diff --git a/test/cmactest.c b/test/cmactest.c
index 4360e35e44a0b..a550d4edecd1b 100644
--- a/test/cmactest.c
+++ b/test/cmactest.c
@@ -327,13 +327,15 @@ static int test_cmac_copy(void)
     return ret;
 }
 
+#define OSSL_HEX_CHARS_PER_BYTE 2
 static char *pt(unsigned char *md, unsigned int len)
 {
     unsigned int i;
-    static char buf[80];
+    static char buf[81];
 
-    for (i = 0; i < len; i++)
-        BIO_snprintf(&(buf[i * 2]), sizeof(buf), "%02x", md[i]);
+    for (i = 0; i < len && (i + 1) * OSSL_HEX_CHARS_PER_BYTE < sizeof(buf); i++)
+        BIO_snprintf(buf + i * OSSL_HEX_CHARS_PER_BYTE,
+                     OSSL_HEX_CHARS_PER_BYTE + 1, "%02x", md[i]);
     return buf;
 }
 
diff --git a/test/hmactest.c b/test/hmactest.c
index 857da999f0dd3..28aba7f6309ac 100644
--- a/test/hmactest.c
+++ b/test/hmactest.c
@@ -275,19 +275,21 @@ static int test_hmac_copy_uninited(void)
     return res;
 }
 
-# ifndef OPENSSL_NO_MD5
+#ifndef OPENSSL_NO_MD5
+# define OSSL_HEX_CHARS_PER_BYTE 2
 static char *pt(unsigned char *md, unsigned int len)
 {
     unsigned int i;
-    static char buf[200];
+    static char buf[201];
 
     if (md == NULL)
         return NULL;
-    for (i = 0; i < len; i++)
-        BIO_snprintf(&(buf[i * 2]), sizeof(buf), "%02x", md[i]);
+    for (i = 0; i < len && (i + 1) * OSSL_HEX_CHARS_PER_BYTE < sizeof(buf); i++)
+        BIO_snprintf(buf + i * OSSL_HEX_CHARS_PER_BYTE,
+                     OSSL_HEX_CHARS_PER_BYTE + 1, "%02x", md[i]);
     return buf;
 }
-# endif
+#endif
 
 static struct test_chunks_st {
     const char *md_name;