diff --git a/channels/audin/client/audin_main.c b/channels/audin/client/audin_main.c
index b637c2112..3a080bd3d 100644
--- a/channels/audin/client/audin_main.c
+++ b/channels/audin/client/audin_main.c
@@ -568,7 +568,7 @@ static UINT audin_on_data_received(IWTSVirtualChannelCallback* pChannelCallback,
 	if (!audin)
 		return ERROR_INTERNAL_ERROR;
 
-	if (Stream_GetRemainingCapacity(data) < 1)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, data, 1))
 		return ERROR_NO_DATA;
 
 	Stream_Read_UINT8(data, MessageId);
diff --git a/channels/urbdrc/common/msusb.c b/channels/urbdrc/common/msusb.c
index 79769632a..a0be420c9 100644
--- a/channels/urbdrc/common/msusb.c
+++ b/channels/urbdrc/common/msusb.c
@@ -64,7 +64,7 @@ static MSUSB_PIPE_DESCRIPTOR** msusb_mspipes_read(wStream* s, UINT32 NumberOfPip
 	UINT32 pnum;
 	MSUSB_PIPE_DESCRIPTOR** MsPipes;
 
-	if (Stream_GetRemainingCapacity(s) / 12 < NumberOfPipes)
+	if (!Stream_CheckAndLogRequiredCapacityOfSize(TAG, (s), NumberOfPipes, 12ull))
 		return NULL;
 
 	MsPipes = (MSUSB_PIPE_DESCRIPTOR**)calloc(NumberOfPipes, sizeof(MSUSB_PIPE_DESCRIPTOR*));
@@ -149,7 +149,7 @@ MSUSB_INTERFACE_DESCRIPTOR* msusb_msinterface_read(wStream* s)
 {
 	MSUSB_INTERFACE_DESCRIPTOR* MsInterface;
 
-	if (Stream_GetRemainingCapacity(s) < 12)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 12))
 		return NULL;
 
 	MsInterface = msusb_msinterface_new();
@@ -317,7 +317,7 @@ MSUSB_CONFIG_DESCRIPTOR* msusb_msconfig_read(wStream* s, UINT32 NumInterfaces)
 	MSUSB_CONFIG_DESCRIPTOR* MsConfig;
 	BYTE lenConfiguration, typeConfiguration;
 
-	if (Stream_GetRemainingCapacity(s) < 6ULL + NumInterfaces * 2ULL)
+	if (!Stream_CheckAndLogRequiredCapacityOfSize(TAG, (s), 3ULL + NumInterfaces, 2ULL))
 		return NULL;
 
 	MsConfig = msusb_msconfig_new();
diff --git a/libfreerdp/core/activation.c b/libfreerdp/core/activation.c
index 008e7a7a5..6b8c26ec6 100644
--- a/libfreerdp/core/activation.c
+++ b/libfreerdp/core/activation.c
@@ -34,7 +34,7 @@ static BOOL rdp_write_synchronize_pdu(wStream* s, const rdpSettings* settings)
 {
 	const UINT32 PduSource = freerdp_settings_get_uint32(settings, FreeRDP_PduSource);
 
