          assert(vlen >= dlen);
          vlen -= dlen;
          e = APR_BUCKET_NEXT(e);
+     }
+ 
++    if (!(dest[-1] == '\n')) return APR_EBADARG;
+     assert(dest[-1] == '\n');
+ 
+     if (dest[-2] == '\r')

         assert(glen >= dlen);
         glen -= dlen;
         e = APR_BUCKET_NEXT(e);
@@ -119,6 +123,7 @@ static apr_status_t split_header_line(apreq_param_t **p,
 
         memcpy(dest, data, dlen);
         dest += dlen;

diff --git a/server/apreq_parser_header.c b/server/apreq_parser_header.c
index 19588be..ede2acf 100644
--- a/server/apreq_parser_header.c
+++ b/server/apreq_parser_header.c
@@ -89,6 +89,8 @@ static apr_status_t split_header_line(apreq_param_t **p,
