diff --git a/glib/ghostutils.c b/glib/ghostutils.c
index f6c41d0d6..387145687 100644
--- a/glib/ghostutils.c
+++ b/glib/ghostutils.c
@@ -344,6 +344,9 @@ nameprep (const gchar *hostname,
   g_free (tmp);
   tmp = name;
 
+  if (!name)
+    return NULL;
+
   /* KC normalization may have created more capital letters (eg,
    * angstrom -> capital A with ring). So we have to lowercasify a
    * second time. (This is more-or-less how the nameprep algorithm
@@ -398,8 +401,11 @@ g_hostname_to_ascii (const gchar *hostname)
   gssize llen, oldlen;
   gboolean unicode;
 
-  out = g_string_new (NULL);
   label = name = nameprep (hostname, -1);
+  if (!name)
+    return NULL;
+
+  out = g_string_new (NULL);
 
   do
     {
@@ -591,6 +597,11 @@ g_hostname_to_unicode (const gchar *hostname)
         {
           gchar *canonicalized = nameprep (hostname, llen);
 
+          if (!canonicalized)
+            {
+              g_string_free (out, TRUE);
+              return NULL;
+            }
           g_string_append (out, canonicalized);
           g_free (canonicalized);
         }
diff --git a/glib/tests/hostutils.c b/glib/tests/hostutils.c
index 515145aff..622a0ced5 100644
--- a/glib/tests/hostutils.c
+++ b/glib/tests/hostutils.c
@@ -48,6 +48,13 @@ static const struct {
 };
 static const gint num_idn_test_domains = G_N_ELEMENTS (idn_test_domains);
 
+static const gchar *bad_names[] = {
+  "disallowed\xef\xbf\xbd" "character",
+  "non-utf\x88",
+  "xn--mixed-\xc3\xbcp"
+};
+static const gint num_bad_names = G_N_ELEMENTS (bad_names);
+
 static void
 test_to_ascii (void)
 {
@@ -65,6 +72,12 @@ test_to_ascii (void)
       g_assert_cmpstr (idn_test_domains[i].ascii_name, ==, ascii);
       g_free (ascii);
     }
+
+  for (i = 0; i < num_bad_names; i++)
+    {
+      ascii = g_hostname_to_ascii (bad_names[i]);
+      g_assert_cmpstr (ascii, ==, NULL);
+    }
 }
 
 static void
@@ -84,6 +97,12 @@ test_to_unicode (void)
       g_assert_cmpstr (idn_test_domains[i].unicode_name, ==, unicode);
       g_free (unicode);
     }
+
+  for (i = 0; i < num_bad_names; i++)
+    {
+      unicode = g_hostname_to_unicode (bad_names[i]);
+      g_assert_cmpstr (unicode, ==, NULL);
+    }
 }
 
 static const struct {