Index: pjproject/trunk/pjlib-util/src/pjlib-util/dns_dump.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/dns_dump.c	(revision 4612)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/dns_dump.c	(revision 4613)
@@ -37,5 +37,5 @@
     if (ttl > DAY) {
 	len = pj_ansi_snprintf(p, size, "%dd ", ttl/DAY);
-	if (len < 1)
+	if (len < 1 || len >= size)
 	    return "-err-";
 	size -= len;
@@ -46,5 +46,5 @@
     if (ttl > HOUR) {
 	len = pj_ansi_snprintf(p, size, "%dh ", ttl/HOUR);
-	if (len < 1)
+	if (len < 1 || len >= size)
 	    return "-err-";
 	size -= len;
@@ -55,5 +55,5 @@
     if (ttl > MINUTE) {
 	len = pj_ansi_snprintf(p, size, "%dm ", ttl/MINUTE);
-	if (len < 1)
+	if (len < 1 || len >= size)
 	    return "-err-";
 	size -= len;
@@ -64,5 +64,5 @@
     if (ttl > 0) {
 	len = pj_ansi_snprintf(p, size, "%ds ", ttl);
-	if (len < 1)
+	if (len < 1 || len >= size)
 	    return "-err-";
 	size -= len;
Index: pjproject/trunk/pjlib-util/src/pjlib-util/errno.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/errno.c	(revision 4612)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/errno.c	(revision 4613)
@@ -167,5 +167,6 @@
 				   "Unknown pjlib-util error %d",
 				   statcode);
-
+    if (errstr.slen < 1 || errstr.slen >= (pj_ssize_t)bufsize)
+	errstr.slen = bufsize - 1;
     return errstr;
 }
Index: pjproject/trunk/pjlib-util/src/pjlib-util/http_client.c
===================================================================
--- pjproject/trunk/pjlib-util/src/pjlib-util/http_client.c	(revision 4612)
+++ pjproject/trunk/pjlib-util/src/pjlib-util/http_client.c	(revision 4613)
@@ -1359,4 +1359,5 @@
     if (chal->qop.slen == 0) {
 	const pj_str_t STR_MD5 = { "MD5", 3 };
+	int max_len;
 
 	/* Server doesn't require quality of protection. */
@@ -1366,6 +1367,7 @@
 				    &hreq->param.method);
 
+	max_len = len;
 	len = pj_ansi_snprintf(
-		phdr->value.ptr, len,
+		phdr->value.ptr, max_len,
 		"Digest username=\"%.*s\", "
 		"realm=\"%.*s\", "
@@ -1380,5 +1382,5 @@
 		STR_PREC(STR_MD5),
 		STR_PREC(digest_response));
-	if (len < 0)
+	if (len < 0 || len >= max_len)
 	    return PJ_ETOOSMALL;
 	phdr->value.slen = len;
@@ -1392,4 +1394,5 @@
 	const pj_str_t nc = pj_str("00000001");
 	const pj_str_t cnonce = pj_str("b39971");
+	int max_len;
 
 	auth_create_digest_response(&digest_response, cred,
@@ -1397,6 +1400,7 @@
 				    &hreq->hurl.path, &chal->realm,
 				    &hreq->param.method);
+	max_len = len;
 	len = pj_ansi_snprintf(
-		phdr->value.ptr, len,
+		phdr->value.ptr, max_len,
 		"Digest username=\"%.*s\", "
 		"realm=\"%.*s\", "
@@ -1417,5 +1421,5 @@
 		STR_PREC(nc),
 		STR_PREC(cnonce));
-	if (len < 0)
+	if (len < 0 || len >= max_len)
 	    return PJ_ETOOSMALL;
 	phdr->value.slen = len;
Index: pjproject/trunk/pjlib/src/pj/errno.c
===================================================================
--- pjproject/trunk/pjlib/src/pj/errno.c	(revision 4612)
+++ pjproject/trunk/pjlib/src/pj/errno.c	(revision 4613)
@@ -92,4 +92,6 @@
 static int pjlib_error(pj_status_t code, char *buf, pj_size_t size)
 {
+    int len;
+
 #if defined(PJ_HAS_ERROR_STRING) && PJ_HAS_ERROR_STRING!=0
     unsigned i;
@@ -106,5 +108,8 @@
 #endif
 
-    return pj_ansi_snprintf( buf, size, "Unknown pjlib error %d", code);
+    len = pj_ansi_snprintf( buf, size, "Unknown pjlib error %d", code);
+    if (len < 1 || len >= (int)size)
+	len = size - 1;
+    return len;
 }
 
@@ -200,7 +205,7 @@
     }
 
-    if (len < 1) {
-        *buf = '\0';
-        len = 0;
+    if (len < 1 || len >= (int)bufsize) {
+	len = bufsize - 1;
+	buf[len] = '\0';
     }
 
Index: pjproject/trunk/pjlib/src/pj/lock.c
===================================================================
--- pjproject/trunk/pjlib/src/pj/lock.c	(revision 4612)
+++ pjproject/trunk/pjlib/src/pj/lock.c	(revision 4613)
@@ -684,5 +684,5 @@
 
 	len = pj_ansi_snprintf(start, max_len, "%s:%d ", ref->file, ref->line);
-	if (len < 1 || len > max_len) {
+	if (len < 1 || len >= max_len) {
 	    len = strlen(ref->file);
 	    if (len > max_len - 1)
Index: pjproject/trunk/pjlib/src/pj/log.c
===================================================================
--- pjproject/trunk/pjlib/src/pj/log.c	(revision 4612)
+++ pjproject/trunk/pjlib/src/pj/log.c	(revision 4613)
@@ -446,4 +446,7 @@
 				     "<logging error: msg too long>");
     }
+    if (print_len < 1 || print_len >= (int)(sizeof(log_buffer)-len)) {
+	print_len = sizeof(log_buffer) - len - 1;
+    }
     len = len + print_len;
     if (len > 0 && len < (int)sizeof(log_buffer)-2) {
Index: pjproject/trunk/pjlib/src/pj/os_error_symbian.cpp
===================================================================
--- pjproject/trunk/pjlib/src/pj/os_error_symbian.cpp	(revision 4612)
+++ pjproject/trunk/pjlib/src/pj/os_error_symbian.cpp	(revision 4613)
@@ -163,5 +163,5 @@
 
     if (!len) {
-	len = pj_ansi_snprintf( buf, bufsize, "Symbian native error %d", 
+	len = pj_ansi_snprintf( buf, bufsize-1, "Symbian native error %d",
 				os_errcode);
 	buf[len] = '\0';
Index: pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c
===================================================================
--- pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c	(revision 4612)
+++ pjproject/trunk/pjlib/src/pj/ssl_sock_ossl.c	(revision 4613)
@@ -273,5 +273,6 @@
 				   "Unknown OpenSSL error %lu",
 				   ssl_err);
-
+    if (errstr.slen < 1 || errstr.slen >= (int)bufsize)
+	errstr.slen = bufsize - 1;
     return errstr;
 }
Index: pjproject/trunk/pjmedia/src/pjmedia-audiodev/alsa_dev.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia-audiodev/alsa_dev.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia-audiodev/alsa_dev.c	(revision 4613)
@@ -172,5 +172,5 @@
 {
     char err_msg[128];
-    int index;
+    int index, len;
     va_list arg;
 
@@ -181,11 +181,28 @@
     index = snprintf (err_msg, sizeof(err_msg), "ALSA lib: ");
 #endif
+    if (index < 1 || index >= (int)sizeof(err_msg)) {
+	index = sizeof(err_msg)-1;
+	err_msg[index] = '\0';
+	goto print_msg;
+    }
+
     va_start (arg, fmt);
-    if (index < sizeof(err_msg)-1)
-	index += vsnprintf (err_msg+index, sizeof(err_msg)-index, fmt, arg);
+    if (index < sizeof(err_msg)-1) {
+	len = vsnprintf( err_msg+index, sizeof(err_msg)-index, fmt, arg);
+	if (len < 1 || len >= (int)sizeof(err_msg)-index)
+	    len = sizeof(err_msg)-index-1;
+	index += len;
+	err_msg[index] = '\0';
+    }
     va_end(arg);
-    if (err && index < sizeof(err_msg)-1)
-	index += snprintf (err_msg+index, sizeof(err_msg)-index, ": %s",
-			   snd_strerror(err));
+    if (err && index < sizeof(err_msg)-1) {
+	len = snprintf( err_msg+index, sizeof(err_msg)-index, ": %s",
+			snd_strerror(err));
+	if (len < 1 || len >= (int)sizeof(err_msg)-index)
+	    len = sizeof(err_msg)-index-1;
+	index += len;
+	err_msg[index] = '\0';
+    }
+print_msg:
     PJ_LOG (4,(THIS_FILE, "%s", err_msg));
 }
Index: pjproject/trunk/pjmedia/src/pjmedia-audiodev/errno.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia-audiodev/errno.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia-audiodev/errno.c	(revision 4613)
@@ -215,5 +215,6 @@
 				   "Unknown pjmedia-audiodev error %d",
 				   statcode);
-
+    if (errstr.slen < 1 || errstr.slen >= (pj_ssize_t)bufsize)
+	errstr.slen = bufsize - 1;
     return errstr;
 }
Index: pjproject/trunk/pjmedia/src/pjmedia-videodev/errno.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia-videodev/errno.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia-videodev/errno.c	(revision 4613)
@@ -112,5 +112,6 @@
 				   "Unknown pjmedia-videodev error %d",
 				   statcode);
-
+    if (errstr.slen < 1 || errstr.slen >= (pj_ssize_t)bufsize)
+	errstr.slen = bufsize - 1;
     return errstr;
 }
Index: pjproject/trunk/pjmedia/src/pjmedia/endpoint.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/endpoint.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/endpoint.c	(revision 4613)
@@ -491,7 +491,7 @@
 
 	    /* Print codec PT */
-	    buf_len += pj_ansi_snprintf(buf, 
-					MAX_FMTP_STR_LEN - buf_len, 
-					"%d", 
+	    buf_len += pj_ansi_snprintf(buf,
+					MAX_FMTP_STR_LEN - buf_len,
+					"%d",
 					codec_info->pt);
 
@@ -501,5 +501,5 @@
 		/* Check if buf still available */
 		test_len = dec_fmtp->param[i].val.slen + 
-			   dec_fmtp->param[i].name.slen;
+			   dec_fmtp->param[i].name.slen + 2;
 		if (test_len + buf_len >= MAX_FMTP_STR_LEN)
 		    return PJ_ETOOBIG;
@@ -687,5 +687,5 @@
 		/* Check if buf still available */
 		test_len = dec_fmtp->param[j].val.slen + 
-			   dec_fmtp->param[j].name.slen;
+			   dec_fmtp->param[j].name.slen + 2;
 		if (test_len + buf_len >= MAX_FMTP_STR_LEN)
 		    return PJ_ETOOBIG;
Index: pjproject/trunk/pjmedia/src/pjmedia/errno.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/errno.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/errno.c	(revision 4613)
@@ -267,5 +267,6 @@
 				   "Unknown pjmedia error %d",
 				   statcode);
-
+    if (errstr.slen < 1 || errstr.slen >= (pj_ssize_t)bufsize)
+	errstr.slen = bufsize - 1;
     return errstr;
 }
Index: pjproject/trunk/pjmedia/src/pjmedia/ffmpeg_util.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/ffmpeg_util.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/ffmpeg_util.c	(revision 4613)
@@ -115,4 +115,6 @@
 	AVClass* avc = *(AVClass**)ptr;
 	len = pj_ansi_snprintf(buf, bufsize, "%s: ", avc->item_name(ptr));
+	if (len < 1 || len >= bufsize)
+	    len = bufsize - 1;
 	bufsize -= len;
     }
Index: pjproject/trunk/pjmedia/src/pjmedia/sdp.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/sdp.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/sdp.c	(revision 4613)
@@ -504,5 +504,5 @@
 			   rtpmap->param.ptr);
 
-    if (len < 1 || len > (int)sizeof(tempbuf))
+    if (len < 1 || len >= (int)sizeof(tempbuf))
 	return PJMEDIA_SDP_ERTPMAPTOOLONG;
 
@@ -527,5 +527,5 @@
 			       (int)c->addr.slen,
 			       c->addr.ptr);
-    if (printed < 1 || printed > len)
+    if (printed < 1 || printed >= len)
 	return -1;
 
Index: pjproject/trunk/pjmedia/src/pjmedia/stream.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/stream.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/stream.c	(revision 4613)
@@ -2412,4 +2412,6 @@
 				   "Frame type, RTP Seq, RTP TS, RTP M, "
 				   "JB size, JB burst level, JB prefetch\n");
+	    if (len < 1 || len >= PJ_LOG_MAX_SIZE)
+		len = PJ_LOG_MAX_SIZE-1;
 	    pj_file_write(stream->trace_jb_fd, stream->trace_jb_buf, &len);
 	    pj_file_flush(stream->trace_jb_fd);
Index: pjproject/trunk/pjmedia/src/pjmedia/transport_ice.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/transport_ice.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/transport_ice.c	(revision 4613)
@@ -350,5 +350,5 @@
 	break;
     }
-    if (len2 < 1 || len2 >= max_len)
+    if (len2 < 1 || len2 >= max_len-len)
 	return -1;
 
@@ -546,5 +546,5 @@
 			   pj_sockaddr_get_port(&check->rcand->addr)
 			   );
-		if (len < 1 || len >= RATTR_BUF_LEN) {
+		if (len < 1 || len >= RATTR_BUF_LEN - rem_cand.slen) {
 		    pj_assert(!"Not enough buffer to print "
 			       "remote-candidates");
Index: pjproject/trunk/pjmedia/src/pjmedia/transport_srtp.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/transport_srtp.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/transport_srtp.c	(revision 4613)
@@ -1044,4 +1044,5 @@
     char b64_key[PJ_BASE256_TO_BASE64_LEN(MAX_KEY_LEN)+1];
     int b64_key_len = sizeof(b64_key);
+    int print_len;
 
     if (cs_idx == -1)
@@ -1102,8 +1103,12 @@
 
     /* Print the crypto attribute value. */
-    *buffer_len = pj_ansi_snprintf(buffer, *buffer_len, "%d %s inline:%s",
+    print_len = pj_ansi_snprintf(buffer, *buffer_len, "%d %s inline:%s",
 				   tag, 
 				   crypto_suites[cs_idx].name,
 				   b64_key);
+    if (print_len < 1 || print_len >= *buffer_len)
+	return PJ_ETOOSMALL;
+
+    *buffer_len = print_len;
 
     return PJ_SUCCESS;
Index: pjproject/trunk/pjmedia/src/pjmedia/vid_stream.c
===================================================================
--- pjproject/trunk/pjmedia/src/pjmedia/vid_stream.c	(revision 4612)
+++ pjproject/trunk/pjmedia/src/pjmedia/vid_stream.c	(revision 4613)
@@ -1651,4 +1651,6 @@
 				   "Frame type, RTP Seq, RTP TS, RTP M, "
 				   "JB size, JB burst level, JB prefetch\n");
+	    if (len < 1 || len >= PJ_LOG_MAX_SIZE)
+		len = PJ_LOG_MAX_SIZE - 1;
 	    pj_file_write(stream->trace_jb_fd, stream->trace_jb_buf, &len);
 	    pj_file_flush(stream->trace_jb_fd);
Index: pjproject/trunk/pjnath/src/pjnath/errno.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/errno.c	(revision 4612)
+++ pjproject/trunk/pjnath/src/pjnath/errno.c	(revision 4613)
@@ -134,6 +134,6 @@
 				   "Unknown pjnath error %d",
 				   statcode);
-    if (errstr.slen < 0) errstr.slen = 0;
-    else if (errstr.slen > (int)bufsize) errstr.slen = bufsize;
+    if (errstr.slen < 1 || errstr.slen >= (int)bufsize)
+	errstr.slen = bufsize-1;
 
