diff --git a/ChangeLog.adoc b/ChangeLog.adoc
index 458d30184..172b9e891 100644
--- a/ChangeLog.adoc
+++ b/ChangeLog.adoc
@@ -18,7 +18,13 @@ https://weechat.org/files/releasenotes/ReleaseNotes-devel.html[release notes]
 [[v2.7]]
 == Version 2.7 (under dev)
 
+Bug fixes::
+
+  * core: fixed segfault during excessive evaluation in function string_repeat (issue #1400)
+  * buflist: fix extra spaces between buffers when conditions are used to hide buffers (regression introduced in version 2.6) (issue #1403)
+
 Build::
+
   * core: remove file FindTCL.cmake
   * core: display an error on missing dependency in CMake (issue #916, issue #956)
 
diff --git a/doc/de/autogen/user/weechat_options.adoc b/doc/de/autogen/user/weechat_options.adoc
index aa86de834..d5d7da7dc 100644
--- a/doc/de/autogen/user/weechat_options.adoc
+++ b/doc/de/autogen/user/weechat_options.adoc
@@ -915,7 +915,7 @@
 ** Standardwert: `+100+`
 
 * [[option_weechat.look.nick_color_force]] *weechat.look.nick_color_force*
-** Beschreibung: pass:none[force color for some nicks: hash computed with nickname to find color will not be used for these nicks (format is: "nick1:color1;nick2:color2"); look up for nicks is with exact case then lower case, so it's possible to use only lower case for nicks in this option; color can include background with the format "text,background", for example "yellow,red"]
+** Beschreibung: pass:none[erzwingt für einen Nick eine spezielle Farbe. Die standardmäßig, mittels Streuwertfunktion aus dem Nicknamen, generierte Farbe findet für diese Nicks keine Anwendung (Format:"Nick1:Farbe1;Nick2:Farbe2"). Zuerst wird beim Namen des Nick nach Groß- und Kleinschreibung unterschieden. Sollte der Nick nicht gefunden werden findet keine Unterscheidung mehr statt. Somit ist es möglich die Nicks, für diese Einstellung, ausschließlich in Kleinschrift aufzuführen; die Farbauswahl kann auch eine Hintergrundfarbe beinhalten "Textfarbe,Hintergrundfarbe", zum Beispiel "yellow,red"]
 ** Typ: Zeichenkette
 ** Werte: beliebige Zeichenkette
 ** Standardwert: `+""+`
diff --git a/src/core/wee-string.c b/src/core/wee-string.c
index 19a25b28b..5025958a1 100644
--- a/src/core/wee-string.c
+++ b/src/core/wee-string.c
@@ -26,6 +26,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #include <errno.h>
+#include <limits.h>
 #include <stdarg.h>
 #include <string.h>
 #include <ctype.h>
@@ -224,6 +225,10 @@ string_repeat (const char *string, int count)
         return strdup (string);
 
     length_string = strlen (string);
+
+    if (count >= INT_MAX / length_string)
+        return NULL;
+
     length_result = (length_string * count) + 1;
     result = malloc (length_result);
     if (!result)
diff --git a/src/plugins/buflist/buflist-bar-item.c b/src/plugins/buflist/buflist-bar-item.c
index c3f108507..fc4a6f8ff 100644
--- a/src/plugins/buflist/buflist-bar-item.c
+++ b/src/plugins/buflist/buflist-bar-item.c
@@ -359,13 +359,6 @@ buflist_bar_item_buflist_cb (const void *pointer, void *data,
                                              ptr_buffer, "name");
         }
 
-        if (weechat_config_boolean (buflist_config_look_add_newline)
-            && *buflist[0])
-        {
-            if (!weechat_string_dyn_concat (buflist, "\n"))
-                goto error;
-        }
-
         /* current buffer */
         current_buffer = (ptr_buffer == ptr_current_buffer);
         weechat_hashtable_set (buflist_hashtable_extra_vars,
@@ -588,6 +581,14 @@ buflist_bar_item_buflist_cb (const void *pointer, void *data,
             line_number_current_buffer = line_number;
         prev_number = number;
 
+        /* add newline between each buffer (if needed) */
+        if (weechat_config_boolean (buflist_config_look_add_newline)
+            && *buflist[0])
+        {
+            if (!weechat_string_dyn_concat (buflist, "\n"))
+                goto error;
+        }
+
         /* build string */
         line = weechat_string_eval_expression (
             (current_buffer) ? ptr_format_current : ptr_format,
diff --git a/tests/unit/core/test-core-string.cpp b/tests/unit/core/test-core-string.cpp
index 11ec19b4d..a1dda1af2 100644
--- a/tests/unit/core/test-core-string.cpp
+++ b/tests/unit/core/test-core-string.cpp
@@ -26,6 +26,7 @@ extern "C"
 #ifndef HAVE_CONFIG_H
 #define HAVE_CONFIG_H
 #endif
+#include <limits.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
@@ -300,6 +301,8 @@ TEST(CoreString, Reverse)
 TEST(CoreString, Repeat)
 {
     POINTERS_EQUAL(NULL, string_repeat (NULL, 1));
+    POINTERS_EQUAL(NULL, string_repeat ("----", INT_MAX / 4));
+
     STRCMP_EQUAL("", string_repeat ("", 1));
 
     STRCMP_EQUAL("", string_repeat ("x", -1));