merge core-8-6-branch

54 files changed, 233 insertions, 129 deletions

diff --git a/generic/tkBind.c b/generic/tkBind.c
index 830e429..0cf887d 100644
--- a/generic/tkBind.c
+++ b/generic/tkBind.c
@@ -31,14 +31,6 @@
 # define DEBUG(expr) expr
 #endif
 
-#ifdef _MSC_VER
-/*
- * Earlier versions of MSVC don't know snprintf, but _snprintf is compatible.
- * Note that sprintf is deprecated.
- */
-# define snprintf _snprintf
-#endif
-
 #define SIZE_OF_ARRAY(arr) (sizeof(arr)/sizeof(arr[0]))
 
 /*
diff --git a/generic/tkBitmap.c b/generic/tkBitmap.c
index 55317de..332e583 100644
--- a/generic/tkBitmap.c
+++ b/generic/tkBitmap.c
@@ -14,6 +14,10 @@
 
 #include "tkInt.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The includes below are for pre-defined bitmaps.
  *
@@ -834,7 +838,7 @@ Tk_GetBitmapFromData(
 	name = (char *)Tcl_GetHashValue(dataHashPtr);
     } else {
 	dispPtr->bitmapAutoNumber++;
-	sprintf(string, "_tk%d", dispPtr->bitmapAutoNumber);
+	snprintf(string, sizeof(string), "_tk%d", dispPtr->bitmapAutoNumber);
 	name = string;
 	Tcl_SetHashValue(dataHashPtr, name);
 	if (Tk_DefineBitmap(interp, name, source, width, height) != TCL_OK) {
diff --git a/generic/tkBusy.c b/generic/tkBusy.c
index 6f58c52..32db4fc 100644
--- a/generic/tkBusy.c
+++ b/generic/tkBusy.c
@@ -16,6 +16,10 @@
 #include "tkBusy.h"
 #include "default.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Things about the busy system that may be configured. Note that on some
  * platforms this may or may not have an effect.
@@ -550,7 +554,7 @@ CreateBusy(
 	    tkChild = NextChild(tkChild)) {
 	Tk_MakeWindowExist(tkChild);
     }
-    sprintf(name, fmt, Tk_Name(tkRef));
+    snprintf(name, length + 6, fmt, Tk_Name(tkRef));
     tkBusy = Tk_CreateWindow(interp, tkParent, name, NULL);
     ckfree(name);
 
diff --git a/generic/tkCanvLine.c b/generic/tkCanvLine.c
index 2633744..de46813 100644
--- a/generic/tkCanvLine.c
+++ b/generic/tkCanvLine.c
@@ -15,6 +15,10 @@
 #include "tkCanvas.h"
 #include "default.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The structure below defines the record for each line item.
  */
@@ -2075,7 +2079,7 @@ PrintArrowShape(
     LineItem *linePtr = (LineItem *) recordPtr;
     char *buffer = (char *)ckalloc(120);
 
-    sprintf(buffer, "%.5g %.5g %.5g", linePtr->arrowShapeA,
+    snprintf(buffer, 120, "%.5g %.5g %.5g", linePtr->arrowShapeA,
 	    linePtr->arrowShapeB, linePtr->arrowShapeC);
     *freeProcPtr = TCL_DYNAMIC;
     return buffer;
diff --git a/generic/tkCanvUtil.c b/generic/tkCanvUtil.c
index 86439df..310df53 100644
--- a/generic/tkCanvUtil.c
+++ b/generic/tkCanvUtil.c
@@ -13,6 +13,10 @@
 #include "tkInt.h"
 #include "tkCanvas.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Structures defined only in this file.
  */
@@ -570,9 +574,9 @@ TkCanvasDashPrintProc(
     *freeProcPtr = TCL_DYNAMIC;
 
     p = (i > (int)sizeof(char *)) ? dash->pattern.pt : dash->pattern.array;
-    sprintf(buffer, "%d", *p++ & 0xff);
+    snprintf(buffer, 4 * i, "%d", *p++ & 0xff);
     while (--i) {
-	sprintf(buffer+strlen(buffer), " %d", *p++ & 0xff);
+	snprintf(buffer + strlen(buffer), 4 * i - strlen(buffer), " %d", *p++ & 0xff);
     }
     return buffer;
 }
diff --git a/generic/tkCmds.c b/generic/tkCmds.c
index b9e07e7..a642137 100644
--- a/generic/tkCmds.c
+++ b/generic/tkCmds.c
@@ -1805,10 +1805,10 @@ Tk_WinfoObjCmd(
 	    if (string == NULL) {
 		strcpy(buf, "unknown");
 	    } else {
-		sprintf(buf, "%s %d", string, visInfoPtr[i].depth);
+		snprintf(buf, sizeof(buf), "%s %d", string, visInfoPtr[i].depth);
 	    }
 	    if (includeVisualId) {
-		sprintf(visualIdString, " 0x%lx",
+		snprintf(visualIdString, sizeof(visualIdString), " 0x%lx",
 			(unsigned long) visInfoPtr[i].visualid);
 		strcat(buf, visualIdString);
 	    }
diff --git a/generic/tkColor.c b/generic/tkColor.c
index 6b6405a..bc4c30c 100644
--- a/generic/tkColor.c
+++ b/generic/tkColor.c
@@ -15,6 +15,10 @@
 #include "tkInt.h"
 #include "tkColor.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Structures of the following following type are used as keys for
  * colorValueTable (in TkDisplay).
@@ -371,7 +375,7 @@ Tk_NameOfColor(
 	ThreadSpecificData *tsdPtr = (ThreadSpecificData *)
 		Tcl_GetThreadData(&dataKey, sizeof(ThreadSpecificData));
 
-	sprintf(tsdPtr->rgbString, "#%04x%04x%04x", colorPtr->red,
+	snprintf(tsdPtr->rgbString, sizeof(tsdPtr->rgbString), "#%04x%04x%04x", colorPtr->red,
 		colorPtr->green, colorPtr->blue);
 
 	/*
diff --git a/generic/tkConfig.c b/generic/tkConfig.c
index ba80776..9e4c875 100644
--- a/generic/tkConfig.c
+++ b/generic/tkConfig.c
@@ -26,6 +26,10 @@
 #include "tkInt.h"
 #include "tkFont.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The following encoding is used in TYPE_FLAGS:
  *
@@ -509,19 +513,19 @@ Tk_InitOptions(
 
 		switch (source) {
 		case OPTION_DATABASE:
-		    sprintf(msg, "\n    (database entry for \"%.50s\")",
+		    snprintf(msg, 200, "\n    (database entry for \"%.50s\")",
 			    optionPtr->specPtr->optionName);
 		    break;
 		case SYSTEM_DEFAULT:
-		    sprintf(msg, "\n    (system default for \"%.50s\")",
+		    snprintf(msg, 200, "\n    (system default for \"%.50s\")",
 			    optionPtr->specPtr->optionName);
 		    break;
 		case TABLE_DEFAULT:
-		    sprintf(msg, "\n    (default value for \"%.50s\")",
+		    snprintf(msg, 200, "\n    (default value for \"%.50s\")",
 			    optionPtr->specPtr->optionName);
 		}
 		if (tkwin != NULL) {
-		    sprintf(msg + strlen(msg) - 1, " in widget \"%.50s\")",
+		    snprintf(msg + strlen(msg) - 1, 200 - (strlen(msg) - 1), " in widget \"%.50s\")",
 			    Tk_PathName(tkwin));
 		}
 		Tcl_AddErrorInfo(interp, msg);
diff --git a/generic/tkCursor.c b/generic/tkCursor.c
index 902472b..50c6803 100644
--- a/generic/tkCursor.c
+++ b/generic/tkCursor.c
@@ -14,6 +14,10 @@
 
