diff --git a/src/core/thread/mle_router.cpp b/src/core/thread/mle_router.cpp
index 98506b140..4c20555cb 100644
--- a/src/core/thread/mle_router.cpp
+++ b/src/core/thread/mle_router.cpp
@@ -2768,6 +2768,11 @@ ThreadError MleRouter::AppendChildAddresses(Message &aMessage, Child &aChild)
 
     for (size_t i = 0; i < sizeof(aChild.mIp6Address) / sizeof(aChild.mIp6Address[0]); i++)
     {
+        if (aChild.mIp6Address[i].IsUnspecified())
+        {
+            break;
+        }
+
         if (mNetworkData.GetContext(aChild.mIp6Address[i], context) == kThreadError_None)
         {
             // compressed entry
diff --git a/src/core/thread/mle_tlvs.hpp b/src/core/thread/mle_tlvs.hpp
index b3f289dfc..176aea228 100644
--- a/src/core/thread/mle_tlvs.hpp
+++ b/src/core/thread/mle_tlvs.hpp
@@ -1362,7 +1362,7 @@ public:
             aIndex--;
         }
 
-        return entry;
+        return (cur < end) ? entry : NULL;
     }
 
 private: