diff --git a/Minecraft.Client/AbstractTexturePack.cpp b/Minecraft.Client/AbstractTexturePack.cpp
index a3c677272..cd6c497df 100644
--- a/Minecraft.Client/AbstractTexturePack.cpp
+++ b/Minecraft.Client/AbstractTexturePack.cpp
@@ -296,8 +296,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable()
 	const DWORD LOCATOR_SIZE = 256; // Use this to allocate space to hold a ResourceLocator string 
 	WCHAR szResourceLocator[ LOCATOR_SIZE ];
 
-	// Try and load the HTMLColours.col based off the common XML first, before the deprecated xuiscene_colourtable	
-	wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col");
+	swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/HTMLColours.col");
 	BYTE *data;
 	UINT dataLength;
 	if(XuiResourceLoadAll(szResourceLocator, &data, &dataLength) == S_OK)
@@ -308,7 +307,7 @@ void AbstractTexturePack::loadDefaultHTMLColourTable()
 	}
 	else
 	{
-		wsprintfW(szResourceLocator,L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/");
+		swprintf_s(szResourceLocator, LOCATOR_SIZE, L"section://%X,%s#%s",c_ModuleHandle,L"media", L"media/");
 		HXUIOBJ hScene;
 		HRESULT hr = XuiSceneCreate(szResourceLocator,L"xuiscene_colourtable.xur", nullptr, &hScene);
 
diff --git a/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp b/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp
index eed3e8511..b02ec449f 100644
--- a/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp
+++ b/Minecraft.Client/Durango/Network/DQRNetworkManager_SendReceive.cpp
@@ -209,15 +209,37 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo,
 				break;
 			case DQRConnectionInfo::ConnectionState_InternalRoomSyncData:
 				connectionInfo->m_pucRoomSyncData[connectionInfo->m_roomSyncDataBytesRead++] = byte;
-				// The room sync info is sent as a 4 byte count of the length of XUID strings, then the RoomSyncData, then the XUID strings
 				if( connectionInfo->m_roomSyncDataBytesToRead == 0 )
 				{
-					// At first stage of reading the 4 byte count
 					if( connectionInfo->m_roomSyncDataBytesRead == 4 )
 					{
-						memcpy( &connectionInfo->m_roomSyncDataBytesToRead, connectionInfo->m_pucRoomSyncData, 4);
+						int receivedSize = 0;
+						memcpy( &receivedSize, connectionInfo->m_pucRoomSyncData, 4);
 						delete [] connectionInfo->m_pucRoomSyncData;
-						connectionInfo->m_roomSyncDataBytesToRead += sizeof(RoomSyncData);
+
+					// a 512KB limit gives enough headroom for legitimate XUID data, but prevents a overflow. With 2 players the size is about 100kb so 512kb gives good headroom
+						if( receivedSize < 0 || receivedSize > 524288 )
+						{
+							DQRNetworkManager::LogCommentFormat(L"RoomSyncData rejected: size=%d", receivedSize);
+							connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
+							connectionInfo->m_pucRoomSyncData = nullptr;
+							connectionInfo->m_roomSyncDataBytesToRead = 0;
+							connectionInfo->m_roomSyncDataBytesRead = 0;
+							break;
+						}
+
+						int totalSize = receivedSize + sizeof(RoomSyncData);
+
+						if( totalSize < receivedSize )
+						{
+							connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
+							connectionInfo->m_pucRoomSyncData = nullptr;
+							connectionInfo->m_roomSyncDataBytesToRead = 0;
+							connectionInfo->m_roomSyncDataBytesRead = 0;
+							break;
+						}
+
+						connectionInfo->m_roomSyncDataBytesToRead = totalSize;
 						connectionInfo->m_pucRoomSyncData = new unsigned char[ connectionInfo->m_roomSyncDataBytesToRead ];
 						connectionInfo->m_roomSyncDataBytesRead = 0;
 					}
@@ -296,8 +318,22 @@ void DQRNetworkManager::BytesReceivedInternal(DQRConnectionInfo *connectionInfo,
 					// At first stage of reading the 4 byte count
 					if( connectionInfo->m_addFailedPlayerDataBytesRead == 4 )
 					{
-						memcpy( &connectionInfo->m_addFailedPlayerDataBytesToRead, connectionInfo->m_pucAddFailedPlayerData, 4);
+						int receivedSize = 0;
+						memcpy( &receivedSize, connectionInfo->m_pucAddFailedPlayerData, 4);
 						delete [] connectionInfo->m_pucAddFailedPlayerData;
+
+					// a 512KB limit gives enough headroom for legitimate XUID strings, but prevents a overflow.
+						if( receivedSize < 0 || receivedSize > 524288 )
+						{
+							DQRNetworkManager::LogCommentFormat(L"AddFailedPlayerData rejected: size=%d", receivedSize);
+							connectionInfo->m_internalDataState = DQRConnectionInfo::ConnectionState_InternalHeaderByte;
+							connectionInfo->m_pucAddFailedPlayerData = nullptr;
+							connectionInfo->m_addFailedPlayerDataBytesToRead = 0;
+							connectionInfo->m_addFailedPlayerDataBytesRead = 0;
+							break;
+						}
+
+						connectionInfo->m_addFailedPlayerDataBytesToRead = receivedSize;
 						connectionInfo->m_pucAddFailedPlayerData = new unsigned char[ connectionInfo->m_addFailedPlayerDataBytesToRead ];
 						connectionInfo->m_addFailedPlayerDataBytesRead = 0;
 					}