */
 
 	if (*precisionPtr == 0) {
-	    sprintf(dst, "e%+d", exponent);
+	    snprintf(dst, TCL_DOUBLE_SPACE, "e%+d", exponent);
 	} else {
-	    sprintf(dst, "e%+03d", exponent);
+	    snprintf(dst, TCL_DOUBLE_SPACE, "e%+03d", exponent);
 	}
     } else {
 	/*
diff --git a/generic/tclZipfs.c b/generic/tclZipfs.c
index d834847..9f6d8aa 100644
--- a/generic/tclZipfs.c
+++ b/generic/tclZipfs.c
@@ -4423,7 +4423,7 @@ ZipChannelOpen(
      * Wrap the ZipChannel into a Tcl_Channel.
      */
 
-    sprintf(cname, "zipfs_%" TCL_Z_MODIFIER "x_%d", z->offset,
+    snprintf(cname, sizeof(cname), "zipfs_%" TCL_Z_MODIFIER "x_%d", z->offset,
 	    ZipFS.idCount++);
     z->zipFilePtr->numOpen++;
     Unlock();
diff --git a/generic/tclZlib.c b/generic/tclZlib.c
index 5afe1ed..c485d43 100644
--- a/generic/tclZlib.c
+++ b/generic/tclZlib.c
@@ -289,7 +289,7 @@ ConvertError(
     case Z_NEED_DICT:
 	codeStr = "NEED_DICT";
 	codeStr2 = codeStrBuf;
-	sprintf(codeStrBuf, "%lu", adler);
+	snprintf(codeStrBuf, sizeof(codeStrBuf), "%lu", adler);
 	break;
 
 	/*
@@ -310,7 +310,7 @@ ConvertError(
     default:
 	codeStr = "UNKNOWN";
 	codeStr2 = codeStrBuf;
-	sprintf(codeStrBuf, "%d", code);
+	snprintf(codeStrBuf, sizeof(codeStrBuf), "%d", code);
 	break;
     }
     Tcl_SetObjResult(interp, Tcl_NewStringObj(zError(code), -1));
@@ -3478,7 +3478,7 @@ ZlibTransformGetOption(
 	    crc = cd->inStream.adler;
 	}
 
-	sprintf(buf, "%lu", crc);
+	snprintf(buf, sizeof(buf), "%lu", crc);
 	if (optionName == NULL) {
 	    Tcl_DStringAppendElement(dsPtr, "-checksum");
 	    Tcl_DStringAppendElement(dsPtr, buf);
diff --git a/unix/dltest/pkgb.c b/unix/dltest/pkgb.c
index e9645a4..41bfdcd 100644
--- a/unix/dltest/pkgb.c
+++ b/unix/dltest/pkgb.c
@@ -13,6 +13,9 @@
 
 #undef STATIC_BUILD
 #include "tcl.h"
+#if defined(_WIN32) && defined(_MSC_VER)
+#   define snprintf _snprintf
+#endif
 
 /*
  *----------------------------------------------------------------------
@@ -52,7 +55,7 @@ Pkgb_SubObjCmd(
     if ((Tcl_GetIntFromObj(interp, objv[1], &first) != TCL_OK)
 	    || (Tcl_GetIntFromObj(interp, objv[2], &second) != TCL_OK)) {
 	char buf[TCL_INTEGER_SPACE];
-	sprintf(buf, "%d", Tcl_GetErrorLine(interp));
+	snprintf(buf, sizeof(buf), "%d", Tcl_GetErrorLine(interp));
 	Tcl_AppendResult(interp, " in line: ", buf, NULL);
 	return TCL_ERROR;
     }
diff --git a/unix/tclLoadDl.c b/unix/tclLoadDl.c
index 5c19ea3..afceafd 100644
--- a/unix/tclLoadDl.c
+++ b/unix/tclLoadDl.c
@@ -191,7 +191,7 @@ FindSymbol(
 #ifdef __cplusplus
     if (proc == NULL) {
 	char buf[32];
-	sprintf(buf, "%d", Tcl_DStringLength(&ds));
+	snprintf(buf, sizeof(buf), "%d", Tcl_DStringLength(&ds));
 	Tcl_DStringInit(&newName);
 	TclDStringAppendLiteral(&newName, "__Z");
 	Tcl_DStringAppend(&newName, buf, TCL_INDEX_NONE);
diff --git a/unix/tclUnixChan.c b/unix/tclUnixChan.c
index 22e9876..94c172d 100644
--- a/unix/tclUnixChan.c
+++ b/unix/tclUnixChan.c
@@ -1077,7 +1077,7 @@ TtyGetOptionProc(
 
