diff --git a/src/core/config.c b/src/core/config.c
index 6bfcb8e8b..715628f0f 100644
--- a/src/core/config.c
+++ b/src/core/config.c
@@ -169,14 +169,14 @@ void mCoreConfigDeinit(struct mCoreConfig* config) {
 
 #if !defined(MINIMAL_CORE) || MINIMAL_CORE < 2
 bool mCoreConfigLoad(struct mCoreConfig* config) {
-	char path[PATH_MAX];
+	char path[PATH_MAX + 1];
 	mCoreConfigDirectory(path, PATH_MAX);
 	strncat(path, PATH_SEP "config.ini", PATH_MAX - strlen(path));
 	return mCoreConfigLoadPath(config, path);
 }
 
 bool mCoreConfigSave(const struct mCoreConfig* config) {
-	char path[PATH_MAX];
+	char path[PATH_MAX + 1];
 	mCoreConfigDirectory(path, PATH_MAX);
 	strncat(path, PATH_SEP "config.ini", PATH_MAX - strlen(path));
 	return mCoreConfigSavePath(config, path);
@@ -304,7 +304,7 @@ void mCoreConfigPortablePath(char* out, size_t outLength) {
 		CFRelease(suburl);
 	}
 #endif
-	strncat(out, PATH_SEP "portable.ini", outLength - strlen(out));
+	strncat(out, PATH_SEP "portable.ini", outLength - strlen(out) - 1);
 #endif
 }
 
diff --git a/src/feature/updater-main.c b/src/feature/updater-main.c
index bc29e5cd4..cd72fc4f3 100644
--- a/src/feature/updater-main.c
+++ b/src/feature/updater-main.c
@@ -114,7 +114,7 @@ int main(int argc, char* argv[]) {
 	int ok = 1;
 
 	mCoreConfigDirectory(bin, sizeof(bin));
-	strncat(bin, "/updater.log", sizeof(bin));
+	strncat(bin, "/updater.log", sizeof(bin) - 1);
 	logfile = fopen(bin, "w");
 
 	mCoreConfigInit(&config, "updater");
diff --git a/src/gb/core.c b/src/gb/core.c
index 7edb1a607..59fb7c016 100644
--- a/src/gb/core.c
+++ b/src/gb/core.c
@@ -607,16 +607,16 @@ static void _GBCoreReset(struct mCore* core) {
 			switch (gb->model) {
 			case GB_MODEL_DMG:
 			case GB_MODEL_MGB: // TODO
-				strncat(path, PATH_SEP "gb_bios.bin", PATH_MAX - strlen(path));
+				strncat(path, PATH_SEP "gb_bios.bin", PATH_MAX - strlen(path) - 1);
 				break;
 			case GB_MODEL_SGB:
 			case GB_MODEL_SGB2: // TODO
-				strncat(path, PATH_SEP "sgb_bios.bin", PATH_MAX - strlen(path));
+				strncat(path, PATH_SEP "sgb_bios.bin", PATH_MAX - strlen(path) - 1);
 				break;
 			case GB_MODEL_CGB:
 			case GB_MODEL_AGB:
 			case GB_MODEL_SCGB:
-				strncat(path, PATH_SEP "gbc_bios.bin", PATH_MAX - strlen(path));
+				strncat(path, PATH_SEP "gbc_bios.bin", PATH_MAX - strlen(path) - 1);
 				break;
 			default:
 				break;
diff --git a/src/gba/core.c b/src/gba/core.c
index 2444a8ae7..8bdf218b3 100644
--- a/src/gba/core.c
+++ b/src/gba/core.c
@@ -684,7 +684,7 @@ static void _GBACoreReset(struct mCore* core) {
 		if (!found) {
 			char path[PATH_MAX];
 			mCoreConfigDirectory(path, PATH_MAX);
-			strncat(path, PATH_SEP "gba_bios.bin", PATH_MAX - strlen(path));
+			strncat(path, PATH_SEP "gba_bios.bin", PATH_MAX - strlen(path) - 1);
 			bios = VFileOpen(path, O_RDONLY);
 			if (bios && GBAIsBIOS(bios)) {
 				found = true;