diff --git a/include/i3status.h b/include/i3status.h
index 1bc2c85f..1c75eaa0 100644
--- a/include/i3status.h
+++ b/include/i3status.h
@@ -204,7 +204,7 @@ void print_separator(const char *separator);
 char *color(const char *colorstr);
 char *endcolor() __attribute__((pure));
 void reset_cursor(void);
-void maybe_escape_markup(char *text, char **buffer);
+char *maybe_escape_markup(char *text);
 
 char *rtrim(const char *s);
 char *ltrim(const char *s);
diff --git a/src/output.c b/src/output.c
index 9a180497..d8c6a25b 100644
--- a/src/output.c
+++ b/src/output.c
@@ -88,39 +88,49 @@ void reset_cursor(void) {
  * https://git.gnome.org/browse/glib/tree/glib/gmarkup.c?id=03db1f455b4265654e237d2ad55464b4113cba8a#n2142
  *
  */
-void maybe_escape_markup(char *text, char **buffer) {
+char *maybe_escape_markup(char *text) {
     if (markup_format == M_NONE) {
-        *buffer += sprintf(*buffer, "%s", text);
-        return;
+        return strdup(text);
     }
+
+    size_t idx = 0;
+    size_t size = 32;
+    char *buffer = malloc(size);
     for (; *text != '\0'; text++) {
+        if (idx + 10 > size) {
+            size *= 2;
+            buffer = realloc(buffer, size);
+        }
         switch (*text) {
             case '&':
-                *buffer += sprintf(*buffer, "%s", "&");
+                idx += sprintf(&buffer[idx], "%s", "&");
                 break;
             case '<':
-                *buffer += sprintf(*buffer, "%s", "&lt;");
+                idx += sprintf(&buffer[idx], "%s", "&lt;");
                 break;
             case '>':
-                *buffer += sprintf(*buffer, "%s", "&gt;");
+                idx += sprintf(&buffer[idx], "%s", "&gt;");
                 break;
             case '\'':
-                *buffer += sprintf(*buffer, "%s", "&apos;");
+                idx += sprintf(&buffer[idx], "%s", "&apos;");
                 break;
             case '"':
-                *buffer += sprintf(*buffer, "%s", "&quot;");
+                idx += sprintf(&buffer[idx], "%s", "&quot;");
                 break;
             default:
                 if ((0x1 <= *text && *text <= 0x8) ||
                     (0xb <= *text && *text <= 0xc) ||
                     (0xe <= *text && *text <= 0x1f)) {
-                    *buffer += sprintf(*buffer, "&#x%x;", *text);
+                    idx += sprintf(&buffer[idx], "&#x%x;", *text);
                 } else {
-                    *(*buffer)++ = *text;
+                    buffer[idx] = *text;
+                    idx++;
                 }
                 break;
         }
     }
+    buffer[idx] = 0;
+    return buffer;
 }
 
 /*
@@ -154,4 +164,4 @@ char *trim(const char *s) {
     char *f = ltrim(r);
     free(r);
     return f;
-}
\ No newline at end of file
+}
diff --git a/src/print_wireless_info.c b/src/print_wireless_info.c
index 7c577f50..cd8f494e 100644
--- a/src/print_wireless_info.c
+++ b/src/print_wireless_info.c
@@ -402,9 +402,9 @@ static int get_wireless_info(const char *interface, wireless_info_t *info) {
     close(s);
     if (na.i_len >= sizeof(u.req)) {
         /*
-	 * Just use the first BSSID returned even if there are
-	 * multiple APs sharing the same BSSID.
-	 */
+         * Just use the first BSSID returned even if there are
+         * multiple APs sharing the same BSSID.
+         */
         info->signal_level = u.req.info[0].isi_rssi / 2 +
                              u.req.info[0].isi_noise;
         info->flags |= WIRELESS_INFO_FLAG_HAS_SIGNAL;
@@ -523,7 +523,7 @@ void print_wireless_info(wireless_info_ctx_t *ctx) {
     /*
      * Removing '%' and following characters from IPv6 since the interface identifier is redundant,
      * as the output already includes the interface name.
-    */
+     */
     if (ipv6_address != NULL) {
         char *prct_ptr = strstr(ipv6_address, "%");
         if (prct_ptr != NULL) {
@@ -569,7 +569,6 @@ void print_wireless_info(wireless_info_ctx_t *ctx) {
     char string_quality[STRING_SIZE] = {'\0'};
     char string_signal[STRING_SIZE] = {'\0'};
     char string_noise[STRING_SIZE] = {'\0'};
-    char string_essid[STRING_SIZE] = {'\0'};
     char string_frequency[STRING_SIZE] = {'\0'};
     char string_ip[STRING_SIZE] = {'\0'};
     char string_bitrate[STRING_SIZE] = {'\0'};
@@ -601,13 +600,13 @@ void print_wireless_info(wireless_info_ctx_t *ctx) {
         snprintf(string_noise, STRING_SIZE, "?");
     }
 
-    char *tmp = string_essid;
+    char *string_essid_tmp = NULL; /* Dynamic allocation of ESSID */
+    char *string_essid = "?";
 #ifdef IW_ESSID_MAX_SIZE
-    if (info.flags & WIRELESS_INFO_FLAG_HAS_ESSID)
-        maybe_escape_markup(info.essid, &tmp);
-    else
+    if (info.flags & WIRELESS_INFO_FLAG_HAS_ESSID) {
+        string_essid = string_essid_tmp = maybe_escape_markup(info.essid);
+    }
 #endif
-        snprintf(string_essid, STRING_SIZE, "?");
 
     if (info.flags & WIRELESS_INFO_FLAG_HAS_FREQUENCY)
         snprintf(string_frequency, STRING_SIZE, "%1.1f GHz", info.frequency / 1e9);
@@ -633,6 +632,7 @@ void print_wireless_info(wireless_info_ctx_t *ctx) {
     char *formatted = format_placeholders(walk, &placeholders[0], num);
     OUTPUT_FORMATTED;
     free(formatted);
+    free(string_essid_tmp);
 
     END_COLOR;
     free(ipv4_address);