diff --git a/src/gui_w32.c b/src/gui_w32.c
index 0debae9..4e6eca8 100644
--- a/src/gui_w32.c
+++ b/src/gui_w32.c
@@ -2157,7 +2157,8 @@
  * Experimental implementation, introduced in v8.2.4807
  * "processing key event in Win32 GUI is not ideal"
  */
-static void process_message_usual_key_experimental(UINT vk, const MSG *pmsg)
+    static void
+process_message_usual_key_experimental(UINT vk, const MSG *pmsg)
 {
     WCHAR	ch[8];
     int		len;
@@ -2237,7 +2238,8 @@
 /*
  * "Classic" implementation, existing prior to v8.2.4807
  */
-static void process_message_usual_key_classic(UINT vk, const MSG *pmsg)
+    static void
+process_message_usual_key_classic(UINT vk, const MSG *pmsg)
 {
     char_u	string[40];
 
@@ -3673,12 +3675,11 @@
     static char_u *
 logfont2name(LOGFONTW lf)
 {
-    char	*p;
-    char	*res;
     char	*charset_name;
     char	*quality_name;
     char	*font_name;
-    int		points;
+    size_t	res_size;
+    char	*res;
 
     font_name = (char *)utf16_to_enc(lf.lfFaceName, NULL);
     if (font_name == NULL)
@@ -3686,43 +3687,48 @@
     charset_name = charset_id2name((int)lf.lfCharSet);
     quality_name = quality_id2name((int)lf.lfQuality);
 
-    res = alloc(strlen(font_name) + 30
-		    + (charset_name == NULL ? 0 : strlen(charset_name) + 2)
-		    + (quality_name == NULL ? 0 : strlen(quality_name) + 2));
+    res_size = STRLEN(font_name) + 30
+		    + (charset_name == NULL ? 0 : STRLEN(charset_name) + 2)
+		    + (quality_name == NULL ? 0 : STRLEN(quality_name) + 2);
+    res = alloc(res_size);
     if (res != NULL)
     {
-	p = res;
+	char	*p;
+	int	points;
+	size_t	res_len;
+
+	// replace spaces in font_name with underscores.
+	for (p = font_name; *p != NUL; ++p)
+	{
+	    if (isspace(*p))
+		*p = '_';
+	}
+
 	// make a normal font string out of the lf thing:
 	points = pixels_to_points(
 			 lf.lfHeight < 0 ? -lf.lfHeight : lf.lfHeight, TRUE);
 	if (lf.lfWeight == FW_NORMAL || lf.lfWeight == FW_BOLD)
-	    sprintf((char *)p, "%s:h%d", font_name, points);
+	    res_len = vim_snprintf_safelen(
+		(char *)res, res_size, "%s:h%d", font_name, points);
 	else
-	    sprintf((char *)p, "%s:h%d:W%ld", font_name, points, lf.lfWeight);
-	while (*p)
-	{
-	    if (*p == ' ')
-		*p = '_';
-	    ++p;
-	}
-	if (lf.lfItalic)
-	    STRCAT(p, ":i");
-	if (lf.lfWeight == FW_BOLD)
-	    STRCAT(p, ":b");
-	if (lf.lfUnderline)
-	    STRCAT(p, ":u");
-	if (lf.lfStrikeOut)
-	    STRCAT(p, ":s");
+	    res_len = vim_snprintf_safelen(
+		(char *)res, res_size, "%s:h%d:W%ld", font_name, points, lf.lfWeight);
+
+	res_len += vim_snprintf_safelen(
+	    (char *)res + res_len,
+	    res_size - res_len,
+	    "%s%s%s%s",
+	    lf.lfItalic ? ":i" : "",
+	    lf.lfWeight ? ":b" : "",
+	    lf.lfUnderline ? ":u" : "",
+	    lf.lfStrikeOut ? ":s" : "");
+
 	if (charset_name != NULL)
-	{
-	    STRCAT(p, ":c");
-	    STRCAT(p, charset_name);
-	}
+	    res_len += vim_snprintf_safelen((char *)res + res_len,
+		res_size - res_len, ":c%s", charset_name);
 	if (quality_name != NULL)
-	{
-	    STRCAT(p, ":q");
-	    STRCAT(p, quality_name);
-	}
+	    vim_snprintf((char *)res + res_len,
+		res_size - res_len, ":q%s", quality_name);
     }
 
