diff --git a/changes/bug2704_part1 b/changes/bug2704_part1
new file mode 100644
index 0000000000..eaf22812cc
--- /dev/null
+++ b/changes/bug2704_part1
@@ -0,0 +1,5 @@
+  o Minor bugfixes:
+    - Fix an issue causing calculation of Tor's average bandwidth as saved
+      in the state file to be 10 times smaller than it should be. Fixes the
+      first part of bug 2704, bugfix on tor-0.2.2.23-alpha.
+
diff --git a/changes/bug2704_part2 b/changes/bug2704_part2
new file mode 100644
index 0000000000..962c8b7099
--- /dev/null
+++ b/changes/bug2704_part2
@@ -0,0 +1,5 @@
+  o Major bugfixes:
+    - Prevent relays that read their bandwidth history from their state file
+      from arbitrarily inflating that value. Fixes the second half of bug
+      2704, bugfix on tor-0.2.2.23-alpha.
+
diff --git a/changes/bug2750 b/changes/bug2750
new file mode 100644
index 0000000000..4371a0a4ee
--- /dev/null
+++ b/changes/bug2750
@@ -0,0 +1,6 @@
+  o Minor bugfixes
+    - Correct the warning displayed when a rendezvous descriptor exceeds
+      the maximum size.  Fixes bug 2750; bugfix on 0.2.1.5-alpha.  Found
+      by John Brooks.
+
+
diff --git a/changes/bug2948 b/changes/bug2948
new file mode 100644
index 0000000000..640ef625d9
--- /dev/null
+++ b/changes/bug2948
@@ -0,0 +1,7 @@
+  o Minor bugfixes
+    - Only limit the lengths of single HS descriptors, even when
+      multiple HS descriptors are published to an HSDir relay in a
+      single POST operation.  Fixes bug 2948; bugfix on 0.2.1.5-alpha.
+      Found by hsdir.
+
+
diff --git a/src/common/address.c b/src/common/address.c
index adc0ef0f7c..aff517ca51 100644
--- a/src/common/address.c
+++ b/src/common/address.c
@@ -604,7 +604,7 @@ tor_addr_parse_mask_ports(const char *s, tor_addr_t *addr_out,
       if (family == AF_INET6 && v4map) {
         if (bits > 32 && bits < 96) { /* Crazy */
           log_warn(LD_GENERAL,
-                   "Bad mask bits %i for V4-mapped V6 address; rejecting.",
+                   "Bad mask bits %d for V4-mapped V6 address; rejecting.",
                    bits);
           goto err;
         }
diff --git a/src/or/rephist.c b/src/or/rephist.c
index 9b7eefecf2..fb091d5adf 100644
--- a/src/or/rephist.c
+++ b/src/or/rephist.c
@@ -1673,7 +1673,7 @@ rep_hist_load_bwhist_state_section(bw_array_t *b,
           mv *= NUM_SECS_ROLLING_MEASURE;
         } else {
           /* No maxima known; guess average rate to be conservative. */
-          mv = v / s_interval;
+          mv = (v / s_interval) * NUM_SECS_ROLLING_MEASURE;
         }
         if (!ok) {
           retval = -1;
@@ -1686,11 +1686,24 @@ rep_hist_load_bwhist_state_section(bw_array_t *b,
         }
 
         if (start < now) {
-          add_obs(b, start, v);
+          time_t cur_start = start;
+          time_t actual_interval_len = s_interval;
+          uint64_t cur_val = 0;
+          /* Calculate the average per second. This is the best we can do
+           * because our state file doesn't have per-second resolution. */
+          if (start + s_interval > now)
+            actual_interval_len = now - start;
+          cur_val = v / actual_interval_len;
+          /* This is potentially inefficient, but since we don't do it very
+           * often it should be ok. */
+          while (cur_start < start + actual_interval_len) {
+            add_obs(b, cur_start, cur_val);
+            ++cur_start;
+          }
           b->max_total = mv;
           /* This will result in some fairly choppy history if s_interval
-           * is notthe same as NUM_SECS_BW_SUM_INTERVAL. XXXX */
-          start += s_interval;
+           * is not the same as NUM_SECS_BW_SUM_INTERVAL. XXXX */
+          start += actual_interval_len;
         }
     } SMARTLIST_FOREACH_END(cp);
   }
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index 95e174e550..ba29f056f1 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -4638,10 +4638,12 @@ rend_parse_v2_service_descriptor(rend_service_descriptor_t **parsed_out,
   else
     eos = eos + 1;
   /* Check length. */
-  if (strlen(desc) > REND_DESC_MAX_SIZE) {
-    log_warn(LD_REND, "Descriptor length is %i which exceeds "
-             "maximum rendezvous descriptor size of %i kilobytes.",
-             (int)strlen(desc), REND_DESC_MAX_SIZE);
+  if (eos-desc > REND_DESC_MAX_SIZE) {
+    /* XXX023 If we are parsing this descriptor as a server, this
+     * should be a protocol warning. */
+    log_warn(LD_REND, "Descriptor length is %d which exceeds "
+             "maximum rendezvous descriptor size of %d bytes.",
+             (int)(eos-desc), REND_DESC_MAX_SIZE);
     goto err;
   }
   /* Tokenize descriptor. */
diff --git a/src/test/test_addr.c b/src/test/test_addr.c
index 20ffaa0c52..6db4ee2483 100644
--- a/src/test/test_addr.c
+++ b/src/test/test_addr.c
@@ -477,9 +477,9 @@ test_addr_ip6_helpers(void)
   i = get_interface_address6(LOG_DEBUG, AF_INET6, &t2);
 #if 0
   tor_inet_ntop(AF_INET, &t1.sa.sin_addr, buf, sizeof(buf));
-  printf("\nv4 address: %s  (family=%i)", buf, IN_FAMILY(&t1));
+  printf("\nv4 address: %s  (family=%d)", buf, IN_FAMILY(&t1));
   tor_inet_ntop(AF_INET6, &t2.sa6.sin6_addr, buf, sizeof(buf));
-  printf("\nv6 address: %s  (family=%i)", buf, IN_FAMILY(&t2));
+  printf("\nv6 address: %s  (family=%d)", buf, IN_FAMILY(&t2));
 #endif
 
  done: