diff --git a/cups/jwt.c b/cups/jwt.c
index a06bc6db3..a51003a47 100644
--- a/cups/jwt.c
+++ b/cups/jwt.c
@@ -405,7 +405,12 @@ cupsJWTHasValidSignature(
   if (!jwt || !jwt->signature || !jwk)
     return (false);
 
-  DEBUG_printf("1cupsJWTHasValidSignature: sigalg=%d, orig sig[%u]=<%02X%02X%02X%02X...%02X%02X%02X%02X>", jwt->sigalg, (unsigned)jwt->sigsize, jwt->signature[0], jwt->signature[1], jwt->signature[2], jwt->signature[3], jwt->signature[jwt->sigsize - 4], jwt->signature[jwt->sigsize - 3], jwt->signature[jwt->sigsize - 2], jwt->signature[jwt->sigsize - 1]);
+#ifdef DEBUG
+  if (jwt->sigsize >= 8)
+    DEBUG_printf("1cupsJWTHasValidSignature: sigalg=%d, orig sig[%u]=<%02X%02X%02X%02X...%02X%02X%02X%02X>", jwt->sigalg, (unsigned)jwt->sigsize, jwt->signature[0], jwt->signature[1], jwt->signature[2], jwt->signature[3], jwt->signature[jwt->sigsize - 4], jwt->signature[jwt->sigsize - 3], jwt->signature[jwt->sigsize - 2], jwt->signature[jwt->sigsize - 1]);
+  else
+    DEBUG_printf("1cupsJWTHasValidSignature: sigalg=%d, orig sig[%u]=<...>", jwt->sigalg, (unsigned)jwt->sigsize);
+#endif // DEBUG
 
   switch (jwt->sigalg)
   {
diff --git a/cups/tls-openssl.c b/cups/tls-openssl.c
index a1a8b0533..8712ac90a 100644
--- a/cups/tls-openssl.c
+++ b/cups/tls-openssl.c
@@ -1210,7 +1210,7 @@ cupsSignCredentialsRequest(
 #ifdef DEBUG
     char *tempptr;				// Pointer into string
 
-    for (j = 0, tempptr = temp; j < datalen; j ++, tempptr += 2)
+    for (j = 0, tempptr = temp; j < datalen && tempptr < (temp + sizeof(temp) - 2); j ++, tempptr += 2)
       snprintf(tempptr, sizeof(temp) - (size_t)(tempptr - temp), "%02X", data[j]);
 
     DEBUG_printf("1cupsSignCredentialsRequest: EXT%d=%s", OBJ_obj2nid(obj), temp);