diff --git a/g10/ChangeLog b/g10/ChangeLog
index 32f33adee..d041c28db 100644
--- a/g10/ChangeLog
+++ b/g10/ChangeLog
@@ -1,3 +1,10 @@
+2007-01-15  Werner Koch  <wk@g10code.com>
+
+	* parse-packet.c (read_protected_v3_mpi): Make sure to stop
+	reading even for corrupted packets.
+	* keygen.c (generate_user_id): Need to allocate one byte more.
+	Reported by Felix von Leitner.
+
 2006-12-14  David Shaw  <dshaw@jabberwocky.com>
 
 	* options.skel: Tweak some examples to match reality and update
diff --git a/g10/keygen.c b/g10/keygen.c
index 620274aef..f79eaaaba 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -1958,7 +1958,7 @@ generate_user_id()
     if( !p )
 	return NULL;
     n = strlen(p);
-    uid = xmalloc_clear( sizeof *uid + n - 1 );
+    uid = xmalloc_clear( sizeof *uid + n );
     uid->len = n;
     strcpy(uid->name, p);
     uid->ref = 1;
diff --git a/g10/parse-packet.c b/g10/parse-packet.c
index 31f21bc92..ed4db4335 100644
--- a/g10/parse-packet.c
+++ b/g10/parse-packet.c
@@ -1533,7 +1533,7 @@ read_protected_v3_mpi (IOBUF inp, unsigned long *length)
   buf = p = xmalloc (2 + nbytes);
   *p++ = nbits >> 8;
   *p++ = nbits;
-  for (; nbytes && length; nbytes--, --*length)
+  for (; nbytes && *length; nbytes--, --*length)
     *p++ = iobuf_get (inp);
   if (nbytes)
     {