diff --git a/telnet/telnet.c b/telnet/telnet.c
index 90527968..3c0df082 100644
--- a/telnet/telnet.c
+++ b/telnet/telnet.c
@@ -1498,6 +1498,7 @@ slc_check (void)
 
 
 unsigned char slc_reply[128];
+unsigned char const * const slc_reply_eom = &slc_reply[sizeof(slc_reply)];
 unsigned char *slc_replyp;
 
 void
@@ -1513,6 +1514,14 @@ slc_start_reply (void)
 void
 slc_add_reply (unsigned char func, unsigned char flags, cc_t value)
 {
+  /* A sequence of up to 6 bytes my be written for this member of the SLC
+   * suboption list by this function.  The end of negotiation command,
+   * which is written by slc_end_reply(), will require 2 additional
+   * bytes.  Do not proceed unless there is sufficient space for these
+   * items.
+   */
+  if (&slc_replyp[6+2] > slc_reply_eom)
+    return;
   if ((*slc_replyp++ = func) == IAC)
     *slc_replyp++ = IAC;
   if ((*slc_replyp++ = flags) == IAC)
@@ -1526,6 +1535,9 @@ slc_end_reply (void)
 {
   register int len;
 
+    /* The end of negotiation command requires 2 bytes. */
+    if (&slc_replyp[2] > slc_reply_eom)
+            return;
   *slc_replyp++ = IAC;
   *slc_replyp++ = SE;
   len = slc_replyp - slc_reply;
@@ -1656,8 +1668,8 @@ env_opt (register unsigned char *buf, register int len)
     }
 }
 
-#define OPT_REPLY_SIZE	256
-unsigned char *opt_reply;
+#define	OPT_REPLY_SIZE	(2 * SUBBUFSIZE)
+unsigned char *opt_reply = NULL;
 unsigned char *opt_replyp;
 unsigned char *opt_replyend;
 
@@ -1711,8 +1723,8 @@ env_opt_add (register unsigned char *ep)
       return;
     }
   vp = env_getvalue ((char *)ep);
-  if (opt_replyp + (vp ? strlen ((char *) vp) : 0) +
-      strlen ((char *) ep) + 6 > opt_replyend)
+  if (opt_replyp + (vp ? 2 * strlen((char *)vp) : 0) +
+      2 * strlen((char *)ep) + 6 > opt_replyend)
     {
       register int len;
       opt_replyend += OPT_REPLY_SIZE;
@@ -1740,6 +1752,8 @@ env_opt_add (register unsigned char *ep)
     {
       while ((c = *ep++))
 	{
+	if (opt_replyp + (2 + 2) > opt_replyend)
+		return;
 	  switch (c & 0xff)
 	    {
 	    case IAC:
@@ -1756,6 +1770,8 @@ env_opt_add (register unsigned char *ep)
 	}
       if ((ep = vp))
 	{
+		if (opt_replyp + (1 + 2 + 2) > opt_replyend)
+			return;
 #ifdef	OLD_ENVIRON
 	  if (telopt_environ == TELOPT_OLD_ENVIRON)
 	    *opt_replyp++ = old_env_value;
@@ -1786,7 +1802,9 @@ env_opt_end (register int emptyok)
 {
   register int len;
 
-  len = opt_replyp - opt_reply + 2;
+  if (opt_replyp + 2 > opt_replyend)
+    return;
+  len = opt_replyp + 2 - opt_reply;
   if (emptyok || len > 6)
     {
       *opt_replyp++ = IAC;