diff --git a/client.c b/client.c
index 38fe52cd..a36c6471 100644
--- a/client.c
+++ b/client.c
@@ -601,8 +601,8 @@ client_read_callback(__unused struct bufferevent *bev, void *arg)
 
 		if (bsize == 0)
 			break;
-		if (bsize > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
-			bsize = MAX_IMSGSIZE - IMSG_HEADER_SIZE;
+		if (bsize > MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg)
+			bsize = MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg;
 		log_debug("read %zu from file %d", bsize, cf->stream);
 
 		msglen = (sizeof *msg) + bsize;
diff --git a/file.c b/file.c
index 7e1f1879..9a3e79de 100644
--- a/file.c
+++ b/file.c
@@ -376,8 +376,8 @@ file_push(struct client_file *cf)
 	left = EVBUFFER_LENGTH(cf->buffer);
 	while (left != 0) {
 		sent = left;
-		if (sent > MAX_IMSGSIZE - IMSG_HEADER_SIZE)
-			sent = MAX_IMSGSIZE - IMSG_HEADER_SIZE;
+		if (sent > MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg)
+			sent = MAX_IMSGSIZE - IMSG_HEADER_SIZE - sizeof *msg;
 
 		msglen = (sizeof *msg) + sent;
 		msg = xrealloc(msg, msglen);