7 files changed, 28 insertions, 15 deletions

diff --git a/src/nvim/api/vim.c b/src/nvim/api/vim.c
index c8bb22b33c..d47f47e638 100644
--- a/src/nvim/api/vim.c
+++ b/src/nvim/api/vim.c
@@ -2241,7 +2241,7 @@ Dictionary nvim_eval_statusline(String str, Dict(eval_statusline) *opts, Error *
   if (highlights) {
     Array hl_values = ARRAY_DICT_INIT;
     const char *grpname;
-    char user_group[6];
+    char user_group[15];  // strlen("User") + strlen("2147483647") + NUL
 
     // If first character doesn't have a defined highlight,
     // add the default highlight at the beginning of the highlight list
diff --git a/src/nvim/drawline.c b/src/nvim/drawline.c
index 604af21899..93549d1fb0 100644
--- a/src/nvim/drawline.c
+++ b/src/nvim/drawline.c
@@ -282,7 +282,7 @@ static void draw_virt_text(win_T *wp, buf_T *buf, int col_off, int *end_col, int
     if (item->win_col < 0) {
       continue;
     }
-    int col;
+    int col = 0;
     if (item->decor.ui_watched) {
       // send mark position to UI
       col = item->win_col;
@@ -1386,7 +1386,7 @@ int win_line(win_T *wp, linenr_T lnum, int startrow, int endrow, bool nochange,
   if (v > 0 && !number_only) {
     char *prev_ptr = ptr;
     chartabsize_T cts;
-    int charsize;
+    int charsize = 0;
 
     init_chartabsize_arg(&cts, wp, lnum, wlv.vcol, line, ptr);
     while (cts.cts_vcol < v && *cts.cts_ptr != NUL) {
diff --git a/src/nvim/eval/userfunc.c b/src/nvim/eval/userfunc.c
index 51e109fdfb..b71e6c9cff 100644
--- a/src/nvim/eval/userfunc.c
+++ b/src/nvim/eval/userfunc.c
@@ -653,14 +653,20 @@ ufunc_T *find_func(const char *name)
 /// Copy the function name of "fp" to buffer "buf".
 /// "buf" must be able to hold the function name plus three bytes.
 /// Takes care of script-local function names.
-static void cat_func_name(char *buf, ufunc_T *fp)
+static void cat_func_name(char *buf, size_t buflen, ufunc_T *fp)
 {
-  if ((uint8_t)fp->uf_name[0] == K_SPECIAL) {
-    STRCPY(buf, "<SNR>");
-    STRCAT(buf, fp->uf_name + 3);
+  int len = -1;
+  size_t uflen = strlen(fp->uf_name);
+  assert(uflen > 0);
+
+  if ((uint8_t)fp->uf_name[0] == K_SPECIAL && uflen > 3) {
+    len = snprintf(buf, buflen, "<SNR>%s", fp->uf_name + 3);
   } else {
-    STRCPY(buf, fp->uf_name);
+    len = snprintf(buf, buflen, "%s", fp->uf_name);
   }
+
+  (void)len;  // Avoid unused warning on release builds
+  assert(len > 0);
 }
 
 /// Add a number variable "name" to dict "dp" with value "nr".
@@ -2851,7 +2857,7 @@ char *get_user_func_name(expand_T *xp, int idx)
       return fp->uf_name;  // Prevent overflow.
     }
 
-    cat_func_name(IObuff, fp);
+    cat_func_name(IObuff, IOSIZE, fp);
     if (xp->xp_context != EXPAND_USER_FUNC) {
       STRCAT(IObuff, "(");
       if (!fp->uf_varargs && GA_EMPTY(&fp->uf_args)) {
diff --git a/src/nvim/ex_getln.c b/src/nvim/ex_getln.c
index 97343e468b..a8ac6ab439 100644
--- a/src/nvim/ex_getln.c
+++ b/src/nvim/ex_getln.c
@@ -2446,7 +2446,7 @@ static bool cmdpreview_may_show(CommandLineState *s)
 
   CpInfo cpinfo;
   bool icm_split = *p_icm == 's';  // inccommand=split
-  buf_T *cmdpreview_buf;
+  buf_T *cmdpreview_buf = NULL;
   win_T *cmdpreview_win = NULL;
 
   emsg_silent++;                 // Block error reporting as the command may be incomplete,
diff --git a/src/nvim/linematch.c b/src/nvim/linematch.c
index a15f41d9a8..7bde6bb121 100644
--- a/src/nvim/linematch.c
+++ b/src/nvim/linematch.c
@@ -186,7 +186,7 @@ static void try_possible_paths(const int *df_iters, const size_t *paths, const i
 {
   if (path_idx == npaths) {
     if ((*choice) > 0) {
-      int from_vals[LN_MAX_BUFS];
+      int from_vals[LN_MAX_BUFS] = { 0 };
       const int *to_vals = df_iters;
       const char *current_lines[LN_MAX_BUFS];
       for (size_t k = 0; k < ndiffs; k++) {
diff --git a/src/nvim/statusline.c b/src/nvim/statusline.c
index e809922be3..db99bae03c 100644
--- a/src/nvim/statusline.c
+++ b/src/nvim/statusline.c
@@ -1656,7 +1656,7 @@ int build_stl_str_hl(win_T *wp, char *out, size_t outlen, char *fmt, char *opt_n
         break;
       }
 
-      char *p;
+      char *p = NULL;
       if (fold) {
         size_t n = fill_foldcolumn(out_p, wp, stcp->foldinfo, (linenr_T)get_vim_var_nr(VV_LNUM));
         stl_items[curitem].minwid = -((stcp->use_cul ? HLF_CLF : HLF_FC) + 1);
@@ -1678,14 +1678,17 @@ int build_stl_str_hl(win_T *wp, char *out, size_t outlen, char *fmt, char *opt_n
           stl_items[curitem].minwid = -(sattr ? stcp->sign_cul_id ? stcp->sign_cul_id
                                         : sattr->hl_id : (stcp->use_cul ? HLF_CLS : HLF_SC) + 1);
         }
+        size_t buflen = strlen(buf_tmp);
         stl_items[curitem].type = Highlight;
-        stl_items[curitem].start = out_p + strlen(buf_tmp);
+        stl_items[curitem].start = out_p + buflen;
         curitem++;
         if (i == width) {
           str = buf_tmp;
           break;
         }
-        STRCAT(buf_tmp, p);
+        int rc = snprintf(buf_tmp + buflen, sizeof(buf_tmp) - buflen, "%s", p);
+        (void)rc;  // Avoid unused warning on release build
+        assert(rc > 0);
       }
       break;
     }
diff --git a/src/nvim/ui_client.c b/src/nvim/ui_client.c
index b93b31f7dc..e177c0a60d 100644
--- a/src/nvim/ui_client.c
+++ b/src/nvim/ui_client.c
@@ -65,7 +65,11 @@ uint64_t ui_client_start_server(int argc, char **argv)
 #ifdef MSWIN
     os_open_conin_fd();
 #else
-    dup(stderr_isatty ? STDERR_FILENO : STDOUT_FILENO);
+    int fd = dup(stderr_isatty ? STDERR_FILENO : STDOUT_FILENO);
+    if (fd < 0) {
+      return 0;
+    }
+    // FIXME: resource leak of fd
 #endif
   }