diff --git a/images.js b/images.js
index 995f679..cac14f3 100755
--- a/images.js
+++ b/images.js
@@ -39,13 +39,23 @@ exports.measureJPG = function(buffer) {
 	if (jpeg) {
 		o += 2;
 		while (o < len) {
-			while (0xff != buffer[o]) o++;
-			while (0xff == buffer[o]) o++;
+
+			// A damaged file must not loop forever: stay inside the buffer
+			while (o < len && 0xff != buffer[o]) o++;
+			while (o < len && 0xff == buffer[o]) o++;
+
+			if (o >= len)
+				break;
+
 			if (SOF[buffer[o]])
 				return { width: u16(buffer, o + 6), height: u16(buffer, o + 4) };
-			else
-				o += u16(buffer, ++o);
 
+			// The length of a segment includes its own two bytes: less than 2 is not valid
+			var size = u16(buffer, o + 1);
+			if (!(size >= 2))
+				break;
+
+			o += size;
 		}
 	}
 
diff --git a/querybuilder.js b/querybuilder.js
index 7c4e218..fb55196 100644
--- a/querybuilder.js
+++ b/querybuilder.js
@@ -1179,7 +1179,7 @@ QBP.autoquery = function(query, schema, defsort, maxlimit) {
 			if ((skipped && skipped[name]) || (!allowed.meta[name]))
 				continue;
 
-			t.sort(allowed.fields[name], item[index + 1] === 'd');
+			t.sort(allowed.fields[name], index !== -1 && item.substring(index + 1).toLowerCase() === 'desc');
 			count++;
 		}
 
diff --git a/viewengine.js b/viewengine.js
index 5300bcf..89d8b06 100755
--- a/viewengine.js
+++ b/viewengine.js
@@ -324,7 +324,7 @@ function prepare(command, dcommand, functions) {
 			return 'self.safehtml(' + command + ')';
 
 		case 'csrf':
-			return 'self.csrf()';
+			return '(controller?controller.csrf():$EMPTY)';
 
 		case 'root':
 			var r = F.config.$root;