 #include "tkInt.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * A TkCursor structure exists for each cursor that is currently active. Each
  * structure is indexed with two hash tables defined below. One of the tables
@@ -425,7 +429,7 @@ Tk_NameOfCursor(
 
     if (!dispPtr->cursorInit) {
     printid:
-	sprintf(dispPtr->cursorString, "cursor id 0x%" TCL_Z_MODIFIER "x", (size_t)cursor);
+	snprintf(dispPtr->cursorString, sizeof(dispPtr->cursorString), "cursor id 0x%" TCL_Z_MODIFIER "x", (size_t)cursor);
 	return dispPtr->cursorString;
     }
     idHashPtr = Tcl_FindHashEntry(&dispPtr->cursorIdTable, (char *) cursor);
diff --git a/generic/tkEntry.c b/generic/tkEntry.c
index bf7626a..86b79ac 100644
--- a/generic/tkEntry.c
+++ b/generic/tkEntry.c
@@ -19,6 +19,10 @@
 #include "default.h"
 #include "tkEntry.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The following macro defines how many extra pixels to leave on each side of
  * the text in the entry.
@@ -1105,6 +1109,7 @@ ConfigureEntry(
     double oldFrom = 0.0;	/* lint initialization */
     double oldTo = 0.0;		/* lint initialization */
     int code;
+    size_t formatSpace = TCL_DOUBLE_SPACE;
 
     /*
      * Eliminate any existing trace on a variable monitored by the entry.
@@ -1193,7 +1198,7 @@ ConfigureEntry(
 		 */
 
 		int min, max;
-		size_t formatLen, formatSpace = TCL_DOUBLE_SPACE;
+		size_t formatLen;
 		char fbuf[4], *fmt = sbPtr->reqFormat;
 
 		formatLen = strlen(fmt);
@@ -1370,7 +1375,7 @@ ConfigureEntry(
 	    } else if (dvalue < sbPtr->fromValue) {
 		dvalue = sbPtr->fromValue;
 	    }
-	    sprintf(sbPtr->formatBuf, sbPtr->valueFormat, dvalue);
+	    snprintf(sbPtr->formatBuf, formatSpace, sbPtr->valueFormat, dvalue);
 
             /*
 	     * No check for error return here as well, because any possible
@@ -3529,11 +3534,11 @@ ExpandPercents(
 		    number = -1;
 		    break;
 		}
-		sprintf(numStorage, "%d", number);
+		snprintf(numStorage, sizeof(numStorage), "%d", number);
 		string = numStorage;
 		break;
 	    case 'i':		/* index of insert/delete */
-		sprintf(numStorage, "%d", index);
+		snprintf(numStorage, sizeof(numStorage), "%d", index);
 		string = numStorage;
 		break;
 	    case 'P':		/* 'Peeked' new value of the string */
@@ -4400,7 +4405,7 @@ SpinboxInvoke(
 		    dvalue = sbPtr->toValue;
 		}
 	    }
-	    sprintf(sbPtr->formatBuf, sbPtr->valueFormat, dvalue);
+	    snprintf(sbPtr->formatBuf, TCL_DOUBLE_SPACE, sbPtr->valueFormat, dvalue);
 	    code = EntryValueChanged(entryPtr, sbPtr->formatBuf);
 	}
     }
@@ -4517,9 +4522,9 @@ ComputeFormat(
 	fDigits++;		/* Zero to left of decimal point. */
     }
     if (fDigits <= eDigits) {
-	sprintf(sbPtr->digitFormat, "%%.%df", afterDecimal);
+	snprintf(sbPtr->digitFormat, sizeof(sbPtr->digitFormat), "%%.%df", afterDecimal);
     } else {
-	sprintf(sbPtr->digitFormat, "%%.%de", numDigits-1);
+	snprintf(sbPtr->digitFormat, sizeof(sbPtr->digitFormat), "%%.%de", numDigits-1);
     }
     sbPtr->valueFormat = sbPtr->digitFormat;
     return TCL_OK;
diff --git a/generic/tkEntry.h b/generic/tkEntry.h
index 6b1bf87..8d863cf 100644
--- a/generic/tkEntry.h
+++ b/generic/tkEntry.h
@@ -217,11 +217,11 @@ typedef struct {
 				 * multiple of this value. */
     char *formatBuf;		/* string into which to format value.
 				 * Malloc'ed. */
-    char *reqFormat;		/* Sprintf conversion specifier used for the
+    char *reqFormat;		/* Snprintf conversion specifier used for the
 				 * value that the users requests. Malloc'ed */
-    char *valueFormat;		/* Sprintf conversion specifier used for the
+    char *valueFormat;		/* Snprintf conversion specifier used for the
 				 * value. */
-    char digitFormat[16];	/* Sprintf conversion specifier computed from
+    char digitFormat[16];	/* Snprintf conversion specifier computed from
 				 * digits and other information; used for the
 				 * value. */
 
diff --git a/generic/tkFont.c b/generic/tkFont.c
index 8138c34..ea8cd20 100644
--- a/generic/tkFont.c
+++ b/generic/tkFont.c
@@ -17,6 +17,10 @@
 #include "tkMacOSXInt.h"    /* Defines TK_DRAW_IN_CONTEXT */
 #endif
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The following structure is used to keep track of all the fonts that exist
  * in the current application. It must be stored in the TkMainInfo for the
@@ -660,7 +664,7 @@ Tk_FontObjCmd(
 	     */
 
 	    for (i = 1; ; i++) {
-		sprintf(buf, "font%d", i);
+		snprintf(buf, sizeof(buf), "font%d", i);
 		namedHashPtr = Tcl_FindHashEntry(&fiPtr->namedTable, buf);
 		if (namedHashPtr == NULL) {
 		    break;
@@ -3328,7 +3332,7 @@ Tk_TextLayoutToPostscript(
 	    p += TkUtfToUniChar(p, &ch);
 	    if ((ch == '(') || (ch == ')') || (ch == '\\') || (ch < 0x20)) {
 		/*
-		 * Tricky point: the "03" is necessary in the sprintf below,
+		 * Tricky point: the "03" is necessary in the snprintf below,
 		 * so that a full three digits of octal are always generated.
 		 * Without the "03", a number following this sequence could be
 		 * interpreted by Postscript as part of this sequence.
@@ -3354,7 +3358,7 @@ Tk_TextLayoutToPostscript(
 	    if (ch > 0xffff) {
 		goto noMapping;
 	    }
-	    sprintf(uindex, "%04X", ch);		/* endianness? */
+	    snprintf(uindex, sizeof(uindex), "%04X", ch);		/* endianness? */
 	    glyphname = Tcl_GetVar2(interp, "::tk::psglyphs", uindex, 0);
 	    if (glyphname) {
 		ps = Tcl_GetStringFromObj(psObj, &len);
diff --git a/generic/tkImage.c b/generic/tkImage.c
index d42ed7d..8cd5519 100644
--- a/generic/tkImage.c
+++ b/generic/tkImage.c
@@ -13,6 +13,10 @@
 
 #include "tkInt.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Each call to Tk_GetImage returns a pointer to one of the following
  * structures, which is used as a token by clients (widgets) that display
@@ -285,7 +289,7 @@ Tk_ImageObjCmd(
 	if ((objc == 3) || (*(arg = Tcl_GetString(objv[3])) == '-')) {
 	    do {
 		dispPtr->imageId++;
-		sprintf(idString, "image%d", dispPtr->imageId);
+		snprintf(idString, sizeof(idString), "image%d", dispPtr->imageId);
 		name = idString;
 	    } while (Tcl_FindCommand(interp, name, NULL, 0) != NULL);
 	    firstOption = 3;
diff --git a/generic/tkImgPPM.c b/generic/tkImgPPM.c
index a53213e..fe76e36 100644
--- a/generic/tkImgPPM.c
+++ b/generic/tkImgPPM.c
@@ -16,6 +16,10 @@
 
 #include "tkInt.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The maximum amount of memory to allocate for data read from the file. If we
  * need more than this, we do it in pieces.
@@ -305,7 +309,7 @@ FileWritePPM(
 	return TCL_ERROR;
     }
 
