diff --git a/fish/display.c b/fish/display.c
index b820725d7..4fa812374 100644
--- a/fish/display.c
+++ b/fish/display.c
@@ -33,7 +33,7 @@
 int
 run_display (const char *cmd, size_t argc, char *argv[])
 {
-  TMP_TEMPLATE_ON_STACK (g, filename);
+  CLEANUP_FREE char *tmpdir = guestfs_get_tmpdir (g), *filename = NULL;
   char *remote;
   const char *display;
   char buf[256];
@@ -57,6 +57,12 @@ run_display (const char *cmd, size_t argc, char *argv[])
     return -1;
 
   /* Download the file and write it to a temporary. */
+  if (asprintf (&filename, "%s/guestfishXXXXXX", tmpdir) == -1) {
+    perror ("asprintf");
+    free (remote);
+    return -1;
+  }
+
   fd = mkstemp (filename);
   if (fd == -1) {
     perror ("mkstemp");
diff --git a/fish/edit.c b/fish/edit.c
index 5793054cf..217ec1e12 100644
--- a/fish/edit.c
+++ b/fish/edit.c
@@ -39,7 +39,7 @@ static int copy_attributes (const char *src, const char *dest);
 int
 run_edit (const char *cmd, size_t argc, char *argv[])
 {
-  TMP_TEMPLATE_ON_STACK (g, filename);
+  CLEANUP_FREE char *tmpdir = guestfs_get_tmpdir (g), *filename = NULL;
   char buf[256];
   const char *editor;
   char *remotefilename, *newname;
@@ -68,6 +68,11 @@ run_edit (const char *cmd, size_t argc, char *argv[])
     goto error0;
 
   /* Download the file and write it to a temporary. */
+  if (asprintf (&filename, "%s/guestfishXXXXXX", tmpdir) == -1) {
+    perror ("asprintf");
+    goto error1;
+  }
+
   fd = mkstemp (filename);
   if (fd == -1) {
     perror ("mkstemp");
diff --git a/fish/fish.c b/fish/fish.c
index bfc08c9cd..9a04a07f4 100644
--- a/fish/fish.c
+++ b/fish/fish.c
@@ -1812,12 +1812,17 @@ file_in (const char *arg)
 static char *
 file_in_heredoc (const char *endmarker)
 {
-  TMP_TEMPLATE_ON_STACK (g, template);
+  CLEANUP_FREE char *tmpdir = guestfs_get_tmpdir (g), *template = NULL;
   int fd;
   size_t markerlen;
   char buffer[BUFSIZ];
   int write_error = 0;
 
+  if (asprintf (&template, "%s/guestfishXXXXXX", tmpdir) == -1) {
+    perror ("asprintf");
+    return NULL;
+  }
+
   file_in_tmpfile = strdup (template);
   if (file_in_tmpfile == NULL) {
     perror ("strdup");
diff --git a/fish/hexedit.c b/fish/hexedit.c
index 88c133f2d..af72ebb5a 100644
--- a/fish/hexedit.c
+++ b/fish/hexedit.c
@@ -101,7 +101,13 @@ run_hexedit (const char *cmd, size_t argc, char *argv[])
   int r;
   struct stat oldstat, newstat;
   char buf[BUFSIZ];
-  TMP_TEMPLATE_ON_STACK (g, tmp);
+
+  CLEANUP_FREE char *tmpdir = guestfs_get_tmpdir (g), *tmp = NULL;
+  if (asprintf (&tmp, "%s/guestfishXXXXXX", tmpdir) == -1) {
+    perror ("asprintf");
+    return -1;
+  }
+
   int fd = mkstemp (tmp);
   if (fd == -1) {
     perror ("mkstemp");
diff --git a/fish/more.c b/fish/more.c
index b7064b2ed..bfcc44ae4 100644
--- a/fish/more.c
+++ b/fish/more.c
@@ -31,7 +31,7 @@
 int
 run_more (const char *cmd, size_t argc, char *argv[])
 {
-  TMP_TEMPLATE_ON_STACK (g, filename);
+  CLEANUP_FREE char *tmpdir = guestfs_get_tmpdir (g), *filename = NULL;
   char buf[256];
   char *remote;
   const char *pager;
@@ -59,6 +59,12 @@ run_more (const char *cmd, size_t argc, char *argv[])
     return -1;
 