 	valid = 1;
 	TtyGetAttributes(fsPtr->fileState.fd, &tty);
-	sprintf(buf, "%d,%c,%d,%d", tty.baud, tty.parity, tty.data, tty.stop);
+	snprintf(buf, sizeof(buf), "%d,%c,%d,%d", tty.baud, tty.parity, tty.data, tty.stop);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
 
@@ -1123,9 +1123,9 @@ TtyGetOptionProc(
 	inBuffered = Tcl_InputBuffered(fsPtr->fileState.channel);
 	outBuffered = Tcl_OutputBuffered(fsPtr->fileState.channel);
 
-	sprintf(buf, "%d", inBuffered+inQueue);
+	snprintf(buf, sizeof(buf), "%d", inBuffered+inQueue);
 	Tcl_DStringAppendElement(dsPtr, buf);
-	sprintf(buf, "%d", outBuffered+outQueue);
+	snprintf(buf, sizeof(buf), "%d", outBuffered+outQueue);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
 
@@ -1164,9 +1164,9 @@ TtyGetOptionProc(
 	    }
 	    return TCL_ERROR;
 	}
-	sprintf(buf, "%d", ws.ws_col);
+	snprintf(buf, sizeof(buf), "%d", ws.ws_col);
 	Tcl_DStringAppendElement(dsPtr, buf);
-	sprintf(buf, "%d", ws.ws_row);
+	snprintf(buf, sizeof(buf), "%d", ws.ws_row);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
 #endif /* TIOCGWINSZ */
@@ -1721,13 +1721,13 @@ TclpOpenFileChannel(
 	translation = "auto crlf";
 	channelTypePtr = &ttyChannelType;
 	TtyInit(fd);
-	sprintf(channelName, "serial%d", fd);
+	snprintf(channelName, sizeof(channelName), "serial%d", fd);
     } else
 #endif	/* SUPPORTS_TTY */
     {
 	translation = NULL;
 	channelTypePtr = &fileChannelType;
-	sprintf(channelName, "file%d", fd);
+	snprintf(channelName, sizeof(channelName), "file%d", fd);
     }
 
     fsPtr = (TtyState *)ckalloc(sizeof(TtyState));
@@ -1801,7 +1801,7 @@ Tcl_MakeFileChannel(
 #ifdef SUPPORTS_TTY
     if (isatty(fd)) {
 	channelTypePtr = &ttyChannelType;
-	sprintf(channelName, "serial%d", fd);
+	snprintf(channelName, sizeof(channelName), "serial%d", fd);
     } else
 #endif /* SUPPORTS_TTY */
     if ((getsockname(fd, (struct sockaddr *) &sockaddr, &sockaddrLen) == 0)
@@ -1811,7 +1811,7 @@ Tcl_MakeFileChannel(
 	return (Tcl_Channel)TclpMakeTcpClientChannelMode(INT2PTR(fd), mode);
     } else {
 	channelTypePtr = &fileChannelType;
-	sprintf(channelName, "file%d", fd);
+	snprintf(channelName, sizeof(channelName), "file%d", fd);
     }
 
     fsPtr = (TtyState *)ckalloc(sizeof(TtyState));
diff --git a/unix/tclUnixInit.c b/unix/tclUnixInit.c
index 7396258..6d7f19b 100644
--- a/unix/tclUnixInit.c
+++ b/unix/tclUnixInit.c
@@ -490,7 +490,7 @@ TclpInitLibraryPath(
 	 * installed.
 	 */
 