-    sprintf(header, "P6\n%d %d\n255\n", blockPtr->width, blockPtr->height);
+    snprintf(header, sizeof(header), "P6\n%d %d\n255\n", blockPtr->width, blockPtr->height);
     Tcl_Write(chan, header, -1);
 
     pixLinePtr = blockPtr->pixelPtr + blockPtr->offset[0];
@@ -376,7 +380,7 @@ StringWritePPM(
     char header[16 + TCL_INTEGER_SPACE * 2];
     Tcl_Obj *byteArrayObj;
 
-    sprintf(header, "P6\n%d %d\n255\n", blockPtr->width, blockPtr->height);
+    snprintf(header, sizeof(header), "P6\n%d %d\n255\n", blockPtr->width, blockPtr->height);
 
     /*
      * Construct a byte array of the right size with the header and
diff --git a/generic/tkImgPhInstance.c b/generic/tkImgPhInstance.c
index 37ee3d9..05fa40c 100644
--- a/generic/tkImgPhInstance.c
+++ b/generic/tkImgPhInstance.c
@@ -21,6 +21,10 @@
 #include "tkImgPhoto.h"
 #include "tkPort.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Declaration for internal Xlib function used here:
  */
@@ -339,9 +343,9 @@ TkImgPhotoGet(
     XFree((char *) visInfoPtr);
 
     if (mono) {
-	sprintf(buf, "%d", nRed);
+	snprintf(buf, sizeof(buf), "%d", nRed);
     } else {
-	sprintf(buf, "%d/%d/%d", nRed, nGreen, nBlue);
+	snprintf(buf, sizeof(buf), "%d/%d/%d", nRed, nGreen, nBlue);
     }
     instancePtr->defaultPalette = Tk_GetUid(buf);
 
diff --git a/generic/tkOldConfig.c b/generic/tkOldConfig.c
index 7854246..fe27ef6 100644
--- a/generic/tkOldConfig.c
+++ b/generic/tkOldConfig.c
@@ -14,6 +14,10 @@
 
 #include "tkInt.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Forward declarations for functions defined later in this file:
  */
@@ -773,7 +777,7 @@ FormatConfigValue(
 	}
 	break;
     case TK_CONFIG_INT:
-	sprintf(buffer, "%d", *((int *)ptr));
+	snprintf(buffer, 200, "%d", *((int *)ptr));
 	result = buffer;
 	break;
     case TK_CONFIG_DOUBLE:
@@ -851,7 +855,7 @@ FormatConfigValue(
 	result = Tk_NameOfJoinStyle(*((int *)ptr));
 	break;
     case TK_CONFIG_PIXELS:
-	sprintf(buffer, "%d", *((int *)ptr));
+	snprintf(buffer, 200, "%d", *((int *)ptr));
 	result = buffer;
 	break;
     case TK_CONFIG_MM:
diff --git a/generic/tkOldTest.c b/generic/tkOldTest.c
index 8996f31..1c0c575 100644
--- a/generic/tkOldTest.c
+++ b/generic/tkOldTest.c
@@ -24,6 +24,10 @@
 #endif
 #include "tkInt.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The following data structure represents the model for a test image:
  */
@@ -267,7 +271,7 @@ ImageGet(
     char buffer[100];
     XGCValues gcValues;
 
-    sprintf(buffer, "%s get", timPtr->imageName);
+    snprintf(buffer, sizeof(buffer), "%s get", timPtr->imageName);
     Tcl_SetVar2(timPtr->interp, timPtr->varName, NULL, buffer,
 	    TCL_GLOBAL_ONLY|TCL_APPEND_VALUE|TCL_LIST_ELEMENT);
 
@@ -312,7 +316,7 @@ ImageDisplay(
     TImageInstance *instPtr = clientData;
     char buffer[200 + TCL_INTEGER_SPACE * 6];
 
-    sprintf(buffer, "%s display %d %d %d %d %d %d",
+    snprintf(buffer, sizeof(buffer), "%s display %d %d %d %d %d %d",
 	    instPtr->modelPtr->imageName, imageX, imageY, width, height,
 	    drawableX, drawableY);
     Tcl_SetVar2(instPtr->modelPtr->interp, instPtr->modelPtr->varName, NULL,
@@ -357,7 +361,7 @@ ImageFree(
     TImageInstance *instPtr = clientData;
     char buffer[200];
 
-    sprintf(buffer, "%s free", instPtr->modelPtr->imageName);
+    snprintf(buffer, sizeof(buffer), "%s free", instPtr->modelPtr->imageName);
     Tcl_SetVar2(instPtr->modelPtr->interp, instPtr->modelPtr->varName, NULL,
 	    buffer, TCL_GLOBAL_ONLY|TCL_APPEND_VALUE|TCL_LIST_ELEMENT);
     Tk_FreeColor(instPtr->fg);
@@ -391,7 +395,7 @@ ImageDelete(
     TImageModel *timPtr = clientData;
     char buffer[100];
 
-    sprintf(buffer, "%s delete", timPtr->imageName);
+    snprintf(buffer, sizeof(buffer), "%s delete", timPtr->imageName);
     Tcl_SetVar2(timPtr->interp, timPtr->varName, NULL, buffer,
 	    TCL_GLOBAL_ONLY|TCL_APPEND_VALUE|TCL_LIST_ELEMENT);
 
diff --git a/generic/tkScale.c b/generic/tkScale.c
index 79cfecb..2d6502d 100644
--- a/generic/tkScale.c
+++ b/generic/tkScale.c
@@ -21,8 +21,8 @@
 #include "tkInt.h"
 #include "tkScale.h"
 
-#if defined(_WIN32)
-#define snprintf _snprintf
+#ifdef _WIN32
+#include "tkWinInt.h"
 #endif
 
 /*
@@ -974,15 +974,15 @@ ComputeFormat(
 
     if (forTicks) {
 	if (fDigits <= eDigits) {
-	    sprintf(scalePtr->tickFormat, "%%.%df", afterDecimal);
+	    snprintf(scalePtr->tickFormat, sizeof(scalePtr->tickFormat), "%%.%df", afterDecimal);
 	} else {
-	    sprintf(scalePtr->tickFormat, "%%.%de", numDigits - 1);
+	    snprintf(scalePtr->tickFormat, sizeof(scalePtr->tickFormat), "%%.%de", numDigits - 1);
 	}
     } else {
 	if (fDigits <= eDigits) {
-	    sprintf(scalePtr->valueFormat, "%%.%df", afterDecimal);
+	    snprintf(scalePtr->valueFormat, sizeof(scalePtr->valueFormat), "%%.%df", afterDecimal);
 	} else {
-	    sprintf(scalePtr->valueFormat, "%%.%de", numDigits - 1);
+	    snprintf(scalePtr->valueFormat, sizeof(scalePtr->valueFormat), "%%.%de", numDigits - 1);
 	}
     }
 }
diff --git a/generic/tkScale.h b/generic/tkScale.h
index e68b786..2ce2190 100644
--- a/generic/tkScale.h
+++ b/generic/tkScale.h
@@ -73,9 +73,9 @@ typedef struct TkScale {
 				 * values. 0 means we get to choose the number
 				 * based on resolution and/or the range of the
 				 * scale. */
-    char valueFormat[16];	/* Sprintf conversion specifier computed from
+    char valueFormat[16];	/* Snprintf conversion specifier computed from
 				 * digits and other information. */
-    char tickFormat[16];	/* Sprintf conversion specifier computed from
+    char tickFormat[16];	/* Snprintf conversion specifier computed from
 				 * tick interval. */
     double bigIncrement;	/* Amount to use for large increments to scale
 				 * value. (0 means we pick a value). */
diff --git a/generic/tkSelect.c b/generic/tkSelect.c
index ef636da..1f0214e 100644
--- a/generic/tkSelect.c
+++ b/generic/tkSelect.c
@@ -14,6 +14,10 @@
 #include "tkInt.h"
 #include "tkSelect.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * When a selection handler is set up by invoking "selection handle", one of
  * the following data structures is set up to hold information about the
@@ -1476,7 +1480,7 @@ TkSelDefaultSelection(
 	if (maxBytes < 20) {
 	    return -1;
 	}
-	sprintf(buffer, "0x%x", (unsigned int) infoPtr->time);
+	snprintf(buffer, maxBytes, "0x%x", (unsigned int) infoPtr->time);
 	*typePtr = XA_INTEGER;
 	return strlen(buffer);
     }
diff --git a/generic/tkStubInit.c b/generic/tkStubInit.c
index 8d3588a..47742c1 100644
--- a/generic/tkStubInit.c
+++ b/generic/tkStubInit.c
@@ -151,7 +151,7 @@ TkpPrintWindowId(
 				 * the hex representation of a pointer. */
     Window window)		/* Window to be printed into buffer. */
 {
-    sprintf(buf, "0x%" TCL_Z_MODIFIER "x", (size_t)window);
+    snprintf(buf, TCL_INTEGER_SPACE, "0x%" TCL_Z_MODIFIER "x", (size_t)window);
 }
 
