diff --git a/c/helper.c b/c/helper.c
--- a/c/helper.c
+++ b/c/helper.c
@@ -110,9 +110,9 @@
 
 	ExpandKey(key, expkey);
 	for (i = 0; i < totlen; i += 16) {
-		//Encrypt(tmp + i, expkey, buff);
+		Encrypt(tmp + i, expkey, buff);
 
-		//memcpy(tmp + 1, buff, 16);
+		memcpy(tmp + i, buff, 16);
 	}
 
 	encoded_len = (totlen + 2 - ((totlen + 2) % 3)) / 3 * 4;
@@ -132,11 +132,11 @@
 	uchar buff[16];
 	uint outlen;
 	uint hash, orig_hash;
-	uint orig_len;
+	uint32_t orig_len;
 
 	if (! len % 4) return 0;
 	outlen = len / 4 * 3;
-	out = alloca(outlen);
+	out = alloca(outlen + 16 - (outlen % 16));
 
 	if (! base64_dec(out, in, len)) {
 		return 0;
@@ -144,14 +144,14 @@
 
 	ExpandKey(key, expkey);
 
-	for (i = 0; i < len; i += 16) {
-		//Decrypt(out + i, expkey, buff);
-
-		//memcpy(out + i, buff, 16);
+	for (i = 0; i < outlen; i += 16) {
+		Decrypt(out + i, expkey, buff);
+		memcpy(out + i, buff, 16);
 	}
 
 	orig_hash = *((uint*) out);
-	orig_len = *(out + 4);
+	orig_len = *((uint32_t*) (out + 4));
+	if (orig_len > outlen) return 0;
 	get_hash(&hash, out + 8, orig_len);
 	if (orig_hash != hash) {
 		return 0;
diff --git a/clientsession.cabal b/clientsession.cabal
--- a/clientsession.cabal
+++ b/clientsession.cabal
@@ -1,5 +1,5 @@
 name:            clientsession
-version:         0.4.0
+version:         0.4.0.1
 license:         BSD3
 license-file:    LICENSE
 author:          Michael Snoyman <michael@snoyman.com>
@@ -32,7 +32,9 @@
         cpp-options:   -DTEST
         build-depends: test-framework,
                        test-framework-quickcheck2,
-                       QuickCheck >= 2 && < 3
+                       test-framework-hunit,
+                       QuickCheck >= 2 && < 3,
+                       HUnit
     else
         Buildable: False
     ghc-options:     -Wall
diff --git a/runtests.hs b/runtests.hs
--- a/runtests.hs
+++ b/runtests.hs
@@ -4,8 +4,11 @@
 import Test.Framework (defaultMain)
 import Test.QuickCheck
 import Test.Framework.Providers.QuickCheck2
+import Test.Framework.Providers.HUnit
+import Test.HUnit
 
 import qualified Data.ByteString as S
+import qualified Data.ByteString.Char8 as S8
 
 import Web.ClientSession
 import System.IO.Unsafe
@@ -17,6 +20,7 @@
     , testProperty "encrypt/decrypt failure" propEncDecFailure
     , testProperty "AES encrypt/decrypt success" propAES
     , testProperty "AES encryption changes bs" propAESChanges
+    , testCase "specific values" caseSpecific
     ]
 
 propEncDec :: S.ByteString -> Bool
@@ -38,6 +42,14 @@
 
 propAESChanges :: S.ByteString -> S.ByteString -> Bool
 propAESChanges key bs = encrypt key bs /= bs
+
+caseSpecific :: Assertion
+caseSpecific = do
+    let s = S8.pack $ show [("lo\ENQ\143XAq","\DC2\207\226\DC1;.z56|\203\222"),("\USnu#\139\ETXB\201 ","l"),("\RS\b,zM2U\184\191F)\EOT\220S\NUL","O\\\GSd\247\246\n\EOT\SYN\182U2G"),("\219\NAK\217\CAN\252","ym\STX\188\232?\\\145"),("\239k","\vRZP\a\DC2F>"),("\FS\180P &\RS\174zSL\\?@","p\170\237vZ|\GS>\SYNk\176n\r"),("","\199D\DC3\200m)"),("6\152tVhB\246)9","\ENQdfU\SUB"),("I\ACK\181\NUL","\129\&6s\130q\US)oR1\197\FSp\US\SYN0"),("\183\200<\250","\211  \131g4\207N\155"),("\248O6k\CANK\135\234.","`\205!+&Z&9\DLE\244\214HP\SI\161"),("\"I'\ACK\149 \CAN\197","\141N\201\SO\204\\o.\128\148")]
+    key <- getDefaultKey
+    Just s @=? decrypt key (encrypt key s)
+    let s' = S.concat $ replicate 500 s
+    Just s' @=? decrypt key (encrypt key s')
 
 instance Arbitrary S.ByteString where
     arbitrary = S.pack `fmap` arbitrary