diff --git a/src/auth/big_num.cpp b/src/auth/big_num.cpp
index 1ccaf27d..7e76475b 100644
--- a/src/auth/big_num.cpp
+++ b/src/auth/big_num.cpp
@@ -136,6 +136,8 @@ std::vector<uint8_t> BigNum::toArray(bool littleEndian, int minSize) const {
 
 std::string BigNum::toHex() const {
     char* hex = BN_bn2hex(bn);
+    // BN_bn2hex returns nullptr on allocation failure
+    if (!hex) return "(null)";
     std::string result(hex);
     OPENSSL_free(hex);
     return result;
@@ -143,6 +145,7 @@ std::string BigNum::toHex() const {
 
 std::string BigNum::toDecimal() const {
     char* dec = BN_bn2dec(bn);
+    if (!dec) return "(null)";
     std::string result(dec);
     OPENSSL_free(dec);
     return result;
diff --git a/src/core/input.cpp b/src/core/input.cpp
index b7c0e060..4c909824 100644
--- a/src/core/input.cpp
+++ b/src/core/input.cpp
@@ -25,7 +25,10 @@ void Input::update() {
     Uint32 mouseState = SDL_GetMouseState(&mouseX, &mouseY);
     mousePosition = glm::vec2(static_cast<float>(mouseX), static_cast<float>(mouseY));
 
-    for (int i = 0; i < NUM_MOUSE_BUTTONS; ++i) {
+    // SDL_BUTTON(x) is defined as (1 << (x-1)), so button indices are 1-based.
+    // SDL_BUTTON(0) is undefined behavior (negative shift). Start at 1.
+    currentMouseState[0] = false;
+    for (int i = 1; i < NUM_MOUSE_BUTTONS; ++i) {
         currentMouseState[i] = (mouseState & SDL_BUTTON(i)) != 0;
     }