 int
diff --git a/generic/tkTest.c b/generic/tkTest.c
index b652068..96793df 100644
--- a/generic/tkTest.c
+++ b/generic/tkTest.c
@@ -1505,7 +1505,7 @@ ImageGet(
     char buffer[100];
     XGCValues gcValues;
 
-    sprintf(buffer, "%s get", timPtr->imageName);
+    snprintf(buffer, sizeof(buffer), "%s get", timPtr->imageName);
     Tcl_SetVar2(timPtr->interp, timPtr->varName, NULL, buffer,
 	    TCL_GLOBAL_ONLY|TCL_APPEND_VALUE|TCL_LIST_ELEMENT);
 
@@ -1574,7 +1574,7 @@ ImageDisplay(
 	     * Log the message.
 	     */
 
-	    sprintf(instPtr->buffer, "%s display %d %d %d %d",
+	    snprintf(instPtr->buffer, sizeof(instPtr->buffer), "%s display %d %d %d %d",
 	    instPtr->modelPtr->imageName, imageX, imageY, width, height);
 	}
 	Tcl_SetVar2(instPtr->modelPtr->interp, instPtr->modelPtr->varName,
@@ -1589,7 +1589,7 @@ ImageDisplay(
 	 */
 
 	if (instPtr->displayFailed == False) {
-	    sprintf(instPtr->buffer, "%s display %d %d %d %d",
+	    snprintf(instPtr->buffer, sizeof(instPtr->buffer), "%s display %d %d %d %d",
 		    instPtr->modelPtr->imageName, imageX, imageY, width, height);
 	}
 	instPtr->displayFailed = True;
@@ -1635,7 +1635,7 @@ ImageFree(
     TImageInstance *instPtr = (TImageInstance *)clientData;
     char buffer[200];
 
-    sprintf(buffer, "%s free", instPtr->modelPtr->imageName);
+    snprintf(buffer, sizeof(buffer), "%s free", instPtr->modelPtr->imageName);
     Tcl_SetVar2(instPtr->modelPtr->interp, instPtr->modelPtr->varName, NULL,
 	    buffer, TCL_GLOBAL_ONLY|TCL_APPEND_VALUE|TCL_LIST_ELEMENT);
     Tk_FreeColor(instPtr->fg);
@@ -1669,7 +1669,7 @@ ImageDelete(
     TImageModel *timPtr = (TImageModel *)clientData;
     char buffer[100];
 
-    sprintf(buffer, "%s delete", timPtr->imageName);
+    snprintf(buffer, sizeof(buffer), "%s delete", timPtr->imageName);
     Tcl_SetVar2(timPtr->interp, timPtr->varName, NULL, buffer,
 	    TCL_GLOBAL_ONLY|TCL_APPEND_VALUE|TCL_LIST_ELEMENT);
 
@@ -1828,7 +1828,7 @@ TestmetricsObjCmd(
 		"\": must be cxhscroll or cyvscroll", NULL);
 	return TCL_ERROR;
     }
-    sprintf(buf, "%d", val);
+    snprintf(buf, sizeof(buf), "%d", val);
     Tcl_AppendResult(interp, buf, NULL);
     return TCL_OK;
 }
@@ -1899,7 +1899,7 @@ TestpropObjCmd(
 		    value = 0xff & *p;
 		    p += 1;
 		}
-		sprintf(buffer, "0x%lx", value);
+		snprintf(buffer, sizeof(buffer), "0x%lx", value);
 		Tcl_AppendElement(interp, buffer);
 	    }
 	}
diff --git a/generic/tkText.c b/generic/tkText.c
index ea6c5fc..ce9bce7 100644
--- a/generic/tkText.c
+++ b/generic/tkText.c
@@ -6836,7 +6836,7 @@ TkpTesttextCmd(
     size_t len;
     int lineIndex, byteIndex, byteOffset;
     TkTextIndex index;
-    char buf[64];
+    char buf[TK_POS_CHARS];
     Tcl_CmdInfo info;
 
     if (objc < 3) {
diff --git a/generic/tkTextDisp.c b/generic/tkTextDisp.c
index cf1cb1b..b23c6f2 100644
--- a/generic/tkTextDisp.c
+++ b/generic/tkTextDisp.c
@@ -3064,7 +3064,7 @@ AsyncUpdateLineMetrics(
     if (tkTextDebug) {
 	char buffer[2 * TCL_INTEGER_SPACE + 1];
 
-	sprintf(buffer, "%d %d", lineNum, dInfoPtr->lastMetricUpdateLine);
+	snprintf(buffer, sizeof(buffer), "%d %d", lineNum, dInfoPtr->lastMetricUpdateLine);
 	LOG("tk_textInvalidateLine", buffer);
     }
 
@@ -3271,7 +3271,7 @@ TkTextUpdateLineMetrics(
 	    if (tkTextDebug) {
 		char buffer[4 * TCL_INTEGER_SPACE + 3];
 
-		sprintf(buffer, "%d %d %d %d",
+		snprintf(buffer, sizeof(buffer), "%d %d %d %d",
 			lineNum, endLine, totalLines, count);
 		LOG("tk_textInvalidateLine", buffer);
 	    }
@@ -4141,7 +4141,7 @@ TkTextUpdateOneLine(
 	    Tcl_Panic("Mustn't ever update line height of last artificial line");
 	}
 
-	sprintf(buffer, "%d %d", TkBTreeLinesTo(textPtr,linePtr), pixelHeight);
+	snprintf(buffer, sizeof(buffer), "%d %d", TkBTreeLinesTo(textPtr,linePtr), pixelHeight);
 	LOG("tk_textNumPixels", buffer);
     }
     if (textPtr->dInfoPtr->scrollbarTimer == NULL) {
diff --git a/generic/tkTextImage.c b/generic/tkTextImage.c
index 776eb04..4f1b284 100644
--- a/generic/tkTextImage.c
+++ b/generic/tkTextImage.c
@@ -13,6 +13,10 @@
 #include "tkPort.h"
 #include "tkText.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Macro that determines the size of an embedded image segment:
  */
@@ -410,7 +414,7 @@ EmbImageConfigure(
     if (conflict) {
     	char buf[4 + TCL_INTEGER_SPACE];
 
-	sprintf(buf, "#%d", count+1);
+	snprintf(buf, sizeof(buf), "#%d", count+1);
 	Tcl_DStringAppend(&newName, buf, -1);
     }
     name = Tcl_DStringValue(&newName);
diff --git a/generic/tkTextIndex.c b/generic/tkTextIndex.c
index e6632d0..cb7ba7b 100644
--- a/generic/tkTextIndex.c
+++ b/generic/tkTextIndex.c
@@ -15,6 +15,10 @@
 #include "tkText.h"
 #include "default.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Index to use to select last character in line (very large integer):
  */
@@ -1128,7 +1132,7 @@ TkTextPrintIndex(
 	charIndex += numBytes;
     }
 
