diff --git a/src/d_main.c b/src/d_main.c
index 9891236e6..ac454f6cb 100644
--- a/src/d_main.c
+++ b/src/d_main.c
@@ -139,6 +139,7 @@ char srb2path[256] = ".";
 boolean usehome = true;
 const char *pandf = "%s" PATHSEP "%s";
 char addonsdir[MAX_WADPATH];
+char downloaddir[sizeof addonsdir + sizeof DOWNLOADDIR_PART] = "DOWNLOAD";
 
 //
 // EVENT HANDLING
@@ -1361,7 +1362,7 @@ void D_SRB2Main(void)
 
 	/* and downloads in a subdirectory */
 	snprintf(downloaddir, sizeof downloaddir, "%s%s%s",
-			addonsdir, PATHSEP, "downloads");
+			addonsdir, PATHSEP, DOWNLOADDIR_PART);
 
 	// rand() needs seeded regardless of password
 	srand((unsigned int)time(NULL));
diff --git a/src/d_netfil.c b/src/d_netfil.c
index 64b605d12..5238f7028 100644
--- a/src/d_netfil.c
+++ b/src/d_netfil.c
@@ -99,7 +99,6 @@ static filetran_t transfer[MAXNETNODES];
 INT32 fileneedednum; // Number of files needed to join the server
 fileneeded_t fileneeded[MAX_WADFILES]; // List of needed files
 static tic_t lasttimeackpacketsent = 0;
-char downloaddir[512] = "DOWNLOAD";
 
 // For resuming failed downloads
 typedef struct
diff --git a/src/d_netfil.h b/src/d_netfil.h
index 904c1862a..26bffbc18 100644
--- a/src/d_netfil.h
+++ b/src/d_netfil.h
@@ -62,7 +62,8 @@ struct fileneeded_t
 
 extern INT32 fileneedednum;
 extern fileneeded_t fileneeded[MAX_WADFILES];
-extern char downloaddir[512];
+#define DOWNLOADDIR_PART "downloads"
+extern char downloaddir[];
 
 extern INT32 lastfilenum;
 extern INT32 downloadcompletednum;
diff --git a/src/g_demo.h b/src/g_demo.h
index 17ea331cf..a8c3f573c 100644
--- a/src/g_demo.h
+++ b/src/g_demo.h
@@ -80,7 +80,7 @@ typedef enum {
 } menudemotype_e;
 
 struct menudemo_t {
-	char filepath[256];
+	char filepath[1023 + 256]; // see M_PrepReplayList and sizeof menupath
 	menudemotype_e type;
 
 	char title[65]; // Null-terminated for string prints
diff --git a/src/k_menufunc.c b/src/k_menufunc.c
index c0f19e497..321dfcb31 100644
--- a/src/k_menufunc.c
+++ b/src/k_menufunc.c
@@ -6636,7 +6636,9 @@ void M_PrepReplayList(void)
 		else
 		{
 			extrasmenu.demolist[i].type = MD_NOTLOADED;
-			snprintf(extrasmenu.demolist[i].filepath, 255, "%s%s", menupath, dirmenu[i] + DIR_STRING);
+			snprintf(extrasmenu.demolist[i].filepath, sizeof extrasmenu.demolist[i].filepath,
+					// 255 = UINT8 limit. dirmenu entries are restricted to this length (see DIR_LEN).
+					"%s%.255s", menupath, dirmenu[i] + DIR_STRING);
 			sprintf(extrasmenu.demolist[i].title, ".....");
 		}
 	}