   /* Download the file and write it to a temporary. */
+  if (asprintf (&filename, "%s/guestfishXXXXXX", tmpdir) == -1) {
+    perror ("asprintf");
+    free (remote);
+    return -1;
+  }
+
   fd = mkstemp (filename);
   if (fd == -1) {
     perror ("mkstemp");
diff --git a/src/filearch.c b/src/filearch.c
index 3fa4763c2..88fe81368 100644
--- a/src/filearch.c
+++ b/src/filearch.c
@@ -127,13 +127,9 @@ is_regular_file (const char *filename)
 static char *
 cpio_arch (guestfs_h *g, const char *file, const char *path)
 {
-  TMP_TEMPLATE_ON_STACK (g, dir);
-#define dir_len (strlen (dir))
-#define initrd_len (dir_len + 16)
-  char initrd[initrd_len];
+  CLEANUP_FREE char *tmpdir = guestfs_get_tmpdir (g), *dir = NULL;
+  CLEANUP_FREE char *initrd = NULL;
   struct command *cmd = NULL;
-#define bin_len (dir_len + 32)
-  char bin[bin_len];
   char *ret = NULL;
   const char *method;
   int64_t size;
@@ -141,6 +137,11 @@ cpio_arch (guestfs_h *g, const char *file, const char *path)
   const char *bins[] = INITRD_BINARIES2;
   size_t i;
 
+  if (asprintf (&dir, "%s/libguestfsXXXXXX", tmpdir) == -1) {
+    perror ("asprintf");
+    return NULL;
+  }
+
   if (strstr (file, "gzip"))
     method = "zcat";
   else if (strstr (file, "bzip2"))
@@ -161,7 +162,7 @@ cpio_arch (guestfs_h *g, const char *file, const char *path)
     goto out;
   }
 
-  snprintf (initrd, initrd_len, "%s/initrd", dir);
+  initrd = safe_asprintf (g, "%s/initrd", dir);
   if (guestfs_download (g, path, initrd) == -1)
     goto out;
 
@@ -180,7 +181,7 @@ cpio_arch (guestfs_h *g, const char *file, const char *path)
   }
 
   for (i = 0; i < sizeof bins / sizeof bins[0]; ++i) {
-    snprintf (bin, bin_len, "%s/%s", dir, bins[i]);
+    CLEANUP_FREE char *bin = safe_asprintf (g, "%s/%s", dir, bins[i]);
 
     if (is_regular_file (bin)) {
       int flags = g->verbose ? MAGIC_DEBUG : 0;
@@ -223,9 +224,6 @@ cpio_arch (guestfs_h *g, const char *file, const char *path)
   guestfs___recursive_remove_dir (g, dir);
 
   return ret;
-#undef dir_len
-#undef initrd_len
-#undef bin_len
 }
 
 char *
diff --git a/src/guestfs-internal-frontend.h b/src/guestfs-internal-frontend.h
index 3bac56fdf..7d418069a 100644
--- a/src/guestfs-internal-frontend.h
+++ b/src/guestfs-internal-frontend.h
@@ -69,12 +69,6 @@
 #endif
 #endif
 
-#define TMP_TEMPLATE_ON_STACK(g,var)                      \
-  char *ttos_tmpdir = guestfs_get_tmpdir (g);             \
-  char var[strlen (ttos_tmpdir) + 32];                    \
-  sprintf (var, "%s/libguestfsXXXXXX", ttos_tmpdir);      \
-  free (ttos_tmpdir)
-
 /* NB: At some point we will stop exporting these safe_* allocation
  * functions outside the library, so don't use them in new tools or
  * bindings code.
diff --git a/src/tmpdirs.c b/src/tmpdirs.c
index c411cbf72..9554d2294 100644
--- a/src/tmpdirs.c
+++ b/src/tmpdirs.c
@@ -129,10 +129,12 @@ int
 guestfs___lazy_make_tmpdir (guestfs_h *g)
 {
   if (!g->tmpdir) {
-    TMP_TEMPLATE_ON_STACK (g, dir_template);
-    g->tmpdir = safe_strdup (g, dir_template);
+    CLEANUP_FREE char *tmpdir = guestfs_get_tmpdir (g);
+    g->tmpdir = safe_asprintf (g, "%s/libguestfsXXXXXX", tmpdir);
     if (mkdtemp (g->tmpdir) == NULL) {
-      perrorf (g, _("%s: cannot create temporary directory"), dir_template);
+      perrorf (g, _("%s: cannot create temporary directory"), g->tmpdir);
+      free (g->tmpdir);
+      g->tmpdir = NULL;
       return -1;
     }
   }