-	sprintf(installLib, "lib/tcl%s", TCL_VERSION);
+	snprintf(installLib, sizeof(installLib), "lib/tcl%s", TCL_VERSION);
 
 	/*
 	 * If TCL_LIBRARY is set, search there.
@@ -890,7 +890,7 @@ TclpSetVariables(
 	osInfo.dwMajorVersion = 11;
     }
     Tcl_SetVar2(interp, "tcl_platform", "os", "Windows NT", TCL_GLOBAL_ONLY);
-    sprintf(buffer, "%d.%d", osInfo.dwMajorVersion, osInfo.dwMinorVersion);
+    snprintf(buffer, sizeof(buffer), "%d.%d", osInfo.dwMajorVersion, osInfo.dwMinorVersion);
     Tcl_SetVar2(interp, "tcl_platform", "osVersion", buffer, TCL_GLOBAL_ONLY);
     if (sysInfo.wProcessorArchitecture < NUMPROCESSORS) {
 	Tcl_SetVar2(interp, "tcl_platform", "machine",
diff --git a/unix/tclUnixPipe.c b/unix/tclUnixPipe.c
index c53360a..c1fd36f 100644
--- a/unix/tclUnixPipe.c
+++ b/unix/tclUnixPipe.c
@@ -475,7 +475,7 @@ TclpCreateProcess(
 		|| (!joinThisError && !SetupStdFile(errorFile, TCL_STDERR))
 		|| (joinThisError &&
 			((dup2(1,2) == -1) || (fcntl(2, F_SETFD, 0) != 0)))) {
-	    sprintf(errSpace,
+	    snprintf(errSpace, sizeof(errSpace),
 		    "%dforked process couldn't set up input/output", errno);
 	    len = strlen(errSpace);
 	    if (len != (size_t) write(fd, errSpace, len)) {
@@ -490,7 +490,7 @@ TclpCreateProcess(
 
 	RestoreSignals();
 	execvp(newArgv[0], newArgv);			/* INTL: Native. */
-	sprintf(errSpace, "%dcouldn't execute \"%.150s\"", errno, argv[0]);
+	snprintf(errSpace, sizeof(errSpace), "%dcouldn't execute \"%.150s\"", errno, argv[0]);
 	len = strlen(errSpace);
 	if (len != (size_t) write(fd, errSpace, len)) {
 	    Tcl_Panic("TclpCreateProcess: unable to write to errPipeOut");
@@ -782,7 +782,7 @@ TclpCreateCommandChannel(
      * natural to use "pipe%d".
      */
 
-    sprintf(channelName, "file%d", channelId);
+    snprintf(channelName, sizeof(channelName), "file%d", channelId);
     statePtr->channel = Tcl_CreateChannel(&pipeChannelType, channelName,
 	    statePtr, mode);
     return statePtr->channel;
diff --git a/unix/tclUnixSock.c b/unix/tclUnixSock.c
index 0be10ad..0a63788 100644
--- a/unix/tclUnixSock.c
+++ b/unix/tclUnixSock.c
@@ -1548,7 +1548,7 @@ Tcl_OpenTcpClient(
         return NULL;
     }
 
-    sprintf(channelName, SOCK_TEMPLATE, PTR2INT(statePtr));
+    snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, PTR2INT(statePtr));
 
     statePtr->channel = Tcl_CreateChannel(&tcpChannelType, channelName,
             statePtr, TCL_READABLE | TCL_WRITABLE);
@@ -1615,7 +1615,7 @@ TclpMakeTcpClientChannelMode(
     statePtr->fds.fd = PTR2INT(sock);
     statePtr->flags = 0;
 
