diff --git a/client/pool-buffer.c b/client/pool-buffer.c
index 1f54a77c..52438303 100644
--- a/client/pool-buffer.c
+++ b/client/pool-buffer.c
@@ -1,37 +1,56 @@
 #define _XOPEN_SOURCE 500
 #include <assert.h>
 #include <cairo/cairo.h>
+#include <fcntl.h>
+#include <pango/pangocairo.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
-#include <pango/pangocairo.h>
 #include <unistd.h>
 #include <wayland-client.h>
 #include "config.h"
 #include "pool-buffer.h"
 
+static bool set_cloexec(int fd) {
+	long flags = fcntl(fd, F_GETFD);
+	if (flags == -1) {
+		return false;
+	}
+
+	if (fcntl(fd, F_SETFD, flags | FD_CLOEXEC) == -1) {
+		return false;
+	}
+
+	return true;
+}
+
 static int create_pool_file(size_t size, char **name) {
 	static const char template[] = "sway-client-XXXXXX";
 	const char *path = getenv("XDG_RUNTIME_DIR");
-	if (!path) {
+	if (path == NULL) {
+		fprintf(stderr, "XDG_RUNTIME_DIR is not set\n");
 		return -1;
 	}
 
-	int ts = (path[strlen(path) - 1] == '/');
-
-	*name = malloc(
-		strlen(template) +
-		strlen(path) +
-		(ts ? 0 : 1) + 1);
-	sprintf(*name, "%s%s%s", path, ts ? "" : "/", template);
+	size_t name_size = strlen(template) + 1 + strlen(path) + 1;
+	*name = malloc(name_size);
+	if (*name == NULL) {
+		fprintf(stderr, "allocation failed\n");
+		return -1;
+	}
+	snprintf(*name, name_size, "%s/%s", path, template);
 
 	int fd = mkstemp(*name);
-
 	if (fd < 0) {
 		return -1;
 	}
 
+	if (!set_cloexec(fd)) {
+		close(fd);
+		return -1;
+	}
+
 	if (ftruncate(fd, size) < 0) {
 		close(fd);
 		return -1;
@@ -53,7 +72,7 @@ static struct pool_buffer *create_buffer(struct wl_shm *shm,
 		struct pool_buffer *buf, int32_t width, int32_t height,
 		uint32_t format) {
 	uint32_t stride = width * 4;
-	uint32_t size = stride * height;
+	size_t size = stride * height;
 
 	char *name;
 	int fd = create_pool_file(size, &name);
@@ -68,8 +87,10 @@ static struct pool_buffer *create_buffer(struct wl_shm *shm,
 	free(name);
 	fd = -1;
 
+	buf->size = size;
 	buf->width = width;
 	buf->height = height;
+	buf->data = data;
 	buf->surface = cairo_image_surface_create_for_data(data,
 			CAIRO_FORMAT_ARGB32, width, height, stride);
 	buf->cairo = cairo_create(buf->surface);
@@ -92,6 +113,9 @@ void destroy_buffer(struct pool_buffer *buffer) {
 	if (buffer->pango) {
 		g_object_unref(buffer->pango);
 	}
+	if (buffer->data) {
+		munmap(buffer->data, buffer->size);
+	}
 	memset(buffer, 0, sizeof(struct pool_buffer));
 }
 
diff --git a/include/pool-buffer.h b/include/pool-buffer.h
index 856f7c8c..54f5be06 100644
--- a/include/pool-buffer.h
+++ b/include/pool-buffer.h
@@ -12,6 +12,8 @@ struct pool_buffer {
 	cairo_t *cairo;
 	PangoContext *pango;
 	uint32_t width, height;
+	void *data;
+	size_t size;
 	bool busy;
 };