diff --git a/programs/ssl/ssl_context_info.c b/programs/ssl/ssl_context_info.c
index 9d7fb99e09..7f90c828ba 100644
--- a/programs/ssl/ssl_context_info.c
+++ b/programs/ssl/ssl_context_info.c
@@ -882,8 +882,8 @@ static void print_deserialized_ssl_context(const uint8_t *ssl, size_t len)
         printf("\tALPN negotiation                   : ");
         CHECK_SSL_END(alpn_len);
         if (alpn_len > 0) {
-            if (strlen((const char *) ssl) == alpn_len) {
-                printf("%s\n", ssl);
+            if (memchr(ssl, '\0', alpn_len) == NULL) {
+                printf("%.*s\n", alpn_len, ssl);
             } else {
                 printf("\n");
                 printf_err("\tALPN negotiation is incorrect\n");
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index b5cdc817b8..7de63f5520 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -1385,6 +1385,10 @@ static int dummy_ticket_parse(void *p_ticket, mbedtls_ssl_session *session,
     int ret;
     ((void) p_ticket);
 
+    if (len < 4) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
     if ((ret = mbedtls_ssl_session_load(session, buf + 4, len - 4)) != 0) {
         return ret;
     }