-    return sprintf(string, "%d.%d",
+    return snprintf(string, TK_POS_CHARS, "%d.%d",
 	    TkBTreeLinesTo(textPtr, indexPtr->linePtr) + 1, charIndex);
 }
 
diff --git a/generic/tkUtil.c b/generic/tkUtil.c
index 3cc8dbf..a673b68 100644
--- a/generic/tkUtil.c
+++ b/generic/tkUtil.c
@@ -13,6 +13,10 @@
 
 #include "tkInt.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * The structure below defines the implementation of the "statekey" Tcl
  * object, used for quickly finding a mapping in a TkStateMap.
@@ -423,7 +427,7 @@ TkOffsetPrintProc(
 	    return "end";
 	}
 	p = (char *)ckalloc(32);
-	sprintf(p, "%d", offsetPtr->flags & ~TK_OFFSET_INDEX);
+	snprintf(p, 32, "%d", offsetPtr->flags & ~TK_OFFSET_INDEX);
 	*freeProcPtr = TCL_DYNAMIC;
 	return p;
     }
@@ -456,7 +460,7 @@ TkOffsetPrintProc(
     if (offsetPtr->flags & TK_OFFSET_RELATIVE) {
 	*q++ = '#';
     }
-    sprintf(q, "%d,%d", offsetPtr->xoffset, offsetPtr->yoffset);
+    snprintf(q, 32, "%d,%d", offsetPtr->xoffset, offsetPtr->yoffset);
     *freeProcPtr = TCL_DYNAMIC;
     return p;
 }
diff --git a/generic/ttk/ttkCache.c b/generic/ttk/ttkCache.c
index c29007c..f4d1846 100644
--- a/generic/ttk/ttkCache.c
+++ b/generic/ttk/ttkCache.c
@@ -31,6 +31,10 @@
 #include "tkInt.h"
 #include "ttkTheme.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 struct Ttk_ResourceCache_ {
     Tcl_Interp	  *interp;	/* Interpreter for error reporting */
     Tk_Window	  tkwin;	/* Cache window. */
@@ -209,7 +213,7 @@ void Ttk_RegisterNamedColor(
     char nameBuf[14];
     Tcl_Obj *colorNameObj;
 
-    sprintf(nameBuf, "#%04X%04X%04X",
+    snprintf(nameBuf, sizeof(nameBuf), "#%04X%04X%04X",
     	colorPtr->red, colorPtr->green, colorPtr->blue);
     colorNameObj = Tcl_NewStringObj(nameBuf, -1);
     Tcl_IncrRefCount(colorNameObj);
diff --git a/generic/ttk/ttkEntry.c b/generic/ttk/ttkEntry.c
index 6cf88c3..85ec1da 100644
--- a/generic/ttk/ttkEntry.c
+++ b/generic/ttk/ttkEntry.c
@@ -12,6 +12,10 @@
 #include "ttkTheme.h"
 #include "ttkWidget.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 /*
  * Extra bits for core.flags:
  */
@@ -443,11 +447,11 @@ ExpandPercents(
 		} else {
 		    number = -1;
 		}
-		sprintf(numStorage, "%d", number);
+		snprintf(numStorage, sizeof(numStorage), "%d", number);
 		string = numStorage;
 		break;
 	    case 'i': /* index of insert/delete */
-		sprintf(numStorage, "%d", index);
+		snprintf(numStorage, sizeof(numStorage), "%d", index);
 		string = numStorage;
 		break;
 	    case 'P': /* 'Peeked' new value of the string */
diff --git a/generic/ttk/ttkTreeview.c b/generic/ttk/ttkTreeview.c
index 0dff72f..717cbb5 100644
--- a/generic/ttk/ttkTreeview.c
+++ b/generic/ttk/ttkTreeview.c
@@ -8,6 +8,10 @@
 #include "ttkTheme.h"
 #include "ttkWidget.h"
 
+#ifdef _WIN32
+#include "tkWinInt.h"
+#endif
+
 #define MAX(a,b) ((a) > (b) ? (a) : (b))
 
 #define DEF_TREE_ROWS		"10"
@@ -2209,7 +2213,7 @@ static int TreeviewHorribleIdentify(
     if (dColumnNumber < 0) {
 	goto done;
     }
-    sprintf(dcolbuf, "#%d", dColumnNumber);
+    snprintf(dcolbuf, sizeof(dcolbuf), "#%d", dColumnNumber);
 
     if (Ttk_BoxContains(tv->tree.headingArea,x,y)) {
 	if (-HALO <= x1 - x  && x1 - x <= HALO) {
@@ -2598,7 +2602,7 @@ static int TreeviewInsertCommand(
 	char idbuf[16];
 	do {
 	    ++tv->tree.serial;
-	    sprintf(idbuf, "I%03X", tv->tree.serial);
+	    snprintf(idbuf, sizeof(idbuf), "I%03X", tv->tree.serial);
 	    entryPtr = Tcl_CreateHashEntry(&tv->tree.items, idbuf, &isNew);
 	} while (!isNew);
     }
diff --git a/macosx/tkMacOSXEmbed.c b/macosx/tkMacOSXEmbed.c
index 2f04e74..9a03178 100644
--- a/macosx/tkMacOSXEmbed.c
+++ b/macosx/tkMacOSXEmbed.c
@@ -596,7 +596,7 @@ TkpTestembedCmd(
 	if (containerPtr->parent == None) {
 	    Tcl_DStringAppendElement(&dString, "");
 	} else if (all) {
-	    sprintf(buffer, "0x%lx", containerPtr->parent);
+	    snprintf(buffer, sizeof(buffer), "0x%lx", containerPtr->parent);
 	    Tcl_DStringAppendElement(&dString, buffer);
 	} else {
 	    Tcl_DStringAppendElement(&dString, "XXX");
diff --git a/macosx/tkMacOSXHLEvents.c b/macosx/tkMacOSXHLEvents.c
index 5055f38..3b87fbe 100644
--- a/macosx/tkMacOSXHLEvents.c
+++ b/macosx/tkMacOSXHLEvents.c
@@ -272,14 +272,14 @@ static const char *scriptTextProc = "::tk::mac::DoScriptText";
     err = AEGetParamPtr(theDesc, keyDirectObject, typeWildCard, &initialType,
 			NULL, 0, NULL);
     if (err != noErr) {
-	sprintf(errString, "AEDoScriptHandler: GetParamDesc error %d", (int)err);
+	snprintf(errString, sizeof(errString), "AEDoScriptHandler: GetParamDesc error %d", (int)err);
 	AEPutParamPtr((AppleEvent*)[replyEvent aeDesc], keyErrorString,
 		      typeChar, errString, strlen(errString));
 	return;
     }
 
     if (MissedAnyParameters((AppleEvent*)theDesc)) {
-    	sprintf(errString, "AEDoScriptHandler: extra parameters");
+    	snprintf(errString, sizeof(errString), "AEDoScriptHandler: extra parameters");
     	AEPutParamPtr((AppleEvent*)[replyEvent aeDesc], keyErrorString,
 		      typeChar,errString, strlen(errString));
     	return;
diff --git a/macosx/tkMacOSXPort.h b/macosx/tkMacOSXPort.h
index ab843f9..2a50663 100644
--- a/macosx/tkMacOSXPort.h
+++ b/macosx/tkMacOSXPort.h
@@ -162,7 +162,7 @@
  */
 
 #define TkpPrintWindowId(buf,w) \
-	sprintf((buf), "0x%lx", (unsigned long) (w))
+	snprintf((buf), TCL_INTEGER_SPACE, "0x%lx", (unsigned long) (w))
 
