diff --git a/cmd-list-buffers.c b/cmd-list-buffers.c
index eb5d75dc..287736ab 100644
--- a/cmd-list-buffers.c
+++ b/cmd-list-buffers.c
@@ -1,4 +1,4 @@
-/* $Id: cmd-list-buffers.c,v 1.13 2009-11-14 17:56:39 tcunha Exp $ */
+/* $Id: cmd-list-buffers.c,v 1.14 2009-11-28 14:54:12 tcunha Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -63,7 +63,7 @@ cmd_list_buffers_exec(struct cmd *self, struct cmd_ctx *ctx)
 		strvisx(tmp, pb->data, len, VIS_OCTAL|VIS_TAB|VIS_NL);
 
 		/*
-		 * If the first 50 characterswere encoded as a longer string,
+		 * If the first 50 characters were encoded as a longer string,
 		 * or there is definitely more data, add "...".
 		 */
 		if (size > 50 || strlen(tmp) > 50) {
diff --git a/cmd-load-buffer.c b/cmd-load-buffer.c
index 3abe5c86..7114fda4 100644
--- a/cmd-load-buffer.c
+++ b/cmd-load-buffer.c
@@ -1,4 +1,4 @@
-/* $Id: cmd-load-buffer.c,v 1.12 2009-11-14 17:56:39 tcunha Exp $ */
+/* $Id: cmd-load-buffer.c,v 1.13 2009-11-28 14:54:12 tcunha Exp $ */
 
 /*
  * Copyright (c) 2009 Tiago Cunha <me@tiagocunha.org>
@@ -50,7 +50,8 @@ cmd_load_buffer_exec(struct cmd *self, struct cmd_ctx *ctx)
 	struct session		*s;
 	struct stat		 sb;
 	FILE			*f;
-	u_char		      	*buf;
+	char		      	*pdata = NULL;
+	size_t			 psize;
 	u_int			 limit;
 
 	if ((s = cmd_find_session(ctx, data->target)) == NULL)
@@ -63,39 +64,45 @@ cmd_load_buffer_exec(struct cmd *self, struct cmd_ctx *ctx)
 
 	if (fstat(fileno(f), &sb) < 0) {
 		ctx->error(ctx, "%s: %s", data->arg, strerror(errno));
-		fclose(f);
-		return (-1);
+		goto error;
 	}
+	if (sb.st_size > SIZE_MAX) {
+		ctx->error(ctx, "%s: file too large", data->arg);
+		goto error;
+	}
+	psize = (size_t) sb.st_size;
 
 	/*
 	 * We don't want to die due to memory exhaustion, hence xmalloc can't
 	 * be used here.
 	 */
-	if ((buf = malloc(sb.st_size + 1)) == NULL) {
+	if ((pdata = malloc(psize)) == NULL) {
 		ctx->error(ctx, "malloc error: %s", strerror(errno));
-		fclose(f);
-		return (-1);
+		goto error;
 	}
 
-	if (fread(buf, 1, sb.st_size, f) != (size_t) sb.st_size) {
+	if (fread(pdata, 1, psize, f) != psize) {
 		ctx->error(ctx, "%s: fread error", data->arg);
-		xfree(buf);
-		fclose(f);
-		return (-1);
+		goto error;
 	}
 
 	fclose(f);
 
 	limit = options_get_number(&s->options, "buffer-limit");
 	if (data->buffer == -1) {
-		paste_add(&s->buffers, buf, sb.st_size, limit);
+		paste_add(&s->buffers, pdata, psize, limit);
 		return (0);
 	}
-	if (paste_replace(&s->buffers, data->buffer, buf, sb.st_size) != 0) {
+	if (paste_replace(&s->buffers, data->buffer, pdata, psize) != 0) {
 		ctx->error(ctx, "no buffer %d", data->buffer);
-		xfree(buf);
-		return (-1);
+		goto error;
 	}
 
