diff --git a/BOB.cpp b/BOB.cpp
index 15b7066b..72cbcd16 100644
--- a/BOB.cpp
+++ b/BOB.cpp
@@ -430,8 +430,10 @@ namespace client
 	void BOBCommandSession::SetkeysCommandHandler (const char * operand, size_t len)
 	{
 		LogPrint (eLogDebug, "BOB: setkeys ", operand);
-		m_Keys.FromBase64 (operand);
-		SendReplyOK (m_Keys.GetPublic ()->ToBase64 ().c_str ());
+		if (m_Keys.FromBase64 (operand))
+			SendReplyOK (m_Keys.GetPublic ()->ToBase64 ().c_str ());
+		else
+			SendReplyError ("invalid keys");
 	}
 		
 	void BOBCommandSession::GetkeysCommandHandler (const char * operand, size_t len)
diff --git a/Identity.cpp b/Identity.cpp
index b9fd7199..15abe62a 100644
--- a/Identity.cpp
+++ b/Identity.cpp
@@ -455,8 +455,9 @@ namespace data
 		
 	size_t PrivateKeys::FromBuffer (const uint8_t * buf, size_t len)
 	{
-		m_Public = std::make_shared<IdentityEx>(buf, len);
-		size_t ret = m_Public->GetFullLen ();
+		m_Public = std::make_shared<IdentityEx>();
+		size_t ret = m_Public->FromBuffer (buf, len);
+		if (!ret || ret + 256 > len) return 0; // overflow	
 		memcpy (m_PrivateKey, buf + ret, 256); // private key always 256
 		ret += 256;
 		size_t signingPrivateKeySize = m_Public->GetSigningPrivateKeyLen ();
diff --git a/SAM.cpp b/SAM.cpp
index d89750f2..017a7634 100644
--- a/SAM.cpp
+++ b/SAM.cpp
@@ -875,7 +875,7 @@ namespace client
 		if (destination != "")
 		{
 			i2p::data::PrivateKeys keys;
-			keys.FromBase64 (destination);
+			if (!keys.FromBase64 (destination)) return nullptr;
 			localDestination = i2p::client::context.CreateNewLocalDestination (keys, true, params);
 		}
 		else // transient