 /*
  * Turn off Tk double-buffering as Aqua windows are already double-buffered.
diff --git a/macosx/tkMacOSXSend.c b/macosx/tkMacOSXSend.c
index a651bcd..72c4bcf 100644
--- a/macosx/tkMacOSXSend.c
+++ b/macosx/tkMacOSXSend.c
@@ -263,11 +263,11 @@ Tk_SetAppName(
 		Tcl_DStringAppend(&dString, name, -1);
 		Tcl_DStringAppend(&dString, " #", 2);
 		offset = Tcl_DStringLength(&dString);
-		Tcl_DStringSetLength(&dString, offset + 10);
+		Tcl_DStringSetLength(&dString, offset + TCL_INTEGER_SPACE);
 		actualName = Tcl_DStringValue(&dString);
 	    }
 	    suffix++;
-	    sprintf(Tcl_DStringValue(&dString) + offset, "%d", suffix);
+	    snprintf(Tcl_DStringValue(&dString) + offset, TCL_INTEGER_SPACE, "%d", suffix);
 	    i = 0;
 	} else {
 	    i++;
diff --git a/macosx/tkMacOSXWm.c b/macosx/tkMacOSXWm.c
index 3fd8af7..a13455b 100644
--- a/macosx/tkMacOSXWm.c
+++ b/macosx/tkMacOSXWm.c
@@ -2074,7 +2074,7 @@ WmFrameCmd(
     if (window == None) {
 	window = Tk_WindowId((Tk_Window)winPtr);
     }
-    sprintf(buf, "0x%" TCL_Z_MODIFIER "x", (size_t)window);
+    snprintf(buf, sizeof(buf), "0x%" TCL_Z_MODIFIER "x", (size_t)window);
     Tcl_SetObjResult(interp, Tcl_NewStringObj(buf, -1));
     return TCL_OK;
 }
diff --git a/tests/textDisp.test b/tests/textDisp.test
index 0fe23f8..2f18759 100644
--- a/tests/textDisp.test
+++ b/tests/textDisp.test
@@ -109,7 +109,6 @@ wm geometry . {}
 proc bo {{w .t}} {
     return [expr {[$w cget -borderwidth] + [$w cget -highlightthickness] + [$w cget -padx]}]
 }
-
 # x-width of $n chars, fixed width font
 proc xw {n} {
     global fixedWidth
diff --git a/tests/textWind.test b/tests/textWind.test
index c03170f..5f4c6eb 100644
--- a/tests/textWind.test
+++ b/tests/textWind.test
@@ -13,23 +13,42 @@ tcltest::loadTestedCommands
 
 deleteWindows
 
-set fixedFont {"Courier" -12}
+set fixedFont {Courier -12}
 set fixedHeight [font metrics $fixedFont -linespace]
 set fixedWidth [font measure $fixedFont m]
 set fixedAscent [font metrics $fixedFont -ascent]
 
 # Widget used in almost all tests
-set tWidth 30
-set tHeight 6
-text .t -width $tWidth -height $tHeight -bd 2 -highlightthickness 2 \
-        -font $fixedFont
+######################################## TODO ~### remove this line    set tWidth 30
+######################################## TODO ~### remove this line    tHeight 6
+text .t -font $fixedFont -width 30 -height 6 -bd 2 -highlightthickness 2
 pack .t -expand 1 -fill both
 update
 .t debug on
+wm geometry . {}
 
-set color [expr {[winfo depth .t] > 1 ? "green" : "black"}]
+# full border size of the text widget, i.e. first x or y coordinate inside the text widget
+# warning:  -padx  is supposed to be the same as  -pady  (same border size horizontally and
+# vertically around the widget)
+proc bo {{w .t}} {
+    return [expr {[$w cget -borderwidth] + [$w cget -highlightthickness] + [$w cget -padx]}]
+}
+# x-width of $n chars, fixed width font
+proc xw {n} {
+    global fixedWidth
+    return [expr {$n * $fixedWidth}]
+}
+# x-coordinate of the first pixel of $n-th char (count starts at zero), left justified
+proc xchar {n {w .t}} {
+    return [expr {[bo $w] + [xw $n]}]
+}
+# y-coordinate of the first pixel of $l-th display line (count starts at 1)
+proc yline {l {w .t}} {
+    global fixedHeight
+    return [expr {[bo $w] + ($l - 1) * $fixedHeight}]
+}
 
-wm geometry . {}
+set color [expr {[winfo depth .t] > 1 ? "green" : "black"}]
 
 # The statements below reset the main window;  it's needed if the window
 # manager is mwm to make mwm forget about a previous minimum size setting.
@@ -44,12 +63,12 @@ wm deiconify .
 
 update
 
-set bw [.t cget -borderwidth]
-set px [.t cget -padx]
-set py [.t cget -pady]
-set hlth [.t cget -highlightthickness]
-set padx [expr {$bw+$px+$hlth}]
-set pady [expr {$bw+$py+$hlth}]
+######################################## TODO ~### remove this line    set bw [.t cget -borderwidth]
+######################################## TODO ~### remove this line    set px [.t cget -padx]
+######################################## TODO ~### remove this line    set py [.t cget -pady]
+######################################## TODO ~### remove this line    set hlth [.t cget -highlightthickness]
+######################################## TODO ~### remove this line    set padx [expr {$bw+$px+$hlth}]
+######################################## TODO ~### remove this line    set pady [expr {$bw+$py+$hlth}]
 
 # ----------------------------------------------------------------------
 
@@ -65,8 +84,8 @@ test textWind-1.1 {basic tests of options} -setup {
         [.t window configure .f -window]
 } -result [list \
     1 \
-    3x3+[expr {$padx+2*$fixedWidth}]+[expr {$pady+$fixedHeight+(($fixedHeight-3)/2)}] \
-    [list [expr {$padx+2*$fixedWidth}] [expr {$pady+$fixedHeight+(($fixedHeight-3)/2)}] 3 3] \
+    3x3+[xchar 2]+[expr {[yline 2]+($fixedHeight-3)/2}] \
+    [list [xchar 2] [expr {[yline 2]+($fixedHeight-3)/2}] 3 3] \
     {-window {} {} {} .f}]
 
 test textWind-1.2 {basic tests of options} -setup {
@@ -81,8 +100,8 @@ test textWind-1.2 {basic tests of options} -setup {
         [.t window configure .f -align]
 } -result [list \
     1 \
-    3x3+[expr {$padx+2*$fixedWidth}]+[expr {$pady+$fixedHeight}] \
-    [list [expr {$padx+2*$fixedWidth}] [expr {$pady+$fixedHeight}] 3 3] \
+    3x3+[xchar 2]+[yline 2] \
+    [list [xchar 2] [yline 2] 3 3] \
     {-align {} {} center top}]
 
 test textWind-1.3 {basic tests of options} -setup {
diff --git a/unix/tkUnixEmbed.c b/unix/tkUnixEmbed.c
index ff7860b..f6378ad 100644
--- a/unix/tkUnixEmbed.c
+++ b/unix/tkUnixEmbed.c
@@ -907,7 +907,7 @@ TkpTestembedCmd(
 	if (containerPtr->parent == None) {
 	    Tcl_DStringAppendElement(&dString, "");
 	} else if (all) {
-	    sprintf(buffer, "0x%lx", containerPtr->parent);
+	    snprintf(buffer, sizeof(buffer), "0x%lx", containerPtr->parent);
 	    Tcl_DStringAppendElement(&dString, buffer);
 	} else {
 	    Tcl_DStringAppendElement(&dString, "XXX");
@@ -924,7 +924,7 @@ TkpTestembedCmd(
 	if (containerPtr->wrapper == None) {
 	    Tcl_DStringAppendElement(&dString, "");
 	} else if (all) {
-	    sprintf(buffer, "0x%lx", containerPtr->wrapper);
+	    snprintf(buffer, sizeof(buffer), "0x%lx", containerPtr->wrapper);
 	    Tcl_DStringAppendElement(&dString, buffer);
 	} else {
 	    Tcl_DStringAppendElement(&dString, "XXX");
diff --git a/unix/tkUnixFont.c b/unix/tkUnixFont.c
index bead00e..5ad7753 100644
--- a/unix/tkUnixFont.c
+++ b/unix/tkUnixFont.c
@@ -2808,7 +2808,7 @@ GetScreenFont(
 	    rest = strchr(rest + 1, '-');
 	}
 	*str = '\0';
-	sprintf(buf, "%.200s-%d-*-*-*-*-*%s", nameList[bestIdx[1]],
+	snprintf(buf, sizeof(buf), "%.200s-%d-*-*-*-*-*%s", nameList[bestIdx[1]],
 		(int)(-wantPtr->fa.size+0.5), rest);
 	*str = '-';
 	fontStructPtr = XLoadQueryFont(display, buf);
@@ -2946,7 +2946,7 @@ ListFonts(
 {
     char buf[256];
 