-	if (Stream_GetRemainingCapacity(s) < 4)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
 		return FALSE;
 	Stream_Write_UINT16(s, SYNCMSGTYPE_SYNC); /* messageType (2 bytes) */
 	Stream_Write_UINT16(s, PduSource);        /* targetUser (2 bytes) */
@@ -129,7 +129,7 @@ static BOOL rdp_write_client_control_pdu(wStream* s, UINT16 action, UINT16 grant
                                          UINT32 controlId)
 {
 	WINPR_ASSERT(s);
-	if (Stream_GetRemainingCapacity(s) < 8)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
 		return FALSE;
 	Stream_Write_UINT16(s, action);    /* action (2 bytes) */
 	Stream_Write_UINT16(s, grantId);   /* grantId (2 bytes) */
@@ -172,7 +172,7 @@ BOOL rdp_send_server_control_cooperate_pdu(rdpRdp* rdp)
 	wStream* s = rdp_data_pdu_init(rdp);
 	if (!s)
 		return FALSE;
-	if (Stream_GetRemainingCapacity(s) < 8)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
 	{
 		Stream_Free(s, TRUE);
 		return FALSE;
@@ -190,7 +190,7 @@ static BOOL rdp_send_server_control_granted_pdu(rdpRdp* rdp)
 	wStream* s = rdp_data_pdu_init(rdp);
 	if (!s)
 		return FALSE;
-	if (Stream_GetRemainingCapacity(s) < 8)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
 	{
 		Stream_Free(s, TRUE);
 		return FALSE;
@@ -487,7 +487,7 @@ static BOOL rdp_write_client_font_list_pdu(wStream* s, UINT16 flags)
 {
 	WINPR_ASSERT(s);
 
-	if (Stream_GetRemainingCapacity(s) < 8)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
 		return FALSE;
 	Stream_Write_UINT16(s, 0);     /* numberFonts (2 bytes) */
 	Stream_Write_UINT16(s, 0);     /* totalNumFonts (2 bytes) */
@@ -565,7 +565,7 @@ BOOL rdp_send_server_font_map_pdu(rdpRdp* rdp)
 	wStream* s = rdp_data_pdu_init(rdp);
 	if (!s)
 		return FALSE;
-	if (Stream_GetRemainingCapacity(s) < 8)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
 	{
 		Stream_Free(s, TRUE);
 		return FALSE;
@@ -638,7 +638,7 @@ BOOL rdp_send_deactivate_all(rdpRdp* rdp)
 	if (!s)
 		return FALSE;
 
-	if (Stream_GetRemainingCapacity(s) < 7)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 7))
 		goto fail;
 
 	WINPR_ASSERT(rdp->settings);
diff --git a/libfreerdp/core/capabilities.c b/libfreerdp/core/capabilities.c
index f301416ab..6a3418a41 100644
--- a/libfreerdp/core/capabilities.c
+++ b/libfreerdp/core/capabilities.c
@@ -131,7 +131,7 @@ static void rdp_write_capability_set_header(wStream* s, UINT16 length, UINT16 ty
 static size_t rdp_capability_set_start(wStream* s)
 {
 	size_t header = Stream_GetPosition(s);
-	if (Stream_GetRemainingCapacity(s) < CAPSET_HEADER_LENGTH)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), CAPSET_HEADER_LENGTH))
 		return SIZE_MAX;
 	Stream_Zero(s, CAPSET_HEADER_LENGTH);
 	return header;
@@ -3674,7 +3674,7 @@ BOOL rdp_print_capability_sets(wStream* s, size_t start, BOOL receiving)
 	}
 	else
 	{
-		if (Stream_GetRemainingCapacity(s) < 4)
+		if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
 			goto fail;
 	}
 
diff --git a/libfreerdp/core/fastpath.c b/libfreerdp/core/fastpath.c
index cc6ca00ee..6dd884459 100644
--- a/libfreerdp/core/fastpath.c
+++ b/libfreerdp/core/fastpath.c
@@ -117,19 +117,19 @@ static BOOL fastpath_write_update_header(wStream* s, FASTPATH_UPDATE_HEADER* fpU
 	fpUpdateHeader->updateHeader |= (fpUpdateHeader->fragmentation & 0x03) << 4;
 	fpUpdateHeader->updateHeader |= (fpUpdateHeader->compression & 0x03) << 6;
 
-	if (Stream_GetRemainingCapacity(s) < 1)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 1))
 		return FALSE;
 	Stream_Write_UINT8(s, fpUpdateHeader->updateHeader);
 
 	if (fpUpdateHeader->compression)
 	{
-		if (Stream_GetRemainingCapacity(s) < 1)
+		if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 1))
 			return FALSE;
 
