diff --git a/src/files.c b/src/files.c
index 392708a..5fa538c 100644
--- a/src/files.c
+++ b/src/files.c
@@ -701,10 +701,10 @@ int do_upload(struct user_record *user, char *final_path) {
 		}
 	}
 }
+
 void upload(struct user_record *user) {
-	char buffer[331];
-	char buffer2[66];
-	char buffer3[256];
+	stralloc buffer = EMPTY_STRALLOC;
+	char pathname[PATH_MAX];
 
 	int i;
 	char *create_sql = "CREATE TABLE IF NOT EXISTS files ("
@@ -735,25 +735,27 @@ void upload(struct user_record *user) {
 	description = get_file_id_diz(upload_filename);
 
 	if (description == NULL) {
+		char descbuf[66];
+
 		s_printf(get_string(199));
 		s_printf(get_string(200));
-		buffer[0] = '\0';
 		for (i = 0; i < 5; i++) {
 			s_printf("\r\n%d: ", i);
-			s_readstring(buffer2, 65);
-			if (strlen(buffer2) == 0) {
+			s_readstring(descbuf, sizeof(descbuf) - 1);
+			if (*descbuf == '\0') {
 				break;
 			}
-			strcat(buffer, buffer2);
-			strcat(buffer, "\n");
+			stralloc_cats(&buffer, descbuf);
+			stralloc_append1(&buffer, '\n');
 		}
-
+		stralloc_0(&buffer);
 	} else {
 		s_printf(get_string(201));
 	}
-	sprintf(buffer3, "%s/%s.sq3", conf.bbs_path, conf.file_directories[user->cur_file_dir]->file_subs[user->cur_file_sub]->database);
+	snprintf(pathname, sizeof pathname, "%s/%s.sq3",
+	         conf.bbs_path, conf.file_directories[user->cur_file_dir]->file_subs[user->cur_file_sub]->database);
 
-	rc = sqlite3_open(buffer3, &db);
+	rc = sqlite3_open(pathname, &db);
 
 	if (rc != SQLITE_OK) {
 		dolog("Cannot open database: %s", sqlite3_errmsg(db));
@@ -766,9 +768,8 @@ void upload(struct user_record *user) {
 		dolog("SQL error: %s", err_msg);
 		sqlite3_free(err_msg);
 		sqlite3_close(db);
-		if (description != NULL) {
-			free(description);
-		}
+		free(description);
+		free(buffer.s);
 		return;
 	}
 	rc = sqlite3_prepare_v2(db, sql, -1, &res, 0);
@@ -778,7 +779,7 @@ void upload(struct user_record *user) {
 
 		sqlite3_bind_text(res, 1, upload_filename, -1, 0);
 		if (description == NULL) {
-			sqlite3_bind_text(res, 2, buffer, -1, 0);
+			sqlite3_bind_text(res, 2, buffer.s, -1, 0);
 		} else {
 			sqlite3_bind_text(res, 2, description, -1, 0);
 		}
@@ -789,9 +790,8 @@ void upload(struct user_record *user) {
 		dolog("Failed to execute statement: %s", sqlite3_errmsg(db));
 		sqlite3_finalize(res);
 		sqlite3_close(db);
-		if (description != NULL) {
-			free(description);
-		}
+		free(description);
+		free(buffer.s);
 		return;
 	}
 
@@ -801,16 +801,14 @@ void upload(struct user_record *user) {
 		dolog("execution failed: %s", sqlite3_errmsg(db));
 		sqlite3_finalize(res);
 		sqlite3_close(db);
-		if (description != NULL) {
-			free(description);
-		}
+		free(description);
+		free(buffer.s);
 		return;
 	}
 	sqlite3_finalize(res);
 	sqlite3_close(db);
-	if (description != NULL) {
-		free(description);
-	}
+	free(description);
+	free(buffer.s);
 
 	s_printf(get_string(202));
 	s_printf(get_string(6));
diff --git a/src/lua_glue.c b/src/lua_glue.c
index 2e7655f..16183c2 100644
--- a/src/lua_glue.c
+++ b/src/lua_glue.c
@@ -395,7 +395,6 @@ int l_postMessage(lua_State *L) {
 	int z;
 	int j;
 	int i;
-	char *msg;
 	char *tagline;
 	struct utsname name;
 
@@ -514,21 +513,16 @@ int l_postMessage(lua_State *L) {
 		snprintf(buffer, 256, "\r--- MagickaBBS v%d.%d%s (%s/%s)\r * Origin: %s \r", VERSION_MAJOR, VERSION_MINOR, VERSION_STR, name.sysname, name.machine, tagline);
 	}
 
-	msg = (char *)malloz(strlen(body) + 2 + strlen(buffer));
+	stralloc sa = EMPTY_STRALLOC;
+	stralloc_ready(&sa, strlen(body) + 2 + strlen(buffer));
+	for (char *p = body; *p != '\0'; ++p)
+		if (*p != '\n')
+			stralloc_append1(&sa, *p);
+	stralloc_cats(&sa, buffer);
+	stralloc_0(&sa);
+	char *msg = sa.s;
 
-	j = 0;
-
-	for (i = 0; i < strlen(body); i++) {
-		if (body[i] == '\n') {
-			continue;
-		}
-		msg[j++] = body[i];
-	}
-	msg[j] = '\0';
-
-	strcat(msg, buffer);
-
-	if (JAM_AddMessage(jb, &jmh, jsp, (char *)msg, strlen(msg))) {
+	if (JAM_AddMessage(jb, &jmh, jsp, msg, strlen(msg))) {
 		dolog("Failed to add message");
 		JAM_UnlockMB(jb);
 
@@ -536,13 +530,12 @@ int l_postMessage(lua_State *L) {
 		JAM_CloseMB(jb);
 		free(msg);
 		return 0;
-	} else {
-		JAM_UnlockMB(jb);
-
-		JAM_DelSubPacket(jsp);
-		JAM_CloseMB(jb);
-		free(jb);
 	}
+	JAM_UnlockMB(jb);
+
+	JAM_DelSubPacket(jsp);
+	JAM_CloseMB(jb);
+	free(jb);
 	free(msg);
 
 	if (conf.mail_conferences[confr]->mail_areas[area]->type == TYPE_ECHOMAIL_AREA || conf.mail_conferences[confr]->mail_areas[area]->type == TYPE_NEWSGROUP_AREA) {