diff --git a/Source/stb_image.h b/Source/stb_image.h
index 0f8459a7998d5ffd87d313e3f6d16e2b45b6e697..1d297d84e8fdabc0fbac45af6996786faa1537e8 100644
--- a/Source/stb_image.h
+++ b/Source/stb_image.h
@@ -1428,7 +1428,7 @@ STBIDEF stbi_uc *stbi_load_gif_from_memory(stbi_uc const *buffer, int len, int *
    stbi__start_mem(&s,buffer,len);
 
    result = (unsigned char*) stbi__load_gif_main(&s, delays, x, y, z, comp, req_comp);
-   if (stbi__vertically_flip_on_load) {
+   if (stbi__vertically_flip_on_load && result) {
       stbi__vertical_flip_slices( result, *x, *y, *z, *comp );
    }
 
@@ -6907,8 +6907,11 @@ static void *stbi__load_gif_main(stbi__context *s, int **delays, int *x, int *y,
 
             if (out) {
                void *tmp = (stbi_uc*) STBI_REALLOC_SIZED( out, out_size, layers * stride );
-               if (!tmp)
-                  return stbi__load_gif_main_outofmem(&g, out, delays);
+               if (!tmp) {
+                  void *ret = stbi__load_gif_main_outofmem(&g, out, delays);
+                  if (delays && *delays) *delays = 0;
+                  return ret;
+               }
                else {
                    out = (stbi_uc*) tmp;
                    out_size = layers * stride;
@@ -6923,8 +6926,11 @@ static void *stbi__load_gif_main(stbi__context *s, int **delays, int *x, int *y,
                }
             } else {
                out = (stbi_uc*)stbi__malloc( layers * stride );
-               if (!out)
-                  return stbi__load_gif_main_outofmem(&g, out, delays);
+               if (!out) {
+                  void *ret = stbi__load_gif_main_outofmem(&g, out, delays);
+                  if (delays && *delays) *delays = 0;
+                  return ret;
+               }
                out_size = layers * stride;
                if (delays) {
                   *delays = (int*) stbi__malloc( layers * sizeof(int) );
@@ -6935,7 +6941,7 @@ static void *stbi__load_gif_main(stbi__context *s, int **delays, int *x, int *y,
             }
             memcpy( out + ((layers - 1) * stride), u, stride );
             if (layers >= 2) {
-               two_back = out - 2 * stride;
+               two_back = out + (layers - 2) * stride;
             }
 
             if (delays) {
diff --git a/Source/tinyexr.h b/Source/tinyexr.h
index 3e0aba94c6ba8540c82e9ab9dbfad69a5002defe..e3e6c32f0cb7af341063c70a17a72eaea0f7874d 100644
--- a/Source/tinyexr.h
+++ b/Source/tinyexr.h
@@ -7764,7 +7764,7 @@ static int rleUncompress(int inLength, int maxLength, const signed char in[],
       int count = *in++;
       inLength -= 2;
 
-      if (0 > (maxLength -= count + 1)) return 0;
+      if (0 > (maxLength -= count + 1) || inLength < 0) return 0;
 
       memset(out, *reinterpret_cast<const char *>(in), count + 1);
       out += count + 1;