diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index deeee33..ef86cd2 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -75,7 +75,7 @@
     SSL_DEBUG_MSG( 3, ( "client hello, adding server name extension: %s",
                    ssl->hostname ) );
 
-    if( (size_t)(end - p) < ssl->hostname_len + 9 )
+    if( end < p || (size_t)( end - p ) < ssl->hostname_len + 9 )
     {
          SSL_DEBUG_MSG( 1, ( "buffer too small" ) );
          return;
@@ -877,13 +877,13 @@
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_SSL_SESSION_TICKETS)
-    ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
+#if defined(POLARSSL_SSL_ALPN)
+    ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif
 
-#if defined(POLARSSL_SSL_ALPN)
-    ssl_write_alpn_ext( ssl, p + 2 + ext_len, &olen );
+#if defined(POLARSSL_SSL_SESSION_TICKETS)
+    ssl_write_session_ticket_ext( ssl, p + 2 + ext_len, &olen );
     ext_len += olen;
 #endif