diff --git a/client/pool-buffer.c b/client/pool-buffer.c
index 1f54a77cd..7610d2235 100644
--- a/client/pool-buffer.c
+++ b/client/pool-buffer.c
@@ -1,37 +1,56 @@
 #define _XOPEN_SOURCE 500
 #include <assert.h>
 #include <cairo/cairo.h>
+#include <fcntl.h>
+#include <pango/pangocairo.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
-#include <pango/pangocairo.h>
 #include <unistd.h>
 #include <wayland-client.h>
 #include "config.h"
 #include "pool-buffer.h"
 
+static bool set_cloexec(int fd) {
+	long flags = fcntl(fd, F_GETFD);
+	if (flags == -1) {
+		return false;
+	}
+
+	if (fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) {
+		return false;
+	}
+
+	return true;
+}
+
 static int create_pool_file(size_t size, char **name) {
 	static const char template[] = "sway-client-XXXXXX";
 	const char *path = getenv("XDG_RUNTIME_DIR");
-	if (!path) {
+	if (path == NULL) {
+		fprintf(stderr, "XDG_RUNTIME_DIR is not set\n");
 		return -1;
 	}
 
-	int ts = (path[strlen(path) - 1] == '/');
-
-	*name = malloc(
-		strlen(template) +
-		strlen(path) +
-		(ts ? 0 : 1) + 1);
-	sprintf(*name, "%s%s%s", path, ts ? "" : "/", template);
+	size_t name_size = strlen(template) + 1 + strlen(path) + 1;
+	*name = malloc(name_size);
+	if (*name == NULL) {
+		fprintf(stderr, "allocation failed\n");
+		return -1;
+	}
+	snprintf(*name, name_size, "%s/%s", path, template);
 
 	int fd = mkstemp(*name);
-
 	if (fd < 0) {
 		return -1;
 	}
 
+	if (!set_cloexec(fd)) {
+		close(fd);
+		return -1;
+	}
+
 	if (ftruncate(fd, size) < 0) {
 		close(fd);
 		return -1;