diff --git a/src/bind.c b/src/bind.c
index 2111735..e0cf1a3 100644
--- a/src/bind.c
+++ b/src/bind.c
@@ -67,7 +67,7 @@ gt_setup_secretkey(struct mud *mud, const char *keyfile)
             break;
         }
 
-        size += r;
+        size += (size_t)r;
     }
 
     close(fd);
@@ -312,15 +312,15 @@ gt_bind(int argc, char **argv)
         if (FD_ISSET(mud_fd, &rfds)) {
             const int r = mud_recv(mud, buf, sizeof(buf));
 
-            if (ip_is_valid(buf, r))
-                tun_write(tun_fd, buf, r);
+            if (r > 0 && ip_is_valid(buf, r))
+                tun_write(tun_fd, buf, (size_t)r);
         }
 
         if (FD_ISSET(tun_fd, &rfds) && !mud_send_wait(mud)) {
             struct ip_common ic;
             const int r = tun_read(tun_fd, buf, sizeof(buf));
 
-            if (!ip_get_common(&ic, buf, r)) {
+            if (r > 0 && !ip_get_common(&ic, buf, r)) {
              // TODO: disable hash for now
              // unsigned char hash[crypto_shorthash_BYTES];
              // crypto_shorthash(hash, (const unsigned char *)&ic, sizeof(ic), hashkey);
@@ -328,7 +328,7 @@ gt_bind(int argc, char **argv)
                 unsigned h = 0;
              // memcpy(&h, hash, sizeof(h));
 
-                mud_send(mud, buf, r, (h << 8) | ic.tc);
+                mud_send(mud, buf, (size_t)r, (h << 8) | ic.tc);
             }
         }
     }