-    sprintf(buf, "-*-%.80s-*-*-*-*-*-*-*-*-*-*-*-*", faceName);
+    snprintf(buf, sizeof(buf), "-*-%.80s-*-*-*-*-*-*-*-*-*-*-*-*", faceName);
     return XListFonts(display, buf, 10000, numNamesPtr);
 }
 
diff --git a/unix/tkUnixPort.h b/unix/tkUnixPort.h
index 156eb04..8b6efce 100644
--- a/unix/tkUnixPort.h
+++ b/unix/tkUnixPort.h
@@ -191,7 +191,7 @@
 
 #ifndef __CYGWIN__
 #define TkpPrintWindowId(buf,w) \
-	sprintf((buf), "0x%08lx", (unsigned long) (w))
+	snprintf((buf), TCL_INTEGER_SPACE, "0x%08lx", (unsigned long) (w))
 #endif
 
 #endif /* _UNIXPORT */
diff --git a/unix/tkUnixScale.c b/unix/tkUnixScale.c
index a603432..c9a5efe 100644
--- a/unix/tkUnixScale.c
+++ b/unix/tkUnixScale.c
@@ -1,7 +1,7 @@
 /*
  * tkUnixScale.c --
  *
- *	This file implements the X specific portion of the scrollbar widget.
+ *	This file implements the X specific portion of the scale widget.
  *
  * Copyright (c) 1996 by Sun Microsystems, Inc.
  * Copyright (c) 1998-2000 by Scriptics Corporation.
@@ -13,8 +13,8 @@
 #include "tkInt.h"
 #include "tkScale.h"
 
-#if defined(_WIN32)
-#define snprintf _snprintf
+#ifdef _WIN32
+#include "tkWinInt.h"
 #endif
 
 /*
diff --git a/unix/tkUnixSelect.c b/unix/tkUnixSelect.c
index 527bc4c..aec6c31 100644
--- a/unix/tkUnixSelect.c
+++ b/unix/tkUnixSelect.c
@@ -1511,7 +1511,7 @@ SelCvtFromX32(
 	} else {
 	    char buf[12];
 
-	    sprintf(buf, "0x%x", (unsigned int) *propPtr);
+	    snprintf(buf, sizeof(buf), "0x%x", (unsigned int) *propPtr);
 	    Tcl_DStringAppendElement(dsPtr, buf);
 	}
     }
@@ -1537,7 +1537,7 @@ SelCvtFromX8(
     for ( ; numValues > 0; propPtr++, numValues--) {
 	char buf[12];
 
-	sprintf(buf, "0x%x", (unsigned char) *propPtr);
+	snprintf(buf, sizeof(buf), "0x%x", (unsigned char) *propPtr);
 	Tcl_DStringAppendElement(dsPtr, buf);
     }
     Tcl_DStringAppend(dsPtr, " ", 1);
diff --git a/unix/tkUnixSend.c b/unix/tkUnixSend.c
index 03d124f..72b2b1e 100644
--- a/unix/tkUnixSend.c
+++ b/unix/tkUnixSend.c
@@ -476,7 +476,7 @@ RegAddName(
     char id[30], *newProp;
     int idLength, newBytes;
 
-    sprintf(id, "%x ", (unsigned) commWindow);
+    snprintf(id, sizeof(id), "%x ", (unsigned) commWindow);
     idLength = strlen(id);
     newBytes = idLength + strlen(name) + 1;
     newProp = (char *)ckalloc(regPtr->propLength + newBytes);
@@ -875,7 +875,7 @@ Tk_SetAppName(
 		Tcl_DStringSetLength(&dString, offset+TCL_INTEGER_SPACE);
 		actualName = Tcl_DStringValue(&dString);
 	    }
-	    sprintf(Tcl_DStringValue(&dString) + offset, "%d", i);
+	    snprintf(Tcl_DStringValue(&dString) + offset, TCL_INTEGER_SPACE, "%d", i);
 	}
 	w = RegFindName(regPtr, actualName);
 	if (w == None) {
@@ -1096,7 +1096,7 @@ Tk_SendObjCmd(
     if (!async) {
 	char buffer[TCL_INTEGER_SPACE * 2];
 
-	sprintf(buffer, "%x %d",
+	snprintf(buffer, sizeof(buffer), "%x %d",
 		(unsigned) Tk_WindowId(dispPtr->commTkwin),
 		localData.sendSerial);
 	Tcl_DStringAppend(&request, "\0-r ", 4);
@@ -1620,7 +1620,7 @@ SendEventProc(
 		if (result != TCL_OK) {
 		    char buffer[TCL_INTEGER_SPACE];
 
-		    sprintf(buffer, "%d", result);
+		    snprintf(buffer, sizeof(buffer), "%d", result);
 		    Tcl_DStringAppend(&reply, "\0-c ", 4);
 		    Tcl_DStringAppend(&reply, buffer, -1);
 		}
@@ -1796,7 +1796,7 @@ AppendErrorProc(
 	    pcPtr = pcPtr->nextPtr) {
 	if ((pcPtr == pendingPtr) && (pcPtr->result == NULL)) {
 	    pcPtr->result = (char *)ckalloc(strlen(pcPtr->target) + 50);
-	    sprintf(pcPtr->result, "no application named \"%s\"",
+	    snprintf(pcPtr->result, strlen(pcPtr->target) + 50, "no application named \"%s\"",
 		    pcPtr->target);
 	    pcPtr->code = TCL_ERROR;
 	    pcPtr->gotResponse = 1;
diff --git a/unix/tkUnixWm.c b/unix/tkUnixWm.c
index 8330098..46beecf 100644
--- a/unix/tkUnixWm.c
+++ b/unix/tkUnixWm.c
@@ -1879,7 +1879,7 @@ WmFrameCmd(
     if (window == None) {
 	window = Tk_WindowId((Tk_Window) winPtr);
     }
-    sprintf(buf, "0x%" TCL_Z_MODIFIER "x", (size_t)window);
+    snprintf(buf, sizeof(buf), "0x%" TCL_Z_MODIFIER "x", (size_t)window);
     Tcl_SetObjResult(interp, Tcl_NewStringObj(buf, -1));
     return TCL_OK;
 }
diff --git a/win/tkWinButton.c b/win/tkWinButton.c
index 4e965c2..98ed69e 100644
--- a/win/tkWinButton.c
+++ b/win/tkWinButton.c
@@ -186,7 +186,7 @@ TkpButtonSetDefaults(void)
 {
     int width = GetSystemMetrics(SM_CXEDGE);
 	if (width > 0) {
-	    sprintf(tkDefButtonBorderWidth, "%d", width);
+	    snprintf(tkDefButtonBorderWidth, sizeof(tkDefButtonBorderWidth), "%d", width);
 	}
 }
 
diff --git a/win/tkWinDialog.c b/win/tkWinDialog.c
index cb765bb..ef3a5fb 100644
--- a/win/tkWinDialog.c
+++ b/win/tkWinDialog.c
@@ -3027,7 +3027,7 @@ SetTkDialog(
 	    Tcl_GetThreadData(&dataKey, sizeof(ThreadSpecificData));
     char buf[32];
 
