diff --git a/changelog.txt b/changelog.txt
index bc14b4af4..dbfc0c0cc 100644
--- a/changelog.txt
+++ b/changelog.txt
@@ -1,5 +1,8 @@
 EQEMu Changelog (Started on Sept 24, 2003 15:50)
 -------------------------------------------------------
+== 11/16/2014 ==
+demonstar55: fix size issue with ControlBoat_Struct and exploit fix in OP_BoardBoat
+
 == 11/15/2014 ==
 Uleat(Natedog): A better fix for OP_ShopPlayerBuy - doesn't cause the issues that I introduced
 
diff --git a/common/eq_packet_structs.h b/common/eq_packet_structs.h
index 8e72ccaa8..c49283f18 100644
--- a/common/eq_packet_structs.h
+++ b/common/eq_packet_structs.h
@@ -4383,7 +4383,7 @@ typedef struct {
 struct ControlBoat_Struct {
 /*000*/	uint32	boatId;			// entitylist id of the boat
 /*004*/	bool	TakeControl;	// 01 if taking control, 00 if releasing it
-/*007*/							// no idea what these last three bytes represent
+/*007*/	char	unknown[3];		// no idea what these last three bytes represent
 };
 
 struct AugmentInfo_Struct
diff --git a/zone/client_packet.cpp b/zone/client_packet.cpp
index 3cd0bb157..0e35db1fa 100644
--- a/zone/client_packet.cpp
+++ b/zone/client_packet.cpp
@@ -3842,19 +3842,23 @@ void Client::Handle_OP_BlockedBuffs(const EQApplicationPacket *app)
 
 void Client::Handle_OP_BoardBoat(const EQApplicationPacket *app)
 {
-
-	if (app->size <= 5)
+	// this sends unclean mob name, so capped at 64
+	// a_boat006
+	if (app->size <= 5 || app->size > 64) {
+		LogFile->write(EQEMuLog::Error, "Size mismatch in OP_BoardBoad. Expected greater than 5 less than 64, got %i", app->size);
+		DumpPacket(app);
 		return;
+	}
 
-	char *boatname;
-	boatname = new char[app->size - 3];
-	memset(boatname, 0, app->size - 3);
-	memcpy(boatname, app->pBuffer, app->size - 4);
+	char boatname[64];
+	memcpy(boatname, app->pBuffer, app->size);
+	boatname[63] = '\0';
 
 	Mob* boat = entity_list.GetMob(boatname);
-	if (boat)
-		this->BoatID = boat->GetID();	// set the client's BoatID to show that it's on this boat
-	safe_delete_array(boatname);
+	if (!boat || (boat->GetRace() != CONTROLLED_BOAT && boat->GetRace() != 502))
+		return;
+	BoatID = boat->GetID();	// set the client's BoatID to show that it's on this boat
+
 	return;
 }