diff --git a/src/core/mac/mac_frame.hpp b/src/core/mac/mac_frame.hpp
index 1d1f4df43..c3b964abf 100644
--- a/src/core/mac/mac_frame.hpp
+++ b/src/core/mac/mac_frame.hpp
@@ -735,8 +735,9 @@ public:
      *
      */
     void SetNetworkName(const char *aNetworkName) {
+        int length = strnlen(aNetworkName, sizeof(mNetworkName));
         memset(mNetworkName, 0, sizeof(mNetworkName));
-        strncpy(mNetworkName, aNetworkName, sizeof(mNetworkName));
+        memcpy(mNetworkName, aNetworkName, length);
     }
 
     /**
diff --git a/src/core/mac/mac_whitelist.cpp b/src/core/mac/mac_whitelist.cpp
index da534bd30..e1ed1cf1f 100644
--- a/src/core/mac/mac_whitelist.cpp
+++ b/src/core/mac/mac_whitelist.cpp
@@ -87,7 +87,7 @@ Whitelist::Entry *Whitelist::Add(const ExtAddress &address)
             continue;
         }
 
-        memcpy(&mWhitelist[i], &address, sizeof(mWhitelist[i]));
+        memcpy(&mWhitelist[i].mExtAddress, &address, sizeof(mWhitelist[i].mExtAddress));
         mWhitelist[i].mValid = true;
         mWhitelist[i].mConstantRssi = false;
         ExitNow(rval = &mWhitelist[i]);
diff --git a/src/core/thread/mesh_forwarder.cpp b/src/core/thread/mesh_forwarder.cpp
index ef1af8cc7..c38883670 100644
--- a/src/core/thread/mesh_forwarder.cpp
+++ b/src/core/thread/mesh_forwarder.cpp
@@ -450,6 +450,7 @@ ThreadError MeshForwarder::UpdateIp6Route(Message &aMessage)
 {
     ThreadError error = kThreadError_None;
     Ip6::Header ip6Header;
+    uint16_t rloc16;
     Neighbor *neighbor;
 
     mAddMeshHeader = false;
@@ -469,7 +470,9 @@ ThreadError MeshForwarder::UpdateIp6Route(Message &aMessage)
             // FFD - peform full routing
             if (mMle.IsRoutingLocator(ip6Header.GetDestination()))
             {
-                mMeshDest = HostSwap16(ip6Header.GetDestination().m16[7]);
+                rloc16 = HostSwap16(ip6Header.GetDestination().m16[7]);
+                VerifyOrExit(mMle.GetRouterId(rloc16) < Mle::kMaxRouterId, error = kThreadError_Drop);
+                mMeshDest = rloc16;
             }
             else if ((neighbor = mMle.GetNeighbor(ip6Header.GetDestination())) != NULL)
             {
diff --git a/src/core/thread/mle.hpp b/src/core/thread/mle.hpp
index 2d1c2ebf9..a4a23cb9d 100644
--- a/src/core/thread/mle.hpp
+++ b/src/core/thread/mle.hpp
@@ -278,7 +278,7 @@ public:
      *
      */
     Command GetCommand(void) const {
-        const uint8_t *command = mKeyIdentifier + (IsKeyIdMode1() ? 1 : 5);
+        const uint8_t *command = IsKeyIdMode1() ? mKeyIdentifier + 1 : &mCommand;
         return static_cast<Command>(*command);
     }
 
@@ -289,7 +289,7 @@ public:
      *
      */
     void SetCommand(Command aCommand) {
-        uint8_t *commandField = mKeyIdentifier + (IsKeyIdMode1() ? 1 : 5);
+        uint8_t *commandField = IsKeyIdMode1() ? mKeyIdentifier + 1 : &mCommand;
         *commandField = static_cast<uint8_t>(aCommand);
     }
 
diff --git a/src/core/thread/mle_router.cpp b/src/core/thread/mle_router.cpp
index 123af6bfd..8087b2957 100644
--- a/src/core/thread/mle_router.cpp
+++ b/src/core/thread/mle_router.cpp
@@ -802,7 +802,7 @@ ThreadError MleRouter::HandleLinkAccept(const Message &aMessage, const Ip6::Mess
         mleFrameCounter.SetFrameCounter(linkFrameCounter.GetFrameCounter());
     }
 
-    routerId = GetRouterId(sourceAddress.GetRloc16());
+    VerifyOrExit((routerId = GetRouterId(sourceAddress.GetRloc16())) < kMaxRouterId, error = kThreadError_Parse);
 
     if (routerId != mRouterId)
     {
@@ -1134,7 +1134,8 @@ ThreadError MleRouter::HandleAdvertisement(const Message &aMessage, const Ip6::M
         SuccessOrExit(error = ProcessRouteTlv(route));
     }
 