     return errstr;
@@ -165,6 +165,6 @@
     }
 
-    if (errstr.slen < 0) errstr.slen = 0;
-    else if (errstr.slen > (int)bufsize) errstr.slen = bufsize;
+    if (errstr.slen < 1 || errstr.slen >= (int)bufsize)
+	errstr.slen = bufsize-1;
 
     return errstr;
Index: pjproject/trunk/pjnath/src/pjnath/stun_msg.c
===================================================================
--- pjproject/trunk/pjnath/src/pjnath/stun_msg.c	(revision 4612)
+++ pjproject/trunk/pjnath/src/pjnath/stun_msg.c	(revision 4613)
@@ -2452,5 +2452,6 @@
 					     err_msg1,
 					     pj_stun_get_attr_name(attr_type));
-
+		    if (e.slen < 1 || e.slen >= (int)sizeof(err_msg2))
+			e.slen = sizeof(err_msg2) - 1;
 		    pj_stun_msg_create_response(pool, msg,
 						PJ_STUN_SC_BAD_REQUEST,
Index: pjproject/trunk/pjsip-apps/src/samples/icedemo.c
===================================================================
--- pjproject/trunk/pjsip-apps/src/samples/icedemo.c	(revision 4612)
+++ pjproject/trunk/pjsip-apps/src/samples/icedemo.c	(revision 4613)
@@ -518,5 +518,6 @@
 	printed = pj_ansi_snprintf(p, maxlen - (p-buffer),  \
 				   fmt, arg0, arg1, arg2, arg3, arg4, arg5); \
-	if (printed <= 0) return -PJ_ETOOSMALL; \
+	if (printed <= 0 || printed >= (int)(maxlen - (p-buffer))) \
+	    return -PJ_ETOOSMALL; \
 	p += printed
 
Index: pjproject/trunk/pjsip/src/pjsip-simple/errno.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip-simple/errno.c	(revision 4612)
+++ pjproject/trunk/pjsip/src/pjsip-simple/errno.c	(revision 4613)
@@ -111,5 +111,6 @@
 				   "Unknown pjsip-simple error %d",
  				   statcode);
-
+    if (errstr.slen < 1 || errstr.slen >= (pj_ssize_t)bufsize)
+	errstr.slen = bufsize - 1;
     return errstr;
 }
Index: pjproject/trunk/pjsip/src/pjsip-ua/sip_100rel.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip-ua/sip_100rel.c	(revision 4612)
+++ pjproject/trunk/pjsip/src/pjsip-ua/sip_100rel.c	(revision 4613)
@@ -345,4 +345,7 @@
 				 (int)tsx->method.name.slen,
 				 tsx->method.name.ptr);
+    if (rack.slen < 1 || rack.slen >= (int)sizeof(rack_buf)) {
+	return PJ_ETOOSMALL;
+    }
     rack_hdr = pjsip_generic_string_hdr_create(tdata->pool, &RACK, &rack);
     pjsip_msg_add_hdr(tdata->msg, (pjsip_hdr*) rack_hdr);
Index: pjproject/trunk/pjsip/src/pjsip/sip_errno.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsip/sip_errno.c	(revision 4612)
+++ pjproject/trunk/pjsip/src/pjsip/sip_errno.c	(revision 4613)
@@ -205,5 +205,6 @@
 				   "Unknown pjsip error %d",
 				   statcode);
-
+    if (errstr.slen < 1 || errstr.slen >= (pj_ssize_t)bufsize)
+	errstr.slen = bufsize - 1;
     return errstr;
 