     vim_free(font_name);
@@ -4975,9 +4981,10 @@
 		else
 		{
 		    LPNMTTDISPINFO	lpdi = (LPNMTTDISPINFO)hdr;
+		    size_t		len = STRLEN(str);
 
-		    if (STRLEN(str) < sizeof(lpdi->szText)
-			    || ((tt_text = vim_strsave(str)) == NULL))
+		    if (len < sizeof(lpdi->szText)
+			    || ((tt_text = vim_strnsave(str, len)) == NULL))
 			vim_strncpy((char_u *)lpdi->szText, str,
 				sizeof(lpdi->szText) - 1);
 		    else
@@ -5020,7 +5027,6 @@
 	    == MF_HILITE
 	    && (State & MODE_CMDLINE) == 0)
     {
-	UINT	    idButton;
 	vimmenu_T   *pMenu;
 	static int  did_menu_tip = FALSE;
 
@@ -5032,17 +5038,23 @@
 	    did_menu_tip = FALSE;
 	}
 
-	idButton = (UINT)LOWORD(wParam);
-	pMenu = gui_mswin_find_menu(root_menu, idButton);
-	if (pMenu != NULL && pMenu->strings[MENU_INDEX_TIP] != 0
-		&& GetMenuState(s_menuBar, pMenu->id, MF_BYCOMMAND) != -1)
+	pMenu = gui_mswin_find_menu(root_menu, (UINT)LOWORD(wParam));
+	if (pMenu != NULL && pMenu->strings[MENU_INDEX_TIP] != NULL)
 	{
-	    ++msg_hist_off;
-	    msg((char *)pMenu->strings[MENU_INDEX_TIP]);
-	    --msg_hist_off;
-	    setcursor();
-	    out_flush();
-	    did_menu_tip = TRUE;
+	    MENUITEMINFO menuinfo;
+
+	    menuinfo.cbSize = sizeof(MENUITEMINFO);
+	    menuinfo.fMask = MIIM_ID;		    // We only want to check if the menu item exists,
+						    // so retrieve something simple.
+	    if (GetMenuItemInfo(s_menuBar, pMenu->id, FALSE, &menuinfo))
+	    {
+		++msg_hist_off;
+		msg((char *)pMenu->strings[MENU_INDEX_TIP]);
+		--msg_hist_off;
+		setcursor();
+		out_flush();
+		did_menu_tip = TRUE;
+	    }
 	}
 	return 0L;
     }
@@ -5051,7 +5063,7 @@
 #endif
 
     static BOOL
-_OnGetDpiScaledSize(HWND hwnd, UINT dpi, SIZE *size)
+_OnGetDpiScaledSize(HWND hwnd UNUSED, UINT dpi, SIZE *size)
 {
     int		old_width, old_height;
     int		new_width, new_height;
@@ -5394,7 +5406,12 @@
 	if (session == NULL)
 	    goto error;
 	savebg = p_bg;
-	p_bg = vim_strsave((char_u *)"light");	// Set 'bg' to "light".
+	p_bg = vim_strnsave((char_u *)"light", 5);	// Set 'bg' to "light".
+	if (p_bg == NULL)
+	{
+	    p_bg = savebg;
+	    goto error;
+	}
 	ret = write_session_file(session);
 	vim_free(p_bg);
 	p_bg = savebg;
diff --git a/src/version.c b/src/version.c
index c4db34a..b805d70 100644
--- a/src/version.c
+++ b/src/version.c
@@ -705,6 +705,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    1347,
+/**/
     1346,
 /**/
     1345,