diff --git a/harbour/ChangeLog b/harbour/ChangeLog
index b388561abc..447b356f9a 100644
--- a/harbour/ChangeLog
+++ b/harbour/ChangeLog
@@ -8,6 +8,15 @@
    2009-12-31 13:59 UTC+0100 Foo Bar (foo.bar foobar.org)
 */
 
+2009-02-11 15:33 UTC+0100 Viktor Szakats (harbour.01 syenar hu)
+  * contrib/gtwvg/wvgwin.c
+    ! Fixed to use hb_snprintf() instead of unsafe sprintf().
+    ! Fixed WIN_APPENDMENU() to not directly modify Harbour string buffer
+      (when compiled in non-Unicode mode).
+    ! Fixed WIN_APPENDMENU() to modify string _before_ converting it to Unicode.
+      (when compiled in Unicode mode).
+    ; This clears the GPF previously reported by me.
+
 2009-02-11 15:05 UTC+0100 Przemyslaw Czerpak (druzus/at/priv.onet.pl)
   * harbour/source/vm/set.c
     ! fixed casting in hb_fsFileExists()
diff --git a/harbour/contrib/gtwvg/wvgwin.c b/harbour/contrib/gtwvg/wvgwin.c
index 43b236eacf..bb137c66ce 100644
--- a/harbour/contrib/gtwvg/wvgwin.c
+++ b/harbour/contrib/gtwvg/wvgwin.c
@@ -785,30 +785,32 @@ HB_FUNC( WIN_APPENDMENU )
       iLen = hb_parclen( 4 );
       if ( iLen > 0 && iLen < 256 )   // Translate '~' to '&'
       {
-         LPTSTR pDest;
+         char * text = ( char * ) hb_xgrab( iLen + 1 );
+
+         memcpy( text, hb_parc( 4 ), iLen + 1 );
 
-         buffer = HB_TCHAR_CONVTO( hb_parc( 4 ) );
-         pDest = buffer;
          for ( i = 0; i < iLen; i++ )
          {
-            pDest[ i ] = ( *buffer == '~' ) ? '&' : ( char ) *buffer;
-            buffer++;
+            if( text[ i ] == '~' )
+               text[ i ] = '&';
          }
-         buffer = pDest;
-         hb_retl( AppendMenu( ( HMENU ) ( HB_PTRDIFF ) hb_parnint( 1 ), ( UINT ) hb_parni( 2 ), ( HB_PTRDIFF ) hb_parnint( 3 ), buffer ) ) ;
+
+         buffer = HB_TCHAR_CONVTO( text );
+         hb_retl( AppendMenu( ( HMENU ) ( HB_PTRDIFF ) hb_parnint( 1 ), ( UINT ) hb_parni( 2 ), ( HB_PTRDIFF ) hb_parnint( 3 ), buffer ) );
          HB_TCHAR_FREE( buffer );
+         hb_xfree( text );
       }
       else
       {
          buffer = HB_TCHAR_CONVTO( hb_parc( 4 ) );
-         hb_retl( AppendMenu( ( HMENU ) ( HB_PTRDIFF ) hb_parnint( 1 ), ( UINT ) hb_parni( 2 ), ( HB_PTRDIFF ) hb_parnint( 3 ), buffer ) ) ;
+         hb_retl( AppendMenu( ( HMENU ) ( HB_PTRDIFF ) hb_parnint( 1 ), ( UINT ) hb_parni( 2 ), ( HB_PTRDIFF ) hb_parnint( 3 ), buffer ) );
          HB_TCHAR_FREE( buffer );
       }
    }
    else
    {  // It is a SEPARATOR or Submenu
-      LPCTSTR lpszCaption = ( LPCTSTR ) ( HB_PTRDIFF ) hb_parnint( 4 ) ;
-      hb_retl( AppendMenu( ( HMENU ) ( HB_PTRDIFF ) hb_parnint( 1 ), ( UINT ) hb_parni( 2 ), ( HB_PTRDIFF ) hb_parnint( 3 ), ( LPCTSTR ) lpszCaption ) ) ;
+      LPCTSTR lpszCaption = ( LPCTSTR ) ( HB_PTRDIFF ) hb_parnint( 4 );
+      hb_retl( AppendMenu( ( HMENU ) ( HB_PTRDIFF ) hb_parnint( 1 ), ( UINT ) hb_parni( 2 ), ( HB_PTRDIFF ) hb_parnint( 3 ), ( LPCTSTR ) lpszCaption ) );
    }
 }
 
@@ -1171,7 +1173,7 @@ static HBITMAP hPrepareBitmap( char * szBitmapX, UINT uiBitmap,
       UINT uiOptions = bMap3Dcolors ? LR_LOADMAP3DCOLORS : LR_DEFAULTCOLOR;
       char szResname[ MAX_PATH + 1 ];
 
-      sprintf( szResname, "?%u", uiBitmap );
+      hb_snprintf( szResname, sizeof( szResname ), "?%u", uiBitmap );
 
       hBitmap = ( HBITMAP ) LoadImage(
                                   wvg_hInstance(),