diff --git a/ChangeLog b/ChangeLog
index b4e3ef12..5837472b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -60,6 +60,8 @@ CVS Code -
 	  mode on. (DLR; found by David Benbennick)
   save_history()
 	- Fix nrealloc return value being ignored (David Benbennick).
+	- Fix off-by-one bug causing write to unallocated memory 
+	  (David Benbennick).
 - global.c:
   thanks_for_all_the_fish()
 	- Fix compiling with DEBUG and multibuffer (David Benbennick).
diff --git a/files.c b/files.c
index b2d14ea7..1ea9bb4b 100644
--- a/files.c
+++ b/files.c
@@ -2932,7 +2932,7 @@ void save_history(void)
 	    chmod(nanohist, S_IRUSR | S_IWUSR);
 	    /* write oldest first */
 	    for (h = search_history.tail ; h->prev ; h = h->prev) {
-		h->data = nrealloc(h->data, strlen(h->data) + 1);
+		h->data = nrealloc(h->data, strlen(h->data) + 2);
 		strcat(h->data, "\n");
 		if (fputs(h->data, hist) == EOF) {
 		    rcfile_msg(_("Unable to write ~/.nano_history file, %s"), strerror(errno));
@@ -2944,7 +2944,7 @@ void save_history(void)
 		    goto come_from;
 	    }
 	    for (h = replace_history.tail ; h->prev ; h = h->prev) {
-		h->data = nrealloc(h->data, strlen(h->data) + 1);
+		h->data = nrealloc(h->data, strlen(h->data) + 2);
 		strcat(h->data, "\n");
 		if (fputs(h->data, hist) == EOF) {
 		    rcfile_msg(_("Unable to write ~/.nano_history file, %s"), strerror(errno));