          assert(vlen >= dlen);
          vlen -= dlen;
          e = APR_BUCKET_NEXT(e);
+     }
+ 
++    if (!(dest[-1] == '\n')) return APR_EBADARG;
+     assert(dest[-1] == '\n');
+ 
+     if (dest[-2] == '\r')

         assert(nlen >= len);
         end->iov_len = len;
         nlen -= len;
@@ -103,6 +105,8 @@ static apr_status_t split_header_line(apreq_param_t **p,
         if (s != APR_SUCCESS)
             return s;
 

         assert(glen >= dlen);
         glen -= dlen;
         e = APR_BUCKET_NEXT(e);
     }
 
     /* copy value */
+    if (!(vlen > 0)) return APR_EBADARG;
     assert(vlen > 0);
     dest = v->data;
     while (vlen > 0) {
@@ -119,11 +124,13 @@ static apr_status_t split_header_line(apreq_param_t **p,
 
         memcpy(dest, data, dlen);
         dest += dlen;