 		Stream_Write_UINT8(s, fpUpdateHeader->compressionFlags);
 	}
 
-	if (Stream_GetRemainingCapacity(s) < 2)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 2))
 		return FALSE;
 
 	Stream_Write_UINT16(s, fpUpdateHeader->size);
@@ -149,7 +149,7 @@ static BOOL fastpath_write_update_pdu_header(wStream* s,
 	if (!s || !fpUpdatePduHeader || !rdp)
 		return FALSE;
 
-	if (Stream_GetRemainingCapacity(s) < 3)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 3))
 		return FALSE;
 
 	fpUpdatePduHeader->fpOutputHeader = 0;
@@ -164,13 +164,13 @@ static BOOL fastpath_write_update_pdu_header(wStream* s,
 		WINPR_ASSERT(rdp->settings);
 		if (rdp->settings->EncryptionMethods == ENCRYPTION_METHOD_FIPS)
 		{
-			if (Stream_GetRemainingCapacity(s) < 4)
+			if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
 				return FALSE;
 
 			Stream_Write(s, fpUpdatePduHeader->fipsInformation, 4);
 		}
 
-		if (Stream_GetRemainingCapacity(s) < 8)
+		if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 8))
 			return FALSE;
 
 		Stream_Write(s, fpUpdatePduHeader->dataSignature, 8);
@@ -1198,7 +1198,7 @@ BOOL fastpath_send_update_pdu(rdpFastPath* fastpath, BYTE updateCode, wStream* s
 		fastpath_write_update_pdu_header(fs, &fpUpdatePduHeader, rdp);
 		fastpath_write_update_header(fs, &fpUpdateHeader);
 
-		if (Stream_GetRemainingCapacity(fs) < (size_t)DstSize + pad)
+		if (!Stream_CheckAndLogRequiredCapacity(TAG, (fs), (size_t)DstSize + pad))
 			return FALSE;
 		Stream_Write(fs, pDstData, DstSize);
 
diff --git a/libfreerdp/core/gateway/rts.c b/libfreerdp/core/gateway/rts.c
index 0f626151d..c0820441f 100644
--- a/libfreerdp/core/gateway/rts.c
+++ b/libfreerdp/core/gateway/rts.c
@@ -1319,7 +1319,7 @@ static BOOL rts_version_command_write(wStream* buffer)
 {
 	WINPR_ASSERT(buffer);
 
-	if (Stream_GetRemainingCapacity(buffer) < 8)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (buffer), 8))
 		return FALSE;
 
 	Stream_Write_UINT32(buffer, RTS_CMD_VERSION); /* CommandType (4 bytes) */
diff --git a/libfreerdp/core/license.c b/libfreerdp/core/license.c
index cc31ac881..a44797521 100644
--- a/libfreerdp/core/license.c
+++ b/libfreerdp/core/license.c
@@ -463,12 +463,10 @@ static BOOL license_check_stream_capacity(wStream* s, size_t expect, const char*
 {
 	WINPR_ASSERT(where);
 
-	if (Stream_GetRemainingCapacity(s) < expect)
-	{
-		WLog_WARN(TAG, "short capacity %s, expected %" PRIuz " bytes, got %" PRIuz, where, expect,
-		          Stream_GetRemainingCapacity(s));
+	if (!Stream_CheckAndLogRequiredCapacityEx(TAG, WLOG_WARN, s, expect, 1, "%s(%s:%" PRIuz ") %s",
+	                                          __FUNCTION__, __FILE__, __LINE__, where))
 		return FALSE;
-	}
+
 	return TRUE;
 }
 
diff --git a/libfreerdp/core/rdp.c b/libfreerdp/core/rdp.c
index a4c851474..df0a23560 100644
--- a/libfreerdp/core/rdp.c
+++ b/libfreerdp/core/rdp.c
@@ -165,7 +165,7 @@ BOOL rdp_write_security_header(wStream* s, UINT16 flags)
 {
 	WINPR_ASSERT(s);
 
