diff --git a/gio/gdbusauth.c b/gio/gdbusauth.c
index 1a0ada5bf..a9cb0de12 100644
--- a/gio/gdbusauth.c
+++ b/gio/gdbusauth.c
@@ -404,13 +404,17 @@ hexdecode (const gchar  *str,
       g_string_append_c (s, value);
     }
 
+  *out_len = s->len;
   ret = g_string_free (s, FALSE);
   s = NULL;
 
  out:
   if (s != NULL)
-    g_string_free (s, TRUE);
-  return ret;
+    {
+      *out_len = 0;
+      g_string_free (s, TRUE);
+    }
+   return ret;
 }
 
 /* TODO: take len */
diff --git a/gio/gdbusauthmechanismanon.c b/gio/gdbusauthmechanismanon.c
index a166ede01..dd57826ff 100644
--- a/gio/gdbusauthmechanismanon.c
+++ b/gio/gdbusauthmechanismanon.c
@@ -262,6 +262,7 @@ mechanism_client_initiate (GDBusAuthMechanism   *mechanism,
                            gsize                *out_initial_response_len)
 {
   GDBusAuthMechanismAnon *m = G_DBUS_AUTH_MECHANISM_ANON (mechanism);
+  gchar *result;
 
   g_return_val_if_fail (G_IS_DBUS_AUTH_MECHANISM_ANON (mechanism), NULL);
   g_return_val_if_fail (!m->priv->is_server && !m->priv->is_client, NULL);
@@ -269,10 +270,11 @@ mechanism_client_initiate (GDBusAuthMechanism   *mechanism,
   m->priv->is_client = TRUE;
   m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_ACCEPTED;
 
-  *out_initial_response_len = -1;
-
   /* just return our library name and version */
-  return g_strdup ("GDBus 0.1");
+  result = g_strdup ("GDBus 0.1");
+  *out_initial_response_len = strlen (result);
+
+  return result;
 }
 
 static void
diff --git a/gio/gdbusauthmechanismexternal.c b/gio/gdbusauthmechanismexternal.c
index a4473a443..a18c69729 100644
--- a/gio/gdbusauthmechanismexternal.c
+++ b/gio/gdbusauthmechanismexternal.c
@@ -177,7 +177,8 @@ mechanism_server_get_state (GDBusAuthMechanism   *mechanism)
 }
 
 static gboolean
-data_matches_credentials (const gchar *data,
+data_matches_credentials (const gchar  *data,
+                          gsize         data_len,
                           GCredentials *credentials)
 {
   gboolean match;
@@ -187,7 +188,7 @@ data_matches_credentials (const gchar *data,
   if (credentials == NULL)
     goto out;
 
-  if (data == NULL || strlen (data) == 0)
+  if (data == NULL || data_len == 0)
     goto out;
 
 #if defined(G_OS_UNIX)
@@ -227,7 +228,9 @@ mechanism_server_initiate (GDBusAuthMechanism   *mechanism,
 
   if (initial_response != NULL)
     {
-      if (data_matches_credentials (initial_response, _g_dbus_auth_mechanism_get_credentials (mechanism)))
+      if (data_matches_credentials (initial_response,
+                                    initial_response_len,
+                                    _g_dbus_auth_mechanism_get_credentials (mechanism)))
         {
           m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_ACCEPTED;
         }
@@ -253,7 +256,9 @@ mechanism_server_data_receive (GDBusAuthMechanism   *mechanism,
   g_return_if_fail (m->priv->is_server && !m->priv->is_client);
   g_return_if_fail (m->priv->state == G_DBUS_AUTH_MECHANISM_STATE_WAITING_FOR_DATA);
 
-  if (data_matches_credentials (data, _g_dbus_auth_mechanism_get_credentials (mechanism)))
+  if (data_matches_credentials (data,
+                                data_len,
+                                _g_dbus_auth_mechanism_get_credentials (mechanism)))
     {
       m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_ACCEPTED;
     }
@@ -340,6 +345,7 @@ mechanism_client_initiate (GDBusAuthMechanism   *mechanism,
   /* return the uid */
 #if defined(G_OS_UNIX)
   initial_response = g_strdup_printf ("%" G_GINT64_FORMAT, (gint64) g_credentials_get_unix_user (credentials, NULL));
+ *out_initial_response_len = strlen (initial_response);
 #elif defined(G_OS_WIN32)
 #ifdef __GNUC__
 #warning Dont know how to send credentials on this OS. The EXTERNAL D-Bus authentication mechanism will not work.
diff --git a/gio/gdbusauthmechanismsha1.c b/gio/gdbusauthmechanismsha1.c
index 0cbaf946d..585694277 100644
--- a/gio/gdbusauthmechanismsha1.c
+++ b/gio/gdbusauthmechanismsha1.c
@@ -949,7 +949,7 @@ mechanism_server_initiate (GDBusAuthMechanism   *mechanism,
   m->priv->is_server = TRUE;
   m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_REJECTED;
 
-  if (initial_response != NULL && strlen (initial_response) > 0)
+  if (initial_response != NULL && initial_response_len > 0)
     {
 #ifdef G_OS_UNIX
       gint64 uid;
@@ -1035,6 +1035,7 @@ mechanism_server_data_send (GDBusAuthMechanism   *mechanism,
   g_return_val_if_fail (m->priv->state == G_DBUS_AUTH_MECHANISM_STATE_HAVE_DATA_TO_SEND, NULL);
 
   s = NULL;
+  *out_data_len = 0;
 
   /* TODO: use GDBusAuthObserver here to get the cookie context to use? */
   cookie_context = "org_gtk_gdbus_general";
@@ -1057,6 +1058,7 @@ mechanism_server_data_send (GDBusAuthMechanism   *mechanism,
                        cookie_context,
                        cookie_id,
                        m->priv->server_challenge);
+  *out_data_len = strlen (s);
 
   m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_WAITING_FOR_DATA;
 
@@ -1120,8 +1122,10 @@ mechanism_client_initiate (GDBusAuthMechanism   *mechanism,
 
 #ifdef G_OS_UNIX
   initial_response = g_strdup_printf ("%" G_GINT64_FORMAT, (gint64) getuid ());
+  *out_initial_response_len = strlen (initial_response);
 #elif defined (G_OS_WIN32)
-initial_response = _g_dbus_win32_get_user_sid ();
+  initial_response = _g_dbus_win32_get_user_sid ();
+  *out_initial_response_len = strlen (initial_response);
 #else
 #error Please implement for your OS
 #endif
@@ -1208,6 +1212,7 @@ mechanism_client_data_send (GDBusAuthMechanism   *mechanism,
 
   m->priv->state = G_DBUS_AUTH_MECHANISM_STATE_ACCEPTED;
 
+  *out_data_len = strlen (m->priv->to_send);
   return g_strdup (m->priv->to_send);
 }