-    routerId = GetRouterId(sourceAddress.GetRloc16());
+    VerifyOrExit((routerId = GetRouterId(sourceAddress.GetRloc16())) < kMaxRouterId, error = kThreadError_Parse);
+
     router = NULL;
 
     switch (GetDeviceState())
@@ -2164,21 +2165,26 @@ exit:
 
 uint16_t MleRouter::GetNextHop(uint16_t aDestination) const
 {
-    uint8_t nexthop;
+    uint16_t nextHopRloc16 = Mac::kShortAddrInvalid;
+    uint8_t nextHopRouterId;
+    uint8_t routerId;
 
     if (mDeviceState == kDeviceStateChild)
     {
-        return Mle::GetNextHop(aDestination);
+        ExitNow(nextHopRloc16 = Mle::GetNextHop(aDestination));
     }
 
-    nexthop = mRouters[GetRouterId(aDestination)].mNextHop;
+    routerId = GetRouterId(aDestination);
 
-    if (nexthop == kMaxRouterId || mRouters[nexthop].mState == Neighbor::kStateInvalid)
+    if (routerId < kMaxRouterId)
     {
-        return Mac::kShortAddrInvalid;
+        nextHopRouterId = mRouters[routerId].mNextHop;
+        VerifyOrExit(nextHopRouterId != kMaxRouterId && mRouters[nextHopRouterId].mState != Neighbor::kStateInvalid, ;);
+        nextHopRloc16 = GetRloc16(mRouters[nextHopRouterId].mNextHop);
     }
 
-    return GetRloc16(nexthop);
+exit:
+    return nextHopRloc16;
 }
 
 uint8_t MleRouter::GetRouteCost(uint16_t aRloc16) const
@@ -2406,6 +2412,7 @@ void MleRouter::HandleAddressSolicitResponse(Message &aMessage)
     ThreadStatusTlv statusTlv;
     ThreadRloc16Tlv rlocTlv;
     ThreadRouterMaskTlv routerMaskTlv;
+    uint8_t routerId;
     bool old;
 
     SuccessOrExit(header.FromMessage(aMessage));
@@ -2423,12 +2430,13 @@ void MleRouter::HandleAddressSolicitResponse(Message &aMessage)
 
     SuccessOrExit(ThreadTlv::GetTlv(aMessage, ThreadTlv::kRloc16, sizeof(rlocTlv), rlocTlv));
     VerifyOrExit(rlocTlv.IsValid(), ;);
+    VerifyOrExit((routerId = GetRouterId(rlocTlv.GetRloc16())) < kMaxRouterId, ;);
 
     SuccessOrExit(ThreadTlv::GetTlv(aMessage, ThreadTlv::kRouterMask, sizeof(routerMaskTlv), routerMaskTlv));
     VerifyOrExit(routerMaskTlv.IsValid(), ;);
 
     // assign short address
-    mRouterId = GetRouterId(rlocTlv.GetRloc16());
+    mRouterId = routerId;
     mPreviousRouterId = mRouterId;
     SuccessOrExit(SetStateRouter(GetRloc16(mRouterId)));
     mRouters[mRouterId].mCost = 0;
@@ -2639,7 +2647,8 @@ void MleRouter::HandleAddressRelease(Coap::Header &aHeader, Message &aMessage,
     SuccessOrExit(error = ThreadTlv::GetTlv(aMessage, ThreadTlv::kExtMacAddress, sizeof(macAddr64Tlv), macAddr64Tlv));
     VerifyOrExit(macAddr64Tlv.IsValid(), error = kThreadError_Parse);
 
-    routerId = GetRouterId(rlocTlv.GetRloc16());
+    VerifyOrExit((routerId = GetRouterId(rlocTlv.GetRloc16())) < kMaxRouterId, error = kThreadError_Parse);
+
     router = &mRouters[routerId];
     VerifyOrExit(memcmp(&router->mMacAddr, macAddr64Tlv.GetMacAddr(), sizeof(router->mMacAddr)) == 0, ;);
 
diff --git a/src/core/thread/network_data.cpp b/src/core/thread/network_data.cpp
index a5bd91a7a..a05c34fe6 100644
--- a/src/core/thread/network_data.cpp
+++ b/src/core/thread/network_data.cpp
@@ -149,7 +149,12 @@ void NetworkData::RemoveTemporaryData(uint8_t *aData, uint8_t &aDataLength, Pref
             case NetworkDataTlv::kTypeBorderRouter:
             {
                 borderRouter = FindBorderRouter(aPrefix);
-                context = FindContext(aPrefix);
+
+                if ((context = FindContext(aPrefix)) == NULL)
+                {
+                    break;
+                }
+
                 contextId = context->GetContextId();
 
                 // replace p_border_router_16