diff --git a/src/config/parse_config.h b/src/config/parse_config.h
index a5f2391b..0ce6d1ea 100644
--- a/src/config/parse_config.h
+++ b/src/config/parse_config.h
@@ -607,10 +607,13 @@ static char *combine_args_until_empty(char *values[], int count) {
 		}
 		if (remaining > 1) {
 			size_t val_len = strlen(values[i]);
+			// Always leave space for null terminator
 			size_t to_copy = (val_len < remaining - 1) ? val_len : remaining - 1;
-			memcpy(ptr, values[i], to_copy);
-			ptr += to_copy;
-			remaining -= to_copy;
+			if (to_copy > 0) {
+				memcpy(ptr, values[i], to_copy);
+				ptr += to_copy;
+				remaining -= to_copy;
+			}
 		}
 	}
 	*ptr = '\0'; // Null terminate
@@ -648,6 +651,7 @@ uint32_t parse_mod(const char *mod_str) {
 			char *endptr;
 			errno = 0;
 			long keycode = strtol(token + 5, &endptr, 10);
+			// Check for conversion errors: overflow or no conversion
 			if (endptr != token + 5 && (*endptr == '\0' || *endptr == ' ') && errno != ERANGE) {
 				switch (keycode) {
 				case 133:
diff --git a/src/dispatch/bind_define.h b/src/dispatch/bind_define.h
index 7a24417b..c54f9a53 100644
--- a/src/dispatch/bind_define.h
+++ b/src/dispatch/bind_define.h
@@ -865,7 +865,7 @@ int32_t spawn(const Arg *arg) {
 		// 4. execvp 失败时：清理并退出
 		// If execvp succeeds, this code never runs (process replaced)
 		// If it fails, clean up allocated strings before exiting
-		for (int i = 0; i < alloc_count; i++) {
+		for (int32_t i = 0; i < alloc_count; i++) {
 			free(allocated_strings[i]);
 		}
 		wlr_log(WLR_ERROR, "mango: execvp '%s' failed: %s\n", argv[0],