-    sprintf(channelName, SOCK_TEMPLATE, PTR2INT(statePtr));
+    snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, PTR2INT(statePtr));
 
     statePtr->channel = Tcl_CreateChannel(&tcpChannelType, channelName,
 	    statePtr, mode);
@@ -1841,7 +1841,7 @@ Tcl_OpenTcpServerEx(
             memset(statePtr, 0, sizeof(TcpState));
             statePtr->acceptProc = acceptProc;
             statePtr->acceptProcData = acceptProcData;
-            sprintf(channelName, SOCK_TEMPLATE, PTR2INT(statePtr));
+            snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, PTR2INT(statePtr));
             newfds = &statePtr->fds;
         } else {
             newfds = (TcpFdList *)ckalloc(sizeof(TcpFdList));
@@ -1933,7 +1933,7 @@ TcpAccept(
     newSockState->flags = 0;
     newSockState->fds.fd = newsock;
 
-    sprintf(channelName, SOCK_TEMPLATE, PTR2INT(newSockState));
+    snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, PTR2INT(newSockState));
     newSockState->channel = Tcl_CreateChannel(&tcpChannelType, channelName,
 	    newSockState, TCL_READABLE | TCL_WRITABLE);
 
diff --git a/unix/tclUnixTest.c b/unix/tclUnixTest.c
index 80e8081..be54481 100644
--- a/unix/tclUnixTest.c
+++ b/unix/tclUnixTest.c
@@ -190,7 +190,7 @@ TestfilehandlerCmd(
 	    Tcl_WrongNumArgs(interp, 2, objv, "index");
 	    return TCL_ERROR;
 	}
-	sprintf(buf, "%d %d", pipePtr->readCount, pipePtr->writeCount);
+	snprintf(buf, sizeof(buf), "%d %d", pipePtr->readCount, pipePtr->writeCount);
 	Tcl_AppendResult(interp, buf, NULL);
     } else if (strcmp(Tcl_GetString(objv[1]), "create") == 0) {
 	if (objc != 5) {
diff --git a/unix/tclUnixThrd.c b/unix/tclUnixThrd.c
index aa5926e..0c32b0d 100644
--- a/unix/tclUnixThrd.c
+++ b/unix/tclUnixThrd.c
@@ -827,7 +827,7 @@ TclpInetNtoa(
     ThreadSpecificData *tsdPtr = TCL_TSD_INIT(&dataKey);
     unsigned char *b = (unsigned char*) &addr.s_addr;
 
-    sprintf(tsdPtr->nabuf, "%u.%u.%u.%u", b[0], b[1], b[2], b[3]);
+    snprintf(tsdPtr->nabuf, sizeof(tsdPtr->nabuf), "%u.%u.%u.%u", b[0], b[1], b[2], b[3]);
     return tsdPtr->nabuf;
 #else
     return inet_ntoa(addr);
diff --git a/win/tclWinConsole.c b/win/tclWinConsole.c
index c93c3e4..1a10324 100644
--- a/win/tclWinConsole.c
+++ b/win/tclWinConsole.c
@@ -2122,7 +2122,7 @@ TclWinOpenConsoleChannel(
      * for instance).
      */
 
-    sprintf(channelName, "file%" TCL_Z_MODIFIER "x", (size_t) chanInfoPtr);
+    snprintf(channelName, 16 + TCL_INTEGER_SPACE, "file%" TCL_Z_MODIFIER "x", (size_t) chanInfoPtr);
 
