diff --git a/src/config.c b/src/config.c
index 4c1394ff3..e1dacb32b 100644
--- a/src/config.c
+++ b/src/config.c
@@ -1060,7 +1060,7 @@ load_image_file(char *dest, char *p, uint8_t *ui_wp)
                      p + strlen("<exe_path>/"));
     } else if (memcmp(p, "../../", strlen("../../")) == 0) {
         use = (above2 == NULL) ? usr_path : above2;
-        if ((strlen(prefix) + strlen(use) + strlen(path_get_slash(use)) + strlen(p + strlen("../"))) >
+        if ((strlen(prefix) + strlen(use) + strlen(path_get_slash(use)) + strlen(p + strlen("../../"))) >
             (MAX_IMAGE_PATH_LEN - 11))
             ret = 1;
         else
@@ -1086,6 +1086,9 @@ load_image_file(char *dest, char *p, uint8_t *ui_wp)
 
     path_normalize(dest);
 
+    if (above2 != NULL)
+        free(above2);
+
     if (above != NULL)
         free(above);
 
@@ -3193,7 +3196,7 @@ save_image_file(char *cat, char *var, char *src)
     else if (!strnicmp(src, usr_path, strlen(usr_path)))
         sprintf(temp, "%s%s", prefix, &src[strlen(usr_path)]);
     /* Do not relativize to root. */
-    else if ((above2 != NULL) && (above3 != NULL) && !strnicmp(src, above, strlen(above2)))
+    else if ((above2 != NULL) && (above3 != NULL) && !strnicmp(src, above2, strlen(above2)))
         sprintf(temp, "../../%s%s", prefix, &src[strlen(above2)]);
     /* Do not relativize to root. */
     else if ((above != NULL) && (above2 != NULL) && !strnicmp(src, above, strlen(above)))
@@ -3205,6 +3208,12 @@ save_image_file(char *cat, char *var, char *src)
 
     ini_section_set_string(cat, var, temp);
 
+    if (above3 != NULL)
+        free(above3);
+
+    if (above2 != NULL)
+        free(above2);
+
     if (above != NULL)
         free(above);
 }