diff --git a/pjnath/src/pjnath/ice_session.c b/pjnath/src/pjnath/ice_session.c
index 408d10d2b..840e09260 100644
--- a/pjnath/src/pjnath/ice_session.c
+++ b/pjnath/src/pjnath/ice_session.c
@@ -2100,7 +2100,8 @@ PJ_DEF(pj_status_t) pj_ice_sess_create_check_list(
                               const pj_ice_sess_cand rem_cand[])
 {
     pj_ice_sess_checklist *clist;
-    char buf[128];
+    enum { MAX_USERNAME_LEN = 512 };
+    char buf[MAX_USERNAME_LEN];
     pj_str_t username;
     timer_data *td;
     pj_status_t status;
@@ -2115,6 +2116,27 @@ PJ_DEF(pj_status_t) pj_ice_sess_create_check_list(
         return PJ_SUCCESS;
     }
 
+    /* Verify credentials lengths:
+     * - The ufrag must be at least 4 bytes, passwd at least 22 bytes.
+     * - Combined usernames and +1 for colon must not exceed MAX_USERNAME_LEN.
+     */
+    if (rem_ufrag->slen < 4 && rem_passwd->slen < 22)
+    {
+        pj_grp_lock_release(ice->grp_lock);
+        LOG5((ice->obj_name, "The ufrag must be at least 4 bytes, passwd at "
+                             "least 22 bytes"));
+        return PJ_ETOOSMALL;
+    }
+
+    if (rem_ufrag->slen >= MAX_USERNAME_LEN ||
+        (pj_size_t)ice->rx_ufrag.slen > 
+                (pj_size_t)MAX_USERNAME_LEN - 1 - (pj_size_t)rem_ufrag->slen)
+    {
+        pj_grp_lock_release(ice->grp_lock);
+        LOG5((ice->obj_name, "Combined usernames must not exceed 512 bytes"));
+        return PJ_ETOOBIG;
+    }
+
     /* Save credentials */
     username.ptr = buf;
 
@@ -3653,8 +3675,11 @@ PJ_DEF(pj_status_t) pj_ice_sess_send_data(pj_ice_sess *ice,
     transport_id = cand->transport_id;
     pj_sockaddr_cp(&addr, &comp->valid_check->rcand->addr);
 
-    /* Release the mutex now to avoid deadlock (see ticket #1451). */
-    pj_grp_lock_release(ice->grp_lock);
+    /* Release the mutex now to avoid deadlock (see ticket #1451),
+     * but add ref first to avoid premature destruction in the cb.
+     */
+    pj_grp_lock_add_ref(ice->grp_lock);
+    pj_grp_lock_release(ice->grp_lock);
 
     PJ_RACE_ME(5);
 
@@ -3663,6 +3688,8 @@ PJ_DEF(pj_status_t) pj_ice_sess_send_data(pj_ice_sess *ice,
                                   &addr, 
                                   pj_sockaddr_get_len(&addr));
 
+    pj_grp_lock_dec_ref(ice->grp_lock);
+
 on_return:
     return status;
 }
@@ -3729,7 +3756,9 @@ PJ_DEF(pj_status_t) pj_ice_sess_on_rx_pkt(pj_ice_sess *ice,
     } else {
         /* Not a STUN packet. Call application's callback instead, but release
          * the mutex now or otherwise we may get deadlock.
+         * Add ref first to avoid race with session destruction.
          */
+        pj_grp_lock_add_ref(ice->grp_lock);
         pj_grp_lock_release(ice->grp_lock);
 
         PJ_RACE_ME(5);
@@ -3737,6 +3766,7 @@ PJ_DEF(pj_status_t) pj_ice_sess_on_rx_pkt(pj_ice_sess *ice,
         (*ice->cb.on_rx_data)(ice, comp_id, transport_id, pkt, pkt_size, 
                               src_addr, src_addr_len);
         status = PJ_SUCCESS;
+        pj_grp_lock_dec_ref(ice->grp_lock);
     }
 
     return status;