-    sprintf(buf, "0x%" TCL_Z_MODIFIER "x", (size_t)clientData);
+    snprintf(buf, sizeof(buf), "0x%" TCL_Z_MODIFIER "x", (size_t)clientData);
     Tcl_SetVar2(tsdPtr->debugInterp, "tk_dialog", NULL, buf, TCL_GLOBAL_ONLY);
 }
 
diff --git a/win/tkWinInt.h b/win/tkWinInt.h
index ccc57db..98c1a35 100644
--- a/win/tkWinInt.h
+++ b/win/tkWinInt.h
@@ -242,4 +242,12 @@ MODULE_SCOPE Tcl_Obj *	        TkWin32ErrorObj(HRESULT hrError);
 #define GWLP_ID			GWL_ID
 #endif /* !GWLP_WNDPROC */
 
+/*
+ * MSVC versions before 2015 don't know snprintf, but _snprintf is compatible.
+ * Note that sprintf is deprecated.
+ */
+#if defined(_MSC_VER) && _MSC_VER < 1900
+#    define snprintf _snprintf
+#endif
+
 #endif /* _TKWININT */
diff --git a/win/tkWinMenu.c b/win/tkWinMenu.c
index 1d2af7e..7634147 100644
--- a/win/tkWinMenu.c
+++ b/win/tkWinMenu.c
@@ -3440,7 +3440,7 @@ SetDefaults(
     DeleteObject(menuFont);
 
     Tcl_DStringAppendElement(&menuFontDString, faceName);
-    sprintf(sizeString, "%d", pointSize);
+    snprintf(sizeString, sizeof(sizeString), "%d", pointSize);
     Tcl_DStringAppendElement(&menuFontDString, sizeString);
 
     if (bold || italic) {
diff --git a/win/tkWinScrlbr.c b/win/tkWinScrlbr.c
index 409a6db..4e1c733 100644
--- a/win/tkWinScrlbr.c
+++ b/win/tkWinScrlbr.c
@@ -360,7 +360,7 @@ UpdateScrollbarMetrics(void)
     vArrowHeight = GetSystemMetrics(SM_CYVSCROLL);
     vThumb = GetSystemMetrics(SM_CYVTHUMB);
 
-    sprintf(tkDefScrollbarWidth, "%d", arrowWidth);
+    snprintf(tkDefScrollbarWidth, sizeof(tkDefScrollbarWidth), "%d", arrowWidth);
 }
 
 /*
diff --git a/win/tkWinSend.c b/win/tkWinSend.c
index d1d6777..7d63cec 100644
--- a/win/tkWinSend.c
+++ b/win/tkWinSend.c
@@ -13,6 +13,7 @@
 
 #include "tkInt.h"
 #include "tkWinSendCom.h"
+#include "tkWinInt.h"
 
 /*
  * Should be defined in WTypes.h but mingw 1.0 is missing them.
@@ -683,7 +684,7 @@ RegisterInterp(
 		    Tcl_DStringSetLength(&dString, offset+TCL_INTEGER_SPACE);
 		    actualName = Tcl_DStringValue(&dString);
 		}
-		sprintf(Tcl_DStringValue(&dString) + offset, "%d", i);
+		snprintf(Tcl_DStringValue(&dString) + offset, sizeof(Tcl_DStringValue(&dString)) - offset, "%d", i);
 	    }
 
 	    hr = BuildMoniker(actualName, &pmk);
diff --git a/win/tkWinTest.c b/win/tkWinTest.c
index 8a292b3..d4639d6 100644
--- a/win/tkWinTest.c
+++ b/win/tkWinTest.c
@@ -171,7 +171,7 @@ AppendSystemError(
 	if (error == ERROR_CALL_NOT_IMPLEMENTED) {
 	    strcpy(msgBuf, "function not supported under Win32s");
 	} else {
-	    sprintf(msgBuf, "unknown error: %ld", error);
+	    snprintf(msgBuf, sizeof(msgBuf), "unknown error: %ld", error);
 	}
 	msg = msgBuf;
     } else {
@@ -198,7 +198,7 @@ AppendSystemError(
 	msg = msgPtr;
     }
 
-    sprintf(id, "%ld", error);
+    snprintf(id, sizeof(id), "%ld", error);
     Tcl_SetErrorCode(interp, "WINDOWS", id, msg, NULL);
     Tcl_AppendToObj(resultPtr, msg, length);
     Tcl_SetObjResult(interp, resultPtr);
@@ -402,14 +402,14 @@ TestwineventObjCmd(
 	    wParam = MAKEWPARAM(id, 0);
 	    lParam = (LPARAM)child;
 	}
-	sprintf(buf, "%d", (int) SendMessageA(hwnd, message, wParam, lParam));
+	snprintf(buf, sizeof(buf), "%d", (int) SendMessageA(hwnd, message, wParam, lParam));
 	Tcl_SetObjResult(interp, Tcl_NewStringObj(buf, -1));
 	break;
     }
     default: {
 	char buf[TCL_INTEGER_SPACE];
 
-	sprintf(buf, "%d",
+	snprintf(buf, sizeof(buf), "%d",
 		(int) SendDlgItemMessageA(hwnd, id, message, wParam, lParam));
 	Tcl_SetObjResult(interp, Tcl_NewStringObj(buf, -1));
 	break;
diff --git a/win/tkWinWindow.c b/win/tkWinWindow.c
index 3478b08..01e43a6 100644
--- a/win/tkWinWindow.c
+++ b/win/tkWinWindow.c
@@ -170,7 +170,7 @@ TkpPrintWindowId(
 {
     HWND hwnd = (window) ? Tk_GetHWND(window) : 0;
 
-    sprintf(buf, "0x%" TCL_Z_MODIFIER "x", (size_t)hwnd);
+    snprintf(buf, TCL_INTEGER_SPACE, "0x%" TCL_Z_MODIFIER "x", (size_t)hwnd);
 }
 
 /*
diff --git a/win/tkWinWm.c b/win/tkWinWm.c
index 7b2b0cf..34ae154 100644
--- a/win/tkWinWm.c
+++ b/win/tkWinWm.c
@@ -3723,7 +3723,7 @@ WmFrameCmd(
     if (hwnd == NULL) {
 	hwnd = Tk_GetHWND(Tk_WindowId((Tk_Window) winPtr));
     }
-    sprintf(buf, "0x%" TCL_Z_MODIFIER "x", (size_t)hwnd);
+    snprintf(buf, sizeof(buf), "0x%" TCL_Z_MODIFIER "x", (size_t)hwnd);
     Tcl_SetObjResult(interp, Tcl_NewStringObj(buf, -1));
     return TCL_OK;
 }
diff --git a/win/tkWinX.c b/win/tkWinX.c
index 1a9bc2a..e7720ae 100644
--- a/win/tkWinX.c
+++ b/win/tkWinX.c
@@ -146,7 +146,7 @@ TkGetServerInfo(
 	    GetVersionExW(&os);
 	}
 	/* Write the first character last, preventing multi-thread issues. */
-	sprintf(buffer+1, "indows %d.%d %d %s", (int)os.dwMajorVersion,
+	snprintf(buffer+1, sizeof(buffer)-1, "indows %d.%d %d %s", (int)os.dwMajorVersion,
 		(int)os.dwMinorVersion, (int)os.dwBuildNumber,
 #ifdef _WIN64
 		"Win64"
@@ -1533,7 +1533,7 @@ UpdateInputLanguage(
     if (charsetInfo.ciACP == CP_UTF8) {
 	strcpy(codepage, "utf-8");
     } else {
-	sprintf(codepage, "cp%d", charsetInfo.ciACP);
+	snprintf(codepage, sizeof(codepage), "cp%d", charsetInfo.ciACP);
     }
 
     if ((encoding = Tcl_GetEncoding(NULL, codepage)) == NULL) {