diff --git a/src/nvim/insexpand.c b/src/nvim/insexpand.c
index 93577450c7..9146db8114 100644
--- a/src/nvim/insexpand.c
+++ b/src/nvim/insexpand.c
@@ -3962,6 +3962,9 @@ static void fuzzy_longest_match(void)
     return;
   }
 
+  if ((size_t)compl_num_bests > SIZE_MAX / sizeof(compl_T *)) {
+    return;
+  }
   compl_best_matches = (compl_T **)xmalloc((size_t)compl_num_bests * sizeof(compl_T *));
 
   for (int i = 0; compl != NULL && i < compl_num_bests; i++) {
diff --git a/src/nvim/regexp.c b/src/nvim/regexp.c
index ba3d9cb5d6..6ca40b51a3 100644
--- a/src/nvim/regexp.c
+++ b/src/nvim/regexp.c
@@ -8286,7 +8286,7 @@ static uint8_t *regprop(uint8_t *op)
     break;
   }
   if (p != NULL) {
-    STRCPY(buf + buflen, p);
+    xstrlcpy(buf + buflen, p, sizeof(buf) - buflen);
   }
   return (uint8_t *)buf;
 }
diff --git a/src/nvim/spell.c b/src/nvim/spell.c
index a5ac2d46dd..91727c8c5c 100644
--- a/src/nvim/spell.c
+++ b/src/nvim/spell.c
@@ -2650,7 +2650,7 @@ void ex_spellrepall(exarg_T *eap)
   }
   const size_t repl_from_len = strlen(repl_from);
   const size_t repl_to_len = strlen(repl_to);
-  const int addlen = (int)(repl_to_len - repl_from_len);
+  const int64_t addlen = (int64_t)repl_to_len - (int64_t)repl_from_len;
 
   const size_t frompatsize = repl_from_len + 7;
   char *frompat = xmalloc(frompatsize);
@@ -2671,7 +2671,7 @@ void ex_spellrepall(exarg_T *eap)
     char *line = get_cursor_line_ptr();
     if (addlen <= 0
         || strncmp(line + curwin->w_cursor.col, repl_to, repl_to_len) != 0) {
-      char *p = xmalloc((size_t)get_cursor_line_len() + (size_t)addlen + 1);
+      char *p = xmalloc((size_t)(get_cursor_line_len() + addlen) + 1);
       memmove(p, line, (size_t)curwin->w_cursor.col);
       STRCPY(p + curwin->w_cursor.col, repl_to);
       strcat(p, line + curwin->w_cursor.col + repl_from_len);
diff --git a/src/nvim/spellfile.c b/src/nvim/spellfile.c
index f2cf59d73f..43f43a6048 100644
--- a/src/nvim/spellfile.c
+++ b/src/nvim/spellfile.c
@@ -1668,7 +1668,7 @@ static int spell_read_tree(FILE *fd, uint8_t **bytsp, int *bytsp_len, idx_T **id
   if (len < 0) {
     return SP_TRUNCERROR;
   }
-  if ((size_t)len >= SIZE_MAX / sizeof(int)) {
+  if ((size_t)len > SIZE_MAX / sizeof(int)) {
     // Invalid length, multiply with sizeof(int) would overflow.
     return SP_FORMERROR;
   }