diff --git a/src/profile.c b/src/profile.c
index 6651c9c4c7..589ed52fc5 100644
--- a/src/profile.c
+++ b/src/profile.c
@@ -240,10 +240,12 @@ static void fopenMaybeCompressed(char* name, struct ProfileState* ps)
 {
 #ifdef HAVE_POPEN
   char popen_buf[4096];
-  if(endsWithgz(name) && strlen(name) < 3000)
+  // Need space for "gzip < '", ".gz'" and terminating \0.
+  if(endsWithgz(name) && strlen(name) < sizeof(popen_buf) - 8 - 4 - 1)
   {
-    strcpy(popen_buf, "gzip > ");
-    strcat(popen_buf, name);
+    strxcpy(popen_buf, "gzip > '", sizeof(popen_buf));
+    strxcat(popen_buf, name, sizeof(popen_buf));
+    strxcat(popen_buf, "'", sizeof(popen_buf));
     ps->Stream = popen(popen_buf, "w");
     ps->StreamWasPopened = 1;
     return;
diff --git a/src/sysfiles.c b/src/sysfiles.c
index c8388524bf..c19f59f9ae 100644
--- a/src/sysfiles.c
+++ b/src/sysfiles.c
@@ -828,12 +828,14 @@ Int SyFopen (
 
     /* set up <namegz> and <cmd> for pipe command                          */
     namegz[0] = '\0';
-    if (strlen(name) <= 1018) {
+    // Need space for "gunzip < '", ".gz'" and terminating \0.
+    if (strlen(name) <= sizeof(cmd) - 10 - 4 - 1) {
       strxcpy( namegz, name, sizeof(namegz) );
       strxcat( namegz, ".gz", sizeof(namegz) );
 
-      strxcpy( cmd, "gunzip <", sizeof(cmd) );
+      strxcpy( cmd, "gunzip < '", sizeof(cmd) );
       strxcat( cmd, namegz, sizeof(cmd) );
+      strxcat( cmd, "'", sizeof(cmd) );
     }
     if (strncmp( mode, "r", 1 ) == 0)
       flags = O_RDONLY;