     if (permissions & TCL_READABLE) {
 	/*
@@ -2419,11 +2419,11 @@ ConsoleGetOptionProc(
 		return TCL_ERROR;
 	    }
 	    Tcl_DStringStartSublist(dsPtr);
-	    sprintf(buf,
+	    snprintf(buf, sizeof(buf),
 		    "%d",
 		    consoleInfo.srWindow.Right - consoleInfo.srWindow.Left + 1);
 	    Tcl_DStringAppendElement(dsPtr, buf);
-	    sprintf(buf,
+	    snprintf(buf, sizeof(buf),
 		    "%d",
 		    consoleInfo.srWindow.Bottom - consoleInfo.srWindow.Top + 1);
 	    Tcl_DStringAppendElement(dsPtr, buf);
diff --git a/win/tclWinInit.c b/win/tclWinInit.c
index a11e732..2eaaa09 100644
--- a/win/tclWinInit.c
+++ b/win/tclWinInit.c
@@ -141,7 +141,7 @@ TclpInitLibraryPath(
      * installed DLL.
      */
 
-    sprintf(installLib, "lib/tcl%s", TCL_VERSION);
+    snprintf(installLib, sizeof(installLib), "lib/tcl%s", TCL_VERSION);
 
     /*
      * Look for the library relative to the TCL_LIBRARY env variable. If the
@@ -304,7 +304,7 @@ InitializeDefaultLibraryDir(
     *end = '\\';
 
     TclWinNoBackslash(name);
-    sprintf(end + 1, "lib/tcl%s", TCL_VERSION);
+    snprintf(end + 1, LIBRARY_SIZE, "lib/tcl%s", TCL_VERSION);
     *lengthPtr = strlen(name);
     *valuePtr = (char *)ckalloc(*lengthPtr + 1);
     *encodingPtr = NULL;
@@ -352,7 +352,7 @@ InitializeSourceLibraryDir(
     *end = '\\';
 
     TclWinNoBackslash(name);
-    sprintf(end + 1, "../library");
+    snprintf(end + 1, LIBRARY_SIZE, "../library");
     *lengthPtr = strlen(name);
     *valuePtr = (char *)ckalloc(*lengthPtr + 1);
     *encodingPtr = NULL;
@@ -404,7 +404,7 @@ Tcl_GetEncodingNameFromEnvironment(
 	Tcl_DStringAppend(bufPtr, "utf-8", 5);
     } else {
 	Tcl_DStringSetLength(bufPtr, 2+TCL_INTEGER_SPACE);
-	wsprintfA(Tcl_DStringValue(bufPtr), "cp%d", GetACP());
+	snprintf(Tcl_DStringValue(bufPtr), 2+TCL_INTEGER_SPACE, "cp%d", GetACP());
 	Tcl_DStringSetLength(bufPtr, strlen(Tcl_DStringValue(bufPtr)));
     }
     return Tcl_DStringValue(bufPtr);
@@ -488,7 +488,7 @@ TclpSetVariables(
     if (osInfo.dwMajorVersion == 10 && osInfo.dwBuildNumber >= 22000) {
 	osInfo.dwMajorVersion = 11;
     }
-    wsprintfA(buffer, "%d.%d", osInfo.dwMajorVersion, osInfo.dwMinorVersion);
+    snprintf(buffer, sizeof(buffer), "%ld.%ld", osInfo.dwMajorVersion, osInfo.dwMinorVersion);
     Tcl_SetVar2(interp, "tcl_platform", "osVersion", buffer, TCL_GLOBAL_ONLY);
     if (sys.oemId.wProcessorArchitecture < NUMPROCESSORS) {
 	Tcl_SetVar2(interp, "tcl_platform", "machine",
diff --git a/win/tclWinPipe.c b/win/tclWinPipe.c
index 6f9a8db..094aa8b 100644
--- a/win/tclWinPipe.c
+++ b/win/tclWinPipe.c
@@ -1823,7 +1823,7 @@ TclpCreateCommandChannel(
      * unique, in case channels share handles (stdin/stdout).
      */
 
-    sprintf(channelName, "file%" TCL_Z_MODIFIER "x", (size_t) infoPtr);
+    snprintf(channelName, sizeof(channelName), "file%" TCL_Z_MODIFIER "x", (size_t) infoPtr);
     infoPtr->channel = Tcl_CreateChannel(&pipeChannelType, channelName,
 	    infoPtr, infoPtr->validMask);
 
