diff --git a/ChangeLog b/ChangeLog
index 4f65f083..57078695 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,9 @@ CVS code -
 	- Since the field precision operator used in the sprintf() uses
 	  ints and not size_t's, replace it with two strncpy()s, which
 	  use size_t's. (DLR)
+	- If the tab-completed path is a directory, make sure enough
+	  space is allocated before tacking a slash onto the end of it.
+	  (DLR)
 - help.c:
   parse_help_input()
 	- Add 'E' and 'e' as aliases for Exit, for consistency with the
diff --git a/src/files.c b/src/files.c
index 5e7f41f6..bfc11ad7 100644
--- a/src/files.c
+++ b/src/files.c
@@ -2240,18 +2240,19 @@ char *input_tab(char *buf, bool allow_files, size_t *place, bool
 
 	mzero = charalloc(lastslash_len + common_len + 1);
 
-	/*sprintf(mzero, "%.*s%.*s", lastslash_len, buf, common_len,
-		matches[0]);*/
 	strncpy(mzero, buf, lastslash_len);
 	strncpy(mzero + lastslash_len, matches[0], common_len);
 
 	common_len += lastslash_len;
+	mzero[common_len] = '\0';
 
 	assert(common_len >= *place);
 
 	if (num_matches == 1 && is_dir(mzero)) {
-	    mzero[common_len] = '/';
 	    common_len++;
+	    mzero = charealloc(mzero, common_len + 1);
+	    mzero[common_len - 1] = '/';
+	    mzero[common_len] = '\0';
 
 	    assert(common_len > *place);
 	}