diff --git a/lib/dns/spnego.c b/lib/dns/spnego.c
index 373db6a2da..d05e156e9a 100644
--- a/lib/dns/spnego.c
+++ b/lib/dns/spnego.c
@@ -14,7 +14,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: spnego.c,v 1.19 2011/08/26 04:42:24 marka Exp $ */
+/* $Id: spnego.c,v 1.20 2011/08/29 04:15:50 marka Exp $ */
 
 /*! \file
  * \brief
@@ -949,7 +949,8 @@ der_match_tag_and_length(const unsigned char *p, size_t len,
 	if (e)
 		return (e);
 	/* p += l; */
-	/* len -= l; */
+	len -= l;
+	POST(len);
 	ret += l;
 	if (size)
 		*size = ret;
@@ -978,8 +979,9 @@ decode_enumerated(const unsigned char *p, size_t len, void *num, size_t *size)
 	e = der_get_int(p, reallen, num, &l);
 	if (e)
 		return (e);
-	/* p += l; */
-	/* len -= l; */
+	p += l;
+	len -= l;
+	POST(p); POST(len);
 	ret += l;
 	if (size)
 		*size = ret;
@@ -1006,7 +1008,7 @@ decode_octet_string(const unsigned char *p, size_t len,
 	if (e)
 		return (e);
 	p += l;
-	/* len -= l; */
+	len -= l;
 	ret += l;
 	if (len < slen)
 		return (ASN1_OVERRUN);
@@ -1014,8 +1016,9 @@ decode_octet_string(const unsigned char *p, size_t len,
 	e = der_get_octet_string(p, slen, k, &l);
 	if (e)
 		return (e);
-	/* p += l; */
-	/* len -= l; */
+	p += l;
+	len -= l;
+	POST(p); POST(len);
 	ret += l;
 	if (size)
 		*size = ret;
@@ -1050,8 +1053,9 @@ decode_oid(const unsigned char *p, size_t len,
 	e = der_get_oid(p, slen, k, &l);
 	if (e)
 		return (e);
-	/* p += l; */
-	/* len -= l; */
+	p += l;
+	len -= l;
+	POST(p); POST(len);
 	ret += l;
 	if (size)
 		*size = ret;
@@ -1198,6 +1202,7 @@ der_put_octet_string(unsigned char *p, size_t len,
 		return (ASN1_OVERFLOW);
 	p -= data->length;
 	len -= data->length;
+	POST(len);
 	memcpy(p + 1, data->data, data->length);
 	*size = data->length;
 	return (0);
@@ -1261,8 +1266,9 @@ der_put_length_and_tag(unsigned char *p, size_t len, size_t len_val,
 	e = der_put_tag(p, len, class, type, tag, &l);
 	if (e)
 		return (e);
-	/* p -= l; */
-	/* len -= l; */
+	p -= l;
+	len -= l;
+	POST(p); POST(len);
 	ret += l;
 	*size = ret;
 	return (0);
@@ -1285,8 +1291,9 @@ encode_enumerated(unsigned char *p, size_t len, const void *data, size_t *size)
 	e = der_put_length_and_tag(p, len, l, ASN1_C_UNIV, PRIM, UT_Enumerated, &l);
 	if (e)
 		return (e);
-	/* p -= l; */
-	/* len -= l; */
+	p -= l;
+	len -= l;
+	POST(p); POST(len);
 	ret += l;
 	*size = ret;
 	return (0);
@@ -1309,8 +1316,9 @@ encode_octet_string(unsigned char *p, size_t len,
 	e = der_put_length_and_tag(p, len, l, ASN1_C_UNIV, PRIM, UT_OctetString, &l);
 	if (e)
 		return (e);
-	/* p -= l; */
-	/* len -= l; */
+	p -= l;
+	len -= l;
+	POST(p); POST(len);
 	ret += l;
 	*size = ret;
 	return (0);
@@ -1333,8 +1341,9 @@ encode_oid(unsigned char *p, size_t len,
 	e = der_put_length_and_tag(p, len, l, ASN1_C_UNIV, PRIM, UT_OID, &l);
 	if (e)
 		return (e);
-	/* p -= l; */
-	/* len -= l; */
+	p -= l;
+	len -= l;
+	POST(p); POST(len);
 	ret += l;
 	*size = ret;
 	return (0);