diff --git a/memcached.c b/memcached.c
index 097588a..cbbbf48 100644
--- a/memcached.c
+++ b/memcached.c
@@ -1388,7 +1388,7 @@ static void process_update_command(conn *c, token_t *tokens, const size_t ntoken
 
     flags = strtoul(tokens[2].value, NULL, 10);
     exptime = strtol(tokens[3].value, NULL, 10);
-    vlen = strtol(tokens[4].value, NULL, 10);
+    vlen = strtol(tokens[4].value, NULL, 10) + 2;
 
     // does cas value exist?
     if(handle_cas)
@@ -1397,7 +1397,7 @@ static void process_update_command(conn *c, token_t *tokens, const size_t ntoken
     }
 
     if(errno == ERANGE || ((flags == 0 || exptime == 0) && errno == EINVAL)
-       || vlen < 0) {
+       || vlen < 0 || vlen - 2 < 0) {
         out_string(c, "CLIENT_ERROR bad command line format");
         return;
     }
@@ -1406,16 +1406,16 @@ static void process_update_command(conn *c, token_t *tokens, const size_t ntoken
         stats_prefix_record_set(key);
     }
 
-    it = item_alloc(key, nkey, flags, realtime(exptime), vlen+2);
+    it = item_alloc(key, nkey, flags, realtime(exptime), vlen);
 
     if (it == 0) {
-        if (! item_size_ok(nkey, flags, vlen + 2))
+        if (! item_size_ok(nkey, flags, vlen))
             out_string(c, "SERVER_ERROR object too large for cache");
         else
             out_string(c, "SERVER_ERROR out of memory storing object");
         /* swallow the data line */
         c->write_and_go = conn_swallow;
-        c->sbytes = vlen + 2;
+        c->sbytes = vlen;
 
         /* Avoid stale data persisting in cache because we failed alloc.
          * Unacceptable for SET. Anywhere else too? */