diff --git a/src/kits/interface/TextInput.cpp b/src/kits/interface/TextInput.cpp
index 30c5e6d510..f1bbd6f1e3 100644
--- a/src/kits/interface/TextInput.cpp
+++ b/src/kits/interface/TextInput.cpp
@@ -207,10 +207,10 @@ _BTextInput_::InsertText(const char* inText, int32 inLength,
 	char* buffer = NULL;
 
 	if (strpbrk(inText, "\r\n") && inLength <= 1024) {
-		buffer = (char*)malloc(inLength);
+		buffer = (char*)malloc(inLength + 1);
 
 		if (buffer) {
-			strcpy(buffer, inText);
+			strlcpy(buffer, inText, inLength);
 
 			for (int32 i = 0; i < inLength; i++) {
 				if (buffer[i] == '\r' || buffer[i] == '\n')