-	if (Stream_GetRemainingCapacity(s) < 4)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
 		return FALSE;
 
 	/* Basic Security Header */
@@ -239,7 +239,7 @@ BOOL rdp_write_share_control_header(wStream* s, UINT16 length, UINT16 type, UINT
 
 	if (length < RDP_PACKET_HEADER_MAX_LENGTH)
 		return FALSE;
-	if (Stream_GetRemainingCapacity(s) < 6)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 6))
 		return FALSE;
 	length -= RDP_PACKET_HEADER_MAX_LENGTH;
 	/* Share Control Header */
@@ -278,7 +278,7 @@ BOOL rdp_write_share_data_header(wStream* s, UINT16 length, BYTE type, UINT32 sh
 	if (length < headerLen)
 		return FALSE;
 	length -= headerLen;
-	if (Stream_GetRemainingCapacity(s) < 12)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 12))
 		return FALSE;
 
 	/* Share Data Header */
diff --git a/libfreerdp/core/tpdu.c b/libfreerdp/core/tpdu.c
index 645d17be3..347d3c4c7 100644
--- a/libfreerdp/core/tpdu.c
+++ b/libfreerdp/core/tpdu.c
@@ -116,7 +116,7 @@ BOOL tpdu_read_header(wStream* s, BYTE* code, BYTE* li, UINT16 tpktlength)
 
 BOOL tpdu_write_header(wStream* s, UINT16 length, BYTE code)
 {
-	if (Stream_GetRemainingCapacity(s) < 3)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 3))
 		return FALSE;
 
 	Stream_Write_UINT8(s, length); /* LI */
@@ -128,7 +128,7 @@ BOOL tpdu_write_header(wStream* s, UINT16 length, BYTE code)
 	}
 	else
 	{
-		if (Stream_GetRemainingCapacity(s) < 5)
+		if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 5))
 			return FALSE;
 		Stream_Write_UINT16(s, 0); /* DST-REF */
 		Stream_Write_UINT16(s, 0); /* SRC-REF */
diff --git a/libfreerdp/core/tpkt.c b/libfreerdp/core/tpkt.c
index 02488887a..0e124911a 100644
--- a/libfreerdp/core/tpkt.c
+++ b/libfreerdp/core/tpkt.c
@@ -156,7 +156,7 @@ BOOL tpkt_ensure_stream_consumed_(wStream* s, UINT16 length, const char* fkt)
 
 BOOL tpkt_write_header(wStream* s, UINT16 length)
 {
-	if (Stream_GetRemainingCapacity(s) < 4)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, (s), 4))
 		return FALSE;
 	Stream_Write_UINT8(s, 3);          /* version */
 	Stream_Write_UINT8(s, 0);          /* reserved */
diff --git a/winpr/libwinpr/sspi/NTLM/ntlm_compute.c b/winpr/libwinpr/sspi/NTLM/ntlm_compute.c
index eb06f51cb..66d41b43e 100644
--- a/winpr/libwinpr/sspi/NTLM/ntlm_compute.c
+++ b/winpr/libwinpr/sspi/NTLM/ntlm_compute.c
@@ -36,6 +36,10 @@
 #include "../../log.h"
 #define TAG WINPR_TAG("sspi.NTLM")
 
+#define NTLM_CheckAndLogRequiredCapacity(tag, s, nmemb, what)                                    \
+	Stream_CheckAndLogRequiredCapacityEx(tag, WLOG_WARN, s, nmemb, 1, "%s(%s:%" PRIuz ") " what, \
+	                                     __FUNCTION__, __FILE__, __LINE__)
+
 static char NTLM_CLIENT_SIGN_MAGIC[] = "session key to client-to-server signing key magic constant";
 static char NTLM_SERVER_SIGN_MAGIC[] = "session key to server-to-client signing key magic constant";
 static char NTLM_CLIENT_SEAL_MAGIC[] = "session key to client-to-server sealing key magic constant";
@@ -105,12 +109,10 @@ BOOL ntlm_write_version_info(wStream* s, const NTLM_VERSION_INFO* versionInfo)
 	WINPR_ASSERT(s);
 	WINPR_ASSERT(versionInfo);
 
