diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index 7865f0a637e..aeede2f09e7 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -577,6 +577,10 @@ Handle<Value> Buffer::AsciiWrite(const Arguments &args) {
                               0,
                               max_length,
                               String::HINT_MANY_WRITES_EXPECTED);
+
+  constructor_template->GetFunction()->Set(chars_written_sym,
+                                           Integer::New(written));
+
   return scope.Close(Integer::New(written));
 }
 
@@ -664,6 +668,9 @@ Handle<Value> Buffer::Base64Write(const Arguments &args) {
     *dst++ = ((c & 0x03) << 6) | (d & 0x3F);
   }
 
+  constructor_template->GetFunction()->Set(chars_written_sym,
+                                           Integer::New(s.length()));
+
   return scope.Close(Integer::New(dst - start));
 }
 
@@ -689,9 +696,15 @@ Handle<Value> Buffer::BinaryWrite(const Arguments &args) {
 
   char *p = (char*)buffer->data_ + offset;
 
-  size_t towrite = MIN((unsigned long) s->Length(), buffer->length_ - offset);
+  size_t max_length = args[2]->IsUndefined() ? buffer->length_ - offset
+                                             : args[2]->Uint32Value();
+  max_length = MIN(s->Length(), MIN(buffer->length_ - offset, max_length));
+
+  int written = DecodeWrite(p, max_length, s, BINARY);
+
+  constructor_template->GetFunction()->Set(chars_written_sym,
+                                           Integer::New(written));
 
-  int written = DecodeWrite(p, towrite, s, BINARY);
   return scope.Close(Integer::New(written));
 }
 
diff --git a/test/simple/test-buffer.js b/test/simple/test-buffer.js
index 8c0d4fb0ddf..7850cb2cfdd 100644
--- a/test/simple/test-buffer.js
+++ b/test/simple/test-buffer.js
@@ -668,3 +668,22 @@ assert.equal(buf[1], 0x00);
 assert.equal(buf[2], 0xFF);
 assert.equal(buf[3], 0xFF);
 
+// test for buffer overrun
+buf = new Buffer([0, 0, 0, 0, 0]); // length: 5
+var sub = buf.slice(0, 4);         // length: 4
+written = sub.write('12345', 'binary');
+assert.equal(written, 4);
+assert.equal(buf[4], 0);
+
+// test for _charsWritten
+buf = new Buffer(9);
+buf.write('あいうえ', 'utf8'); // 3bytes * 4
+assert.equal(Buffer._charsWritten, 3);
+buf.write('あいうえお', 'ucs2'); // 2bytes * 5
+assert.equal(Buffer._charsWritten, 4);
+buf.write('0123456789', 'ascii');
+assert.equal(Buffer._charsWritten, 9);
+buf.write('0123456789', 'binary');
+assert.equal(Buffer._charsWritten, 9);
+buf.write('123456', 'base64');
+assert.equal(Buffer._charsWritten, 6);
diff --git a/test/simple/test-net-large-string.js b/test/simple/test-net-large-string.js
new file mode 100644
index 00000000000..877dc7c780e
--- /dev/null
+++ b/test/simple/test-net-large-string.js
@@ -0,0 +1,55 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+var common = require('../common');
+var assert = require('assert');
+var net = require('net');
+
+var kPoolSize = 40 * 1024;
+var data = '';
+for (var i = 0; i < kPoolSize; ++i) {
+  data += 'あ'; // 3bytes
+}
+var receivedSize = 0;
+var encoding = 'UTF-8';
+
+var server = net.createServer(function(socket) {
+  socket.setEncoding(encoding);
+  socket.on('data', function(data) {
+    receivedSize += data.length;
+  });
+  socket.on('end', function() {
+    socket.end();
+  });
+});
+
+server.listen(common.PORT, function() {
+  var client = net.createConnection(common.PORT);
+  client.on('end', function() {
+    server.close();
+  });
+  client.write(data, encoding);
+  client.end();
+});
+
+process.on('exit', function() {
+  assert.equal(receivedSize, kPoolSize);
+});