diff --git a/ssh.c b/ssh.c
index 0c95074..f34be67 100644
--- a/ssh.c
+++ b/ssh.c
@@ -687,7 +687,7 @@
 	if (options.rhosts_rsa_authentication ||
 	    options.hostbased_authentication) {
 		sensitive_data.nkeys = 3;
-		sensitive_data.keys = xmalloc(sensitive_data.nkeys *
+		sensitive_data.keys = xcalloc(sensitive_data.nkeys, 
 		    sizeof(Key));
 
 		PRIV_START;
@@ -1250,7 +1250,8 @@
 	int i;
 	char name[1024], *cp;
 
-	strlcpy(name, env, sizeof(name));
+	if (strlcpy(name, env, sizeof(name)) >= sizeof(name))
+		fatal("env_permitted: name too long");
 	if ((cp = strchr(name, '=')) == NULL)
 		return (0);