diff --git a/ext/-test-/num2int/num2int.c b/ext/-test-/num2int/num2int.c
index 3aec3ccf3b..63a441fda6 100644
--- a/ext/-test-/num2int/num2int.c
+++ b/ext/-test-/num2int/num2int.c
@@ -4,7 +4,7 @@ static VALUE
 test_num2short(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%d", NUM2SHORT(num));
+    snprintf(buf, sizeof(buf), "%d", NUM2SHORT(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -12,7 +12,7 @@ static VALUE
 test_num2ushort(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%u", NUM2USHORT(num));
+    snprintf(buf, sizeof(buf), "%u", NUM2USHORT(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -20,7 +20,7 @@ static VALUE
 test_num2int(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%d", NUM2INT(num));
+    snprintf(buf, sizeof(buf), "%d", NUM2INT(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -28,7 +28,7 @@ static VALUE
 test_num2uint(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%u", NUM2UINT(num));
+    snprintf(buf, sizeof(buf), "%u", NUM2UINT(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -36,7 +36,7 @@ static VALUE
 test_num2long(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%ld", NUM2LONG(num));
+    snprintf(buf, sizeof(buf), "%ld", NUM2LONG(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -44,7 +44,7 @@ static VALUE
 test_num2ulong(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%lu", NUM2ULONG(num));
+    snprintf(buf, sizeof(buf), "%lu", NUM2ULONG(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -53,7 +53,7 @@ static VALUE
 test_num2ll(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%"PRI_LL_PREFIX"d", NUM2LL(num));
+    snprintf(buf, sizeof(buf), "%"PRI_LL_PREFIX"d", NUM2LL(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -61,7 +61,7 @@ static VALUE
 test_num2ull(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%"PRI_LL_PREFIX"u", NUM2ULL(num));
+    snprintf(buf, sizeof(buf), "%"PRI_LL_PREFIX"u", NUM2ULL(num));
     return rb_str_new_cstr(buf);
 }
 #endif
@@ -70,7 +70,7 @@ static VALUE
 test_fix2short(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%d", FIX2SHORT(num));
+    snprintf(buf, sizeof(buf), "%d", FIX2SHORT(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -78,7 +78,7 @@ static VALUE
 test_fix2int(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%d", FIX2INT(num));
+    snprintf(buf, sizeof(buf), "%d", FIX2INT(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -86,7 +86,7 @@ static VALUE
 test_fix2uint(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%u", FIX2UINT(num));
+    snprintf(buf, sizeof(buf), "%u", FIX2UINT(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -94,7 +94,7 @@ static VALUE
 test_fix2long(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%ld", FIX2LONG(num));
+    snprintf(buf, sizeof(buf), "%ld", FIX2LONG(num));
     return rb_str_new_cstr(buf);
 }
 
@@ -102,7 +102,7 @@ static VALUE
 test_fix2ulong(VALUE obj, VALUE num)
 {
     char buf[128];
-    sprintf(buf, "%lu", FIX2ULONG(num));
+    snprintf(buf, sizeof(buf), "%lu", FIX2ULONG(num));
     return rb_str_new_cstr(buf);
 }
 
diff --git a/mjit.c b/mjit.c
index 824287e329..1350307652 100644
--- a/mjit.c
+++ b/mjit.c
@@ -566,11 +566,11 @@ remove_so_file(const char *so_file, struct rb_mjit_unit *unit)
 
 // Print _mjitX, but make a human-readable funcname when --mjit-debug is used
 static void
-sprint_funcname(char *funcname, const struct rb_mjit_unit *unit)
+sprint_funcname(char *funcname, size_t funcname_size, const struct rb_mjit_unit *unit)
 {
     const rb_iseq_t *iseq = unit->iseq;
     if (iseq == NULL || (!mjit_opts.debug && !mjit_opts.debug_flags)) {
-        sprintf(funcname, "_mjit%d", unit->id);
+        snprintf(funcname, funcname_size, "_mjit%d", unit->id);
         return;
     }
 
@@ -589,7 +589,7 @@ sprint_funcname(char *funcname, const struct rb_mjit_unit *unit)
     if (!strcmp(method, "[]=")) method = "ASET";
 