 	return (0);
+
+error:
+	if (pdata != NULL)
+		xfree(pdata);
+	fclose(f);
+	return (-1);
 }
diff --git a/cmd-paste-buffer.c b/cmd-paste-buffer.c
index b26780d6..7860e3a7 100644
--- a/cmd-paste-buffer.c
+++ b/cmd-paste-buffer.c
@@ -1,4 +1,4 @@
-/* $Id: cmd-paste-buffer.c,v 1.22 2009-11-14 17:56:39 tcunha Exp $ */
+/* $Id: cmd-paste-buffer.c,v 1.23 2009-11-28 14:54:12 tcunha Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -62,7 +62,7 @@ cmd_paste_buffer_exec(struct cmd *self, struct cmd_ctx *ctx)
 		}
 	}
 
-	if (pb != NULL && *pb->data != '\0') {
+	if (pb != NULL) {
 		/* -r means raw data without LF->CR conversion. */
 		if (cmd_check_flag(data->chflags, 'r'))
 			bufferevent_write(wp->event, pb->data, pb->size);
diff --git a/cmd-set-buffer.c b/cmd-set-buffer.c
index b7a35451..dfcd1473 100644
--- a/cmd-set-buffer.c
+++ b/cmd-set-buffer.c
@@ -1,4 +1,4 @@
-/* $Id: cmd-set-buffer.c,v 1.11 2009-11-14 17:56:39 tcunha Exp $ */
+/* $Id: cmd-set-buffer.c,v 1.12 2009-11-28 14:54:12 tcunha Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -45,7 +45,7 @@ cmd_set_buffer_exec(struct cmd *self, struct cmd_ctx *ctx)
 	struct cmd_buffer_data	*data = self->data;
 	struct session		*s;
 	u_int			 limit;
-	u_char			*pdata;
+	char			*pdata;
 	size_t			 psize;
 
 	if ((s = cmd_find_session(ctx, data->target)) == NULL)
diff --git a/paste.c b/paste.c
index 1cd83bff..ec9eefb3 100644
--- a/paste.c
+++ b/paste.c
@@ -1,4 +1,4 @@
-/* $Id: paste.c,v 1.11 2009-11-04 22:39:20 tcunha Exp $ */
+/* $Id: paste.c,v 1.12 2009-11-28 14:54:12 tcunha Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -23,6 +23,11 @@
 
 #include "tmux.h"
 
+/*
+ * Stack of paste buffers. Note that paste buffer data is not necessarily a C
+ * string!
+ */
+
 void
 paste_init_stack(struct paste_stack *ps)
 {
@@ -36,6 +41,7 @@ paste_free_stack(struct paste_stack *ps)
 		;
 }
 
+/* Return each item of the stack in turn. */
 struct paste_buffer *
 paste_walk_stack(struct paste_stack *ps, uint *idx)
 {
@@ -46,6 +52,7 @@ paste_walk_stack(struct paste_stack *ps, uint *idx)
 	return (pb);
 }
 
+/* Get the top item on the stack. */
 struct paste_buffer *
 paste_get_top(struct paste_stack *ps)
 {
@@ -54,6 +61,7 @@ paste_get_top(struct paste_stack *ps)
 	return (ARRAY_FIRST(ps));
 }
 
+/* Get an item by its index. */
 struct paste_buffer *
 paste_get_index(struct paste_stack *ps, u_int idx)
 {
@@ -62,6 +70,7 @@ paste_get_index(struct paste_stack *ps, u_int idx)
 	return (ARRAY_ITEM(ps, idx));
 }
 
+/* Free the top item on the stack. */
 int
 paste_free_top(struct paste_stack *ps)
 {
@@ -79,6 +88,7 @@ paste_free_top(struct paste_stack *ps)
 	return (0);
 }
 
