diff --git a/lib/misc/lecp.c b/lib/misc/lecp.c
index 4783241a49bdff5320cf9dfb95fab4a9b4ad8902..d55b15c34d50e475f03637167038526f3c96878b 100644
--- a/lib/misc/lecp.c
+++ b/lib/misc/lecp.c
@@ -524,7 +524,8 @@ i2:
 						goto reject_callback;
 					pst->ppos = st->p;
 					ctx->path[pst->ppos] = '\0';
-					ctx->ipos--;
+					if (ctx->ipos)
+						ctx->ipos--;
 					lecp_check_path_match(ctx);
 					lwcp_completed(ctx, 0);
 					break;
diff --git a/lib/roles/cgi/cgi-server.c b/lib/roles/cgi/cgi-server.c
index a6f04fa1b14dd3c21a549cdc682e38ce4b3ebd38..34015e1ece8acdde9086e1040014c8cd4e08f260 100644
--- a/lib/roles/cgi/cgi-server.c
+++ b/lib/roles/cgi/cgi-server.c
@@ -828,7 +828,7 @@ agin:
 	n = lws_get_socket_fd(wsi->http.cgi->lsp->stdwsi[LWS_STDOUT]);
 	if (n < 0)
 		return -1;
-	n = (int)read(n, start, sizeof(buf) - LWS_PRE);
+	n = (int)read(n, start, sizeof(buf) - LWS_PRE - 16);
 
 	if (n < 0 && errno != EAGAIN) {
 		lwsl_wsi_debug(wsi, "stdout read says %d", n);