-	if (Stream_GetRemainingCapacity(s) < 5 + sizeof(versionInfo->Reserved))
-	{
-		WLog_ERR(TAG, "NTLM_VERSION_INFO short header %" PRIuz ", expected %" PRIuz,
-		         Stream_GetRemainingCapacity(s), 5 + sizeof(versionInfo->Reserved));
+	if (!Stream_CheckAndLogRequiredCapacityEx(
+	        TAG, WLOG_WARN, s, 5ull + sizeof(versionInfo->Reserved), 1ull,
+	        "%s(%s:%" PRIuz ") NTLM_VERSION_INFO", __FUNCTION__, __FILE__, __LINE__))
 		return FALSE;
-	}
 
 	Stream_Write_UINT8(s, versionInfo->ProductMajorVersion); /* ProductMajorVersion (1 byte) */
 	Stream_Write_UINT8(s, versionInfo->ProductMinorVersion); /* ProductMinorVersion (1 byte) */
@@ -185,12 +187,9 @@ static BOOL ntlm_write_ntlm_v2_client_challenge(wStream* s,
 	WINPR_ASSERT(s);
 	WINPR_ASSERT(challenge);
 
-	if (Stream_GetRemainingCapacity(s) < 28)
-	{
-		WLog_ERR(TAG, "NTLMv2_CLIENT_CHALLENGE expected 28bytes, have %" PRIuz "bytes",
-		         Stream_GetRemainingCapacity(s));
+	if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, 28, "NTLMv2_CLIENT_CHALLENGE"))
 		return FALSE;
-	}
+
 	Stream_Write_UINT8(s, challenge->RespType);
 	Stream_Write_UINT8(s, challenge->HiRespType);
 	Stream_Write_UINT16(s, challenge->Reserved1);
@@ -224,12 +223,9 @@ BOOL ntlm_write_ntlm_v2_response(wStream* s, const NTLMv2_RESPONSE* response)
 	WINPR_ASSERT(s);
 	WINPR_ASSERT(response);
 
-	if (Stream_GetRemainingCapacity(s) < 16)
-	{
-		WLog_ERR(TAG, "NTLMv2_RESPONSE expected 16bytes, have %" PRIuz "bytes",
-		         Stream_GetRemainingCapacity(s));
+	if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, 16ull, "NTLMv2_RESPONSE"))
 		return FALSE;
-	}
+
 	Stream_Write(s, response->Response, 16);
 	return ntlm_write_ntlm_v2_client_challenge(s, &(response->Challenge));
 }
diff --git a/winpr/libwinpr/sspi/NTLM/ntlm_message.c b/winpr/libwinpr/sspi/NTLM/ntlm_message.c
index ef6a80d31..eae8d3ccb 100644
--- a/winpr/libwinpr/sspi/NTLM/ntlm_message.c
+++ b/winpr/libwinpr/sspi/NTLM/ntlm_message.c
@@ -35,6 +35,10 @@
 #include "../../log.h"
 #define TAG WINPR_TAG("sspi.NTLM")
 
+#define NTLM_CheckAndLogRequiredCapacity(tag, s, nmemb, what)                                    \
+	Stream_CheckAndLogRequiredCapacityEx(tag, WLOG_WARN, s, nmemb, 1, "%s(%s:%" PRIuz ") " what, \
+	                                     __FUNCTION__, __FILE__, __LINE__)
+
 static const char NTLM_SIGNATURE[8] = { 'N', 'T', 'L', 'M', 'S', 'S', 'P', '\0' };
 
 static void ntlm_free_message_fields_buffer(NTLM_MESSAGE_FIELDS* fields);
@@ -272,12 +276,9 @@ static BOOL ntlm_write_message_header(wStream* s, const NTLM_MESSAGE_HEADER* hea
 	WINPR_ASSERT(s);
 	WINPR_ASSERT(header);
 
