Index: uspace/srv/hid/rfb/rfb.c
===================================================================
--- uspace/srv/hid/rfb/rfb.c	(revision 8e3498b351ae109f7ad16592a1f108e3bd44c829)
+++ uspace/srv/hid/rfb/rfb.c	(revision bde5c044624f5375df5235c6f6f2f4a7286fbe1a)
@@ -418,8 +418,8 @@
 }
 
-static ssize_t rfb_tile_encode_raw(rfb_t *rfb, cpixel_ctx_t *cpixel,
+static size_t rfb_tile_encode_raw(rfb_t *rfb, cpixel_ctx_t *cpixel,
     rfb_rectangle_t *tile, void *buf)
 {
-	ssize_t size = tile->width * tile->height * cpixel->size;
+	size_t size = tile->width * tile->height * cpixel->size;
 	if (buf == NULL)
 		return size;
@@ -435,6 +435,6 @@
 }
 
-static ssize_t rfb_tile_encode_solid(rfb_t *rfb, cpixel_ctx_t *cpixel,
-    rfb_rectangle_t *tile, void *buf)
+static size_t rfb_tile_encode_solid(rfb_t *rfb, cpixel_ctx_t *cpixel,
+    rfb_rectangle_t *tile, void *buf, size_t *size)
 {
 	/* Check if it is single color */
@@ -443,5 +443,5 @@
 		for (uint16_t x = tile->x; x < tile->x + tile->width; x++) {
 			if (pixelmap_get_pixel(&rfb->framebuffer, x, y) != the_color)
-				return -1;
+				return EINVAL;
 		}
 	}
@@ -450,5 +450,6 @@
 	if (buf)
 		cpixel_encode(rfb, cpixel, buf, the_color);
-	return cpixel->size;
+	*size = cpixel->size;
+	return EOK;
 }
 
@@ -474,6 +475,8 @@
 			
 			uint8_t tile_enctype = RFB_TILE_ENCODING_SOLID;
-			ssize_t tile_size = rfb_tile_encode_solid(rfb, &cpixel, &tile, buf);
-			if (tile_size < 0) {
+			size_t tile_size;
+			int rc = rfb_tile_encode_solid(rfb, &cpixel, &tile, buf,
+			    &tile_size);
+			if (rc != EOK) {
 				tile_size = rfb_tile_encode_raw(rfb, &cpixel, &tile, buf);
 				tile_enctype = RFB_TILE_ENCODING_RAW;
Index: uspace/srv/net/udp/service.c
===================================================================
--- uspace/srv/net/udp/service.c	(revision 8e3498b351ae109f7ad16592a1f108e3bd44c829)
+++ uspace/srv/net/udp/service.c	(revision bde5c044624f5375df5235c6f6f2f4a7286fbe1a)
@@ -570,5 +570,5 @@
 
 	rc = async_data_read_finalize(callid, &enext->epp.remote,
-	    max(size, (ssize_t)sizeof(inet_ep_t)));
+	    max(size, (size_t)sizeof(inet_ep_t)));
 	if (rc != EOK) {
 		async_answer_0(iid, rc);
@@ -596,9 +596,9 @@
 {
 	ipc_callid_t callid;
-	ssize_t msg_size;
+	size_t msg_size;
 	udp_crcv_queue_entry_t *enext;
 	void *data;
 	size_t size;
-	ssize_t off;
+	size_t off;
 	int rc;
 
@@ -623,6 +623,11 @@
 	msg_size = enext->msg->data_size;
 
-	rc = async_data_read_finalize(callid, data, max(msg_size - off,
-	    (ssize_t)size));
+	if (off > msg_size) {
+		async_answer_0(callid, EINVAL);
+		async_answer_0(iid, EINVAL);
+		return;
+	}
+
+	rc = async_data_read_finalize(callid, data, min(msg_size - off, size));
 	if (rc != EOK) {
 		async_answer_0(iid, rc);