diff --git a/src/ieee1905/topologyd.c b/src/ieee1905/topologyd.c
index 22da516555fa60ba4503202d6dc9347544aed827..594ab09a069ea1fae9908c05b11996953517d107 100644
--- a/src/ieee1905/topologyd.c
+++ b/src/ieee1905/topologyd.c
@@ -1522,9 +1522,9 @@ void topologyd_dump_node(struct blob_buf *bb, struct node *p, int is_self)
 
 			hwaddr_ntoa(p->l2_nbr[j].behind_intf_addr[k], mac_str);
 			if (k != 0)
-				snprintf(behind_mac_str + len, size, "%s,", behind_mac_str);
+				snprintf(behind_mac_str + len, size - len, "%s,", behind_mac_str);
 
-			snprintf(behind_mac_str + len,  size, "%s", mac_str);
+			snprintf(behind_mac_str + len,  size - len, "%s", mac_str);
 		}
 		blobmsg_add_string(bb, "behind_mac_id", behind_mac_str);
 		blobmsg_close_table(bb, table);