diff --git a/Frameworks/OakTextView/src/OakTextView.mm b/Frameworks/OakTextView/src/OakTextView.mm
index b623aaa7..55c8cb1b 100644
--- a/Frameworks/OakTextView/src/OakTextView.mm
+++ b/Frameworks/OakTextView/src/OakTextView.mm
@@ -653,8 +653,8 @@ static std::string shell_quote (std::vector<std::string> paths)
 	{
 		std::string const str = document->buffer().substr(range->min().index, range->max().index);
 		char const* base = str.data();
-		size_t from = utf16::advance(base, aRange.location) - base;
-		size_t to   = utf16::advance(base, aRange.location + aRange.length) - base;
+		size_t from = utf16::advance(base, aRange.location, base + str.size()) - base;
+		size_t to   = utf16::advance(base, aRange.location + aRange.length, base + str.size()) - base;
 		sel.push_back(ng::range_t(range->min() + from, range->min() + to));
 	}
 	editor->set_selections(sel);
@@ -760,7 +760,7 @@ static std::string shell_quote (std::vector<std::string> paths)
 {
 	std::string const text = editor->as_string();
 
-	size_t index = utf16::advance(text.data(), theRange.location) - text.data();
+	size_t index = utf16::advance(text.data(), theRange.location, text.data() + text.size()) - text.data();
 	NSRect rect = [self convertRect:layout->rect_at_index(index) toView:nil];
 	rect.origin = [[self window] convertBaseToScreen:rect.origin];
 	D(DBF_OakTextView_TextInput, bug("%s → %s\n", [NSStringFromRange(theRange) UTF8String], [NSStringFromRect(rect) UTF8String]););
diff --git a/Frameworks/ns/src/spellcheck.mm b/Frameworks/ns/src/spellcheck.mm
index 27e5455a..153a64d9 100644
--- a/Frameworks/ns/src/spellcheck.mm
+++ b/Frameworks/ns/src/spellcheck.mm
@@ -27,8 +27,8 @@ namespace ns
 
 		while(range.location != NSNotFound && range.length)
 		{
-			char const* from = utf16::advance(first, range.location);
-			char const* to   = utf16::advance(from,  range.length);
+			char const* from = utf16::advance(first, range.location, last);
+			char const* to   = utf16::advance(from,  range.length,   last);
 			*out++ = ns::range_t(offset + from - first, offset + to - first);
 			range = [spellChecker checkSpellingOfString:str startingAt:range.location + range.length language:lang wrap:NO inSpellDocumentWithTag:tag wordCount:NULL];
 		}