diff --git a/include/QF/msg.h b/include/QF/msg.h
index 4f6bca581..22748f2e5 100644
--- a/include/QF/msg.h
+++ b/include/QF/msg.h
@@ -30,10 +30,10 @@
 
 #include "QF/sizebuf.h"
 
-void MSG_WriteChar (sizebuf_t *sb, int c);
-void MSG_WriteByte (sizebuf_t *sb, int c);
-void MSG_WriteShort (sizebuf_t *sb, int c);
-void MSG_WriteLong (sizebuf_t *sb, int c);
+void MSG_WriteChar (sizebuf_t *sb, unsigned int c);
+void MSG_WriteByte (sizebuf_t *sb, unsigned int c);
+void MSG_WriteShort (sizebuf_t *sb, unsigned int c);
+void MSG_WriteLong (sizebuf_t *sb, unsigned int c);
 void MSG_WriteFloat (sizebuf_t *sb, float f);
 void MSG_WriteString (sizebuf_t *sb, const char *s);
 void MSG_WriteCoord (sizebuf_t *sb, float f);
diff --git a/libs/gamecode/builtins/pr_cmds.c b/libs/gamecode/builtins/pr_cmds.c
index 32faf3ece..49996f56a 100644
--- a/libs/gamecode/builtins/pr_cmds.c
+++ b/libs/gamecode/builtins/pr_cmds.c
@@ -72,6 +72,7 @@ PF_VarString (progs_t *pr, int first)
 	for (len = 0, i = first; i < pr->pr_argc; i++)
 		len += strlen (G_STRING (pr, (OFS_PARM0 + i * 3)));
 	out = Hunk_TempAlloc (len + 1);
+	out[0] = 0;
 	for (i = first; i < pr->pr_argc; i++)
 		strcat (out, G_STRING (pr, (OFS_PARM0 + i * 3)));
 	return out;
diff --git a/libs/util/msg.c b/libs/util/msg.c
index 615c81af5..e96a8b79f 100644
--- a/libs/util/msg.c
+++ b/libs/util/msg.c
@@ -53,7 +53,7 @@ static const char rcsid[] =
 // writing functions
 
 void
-MSG_WriteChar (sizebuf_t *sb, int c)
+MSG_WriteChar (sizebuf_t *sb, unsigned int c)
 {
 	byte       *buf;
 
@@ -62,7 +62,7 @@ MSG_WriteChar (sizebuf_t *sb, int c)
 }
 
 void
-MSG_WriteByte (sizebuf_t *sb, int c)
+MSG_WriteByte (sizebuf_t *sb, unsigned int c)
 {
 	byte       *buf;
 
@@ -71,7 +71,7 @@ MSG_WriteByte (sizebuf_t *sb, int c)
 }
 
 void
-MSG_WriteShort (sizebuf_t *sb, int c)
+MSG_WriteShort (sizebuf_t *sb, unsigned int c)
 {
 	byte       *buf;
 
@@ -81,7 +81,7 @@ MSG_WriteShort (sizebuf_t *sb, int c)
 }
 
 void
-MSG_WriteLong (sizebuf_t *sb, int c)
+MSG_WriteLong (sizebuf_t *sb, unsigned int c)
 {
 	byte       *buf;
 
@@ -97,7 +97,7 @@ MSG_WriteFloat (sizebuf_t *sb, float f)
 {
 	union {
 		float       f;
-		int         l;
+		unsigned int l;
 	} dat;
 
 	dat.f = f;
@@ -118,19 +118,19 @@ MSG_WriteString (sizebuf_t *sb, const char *s)
 void
 MSG_WriteCoord (sizebuf_t *sb, float f)
 {
-	MSG_WriteShort (sb, (int) (f * 8));
+	MSG_WriteShort (sb, (unsigned int) (f * 8));
 }
 
 void
 MSG_WriteAngle (sizebuf_t *sb, float f)
 {
-	MSG_WriteByte (sb, (int) (f * 256 / 360) & 255);
+	MSG_WriteByte (sb, (unsigned int) (f * 256 / 360) & 255);
 }
 
 void
 MSG_WriteAngle16 (sizebuf_t *sb, float f)
 {
-	MSG_WriteShort (sb, (int) (f * 65536 / 360) & 65535);
+	MSG_WriteShort (sb, (unsigned int) (f * 65536 / 360) & 65535);
 }
 
 
diff --git a/libs/util/sizebuf.c b/libs/util/sizebuf.c
index 5dba99f2a..fdf4e0614 100644
--- a/libs/util/sizebuf.c
+++ b/libs/util/sizebuf.c
@@ -64,23 +64,24 @@ SZ_GetSpace (sizebuf_t *buf, int length)
 {
 	void       *data;
 
-	if (buf->cursize + length > buf->maxsize) {
-		if (!buf->allowoverflow)
-			Sys_Error ("SZ_GetSpace: overflow without allowoverflow set (%d)",
-					   buf->maxsize);
-
-		if (length > buf->maxsize)
-			Sys_Error ("SZ_GetSpace: %i is > full buffer size", length);
-
-		Sys_Printf ("SZ_GetSpace: overflow\n");
-		SZ_Clear (buf);
-		buf->overflowed = true;
+	if (buf->cursize + length <= buf->maxsize) {
+getspace:
+		data = buf->data + buf->cursize;
+		buf->cursize += length;
+		return data;
 	}
 
-	data = buf->data + buf->cursize;
-	buf->cursize += length;
+	if (!buf->allowoverflow)
+		Sys_Error ("SZ_GetSpace: overflow without allowoverflow set (%d)",
+				   buf->maxsize);
 
-	return data;
+	if (length > buf->maxsize)
+		Sys_Error ("SZ_GetSpace: %i is > full buffer size", length);
+
+	Sys_Printf ("SZ_GetSpace: overflow\n");
+	SZ_Clear (buf);
+	buf->overflowed = true;
+	goto getspace;
 }
 
 void
diff --git a/qw/source/sv_user.c b/qw/source/sv_user.c
index 587fd35af..f77a7458d 100644
--- a/qw/source/sv_user.c
+++ b/qw/source/sv_user.c
@@ -725,6 +725,7 @@ SV_BeginDownload_f (void)
 
 		while (*name)
 			*p++ = tolower ((int) *name++);
+		*p = 0;
 		name = n;
 	}