diff --git a/tools/widl/typegen.c b/tools/widl/typegen.c
index bf24d3f23d9..53ec78c30f1 100644
--- a/tools/widl/typegen.c
+++ b/tools/widl/typegen.c
@@ -2501,7 +2501,7 @@ void print_phase_basetype(FILE *file, int indent, enum remoting_phase phase,
             fprintf(file, " *)_StubMsg.Buffer = *");
         else
             fprintf(file, " *)_StubMsg.Buffer = ");
-        fprintf(file, varname);
+        fprintf(file, "%s", varname);
         fprintf(file, ";\n");
     }
     else if (phase == PHASE_UNMARSHAL)
@@ -2510,7 +2510,7 @@ void print_phase_basetype(FILE *file, int indent, enum remoting_phase phase,
             print_file(file, indent, "");
         else
             print_file(file, indent, "*");
-        fprintf(file, varname);
+        fprintf(file, "%s", varname);
         if (pass == PASS_IN && is_ptr(type))
             fprintf(file, " = (");
         else
diff --git a/tools/widl/widl.c b/tools/widl/widl.c
index 53c9e29780b..37f1a5ed7b7 100644
--- a/tools/widl/widl.c
+++ b/tools/widl/widl.c
@@ -422,13 +422,13 @@ int main(int argc,char *argv[])
       idfile_name = xstrdup(optarg);
       break;
     case 'V':
-      printf(version_string);
+      printf("%s", version_string);
       return 0;
     case 'W':
       pedantic = 1;
       break;
     default:
-      fprintf(stderr, usage);
+      fprintf(stderr, "%s", usage);
       return 1;
     }
   }
@@ -458,7 +458,7 @@ int main(int argc,char *argv[])
       input_name = xstrdup(argv[optind]);
   }
   else {
-    fprintf(stderr, usage);
+    fprintf(stderr, "%s", usage);
     return 1;
   }