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c	(revision 4612)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_acc.c	(revision 4613)
@@ -1750,5 +1750,5 @@
 			       (int)acc->cfg.contact_params.slen,
 			       acc->cfg.contact_params.ptr);
-	if (len < 1) {
+	if (len < 1 || len >= PJSIP_MAX_URL_SIZE) {
 	    PJ_LOG(1,(THIS_FILE, "URI too long"));
 	    pj_pool_release(pool);
@@ -3102,5 +3102,6 @@
 				     (int)acc->cfg.contact_params.slen,
 				     acc->cfg.contact_params.ptr);
-
+    if (contact->slen < 1 || contact->slen >= (int)PJSIP_MAX_URL_SIZE)
+	return PJ_ETOOSMALL;
     return PJ_SUCCESS;
 }
@@ -3272,4 +3273,6 @@
 				     (int)acc->cfg.contact_params.slen,
 				     acc->cfg.contact_params.ptr);
+    if (contact->slen < 1 || contact->slen >= (int)PJSIP_MAX_URL_SIZE)
+	return PJ_ETOOSMALL;
 
     return PJ_SUCCESS;
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_aud.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_aud.c	(revision 4612)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_aud.c	(revision 4613)
@@ -1760,10 +1760,12 @@
 	    if (param->base.clock_rate != pjsua_var.media_cfg.clock_rate) {
 		char tmp_buf[128];
-		int tmp_buf_len = sizeof(tmp_buf);
-
-		tmp_buf_len = pj_ansi_snprintf(tmp_buf, sizeof(tmp_buf)-1,
+		int tmp_buf_len;
+
+		tmp_buf_len = pj_ansi_snprintf(tmp_buf, sizeof(tmp_buf),
 					       "%s (%dKHz)",
 					       rec_info.name,
 					       param->base.clock_rate/1000);
+		if (tmp_buf_len < 1 || tmp_buf_len >= (int)sizeof(tmp_buf))
+		    tmp_buf_len = sizeof(tmp_buf) - 1;
 		pj_strset(&tmp, tmp_buf, tmp_buf_len);
 		pjmedia_conf_set_port0_name(pjsua_var.mconf, &tmp);
Index: pjproject/trunk/pjsip/src/pjsua-lib/pjsua_dump.c
===================================================================
--- pjproject/trunk/pjsip/src/pjsua-lib/pjsua_dump.c	(revision 4612)
+++ pjproject/trunk/pjsip/src/pjsua-lib/pjsua_dump.c	(revision 4613)
@@ -129,5 +129,5 @@
 	   );
 
-    if (len < 1 || len > end-p) {
+    if (len < 1 || len >= end-p) {
 	*p = '\0';
 	return (unsigned)(p-buf);
@@ -187,5 +187,5 @@
 	   );
 
-    if (len < 1 || len > end-p) {
+    if (len < 1 || len >= end-p) {
 	*p = '\0';
 	return (unsigned)(p-buf);
@@ -202,5 +202,5 @@
 	   pj_math_stat_get_stddev(&stat->rtt) / 1000.0
 	   );
-    if (len < 1 || len > end-p) {
+    if (len < 1 || len >= end-p) {
 	*p = '\0';
 	return (unsigned)(p-buf);
@@ -260,5 +260,5 @@
 		      "%s  #%d %s deactivated\n",
 		      indent, i, media_type_str);
-	    if (len < 1 || len > end-p) {
+	    if (len < 1 || len >= end-p) {
 		*p = '\0';
 		return;
@@ -364,5 +364,5 @@
 		  dir_str,
 		  rem_addr);
-	if (len < 1 || len > end-p) {
+	if (len < 1 || len >= end-p) {
 	    *p = '\0';
 	    return;
@@ -471,5 +471,5 @@
 
 #   define VALIDATE_PRINT_BUF() \
-	if (len < 1 || len > end-p) { *p = '\0'; return; } \
+	if (len < 1 || len >= end-p) { *p = '\0'; return; } \
 	p += len; *p++ = '\n'; *p = '\0'
 