     // Print and normalize
-    sprintf(funcname, "_mjit%d_%s_%s", unit->id, path, method);
+    snprintf(funcname, funcname_size, "_mjit%d_%s_%s", unit->id, path, method);
     for (size_t i = 0; i < strlen(funcname); i++) {
         char c = funcname[i];
         if (!(('a' <= c && c <= 'z') || ('A' <= c && c <= 'Z') || ('0' <= c && c <= '9') || c == '_')) {
@@ -705,7 +705,7 @@ mjit_compact(char* c_file)
         if (ISEQ_BODY(child_unit->iseq)->jit_unit == NULL) continue; // Sometimes such units are created. TODO: Investigate why
 
         char funcname[MAXPATHLEN];
-        sprint_funcname(funcname, child_unit);
+        sprint_funcname(funcname, sizeof(funcname), child_unit);
 
         int iseq_lineno = ISEQ_BODY(child_unit->iseq)->location.first_lineno;
         const char *sep = "@";
@@ -777,7 +777,7 @@ load_compact_funcs_from_so(struct rb_mjit_unit *unit, char *c_file, char *so_fil
     ccan_list_for_each(&active_units.head, cur, unode) {
         void *func;
         char funcname[MAXPATHLEN];
-        sprint_funcname(funcname, cur);
+        sprint_funcname(funcname, sizeof(funcname), cur);
 
         if ((func = dlsym(handle, funcname)) == NULL) {
             mjit_warning("skipping to reload '%s' from '%s': %s", funcname, so_file, dlerror());
@@ -857,7 +857,7 @@ mjit_compile_unit(struct rb_mjit_unit *unit)
 
     sprint_uniq_filename(c_file, (int)sizeof(c_file), unit->id, MJIT_TMP_PREFIX, c_ext);
     sprint_uniq_filename(so_file, (int)sizeof(so_file), unit->id, MJIT_TMP_PREFIX, so_ext);
-    sprint_funcname(funcname, unit);
+    sprint_funcname(funcname, sizeof(funcname), unit);
 
     FILE *f;
     int fd = rb_cloexec_open(c_file, c_file_access_mode, 0600);
@@ -1267,7 +1267,7 @@ mjit_notify_waitpid(int exit_code)
     else { // Normal unit
         // Load the function from so
         char funcname[MAXPATHLEN];
-        sprint_funcname(funcname, current_cc_unit);
+        sprint_funcname(funcname, sizeof(funcname), current_cc_unit);
         void *func = load_func_from_so(so_file, funcname, current_cc_unit);
 
         // Delete .so file
diff --git a/win32/win32.c b/win32/win32.c
index b9af42d9c9..1a532c6c7c 100644
--- a/win32/win32.c
+++ b/win32/win32.c
@@ -1423,18 +1423,20 @@ w32_spawn(int mode, const char *cmd, const char *prog, UINT cp)
         while (ISSPACE(*cmd)) cmd++;
         if ((shell = w32_getenv("RUBYSHELL", cp)) && (redir = has_redirection(cmd, cp))) {
             size_t shell_len = strlen(shell);
-            char *tmp = ALLOCV(v, shell_len + strlen(cmd) + sizeof(" -c ") + 2);
+            size_t cmd_len = strlen(cmd) + sizeof(" -c ") + 2;
+            char *tmp = ALLOCV(v, shell_len + cmd_len);
             memcpy(tmp, shell, shell_len + 1);
             translate_char(tmp, '/', '\\', cp);
-            sprintf(tmp + shell_len, " -c \"%s\"", cmd);
+            snprintf(tmp + shell_len, cmd_len, " -c \"%s\"", cmd);
             cmd = tmp;
         }
         else if ((shell = w32_getenv("COMSPEC", cp)) &&
                  (nt = !is_command_com(shell),
                   (redir < 0 ? has_redirection(cmd, cp) : redir) ||
                   is_internal_cmd(cmd, nt))) {
-            char *tmp = ALLOCV(v, strlen(shell) + strlen(cmd) + sizeof(" /c ") + (nt ? 2 : 0));
-            sprintf(tmp, nt ? "%s /c \"%s\"" : "%s /c %s", shell, cmd);
+            size_t cmd_len = strlen(shell) + strlen(cmd) + sizeof(" /c ") + (nt ? 2 : 0);
+            char *tmp = ALLOCV(v, cmd_len);
+            snprintf(tmp, cmd_len, nt ? "%s /c \"%s\"" : "%s /c %s", shell, cmd);
             cmd = tmp;
         }
         else {