diff --git a/backend/ibm.c b/backend/ibm.c
index 7b847d9c9..229753d4b 100644
--- a/backend/ibm.c
+++ b/backend/ibm.c
@@ -249,9 +249,9 @@ attach (const char *devnam, Ibm_Device ** devp)
   dev->sane.name = strdup (devnam);
   dev->sane.vendor = "IBM";
   str = malloc (sizeof(ibuf.product) + sizeof(ibuf.revision) + 1);
-  strncpy (str, (char *)ibuf.product, sizeof(ibuf.product));
-  strncpy (str + sizeof(ibuf.product), (char *)ibuf.revision, sizeof(ibuf.revision));
-  str[sizeof(ibuf.product) + sizeof(ibuf.revision)] = '\0';
+  str[0] = '\0';
+  strncat (str, (char *)ibuf.product, sizeof(ibuf.product));
+  strncat (str, (char *)ibuf.revision, sizeof(ibuf.revision));
   dev->sane.model = str;
   dev->sane.type = "flatbed scanner";
 
diff --git a/backend/ricoh.c b/backend/ricoh.c
index 40ab53936..8802e1e93 100644
--- a/backend/ricoh.c
+++ b/backend/ricoh.c
@@ -223,9 +223,9 @@ attach (const char *devnam, Ricoh_Device ** devp)
   dev->sane.name = strdup (devnam);
   dev->sane.vendor = "RICOH";
   str = malloc (sizeof(ibuf.product) + sizeof(ibuf.revision) + 1);
-  strncpy (str, (char *)ibuf.product, sizeof(ibuf.product));
-  strncpy (str + sizeof(ibuf.product), (char *)ibuf.revision, sizeof(ibuf.revision));
-  str[sizeof(ibuf.product) + sizeof(ibuf.revision)] = '\0';
+  str[0] = '\0';
+  strncat (str, (char *)ibuf.product, sizeof(ibuf.product));
+  strncat (str, (char *)ibuf.revision, sizeof(ibuf.revision));
   dev->sane.model = str;
   dev->sane.type = "flatbed scanner";