diff --git a/apps/mosquitto_passwd/mosquitto_passwd.c b/apps/mosquitto_passwd/mosquitto_passwd.c
index 262f89cf6..2c10359f6 100644
--- a/apps/mosquitto_passwd/mosquitto_passwd.c
+++ b/apps/mosquitto_passwd/mosquitto_passwd.c
@@ -629,13 +629,13 @@ int main(int argc, char *argv[])
 			return 1;
 		}
 
-		backup_file = malloc((size_t)strlen(password_file)+strlen(".backup.XXXXXX"));
+		backup_file = malloc((size_t)strlen(password_file)+strlen(".backup.XXXXXX")+1);
 		if(!backup_file){
 			fprintf(stderr, "Error: Out of memory.\n");
 			free(password_file);
 			return 1;
 		}
-		snprintf(backup_file, strlen(password_file)+5, "%s.backup.XXXXXX", password_file);
+		snprintf(backup_file, strlen(password_file)+strlen(".backup.XXXXXX")+1, "%s.backup.XXXXXX", password_file);
 		free(password_file);
 		password_file = NULL;