@@ -2712,7 +2712,7 @@ TclWinAddProcess(
     void *hProcess,		/* Handle to process */
     unsigned long id)		/* Global process identifier */
 {
-    ProcInfo *procPtr = (ProcInfo*)ckalloc(sizeof(ProcInfo));
+    ProcInfo *procPtr = (ProcInfo *)ckalloc(sizeof(ProcInfo));
 
     PipeInit();
 
@@ -2812,7 +2812,7 @@ WaitForRead(
 				 * or not. */
 {
     DWORD timeout, count;
-    HANDLE *handle = (HANDLE *)((WinFile *) infoPtr->readFile)->handle;
+    HANDLE handle = ((WinFile *) infoPtr->readFile)->handle;
 
     while (1) {
 	/*
@@ -3234,7 +3234,7 @@ TclpOpenTemporaryFile(
     do {
 	char number[TCL_INTEGER_SPACE + 4];
 
-	sprintf(number, "%d.TMP", counter);
+	snprintf(number, sizeof(number), "%d.TMP", counter);
 	counter = (unsigned short) (counter + 1);
 	Tcl_DStringInit(&buf);
 	Tcl_UtfToWCharDString(number, strlen(number), &buf);
diff --git a/win/tclWinReg.c b/win/tclWinReg.c
index f9481be..becc6f5 100644
--- a/win/tclWinReg.c
+++ b/win/tclWinReg.c
@@ -1508,7 +1508,7 @@ AppendSystemError(
 	    MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (WCHAR *) tMsgPtrPtr,
 	    0, NULL);
     if (length == 0) {
-	sprintf(msgBuf, "unknown error: %ld", error);
+	snprintf(msgBuf, sizeof(msgBuf), "unknown error: %ld", error);
 	msg = msgBuf;
     } else {
 	char *msgPtr;
@@ -1534,7 +1534,7 @@ AppendSystemError(
 	msg = msgPtr;
     }
 
-    sprintf(id, "%ld", error);
+    snprintf(id, sizeof(id), "%ld", error);
     Tcl_SetErrorCode(interp, "WINDOWS", id, msg, NULL);
     Tcl_AppendToObj(resultPtr, msg, length);
     Tcl_SetObjResult(interp, resultPtr);
diff --git a/win/tclWinSerial.c b/win/tclWinSerial.c
index 449a8d7..62af1c5 100644
--- a/win/tclWinSerial.c
+++ b/win/tclWinSerial.c
@@ -1476,7 +1476,7 @@ TclWinOpenSerialChannel(
      * are shared between multiple channels (stdin/stdout).
      */
 
-    sprintf(channelName, "file%" TCL_Z_MODIFIER "x", (size_t) infoPtr);
+    snprintf(channelName, 16 + TCL_INTEGER_SPACE, "file%" TCL_Z_MODIFIER "x", (size_t) infoPtr);
 
     infoPtr->channel = Tcl_CreateChannel(&serialChannelType, channelName,
 	    infoPtr, permissions);
@@ -1564,7 +1564,7 @@ SerialErrorStr(
     if (error & ~((DWORD) (SERIAL_READ_ERRORS | SERIAL_WRITE_ERRORS))) {
 	char buf[TCL_INTEGER_SPACE + 1];
 
-	wsprintfA(buf, "%d", error);
+	snprintf(buf, sizeof(buf), "%ld", error);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
 }
@@ -2110,7 +2110,7 @@ SerialGetOptionProc(
 	stop = (dcb.StopBits == ONESTOPBIT) ? "1" :
 		(dcb.StopBits == ONE5STOPBITS) ? "1.5" : "2";
 
