diff --git a/luni/src/main/native/libcore_icu_NativeIDN.cpp b/luni/src/main/native/libcore_icu_NativeIDN.cpp
index 16a6e1c..63d40e0 100644
--- a/luni/src/main/native/libcore_icu_NativeIDN.cpp
+++ b/luni/src/main/native/libcore_icu_NativeIDN.cpp
@@ -37,11 +37,12 @@
     if (src.get() == NULL) {
         return NULL;
     }
-    UChar dst[256];
+    static const size_t kDstSize = 512;
+    UChar dst[kDstSize];
     UErrorCode status = U_ZERO_ERROR;
     size_t resultLength = toAscii
-        ? uidna_IDNToASCII(src.get(), src.size(), &dst[0], sizeof(dst), flags, NULL, &status)
-        : uidna_IDNToUnicode(src.get(), src.size(), &dst[0], sizeof(dst), flags, NULL, &status);
+        ? uidna_IDNToASCII(src.get(), src.size(), &dst[0], kDstSize, flags, NULL, &status)
+        : uidna_IDNToUnicode(src.get(), src.size(), &dst[0], kDstSize, flags, NULL, &status);
     if (U_FAILURE(status)) {
         jniThrowException(env, "java/lang/IllegalArgumentException", u_errorName(status));
         return NULL;
diff --git a/luni/src/test/java/libcore/java/net/IDNTest.java b/luni/src/test/java/libcore/java/net/IDNTest.java
index f01eca3..37f3505 100644
--- a/luni/src/test/java/libcore/java/net/IDNTest.java
+++ b/luni/src/test/java/libcore/java/net/IDNTest.java
@@ -37,4 +37,15 @@
         String longInput = makePunyString(512);
         assertEquals(longInput, IDN.toUnicode(longInput));
     }
+
+    // http://b/30765246
+    public void testLongDomainName() {
+        String label63 = "123456789-123456789-123456789-123456789-123456789-123456789-123";
+        String host255 = label63 + "." + label63 + "." + label63 + "." + label63;
+        try {
+            IDN.toASCII(host255.substring(3) + ".com");
+            fail();
+        } catch (IllegalArgumentException expected) {
+        }
+    }
 }
diff --git a/luni/src/test/java/libcore/xml/ExpatSaxParserTest.java b/luni/src/test/java/libcore/xml/ExpatSaxParserTest.java
index 51ca5bf..ccac61a 100644
--- a/luni/src/test/java/libcore/xml/ExpatSaxParserTest.java
+++ b/luni/src/test/java/libcore/xml/ExpatSaxParserTest.java
@@ -36,6 +36,7 @@
 import org.xml.sax.InputSource;
 import org.xml.sax.Locator;
 import org.xml.sax.SAXException;
+import org.xml.sax.SAXParseException;
 import org.xml.sax.XMLReader;
 import org.xml.sax.ext.DefaultHandler2;
 import org.xml.sax.helpers.DefaultHandler;
@@ -625,6 +626,54 @@
     }
 
     /**
+     * A little endian UTF-16 file with an odd number of bytes.
+     */
+    public void testBug28698301_1() throws Exception {
+        checkBug28698301("bug28698301-1.xml");
+    }
+
+    /**
+     * A little endian UTF-16 file with an even number of bytes that didn't exhibit the problem
+     * reported in the bug.
+     */
+    public void testBug28698301_2() throws Exception {
+        checkBug28698301("bug28698301-2.xml");
+    }
+
+    /**
+     * A big endian UTF-16 file with an odd number of bytes.
+     */
+    public void testBug28698301_3() throws Exception {
+        checkBug28698301("bug28698301-3.xml");
+    }
+
+    /**
+     * This tests what happens when UTF-16 input (little and big endian) that has an odd number of
+     * bytes (and hence is invalid UTF-16) is parsed by Expat.
+     *
+     * <p>Prior to the patch the files would cause the pointer into the byte buffer to jump past
+     * the end of the buffer and keep reading. Once it had jumped past it would continue reading
+     * from memory until it hit a check that caused it to stop or caused a SIGSEGV. If a SIGSEGV
+     * was not thrown that lead to spurious and misleading errors being reported.
+     *
+     * <p>The initial jump was caused because it was not checking to make sure that there were
+     * enough bytes to read a whole UTF-16 character. It kept reading because most of the buffer
+     * range checks used == and != rather than >= and <. The patch fixes the initial jump and then
+     * uses inequalities in the range check to fail fast in the event of another overflow bug.
+     */
+    private void checkBug28698301(String name) throws IOException, SAXException {
+        InputStream is = getClass().getResourceAsStream(name);
+        try {
+            parse(is, Encoding.UTF_16, new TestHandler());
+        } catch (SAXParseException exception) {
+            String message = exception.getMessage();
+            if (!message.contains("no element found")) {
+                fail("Expected 'no element found' exception, found: " + message);
+            }
+        }
+    }
+
+    /**
      * Parses the given xml string and fires events on the given SAX handler.
      */
     private static void parse(String xml, ContentHandler contentHandler)
diff --git a/luni/src/test/resources/libcore/xml/bug28698301-1.xml b/luni/src/test/resources/libcore/xml/bug28698301-1.xml
new file mode 100644
index 0000000..b102e55
--- /dev/null
+++ b/luni/src/test/resources/libcore/xml/bug28698301-1.xml
Binary files differ
diff --git a/luni/src/test/resources/libcore/xml/bug28698301-2.xml b/luni/src/test/resources/libcore/xml/bug28698301-2.xml
new file mode 100644
index 0000000..f66912a
--- /dev/null
+++ b/luni/src/test/resources/libcore/xml/bug28698301-2.xml
Binary files differ
diff --git a/luni/src/test/resources/libcore/xml/bug28698301-3.xml b/luni/src/test/resources/libcore/xml/bug28698301-3.xml
new file mode 100644
index 0000000..b8ccb9c
--- /dev/null
+++ b/luni/src/test/resources/libcore/xml/bug28698301-3.xml
Binary files differ