diff --git a/lib/http/fnHttpClient.cpp b/lib/http/fnHttpClient.cpp
index a76dedf08..57b7f1ea4 100755
--- a/lib/http/fnHttpClient.cpp
+++ b/lib/http/fnHttpClient.cpp
@@ -5,6 +5,7 @@
 #include <vector>
 
 #include "fnHttpClient.h"
+#include "compat_string.h"
 
 #include "../../include/debug.h"
 
@@ -23,6 +24,10 @@ const char *webdav_depths[] = {"0", "1", "infinity"};
 fnHttpClient::fnHttpClient()
 {
     _buffer = (char *)malloc(DEFAULT_HTTP_BUF_SIZE);
+    if (_buffer == nullptr)
+    {
+        Debug_printf("fnHttpClient::fnHttpClient() failed to allocate %d byte buffer\r\n", DEFAULT_HTTP_BUF_SIZE);
+    }
 }
 
 // Close connection, destroy any resoruces
@@ -293,7 +298,7 @@ esp_err_t fnHttpClient::_httpevent_handler(esp_http_client_event_t *evt)
         Debug_printf("HTTP_EVENT_ON_HEADER %u\r\n", uxTaskGetStackHighWaterMark(nullptr));
 #endif
         // Check to see if we should store this response header
-        if (client->_stored_headers.size() <= 0)
+        if (client->_stored_headers.size() == 0)
             break;
 
         client->set_header_value(evt->header_key, evt->header_value);
@@ -354,9 +359,16 @@ esp_err_t fnHttpClient::_httpevent_handler(esp_http_client_event_t *evt)
         Debug_printf("HTTP_EVENT_ON_DATA: Data: %p, Datalen: %d\r\n", evt->data, evt->data_len);
 #endif
 
-        client->_buffer_pos = 0;
-        client->_buffer_len = (evt->data_len > DEFAULT_HTTP_BUF_SIZE) ? DEFAULT_HTTP_BUF_SIZE : evt->data_len;
-        memcpy(client->_buffer, evt->data, client->_buffer_len);
+        if (client->_buffer == nullptr) {
+            Debug_printf("HTTP_EVENT_ON_DATA: _buffer is null, dropping data\r\n");
+            client->_buffer_pos = 0;
+            client->_buffer_len = 0;
+        }
+        else {
+            client->_buffer_pos = 0;
+            client->_buffer_len = (evt->data_len > DEFAULT_HTTP_BUF_SIZE) ? DEFAULT_HTTP_BUF_SIZE : evt->data_len;
+            memcpy(client->_buffer, evt->data, client->_buffer_len);
+        }
 
         // Now let the reader know there's data in the buffer
         xTaskNotifyGive(client->_taskh_consumer);
@@ -811,7 +823,8 @@ char *fnHttpClient::get_header(int index, char *buffer, int buffer_len)
 
     auto vi = _stored_headers.begin();
     std::advance(vi, index);
-    return strncpy(buffer, vi->second.c_str(), buffer_len);
+    strlcpy(buffer, vi->second.c_str(), buffer_len);
+    return buffer;
 }
 
 const std::string fnHttpClient::get_header(int index)
diff --git a/lib/http/httpService.cpp b/lib/http/httpService.cpp
index af5201e77..ec4e3e3d4 100644
--- a/lib/http/httpService.cpp
+++ b/lib/http/httpService.cpp
@@ -65,7 +65,11 @@ char to_hex(char code)
 /* IMPORTANT: be sure to free() the returned string after use */
 char *url_encode(char *str)
 {
-    char *pstr = str, *buf = (char *)malloc(strlen(str) * 3 + 1), *pbuf = buf;
+    char *pstr = str;
+    char *buf = (char *)malloc(strlen(str) * 3 + 1);
+    if (buf == NULL)
+        return NULL;
+    char *pbuf = buf;
     while (*pstr)
     {
         if (isalnum(*pstr) || *pstr == '-' || *pstr == '_' || *pstr == '.' || *pstr == '~')
@@ -84,7 +88,11 @@ char *url_encode(char *str)
 /* IMPORTANT: be sure to free() the returned string after use */
 char *url_decode(char *str)
 {
-    char *pstr = str, *buf = (char *)malloc(strlen(str) + 1), *pbuf = buf;
+    char *pstr = str;
+    char *buf = (char *)malloc(strlen(str) + 1);
+    if (buf == NULL)
+        return NULL;
+    char *pbuf = buf;
     while (*pstr)
     {
         if (*pstr == '%')
@@ -341,7 +349,7 @@ void fnHttpService::parse_query(httpd_req_t *req, queryparts *results)
     }
 
     /// @todo Error if path_end == 0, the index to substr becomes -1
-    results->path += results->full_uri.substr(0, path_end - 1);
+    results->path += results->full_uri.substr(0, path_end);
     results->query += results->full_uri.substr(path_end + 1);
 
     // URL Decode query
diff --git a/lib/http/httpServiceParser.cpp b/lib/http/httpServiceParser.cpp
index ac4830cae..812bc0e8a 100644
--- a/lib/http/httpServiceParser.cpp
+++ b/lib/http/httpServiceParser.cpp
@@ -652,7 +652,7 @@ const string fnHttpServiceParser::substitute_tag(const string &tag)
                 {
                     strncat(result, "<option value=\"", MAX_PRINTER_LIST_BUFFER-1);
                     strncat(result, PRINTER_CLASS::printer_model_str[i], MAX_PRINTER_LIST_BUFFER-1);
-                    strncat(result, "\">", MAX_PRINTER_LIST_BUFFER);
+                    strncat(result, "\">", MAX_PRINTER_LIST_BUFFER - strlen(result) - 1);
                     strncat(result, PRINTER_CLASS::printer_model_str[i], MAX_PRINTER_LIST_BUFFER-1);
                     strncat(result, "</option>\n", MAX_PRINTER_LIST_BUFFER-1);
                 }
diff --git a/lib/http/mgHttpClient.cpp b/lib/http/mgHttpClient.cpp
index 202d75c44..adde998f5 100644
--- a/lib/http/mgHttpClient.cpp
+++ b/lib/http/mgHttpClient.cpp
@@ -14,6 +14,7 @@
 
 #include "mongoose.h"
 #undef mkdir
+#include "compat_string.h"
 
 #if defined(_WIN32)
 
@@ -984,7 +985,7 @@ int mgHttpClient::COPY(const char *destination, bool overwrite, bool move)
     _flush_response();
 
     // Set method
-    _method = HTTP_MOVE;
+    _method = move ? HTTP_MOVE : HTTP_COPY;
     // Set detination
     set_header("Destination", destination);
     // Set overwrite
@@ -1110,7 +1111,8 @@ char *mgHttpClient::get_header(int index, char *buffer, int buffer_len)
 
     auto vi = _stored_headers.begin();
     std::advance(vi, index);
-    return strncpy(buffer, vi->second.c_str(), buffer_len);
+    strlcpy(buffer, vi->second.c_str(), buffer_len);
+    return buffer;
 }
 
 const std::string mgHttpClient::get_header(int index)