diff --git a/src/globals.h b/src/globals.h
index f5df847..6f69fcd 100644
--- a/src/globals.h
+++ b/src/globals.h
@@ -810,11 +810,14 @@
  */
 /* length of char in bytes, including following composing chars */
 EXTERN int (*mb_ptr2len) __ARGS((char_u *p)) INIT(= latin_ptr2len);
+/* idem, with limit on string length */
+EXTERN int (*mb_ptr2len_len) __ARGS((char_u *p, int size)) INIT(= latin_ptr2len_len);
 /* byte length of char */
 EXTERN int (*mb_char2len) __ARGS((int c)) INIT(= latin_char2len);
 /* convert char to bytes, return the length */
 EXTERN int (*mb_char2bytes) __ARGS((int c, char_u *buf)) INIT(= latin_char2bytes);
 EXTERN int (*mb_ptr2cells) __ARGS((char_u *p)) INIT(= latin_ptr2cells);
+EXTERN int (*mb_ptr2cells_len) __ARGS((char_u *p, int size)) INIT(= latin_ptr2cells_len);
 EXTERN int (*mb_char2cells) __ARGS((int c)) INIT(= latin_char2cells);
 EXTERN int (*mb_off2cells) __ARGS((unsigned off, unsigned max_off)) INIT(= latin_off2cells);
 EXTERN int (*mb_ptr2char) __ARGS((char_u *p)) INIT(= latin_ptr2char);
diff --git a/src/gui_gtk_x11.c b/src/gui_gtk_x11.c
index 87c73fd..e44ae06 100644
--- a/src/gui_gtk_x11.c
+++ b/src/gui_gtk_x11.c
@@ -6077,12 +6077,15 @@
 # ifdef FEAT_MBYTE
 	    if (enc_utf8)
 	    {
-		c = utf_ptr2char(p);
+		int pcc[MAX_MCO];
+
+		/* TODO: use the composing characters */
+		c = utfc_ptr2char_len(p, &pcc, len - (p - s));
 		if (c >= 0x10000)	/* show chars > 0xffff as ? */
 		    c = 0xbf;
 		buf[textlen].byte1 = c >> 8;
 		buf[textlen].byte2 = c;
-		p += utf_ptr2len(p);
+		p += utfc_ptr2len_len(p, len - (p - s));
 		width += utf_char2cells(c);
 	    }
 	    else
@@ -6106,8 +6109,8 @@
 	if (has_mbyte)
 	{
 	    width = 0;
-	    for (p = s; p < s + len; p += (*mb_ptr2len)(p))
-		width += (*mb_ptr2cells)(p);
+	    for (p = s; p < s + len; p += (*mb_ptr2len_len)(p, len - (p - s)))
+		width += (*mb_ptr2cells_len)(p, len - (p - s));
 	}
 	else
 # endif
diff --git a/src/mbyte.c b/src/mbyte.c
index 1b8733c..bb3db5b 100644
--- a/src/mbyte.c
+++ b/src/mbyte.c
@@ -127,7 +127,10 @@
 static int dbcs_char2len __ARGS((int c));
 static int dbcs_char2bytes __ARGS((int c, char_u *buf));
 static int dbcs_ptr2len __ARGS((char_u *p));
+static int dbcs_ptr2len_len __ARGS((char_u *p, int size));
+static int utf_ptr2cells_len __ARGS((char_u *p, int size));
 static int dbcs_char2cells __ARGS((int c));
+static int dbcs_ptr2cells_len __ARGS((char_u *p, int size));
 static int dbcs_ptr2char __ARGS((char_u *p));
 
 /* Lookup table to quickly get the length in bytes of a UTF-8 character from
@@ -606,9 +609,11 @@
     if (enc_utf8)
     {
 	mb_ptr2len = utfc_ptr2len;
+	mb_ptr2len_len = utfc_ptr2len_len;
 	mb_char2len = utf_char2len;
 	mb_char2bytes = utf_char2bytes;
 	mb_ptr2cells = utf_ptr2cells;
+	mb_ptr2cells_len = utf_ptr2cells_len;
 	mb_char2cells = utf_char2cells;
 	mb_off2cells = utf_off2cells;
 	mb_ptr2char = utf_ptr2char;
@@ -617,9 +622,11 @@
     else if (enc_dbcs != 0)
     {
 	mb_ptr2len = dbcs_ptr2len;
+	mb_ptr2len_len = dbcs_ptr2len_len;
 	mb_char2len = dbcs_char2len;
 	mb_char2bytes = dbcs_char2bytes;
 	mb_ptr2cells = dbcs_ptr2cells;
+	mb_ptr2cells_len = dbcs_ptr2cells_len;
 	mb_char2cells = dbcs_char2cells;
 	mb_off2cells = dbcs_off2cells;
 	mb_ptr2char = dbcs_ptr2char;
@@ -628,9 +635,11 @@
     else
     {
 	mb_ptr2len = latin_ptr2len;
+	mb_ptr2len_len = latin_ptr2len_len;
 	mb_char2len = latin_char2len;
 	mb_char2bytes = latin_char2bytes;
 	mb_ptr2cells = latin_ptr2cells;
+	mb_ptr2cells_len = latin_ptr2cells_len;
 	mb_char2cells = latin_char2cells;
 	mb_off2cells = latin_off2cells;
 	mb_ptr2char = latin_ptr2char;
@@ -1069,7 +1078,6 @@
  * Get byte length of character at "*p" but stop at a NUL.
  * For UTF-8 this includes following composing characters.
  * Returns 0 when *p is NUL.
- *
  */
     int
 latin_ptr2len(p)
@@ -1091,6 +1099,40 @@
     return len;
 }
 
