diff --git a/include/common/chunk.h b/include/common/chunk.h
index 9166f60..397bd24 100644
--- a/include/common/chunk.h
+++ b/include/common/chunk.h
@@ -66,7 +66,7 @@
 static inline int chunk_initlen(struct chunk *chk, char *str, size_t size, int len)
 {
 
-	if (size && len > size)
+	if (len < 0 || (size && len > size))
 		return 0;
 
 	chk->str  = str;
@@ -111,7 +111,7 @@
 
 	len = strlen(str);
 
-	if (unlikely(chk->len + len >= chk->size))
+	if (unlikely(chk->len < 0 || chk->len + len >= chk->size))
 		return 0;
 
 	memcpy(chk->str + chk->len, str, len + 1);
@@ -133,7 +133,7 @@
  */
 static inline char *chunk_newstr(struct chunk *chk)
 {
-	if (chk->len + 1 >= chk->size)
+	if (chk->len < 0 || chk->len + 1 >= chk->size)
 		return NULL;
 
 	chk->str[chk->len++] = 0;
@@ -165,7 +165,7 @@
  */
 static inline char *chunk_dup(struct chunk *dst, const struct chunk *src)
 {
-	if (!dst || !src || !src->str)
+	if (!dst || !src || src->len < 0 || !src->str)
 		return NULL;
 
 	if (dst->size)
diff --git a/src/channel.c b/src/channel.c
index 2f98396..36b4e44 100644
--- a/src/channel.c
+++ b/src/channel.c
@@ -87,7 +87,7 @@
 	if (len == 0)
 		return -1;
 
-	if (len > chn->buf->size) {
+	if (len < 0 || len > chn->buf->size) {
 		/* we can't write this chunk and will never be able to, because
 		 * it is larger than the buffer. This must be reported as an
 		 * error. Then we return -2 so that writers that don't care can
@@ -157,6 +157,9 @@
 	if (unlikely(channel_input_closed(chn)))
 		return -2;
 
+	if (len < 0)
+		return -3;
+
 	max = buffer_max_len(chn);
 	if (unlikely(len > max - buffer_len(chn->buf))) {
 		/* we can't write this chunk right now because the buffer is
diff --git a/src/chunk.c b/src/chunk.c
index 3c1cfdf..fbba6d5 100644
--- a/src/chunk.c
+++ b/src/chunk.c
@@ -100,7 +100,7 @@
 	va_list argp;
 	int ret;
 
-	if (!chk->str || !chk->size)
+	if (chk->len < 0 || !chk->str || !chk->size)
 		return 0;
 
 	va_start(argp, fmt);
@@ -125,6 +125,9 @@
 	int olen, free;
 	char c;
 
+	if (dst->len < 0)
+		return dst->len;
+
 	olen = dst->len;
 
 	for (i = 0; i < src->len; i++) {
@@ -166,6 +169,9 @@
 	int olen, free;
 	char c;
 
+	if (dst->len < 0)
+		return dst->len;
+
 	olen = dst->len;
 
 	for (i = 0; i < src->len; i++) {