diff --git a/src/conf.c b/src/conf.c
index 8f92fe465e..b614148552 100644
--- a/src/conf.c
+++ b/src/conf.c
@@ -202,7 +202,10 @@ long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db)
                 return WOLFSSL_FAILURE;
             }
         }
-        idx[-1] = '\n';
+        if (idx > buf)
+            idx[-1] = '\n';
+        else
+            return WOLFSSL_FAILURE;
         sz = (int)(idx - buf);
 
         if (wolfSSL_BIO_write(out, buf, sz) != sz) {
diff --git a/wolfcrypt/src/coding.c b/wolfcrypt/src/coding.c
index 8681a5ee06..823799dd92 100644
--- a/wolfcrypt/src/coding.c
+++ b/wolfcrypt/src/coding.c
@@ -297,8 +297,10 @@ static int CEscape(int escaped, byte e, byte* out, word32* i, word32 maxSz,
 
     if (raw)
         basic = e;
-    else
+    else if (e <= sizeof(base64Encode))
         basic = base64Encode[e];
+    else
+        return BAD_FUNC_ARG;
 
     /* check whether to escape. Only escape for EncodeEsc */
     if (escaped == WC_ESC_NL_ENC) {