-	if (Stream_GetRemainingCapacity(s) < sizeof(NTLM_SIGNATURE) + 4)
-	{
-		WLog_ERR(TAG, "Short NTLM_MESSAGE_HEADER::header %" PRIuz ", expected 12",
-		         Stream_GetRemainingCapacity(s));
+	if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, sizeof(NTLM_SIGNATURE) + 4ull,
+	                                      "NTLM_MESSAGE_HEADER::header"))
 		return FALSE;
-	}
 
 	Stream_Write(s, header->Signature, sizeof(NTLM_SIGNATURE));
 	Stream_Write_UINT32(s, header->MessageType);
@@ -320,12 +321,9 @@ static BOOL ntlm_write_message_fields(wStream* s, const NTLM_MESSAGE_FIELDS* fie
 	if (fields->MaxLen < 1)
 		MaxLen = fields->Len;
 
-	if (Stream_GetRemainingCapacity(s) < 8)
-	{
-		WLog_ERR(TAG, "Short NTLM_MESSAGE_FIELDS::header %" PRIuz ", expected %" PRIuz,
-		         Stream_GetRemainingCapacity(s), 8);
+	if (!NTLM_CheckAndLogRequiredCapacity(TAG, (s), 8, "NTLM_MESSAGE_FIELDS::header"))
 		return FALSE;
-	}
+
 	Stream_Write_UINT16(s, fields->Len);          /* Len (2 bytes) */
 	Stream_Write_UINT16(s, MaxLen);               /* MaxLen (2 bytes) */
 	Stream_Write_UINT32(s, fields->BufferOffset); /* BufferOffset (4 bytes) */
@@ -382,12 +380,9 @@ static BOOL ntlm_write_message_fields_buffer(wStream* s, const NTLM_MESSAGE_FIEL
 	if (fields->Len > 0)
 	{
 		Stream_SetPosition(s, fields->BufferOffset);
-		if (Stream_GetRemainingCapacity(s) < fields->Len)
-		{
-			WLog_ERR(TAG, "Short NTLM_MESSAGE_FIELDS::Len %" PRIuz ", expected %" PRIu16,
-			         Stream_GetRemainingCapacity(s), fields->Len);
+		if (!NTLM_CheckAndLogRequiredCapacity(TAG, (s), fields->Len, "NTLM_MESSAGE_FIELDS::Len"))
 			return FALSE;
-		}
+
 		Stream_Write(s, fields->Buffer, fields->Len);
 	}
 	return TRUE;
@@ -440,12 +435,10 @@ static BOOL ntlm_write_negotiate_flags(wStream* s, UINT32 flags, const char* nam
 	WINPR_ASSERT(s);
 	WINPR_ASSERT(name);
 
-	if (Stream_GetRemainingCapacity(s) < 4)
-	{
-		WLog_ERR(TAG, "%s::NegotiateFlags expected 4bytes, have %" PRIuz "bytes", name,
-		         Stream_GetRemainingCapacity(s));
+	if (!Stream_CheckAndLogRequiredCapacityEx(TAG, WLOG_WARN, s, 4ull, 1ull,
+	                                          "%s(%s:%" PRIuz ") %s::NegotiateFlags", __FUNCTION__,
+	                                          __FILE__, __LINE__, name))
 		return FALSE;
-	}
 
