diff --git a/calcApp/src/aCalcPerform.c b/calcApp/src/aCalcPerform.c
index 66f5e60..2c05b86 100644
--- a/calcApp/src/aCalcPerform.c
+++ b/calcApp/src/aCalcPerform.c
@@ -1531,7 +1531,7 @@ long aCalcPerform(double *p_dArg, int num_dArgs, double **pp_aArg,
 			j = (int)ps2->d;
 			if (j < 0) j += arraySize;
 			i = myMAX(myMIN(i,arraySize),0);
-			j = myMIN(j,arraySize);
+			j = myMIN(j,arraySize-1);
 			if (aCalcPerformDebug > 20) printf("\tSUBRANGE*: ix1=%d, ix2=%d\n", i, j);
 			if (op == SUBRANGE) {
 				ps->firstEl = 0;
diff --git a/calcApp/src/calcUtil.c b/calcApp/src/calcUtil.c
index a187a97..a45b6be 100644
--- a/calcApp/src/calcUtil.c
+++ b/calcApp/src/calcUtil.c
@@ -30,6 +30,7 @@ int nderiv(double *x, double *y, int n, double *d, int npts, double *lx)
 	double c, b, a;
 
 	m = 2*npts+1;
+	if (n < m) return(-1);	/* fit window larger than the array: refuse rather than read OOB */
 	/* first m/2+1 points */
 	e = fitpoly(x,y,m, &c, &b, &a, NULL);
 	if (e) {
diff --git a/calcApp/src/sCalcPerform.c b/calcApp/src/sCalcPerform.c
index 31816ac..ea7d721 100644
--- a/calcApp/src/sCalcPerform.c
+++ b/calcApp/src/sCalcPerform.c
@@ -1265,7 +1265,7 @@ epicsShareFunc long
 				ps1 = ps;
 				toDouble(ps1);
 				j = myNINT(ps1->d);
-				j = myMIN(j,SCALC_STRING_SIZE);
+				j = myMAX(myMIN(j,SCALC_STRING_SIZE),0);
 				DEC(ps);
 				if (isDouble(ps)) {
 					/* numeric variable: bit shift by integer amount */
@@ -1494,7 +1494,7 @@ epicsShareFunc long
 				INC(ps);
 				ps->s = &(ps->local_string[0]);
 				s = ps->s;
-				for (i=0; (i<SCALC_STRING_SIZE-1) && *post; )
+				for (i=0; (i<SCALC_STRING_SIZE-1) && *post; i++)
 					*s++ = (char)*post++;
 				*s = '\0';
 				/* skip to end of string, if we haven't already */