+/* Free an item by index. */
 int
 paste_free_index(struct paste_stack *ps, u_int idx)
 {
@@ -96,12 +106,16 @@ paste_free_index(struct paste_stack *ps, u_int idx)
 	return (0);
 }
 
+/* 
+ * Add an item onto the top of the stack, freeing the bottom if at limit. Note
+ * that the caller is responsible for allocating data.
+ */
 void
-paste_add(struct paste_stack *ps, u_char *data, size_t size, u_int limit)
+paste_add(struct paste_stack *ps, char *data, size_t size, u_int limit)
 {
 	struct paste_buffer	*pb;
 
-	if (*data == '\0')
+	if (size == 0)
 		return;
 
 	while (ARRAY_LENGTH(ps) >= limit) {
@@ -118,11 +132,19 @@ paste_add(struct paste_stack *ps, u_char *data, size_t size, u_int limit)
 	pb->size = size;
 }
 
+
+/* 
+ * Replace an item on the stack. Note that the caller is responsible for
+ * allocating data.
+ */
 int
-paste_replace(struct paste_stack *ps, u_int idx, u_char *data, size_t size)
+paste_replace(struct paste_stack *ps, u_int idx, char *data, size_t size)
 {
 	struct paste_buffer	*pb;
 
+	if (size == 0)
+		return (0);
+
 	if (idx >= ARRAY_LENGTH(ps))
 		return (-1);
 
diff --git a/status.c b/status.c
index fe8aa608..92df2f18 100644
--- a/status.c
+++ b/status.c
@@ -1,4 +1,4 @@
-/* $Id: status.c,v 1.137 2009-11-28 14:50:37 tcunha Exp $ */
+/* $Id: status.c,v 1.138 2009-11-28 14:54:12 tcunha Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -882,6 +882,7 @@ status_prompt_key(struct client *c, int key)
 {
 	struct paste_buffer	*pb;
 	char   			*s, *first, *last, word[64], swapc;
+	u_char			 ch;
 	size_t			 size, n, off, idx;
 
 	size = strlen(c->prompt_buffer);
@@ -1023,7 +1024,8 @@ status_prompt_key(struct client *c, int key)
 		if ((pb = paste_get_top(&c->session->buffers)) == NULL)
 			break;
 		for (n = 0; n < pb->size; n++) {
-			if (pb->data[n] < 32 || pb->data[n] == 127)
+			ch = (u_char) pb->data[n];
+			if (ch < 32 || ch == 127)
 				break;
 		}
 
diff --git a/tmux.h b/tmux.h
index 45dbabc8..b4f6c52b 100644
--- a/tmux.h
+++ b/tmux.h
@@ -1,4 +1,4 @@
-/* $Id: tmux.h,v 1.524 2009-11-28 14:50:37 tcunha Exp $ */
+/* $Id: tmux.h,v 1.525 2009-11-28 14:54:12 tcunha Exp $ */
 
 /*
  * Copyright (c) 2007 Nicholas Marriott <nicm@users.sourceforge.net>
@@ -883,7 +883,7 @@ struct layout_cell {
 
 /* Paste buffer. */
 struct paste_buffer {
-     	char		*data;
+	char		*data;
 	size_t		 size;
 };
 ARRAY_DECL(paste_stack, struct paste_buffer *);
@@ -1402,8 +1402,8 @@ struct paste_buffer *paste_get_top(struct paste_stack *);
 struct paste_buffer *paste_get_index(struct paste_stack *, u_int);
 int	     	 paste_free_top(struct paste_stack *);
 int		 paste_free_index(struct paste_stack *, u_int);
-void		 paste_add(struct paste_stack *, u_char *, size_t, u_int);
-int		 paste_replace(struct paste_stack *, u_int, u_char *, size_t);
+void		 paste_add(struct paste_stack *, char *, size_t, u_int);
+int		 paste_replace(struct paste_stack *, u_int, char *, size_t);
 
 /* clock.c */
 extern const char clock_table[14][5][5];