+/*
+ * mb_ptr2len_len() function pointer.
+ * Like mb_ptr2len(), but limit to read "size" bytes.
+ * Returns 0 for an empty string.
+ * Returns 1 for an illegal char or an incomplete byte sequence.
+ */
+    int
+latin_ptr2len_len(p, size)
+    char_u	*p;
+    int		size;
+{
+    if (size < 1 || *p == NUL)
+	return 0;
+    return 1;
+}
+
+    static int
+dbcs_ptr2len_len(p, size)
+    char_u	*p;
+    int		size;
+{
+    int		len;
+
+    if (size < 1 || *p == NUL)
+	return 0;
+    if (size == 1)
+	return 1;
+    /* Check that second byte is not missing. */
+    len = MB_BYTE2LEN(*p);
+    if (len == 2 && p[1] == NUL)
+	len = 1;
+    return len;
+}
+
 struct interval
 {
     unsigned short first;
@@ -1287,6 +1329,55 @@
 }
 
 /*
+ * mb_ptr2cells_len() function pointer.
+ * Like mb_ptr2cells(), but limit string length to "size".
+ * For an empty string or truncated character returns 1.
+ */
+    int
+latin_ptr2cells_len(p, size)
+    char_u	*p UNUSED;
+    int		size UNUSED;
+{
+    return 1;
+}
+
+    static int
+utf_ptr2cells_len(p, size)
+    char_u	*p;
+    int		size;
+{
+    int		c;
+
+    /* Need to convert to a wide character. */
+    if (size > 0 && *p >= 0x80)
+    {
+	if (utf_ptr2len_len(p, size) < utf8len_tab[*p])
+	    return 1;
+	c = utf_ptr2char(p);
+	/* An illegal byte is displayed as <xx>. */
+	if (utf_ptr2len(p) == 1 || c == NUL)
+	    return 4;
+	/* If the char is ASCII it must be an overlong sequence. */
+	if (c < 0x80)
+	    return char2cells(c);
+	return utf_char2cells(c);
+    }
+    return 1;
+}
+
+    static int
+dbcs_ptr2cells_len(p, size)
+    char_u	*p;
+    int		size;
+{
+    /* Number of cells is equal to number of bytes, except for euc-jp when
+     * the first byte is 0x8e. */
+    if (size <= 1 || (enc_dbcs == DBCS_JPNU && *p == 0x8e))
+	return 1;
+    return MB_BYTE2LEN(*p);
+}
+
+/*
  * mb_char2cells() function pointer.
  * Return the number of display cells character "c" occupies.
  * Only takes care of multi-byte chars, not "^C" and such.
@@ -1716,6 +1807,7 @@
 /*
  * Return the number of bytes the UTF-8 encoding of the character at "p[size]"
  * takes.  This includes following composing characters.
+ * Returns 0 for an empty string.
  * Returns 1 for an illegal char or an incomplete byte sequence.
  */
     int
@@ -1728,7 +1820,7 @@
     int		prevlen;
 #endif
 
-    if (*p == NUL)
+    if (size < 1 || *p == NUL)
 	return 0;
     if (p[0] < 0x80 && (size == 1 || p[1] < 0x80)) /* be quick for ASCII */
 	return 1;
diff --git a/src/os_unix.c b/src/os_unix.c
index 72b17c4..591b49c 100644
--- a/src/os_unix.c
+++ b/src/os_unix.c
@@ -4305,7 +4305,8 @@
 				ta_buf[i] = '\n';
 # ifdef FEAT_MBYTE
 			    if (has_mbyte)
-				i += (*mb_ptr2len)(ta_buf + i) - 1;
+				i += (*mb_ptr2len_len)(ta_buf + i,
+							ta_len + len - i) - 1;
 # endif
 			}
 
diff --git a/src/proto/mbyte.pro b/src/proto/mbyte.pro
index cac9ba8..ac350e1 100644
--- a/src/proto/mbyte.pro
+++ b/src/proto/mbyte.pro
@@ -7,10 +7,12 @@
 int latin_char2len __ARGS((int c));
 int latin_char2bytes __ARGS((int c, char_u *buf));
 int latin_ptr2len __ARGS((char_u *p));
+int latin_ptr2len_len __ARGS((char_u *p, int size));
 int utf_char2cells __ARGS((int c));
 int latin_ptr2cells __ARGS((char_u *p));
 int utf_ptr2cells __ARGS((char_u *p));
 int dbcs_ptr2cells __ARGS((char_u *p));
+int latin_ptr2cells_len __ARGS((char_u *p, int size));
 int latin_char2cells __ARGS((int c));
 int latin_off2cells __ARGS((unsigned off, unsigned max_off));
 int dbcs_off2cells __ARGS((unsigned off, unsigned max_off));
@@ -85,6 +87,7 @@
 int preedit_get_status __ARGS((void));
 int im_is_preediting __ARGS((void));
 int convert_setup __ARGS((vimconv_T *vcp, char_u *from, char_u *to));
+int convert_setup_ext __ARGS((vimconv_T *vcp, char_u *from, int from_unicode_is_utf8, char_u *to, int to_unicode_is_utf8));
 int convert_input __ARGS((char_u *ptr, int len, int maxlen));
 int convert_input_safe __ARGS((char_u *ptr, int len, int maxlen, char_u **restp, int *restlenp));
 char_u *string_convert __ARGS((vimconv_T *vcp, char_u *ptr, int *lenp));
diff --git a/src/version.c b/src/version.c
index 43f8f0f..a0a5951 100644
--- a/src/version.c
+++ b/src/version.c
@@ -677,6 +677,8 @@
 static int included_patches[] =
 {   /* Add new patch number below this line */
 /**/
+    200,
+/**/
     199,
 /**/
     198,