diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
index a57c35ce0d2..9214d9a4fe7 100644
--- a/modules/proxy/proxy_util.c
+++ b/modules/proxy/proxy_util.c
@@ -262,6 +262,7 @@ PROXY_DECLARE(char *)ap_proxy_canonenc_ex(apr_pool_t *p, const char *x, int len,
         reserved = "";
     }
 
+    ap_assert(len >= 0 && len <= (INT_MAX - 1) / 3);
     y = apr_palloc(p, 3 * len + 1);
 
     for (i = 0, j = 0; i < len; i++, j++) {
diff --git a/server/util.c b/server/util.c
index d1d06fc15b4..d2810a2cac2 100644
--- a/server/util.c
+++ b/server/util.c
@@ -2376,6 +2376,7 @@ AP_DECLARE(char *) ap_make_full_path(apr_pool_t *a, const char *src1,
      /* allocate +3 for '/' delimiter, trailing NULL and overallocate
       * one extra byte to allow the caller to add a trailing '/'
       */
+    ap_assert(len2 <= APR_SIZE_MAX - 3 && len1 <= APR_SIZE_MAX - 3 - len2);
     path = (char *)apr_palloc(a, len1 + len2 + 3);
     if (len1 == 0) {
         *path = '/';