diff --git a/common/menu-list.c b/common/menu-list.c
index abbceea..ba7aacd 100644
--- a/common/menu-list.c
+++ b/common/menu-list.c
@@ -133,6 +133,7 @@ int menuScan(const char* target) {
             continue;
 
         strncpy(me->path, tmp_path, sizeof(me->path)-1);
+        me->path[sizeof(me->path)-1] = 0;
         if (menuEntryLoad(me, dp->d_name, shortcut))
             menuAddEntry(me);
         else
diff --git a/common/menu.c b/common/menu.c
index 9f8be74..ba2a80c 100644
--- a/common/menu.c
+++ b/common/menu.c
@@ -5,7 +5,7 @@
 #include "invalid_icon_bin.h"
 #include "folder_icon_bin.h"
 
-char rootPath[PATH_MAX];
+char rootPath[PATH_MAX+8];
 
 char *menuGetRootPath() {
     return rootPath;
@@ -248,14 +248,14 @@ void computeFrontGradient(color_t baseColor, int height) {
 }
 
 void menuStartup() {
-
+    char tmp_path[PATH_MAX];
 
     #ifdef __SWITCH__
-    strcpy(rootPath,"sdmc:");
+    strcpy(tmp_path,"sdmc:");
     #else
-    getcwd(rootPath, PATH_MAX);
+    getcwd(tmp_path, PATH_MAX);
     #endif
-    sprintf(rootPath,"%s%s%s" , rootPath, DIRECTORY_SEPARATOR, "switch" );
+    snprintf(rootPath, sizeof(rootPath)-1, "%s%s%s", tmp_path, DIRECTORY_SEPARATOR, "switch");
 
     menuScan(rootPath);
 
diff --git a/common/menu.h b/common/menu.h
index 6c8be14..9b4a17e 100644
--- a/common/menu.h
+++ b/common/menu.h
@@ -46,7 +46,7 @@ struct menuEntry_s_tag
     menuEntry_s* next;
     MenuEntryType type;
 
-    char path[PATH_MAX+1];
+    char path[PATH_MAX+8];
     argData_s args;
 
     char name[ENTRY_NAMELENGTH+1];
diff --git a/common/netloader.c b/common/netloader.c
index 8a9efd8..9d5ade7 100644
--- a/common/netloader.c
+++ b/common/netloader.c
@@ -329,7 +329,8 @@ int loadnro(menuEntry_s *me, int sock, struct in_addr remote) {
 
     sanitisePath(filename);
 
-    snprintf(me->path, PATH_MAX, "%s%s%s", menuGetRootPath(), DIRECTORY_SEPARATOR,  filename);
+    snprintf(me->path, sizeof(me->path)-1, "%s%s%s", menuGetRootPath(), DIRECTORY_SEPARATOR,  filename);
+    me->path[PATH_MAX] = 0;
     // make sure it's terminated
     me->path[PATH_MAX] = 0;