-	wsprintfA(buf, "%d,%c,%d,%s", dcb.BaudRate, parity,
+	snprintf(buf, sizeof(buf), "%ld,%c,%d,%s", dcb.BaudRate, parity,
 		dcb.ByteSize, stop);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
@@ -2126,7 +2126,7 @@ SerialGetOptionProc(
 	char buf[TCL_INTEGER_SPACE + 1];
 
 	valid = 1;
-	wsprintfA(buf, "%d", infoPtr->blockTime);
+	snprintf(buf, sizeof(buf), "%d", infoPtr->blockTime);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
 
@@ -2142,9 +2142,9 @@ SerialGetOptionProc(
 	char buf[TCL_INTEGER_SPACE + 1];
 	valid = 1;
 
-	wsprintfA(buf, "%d", infoPtr->sysBufRead);
+	snprintf(buf, sizeof(buf), "%ld", infoPtr->sysBufRead);
 	Tcl_DStringAppendElement(dsPtr, buf);
-	wsprintfA(buf, "%d", infoPtr->sysBufWrite);
+	snprintf(buf, sizeof(buf), "%ld", infoPtr->sysBufWrite);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
     if (len == 0) {
@@ -2225,9 +2225,9 @@ SerialGetOptionProc(
 	count = (int) cStat.cbOutQue + infoPtr->writeQueue;
 	LeaveCriticalSection(&infoPtr->csWrite);
 
-	wsprintfA(buf, "%d", inBuffered + cStat.cbInQue);
+	snprintf(buf, sizeof(buf), "%ld", inBuffered + cStat.cbInQue);
 	Tcl_DStringAppendElement(dsPtr, buf);
-	wsprintfA(buf, "%d", outBuffered + count);
+	snprintf(buf, sizeof(buf), "%d", outBuffered + count);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
 
diff --git a/win/tclWinSock.c b/win/tclWinSock.c
index b349d0d..7fc34e1 100644
--- a/win/tclWinSock.c
+++ b/win/tclWinSock.c
@@ -1981,7 +1981,7 @@ Tcl_OpenTcpClient(
 	return NULL;
     }
 
-    sprintf(channelName, SOCK_TEMPLATE, statePtr);
+    snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, statePtr);
 
     statePtr->channel = Tcl_CreateChannel(&tcpChannelType, channelName,
 	    statePtr, (TCL_READABLE | TCL_WRITABLE));
@@ -2040,7 +2040,7 @@ Tcl_MakeTcpClientChannel(
     statePtr->selectEvents = FD_READ | FD_CLOSE | FD_WRITE;
     SendSelectMessage(tsdPtr, SELECT, statePtr);
 
-    sprintf(channelName, SOCK_TEMPLATE, statePtr);
+    snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, statePtr);
     statePtr->channel = Tcl_CreateChannel(&tcpChannelType, channelName,
 	    statePtr, (TCL_READABLE | TCL_WRITABLE));
     Tcl_SetChannelOption(NULL, statePtr->channel, "-translation", "auto crlf");
@@ -2212,7 +2212,7 @@ Tcl_OpenTcpServerEx(
 
 	statePtr->acceptProc = acceptProc;
 	statePtr->acceptProcData = acceptProcData;
-	sprintf(channelName, SOCK_TEMPLATE, statePtr);
+	snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, statePtr);
 	statePtr->channel = Tcl_CreateChannel(&tcpChannelType, channelName,
 		statePtr, 0);
 	/*
@@ -2297,7 +2297,7 @@ TcpAccept(
     newInfoPtr->selectEvents = (FD_READ | FD_WRITE | FD_CLOSE);
     SendSelectMessage(tsdPtr, SELECT, newInfoPtr);
 
-    sprintf(channelName, SOCK_TEMPLATE, newInfoPtr);
+    snprintf(channelName, sizeof(channelName), SOCK_TEMPLATE, newInfoPtr);
     newInfoPtr->channel = Tcl_CreateChannel(&tcpChannelType, channelName,
 	    newInfoPtr, (TCL_READABLE | TCL_WRITABLE));
     if (Tcl_SetChannelOption(NULL, newInfoPtr->channel, "-translation",