 	WLog_DBG(TAG, "Write flags %s", ntlm_negotiate_flags_string(buffer, ARRAYSIZE(buffer), flags));
 	Stream_Write_UINT32(s, flags); /* NegotiateFlags (4 bytes) */
@@ -482,21 +475,12 @@ static BOOL ntlm_write_message_integrity_check(wStream* s, size_t offset, const
 
 	pos = Stream_GetPosition(s);
 
-	if (offset + size > Stream_Capacity(s))
-	{
-		WLog_ERR(TAG,
-		         "%s::MessageIntegrityCheck invalid offset[length] %" PRIuz "[%" PRIuz
-		         "], got %" PRIuz,
-		         name, offset, size, Stream_GetRemainingCapacity(s));
+	if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, offset, "MessageIntegrityCheck::offset"))
 		return FALSE;
-	}
+
 	Stream_SetPosition(s, offset);
-	if (Stream_GetRemainingCapacity(s) < size)
-	{
-		WLog_ERR(TAG, "%s::MessageIntegrityCheck expected %" PRIuz "bytes, got %" PRIuz "bytes",
-		         name, size, Stream_GetRemainingCapacity(s));
+	if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, size, "MessageIntegrityCheck::size"))
 		return FALSE;
-	}
 
 	Stream_Write(s, data, size);
 	Stream_SetPosition(s, pos);
@@ -882,13 +866,8 @@ SECURITY_STATUS ntlm_write_ChallengeMessage(NTLM_CONTEXT* context, PSecBuffer bu
 	if (!ntlm_write_negotiate_flags(s, message->NegotiateFlags, "NTLM_CHALLENGE_MESSAGE"))
 		return SEC_E_INTERNAL_ERROR;
 
-	if (Stream_GetRemainingCapacity(s) < 16)
-	{
-		WLog_ERR(TAG,
-		         "NTLM_CHALLENGE_MESSAGE::ServerChallenge expected 16bytes, got %" PRIuz "bytes",
-		         Stream_GetRemainingCapacity(s));
+	if (!NTLM_CheckAndLogRequiredCapacity(TAG, s, 16, "NTLM_CHALLENGE_MESSAGE::ServerChallenge"))
 		return SEC_E_INTERNAL_ERROR;
-	}
 
 	Stream_Write(s, message->ServerChallenge, 8); /* ServerChallenge (8 bytes) */
 	Stream_Write(s, message->Reserved, 8);        /* Reserved (8 bytes), should be ignored */
diff --git a/winpr/libwinpr/utils/image.c b/winpr/libwinpr/utils/image.c
index 51b58910b..b8ec9ff1a 100644
--- a/winpr/libwinpr/utils/image.c
+++ b/winpr/libwinpr/utils/image.c
@@ -385,7 +385,7 @@ static int winpr_image_bitmap_read_buffer(wImage* image, const BYTE* buffer, siz
 		goto fail;
 	if (!Stream_SafeSeek(s, bf.bfOffBits - Stream_GetPosition(s)))
 		goto fail;
-	if (Stream_GetRemainingCapacity(s) < bi.biSizeImage)
+	if (!Stream_CheckAndLogRequiredCapacity(TAG, s, bi.biSizeImage))
 		goto fail;
 
 	if (bi.biWidth < 0)
diff --git a/winpr/libwinpr/utils/stream.c b/winpr/libwinpr/utils/stream.c
index 24c2d80e0..37e73fe12 100644
--- a/winpr/libwinpr/utils/stream.c
+++ b/winpr/libwinpr/utils/stream.c
@@ -290,7 +290,7 @@ BOOL Stream_Write_UTF16_String(wStream* s, const WCHAR* src, size_t length)
 	if (!s || !src)
 		return FALSE;
 
-	if (!Stream_CheckAndLogRequiredCapacity(STREAM_TAG, (s), sizeof(WCHAR) * length))
+	if (!Stream_CheckAndLogRequiredCapacityOfSize(STREAM_TAG, (s), length, sizeof(WCHAR)))
 		return FALSE;
 
 	for (x = 0; x < length; x++)