diff --git a/lib/core-net/client/conmon.c b/lib/core-net/client/conmon.c
index 68fc761f1..22d1b53e3 100644
--- a/lib/core-net/client/conmon.c
+++ b/lib/core-net/client/conmon.c
@@ -95,7 +95,7 @@ lws_conmon_append_copy_new_dns_results(struct lws *wsi,
 			size_t cl = cai->ai_canonname ?
 					strlen(cai->ai_canonname) + 1 : 0;
 
-			ai = lws_malloc(al + cl, __func__);
+			ai = lws_malloc(al + cl + 1, __func__);
 			if (!ai) {
 				lwsl_warn("%s: OOM\n", __func__);
 				return 1;
diff --git a/lib/system/async-dns/async-dns-parse.c b/lib/system/async-dns/async-dns-parse.c
index cc9693ab6..17e95aa20 100644
--- a/lib/system/async-dns/async-dns-parse.c
+++ b/lib/system/async-dns/async-dns-parse.c
@@ -603,7 +603,7 @@ lws_adns_parse_udp(lws_async_dns_t *dns, const uint8_t *pkt, size_t len)
 
 	lwsl_info("%s: create cache entry for %s, %zu\n", __func__, nm,
 			est - sizeof(lws_adns_cache_t));
-	c = lws_malloc(est, "async-dns-entry");
+	c = lws_malloc(est + 1, "async-dns-entry");
 	if (!c) {
 		lwsl_err("%s: OOM %zu\n", __func__, est);
 		goto fail_out;