Add some bounds checking to _reply functions

This is a step towards fixing a security vulnerability.
8 jobs for some-bounds-checks in 4 minutes and 54 seconds (queued for 1 second)