diff --git a/core/systems/CFunction.cpp b/core/systems/CFunction.cpp
index e032f8ba..5acfa907 100644
--- a/core/systems/CFunction.cpp
+++ b/core/systems/CFunction.cpp
@@ -130,7 +130,7 @@ int CFunction::_PushString(const char *string, int flags)
 	IPluginContext *base = m_pPlugin->m_ctx_current.base;
 	ParamInfo *info = &m_info[m_curparam];
 	size_t len = strlen(string);
-	size_t cells = (len + sizeof(cell_t) - 1) / sizeof(cell_t);
+	size_t cells = (len + sizeof(cell_t)) / sizeof(cell_t);
 	int err;
 
 	if ((err=base->HeapAlloc(cells, &info->local_addr, &info->phys_addr)) != SP_ERROR_NONE)
@@ -142,7 +142,7 @@ int CFunction::_PushString(const char *string, int flags)
 	m_params[m_curparam] = info->local_addr;
 	m_curparam++;	/* Prevent a leak */
 
-	if ((err=base->StringToLocalUTF8(info->local_addr, len, string, NULL)) != SP_ERROR_NONE)
+	if ((err=base->StringToLocalUTF8(info->local_addr, len+1, string, NULL)) != SP_ERROR_NONE)
 	{
 		return SetError(err);
 	}
diff --git a/core/systems/ForwardSys.cpp b/core/systems/ForwardSys.cpp
index c1dd84a5..30fcc56f 100644
--- a/core/systems/ForwardSys.cpp
+++ b/core/systems/ForwardSys.cpp
@@ -17,7 +17,7 @@ CForwardManager g_Forwards;
  * X Push floats
  * X Push floats byref (copyback tested = yes)
  * X Push arrays  (copyback tested = yes)
- * - Push strings (copyback tested = ??)
+ * X Push strings (copyback tested = yes)
  * VARARG FUNCTIONS:
  * - Pushing no varargs
  * - Push vararg cells (copyback should be verified to not happen = ??)
@@ -453,7 +453,7 @@ int CForward::PushString(const char *string)
 		if (m_types[m_curparam] == Param_Any)
 		{
 			m_params[m_curparam].pushedas = Param_String;
-		} else if (m_types[m_curparam] == Param_String) {
+		} else if (m_types[m_curparam] != Param_String) {
 			return SetError(SP_ERROR_PARAM);
 		}
 	} else {
@@ -477,7 +477,7 @@ int CForward::PushStringEx(char *string, int flags)
 		if (m_types[m_curparam] == Param_Any)
 		{
 			m_params[m_curparam].pushedas = Param_String;
-		} else if (m_types[m_curparam] == Param_String) {
+		} else if (m_types[m_curparam] != Param_String) {
 			return SetError(SP_ERROR_PARAM);
 		}
 	} else {