2 files changed, 11 insertions, 4 deletions

diff --git a/src/Protocol/Protocol17x.cpp b/src/Protocol/Protocol17x.cpp
index 1e5fe5586..1e33ec433 100644
--- a/src/Protocol/Protocol17x.cpp
+++ b/src/Protocol/Protocol17x.cpp
@@ -1524,7 +1524,7 @@ void cProtocol172::AddReceivedData(const char * a_Data, size_t a_Size)
 			AString PacketData;
 			bb.ReadAll(PacketData);
 			bb.ResetRead();
-			bb.ReadVarInt(PacketType);
+			bb.ReadVarInt(PacketType);  // We have already read the packet type once, it will be there again.
 			ASSERT(PacketData.size() > 0);  // We have written an extra NUL, so there had to be at least one byte read
 			PacketData.resize(PacketData.size() - 1);
 			AString PacketDataHex;
@@ -1753,7 +1753,10 @@ void cProtocol172::HandlePacketLoginEncryptionResponse(cByteBuffer & a_ByteBuffe
 	{
 		return;
 	}
-	a_ByteBuffer.ReadBEShort(EncNonceLength);
+	if (!a_ByteBuffer.ReadBEShort(EncNonceLength))
+	{
+		return;
+	}
 	AString EncNonce;
 	if (!a_ByteBuffer.ReadString(EncNonce, EncNonceLength))
 	{
diff --git a/src/Protocol/Protocol18x.cpp b/src/Protocol/Protocol18x.cpp
index ce580d73e..1a13f4f7c 100644
--- a/src/Protocol/Protocol18x.cpp
+++ b/src/Protocol/Protocol18x.cpp
@@ -1723,7 +1723,11 @@ void cProtocol180::AddReceivedData(const char * a_Data, size_t a_Size)
 			{
 				// Decompress the data:
 				AString CompressedData;
-				m_ReceivedData.ReadString(CompressedData, CompressedSize);
+				if (!m_ReceivedData.ReadString(CompressedData, CompressedSize))
+				{
+					m_Client->Kick("Compression failure");
+					return;
+				}
 				InflateString(CompressedData.data(), CompressedSize, UncompressedData);
 				PacketLen = UncompressedData.size();
 			}
@@ -1765,7 +1769,7 @@ void cProtocol180::AddReceivedData(const char * a_Data, size_t a_Size)
 			AString PacketData;
 			bb.ReadAll(PacketData);
 			bb.ResetRead();
-			bb.ReadVarInt(PacketType);
+			bb.ReadVarInt(PacketType);  // We have already read the packet type once, it will be there again
 			ASSERT(PacketData.size() > 0);  // We have written an extra NUL, so there had to be at least one byte read
 			PacketData.resize(PacketData.size() - 1);
 			AString PacketDataHex;