diff --git a/sys/src/cmd/rio/wind.c b/sys/src/cmd/rio/wind.c
index 1026a768e..b583d1360 100644
--- a/sys/src/cmd/rio/wind.c
+++ b/sys/src/cmd/rio/wind.c
@@ -406,7 +406,7 @@ winctl(void *arg)
 			t = "notcurrent";
 			if(w == input)
 				t = "current";
-			pair.ns = snprint(pair.s, pair.ns, "%11d %11d %11d %11d %11s %11s ",
+			pair.ns = snprint(pair.s, pair.ns+1, "%11d %11d %11d %11d %11s %11s ",
 				w->i->r.min.x, w->i->r.min.y, w->i->r.max.x, w->i->r.max.y, t, s);
 			send(crm.c2, &pair);
 			continue;
diff --git a/sys/src/cmd/rio/xfid.c b/sys/src/cmd/rio/xfid.c
index b8e4be84a..3985bea00 100644
--- a/sys/src/cmd/rio/xfid.c
+++ b/sys/src/cmd/rio/xfid.c
@@ -670,9 +670,9 @@ xfidread(Xfid *x)
 		}
 		c1 = crm.c1;
 		c2 = crm.c2;
-		pair.ns = cnt+UTFmax+1;	/* room for partial rune and null byte */
-		t = emalloc(pair.ns);
+		t = emalloc(cnt+UTFmax+1);	/* room to unpack partial rune plus */
 		pair.s = t;
+		pair.ns = cnt;
 		send(c1, &pair);
 		recv(c2, &pair);
 		fc.data = pair.s;