diff --git a/common/rfb/obfuscate.cxx b/common/rfb/obfuscate.cxx
index 1f785893de..d40e25c3ea 100644
--- a/common/rfb/obfuscate.cxx
+++ b/common/rfb/obfuscate.cxx
@@ -56,11 +56,11 @@ std::string rfb::deobfuscate(const uint8_t *data, size_t len)
 {
   char buf[9];
 
-  assert(data != NULL);
-
   if (len != 8)
     throw rdr::Exception("bad obfuscated password length");
 
+  assert(data != NULL);
+
   deskey(d3desObfuscationKey, DE1);
   des((uint8_t*)data, (uint8_t*)buf);
   buf[8] = 0;
diff --git a/common/rfb/util.cxx b/common/rfb/util.cxx
index d1a8cc332b..48f59846dd 100644
--- a/common/rfb/util.cxx
+++ b/common/rfb/util.cxx
@@ -126,8 +126,8 @@ namespace rfb {
 
   bool hexToBin(const char* in, size_t inlen,
                 uint8_t* out, size_t outlen) {
-    assert(in);
-    assert(out);
+    assert(in || inlen == 0);
+    assert(out || outlen == 0);
 
     if (inlen & 1)
       return false;