diff --git a/include/i3status.h b/include/i3status.h
index 1bc2c85f..ad05055d 100644
--- a/include/i3status.h
+++ b/include/i3status.h
@@ -204,7 +204,7 @@ void print_separator(const char *separator);
 char *color(const char *colorstr);
 char *endcolor() __attribute__((pure));
 void reset_cursor(void);
-void maybe_escape_markup(char *text, char **buffer);
+void maybe_escape_markup(char *text, char *buffer, size_t size);
 
 char *rtrim(const char *s);
 char *ltrim(const char *s);
diff --git a/src/output.c b/src/output.c
index 9a180497..e1bfa1fa 100644
--- a/src/output.c
+++ b/src/output.c
@@ -88,35 +88,42 @@ void reset_cursor(void) {
  * https://git.gnome.org/browse/glib/tree/glib/gmarkup.c?id=03db1f455b4265654e237d2ad55464b4113cba8a#n2142
  *
  */
-void maybe_escape_markup(char *text, char **buffer) {
+void maybe_escape_markup(char *text, char *buffer, size_t size) {
+    size--; /* Leave a byte for NUL termination. */
+
     if (markup_format == M_NONE) {
-        *buffer += sprintf(*buffer, "%s", text);
+        *buffer += snprintf(buffer, size, "%s", text);
         return;
     }
-    for (; *text != '\0'; text++) {
+
+    for (size_t i = 0; *text != '\0'; text++) {
+        if (i >= size) {
+            return;
+        }
         switch (*text) {
             case '&':
-                *buffer += sprintf(*buffer, "%s", "&");
+                i += snprintf(&buffer[i], size - i, "%s", "&");
                 break;
             case '<':
-                *buffer += sprintf(*buffer, "%s", "&lt;");
+                i += snprintf(&buffer[i], size - i, "%s", "&lt;");
                 break;
             case '>':
-                *buffer += sprintf(*buffer, "%s", "&gt;");
+                i += snprintf(&buffer[i], size - i, "%s", "&gt;");
                 break;
             case '\'':
-                *buffer += sprintf(*buffer, "%s", "&apos;");
+                i += snprintf(&buffer[i], size - i, "%s", "&apos;");
                 break;
             case '"':
-                *buffer += sprintf(*buffer, "%s", "&quot;");
+                i += snprintf(&buffer[i], size - i, "%s", "&quot;");
                 break;
             default:
                 if ((0x1 <= *text && *text <= 0x8) ||
                     (0xb <= *text && *text <= 0xc) ||
                     (0xe <= *text && *text <= 0x1f)) {
-                    *buffer += sprintf(*buffer, "&#x%x;", *text);
+                    i += snprintf(&buffer[i], size - i, "&#x%x;", *text);
                 } else {
-                    *(*buffer)++ = *text;
+                    buffer[i] = *text;
+                    i++;
                 }
                 break;
         }
@@ -154,4 +161,4 @@ char *trim(const char *s) {
     char *f = ltrim(r);
     free(r);
     return f;
-}
\ No newline at end of file
+}
diff --git a/src/print_wireless_info.c b/src/print_wireless_info.c
index 7c577f50..88d87f44 100644
--- a/src/print_wireless_info.c
+++ b/src/print_wireless_info.c
@@ -68,7 +68,7 @@
 
 #include "i3status.h"
 
-#define STRING_SIZE 30
+#define STRING_SIZE 60
 
 #define WIRELESS_INFO_FLAG_HAS_ESSID (1 << 0)
 #define WIRELESS_INFO_FLAG_HAS_QUALITY (1 << 1)
@@ -402,9 +402,9 @@ static int get_wireless_info(const char *interface, wireless_info_t *info) {
     close(s);
     if (na.i_len >= sizeof(u.req)) {
         /*
-	 * Just use the first BSSID returned even if there are
-	 * multiple APs sharing the same BSSID.
-	 */
+         * Just use the first BSSID returned even if there are
+         * multiple APs sharing the same BSSID.
+         */
         info->signal_level = u.req.info[0].isi_rssi / 2 +
                              u.req.info[0].isi_noise;
         info->flags |= WIRELESS_INFO_FLAG_HAS_SIGNAL;
@@ -523,7 +523,7 @@ void print_wireless_info(wireless_info_ctx_t *ctx) {
     /*
      * Removing '%' and following characters from IPv6 since the interface identifier is redundant,
      * as the output already includes the interface name.
-    */
+     */
     if (ipv6_address != NULL) {
         char *prct_ptr = strstr(ipv6_address, "%");
         if (prct_ptr != NULL) {
@@ -601,10 +601,9 @@ void print_wireless_info(wireless_info_ctx_t *ctx) {
         snprintf(string_noise, STRING_SIZE, "?");
     }
 
-    char *tmp = string_essid;
 #ifdef IW_ESSID_MAX_SIZE
     if (info.flags & WIRELESS_INFO_FLAG_HAS_ESSID)
-        maybe_escape_markup(info.essid, &tmp);
+        maybe_escape_markup(info.essid, string_essid, STRING_SIZE);
     else
 #endif
         snprintf(string_essid, STRING_SIZE, "?");