diff --git a/ChangeLog b/ChangeLog
index b855373e1..d8e78a6f9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -56,6 +56,8 @@ Version 0.4.0 (under dev!)
   "ipv4." and/or "ipv6." before protocol name, to force IPv4/IPv6 (task #12270)
 * relay: add missing "ssl." in output of /relay listrelay
 * script: fix compilation on OS X
+* xfer: limit bytes received to file size (for DCC file received), fix crash
+  when displaying a xfer file with pos greater than size
 
 Version 0.3.9.2 (2012-11-18)
 ----------------------------
diff --git a/src/plugins/xfer/xfer-buffer.c b/src/plugins/xfer/xfer-buffer.c
index a99a8ecaf..e8e1f9cf7 100644
--- a/src/plugins/xfer/xfer-buffer.c
+++ b/src/plugins/xfer/xfer-buffer.c
@@ -48,7 +48,7 @@ xfer_buffer_refresh (const char *hotlist)
     char str_color[256], suffix[32], status[64], date[128], eta[128];
     char *progress_bar, *str_pos, *str_total, *str_bytes_per_sec;
     int i, length, line, progress_bar_size, num_bars;
-    unsigned long long pct_complete;
+    unsigned long long pos, pct_complete;
     struct tm *date_tmp;
 
     if (xfer_buffer)
@@ -145,6 +145,7 @@ xfer_buffer_refresh (const char *hotlist)
             else
             {
                 /* build progress bar */
+                pos = (ptr_xfer->pos <= ptr_xfer->size) ? ptr_xfer->pos : ptr_xfer->size;
                 progress_bar = NULL;
                 progress_bar_size = weechat_config_integer (xfer_config_look_progress_bar_size);
                 if (progress_bar_size > 0)
@@ -159,7 +160,7 @@ xfer_buffer_refresh (const char *hotlist)
                             num_bars = 0;
                     }
                     else
-                        num_bars = (int)(((float)(ptr_xfer->pos)/(float)(ptr_xfer->size)) * (float)progress_bar_size);
+                        num_bars = (int)(((float)(pos)/(float)(ptr_xfer->size)) * (float)progress_bar_size);
                     for (i = 0; i < num_bars - 1; i++)
                     {
                         strcat (progress_bar, "=");
@@ -182,10 +183,10 @@ xfer_buffer_refresh (const char *hotlist)
                         pct_complete = 0;
                 }
                 else
-                    pct_complete = (unsigned long long)(((float)(ptr_xfer->pos)/(float)(ptr_xfer->size)) * 100);
+                    pct_complete = (unsigned long long)(((float)(pos)/(float)(ptr_xfer->size)) * 100);
 
                 /* position, total and bytes per second */
-                str_pos = weechat_string_format_size (ptr_xfer->pos);
+                str_pos = weechat_string_format_size (pos);
                 str_total = weechat_string_format_size (ptr_xfer->size);
                 str_bytes_per_sec = weechat_string_format_size (ptr_xfer->bytes_per_sec);
 
diff --git a/src/plugins/xfer/xfer-dcc.c b/src/plugins/xfer/xfer-dcc.c
index f23adcee2..a5fabd89b 100644
--- a/src/plugins/xfer/xfer-dcc.c
+++ b/src/plugins/xfer/xfer-dcc.c
@@ -185,6 +185,7 @@ xfer_dcc_recv_file_child (struct t_xfer *xfer)
     static char buffer[XFER_BLOCKSIZE_MAX];
     uint32_t pos;
     time_t last_sent, new_time;
+    unsigned long long bytes_remaining;
 
     /* first connect to sender (blocking) */
     if (!weechat_network_connect_to (xfer->proxy, xfer->sock,
@@ -202,7 +203,10 @@ xfer_dcc_recv_file_child (struct t_xfer *xfer)
     last_sent = time (NULL);
     while (1)
     {
-        num_read = recv (xfer->sock, buffer, sizeof (buffer), 0);
+        bytes_remaining = xfer->size - xfer->pos;
+        num_read = recv (xfer->sock, buffer,
+                         (bytes_remaining >= sizeof (buffer)) ? sizeof (buffer) : bytes_remaining,
+                         0);
         if (num_read == -1)
         {
             /* socket is temporarily not available (sender is not fast ?!) */