diff --git a/src/common/util.c b/src/common/util.c
index 2775dae8e6..a80d96ac9b 100644
--- a/src/common/util.c
+++ b/src/common/util.c
@@ -2823,7 +2823,7 @@ unescape_string(const char *s, char **result, size_t *size_out)
         if (size_out) *size_out = out - *result;
         return cp+1;
       case '\0':
-        /* LCOV_EXCL_START */
+        /* LCOV_EXCL_START -- we caught this in parse_config_from_line. */
         tor_fragile_assert();
         tor_free(*result);
         return NULL;
@@ -2841,8 +2841,12 @@ unescape_string(const char *s, char **result, size_t *size_out)
               x1 = hex_decode_digit(cp[2]);
               x2 = hex_decode_digit(cp[3]);
               if (x1 == -1 || x2 == -1) {
-                  tor_free(*result);
-                  return NULL;
+                /* LCOV_EXCL_START */
+                /* we caught this above in the initial loop. */
+                tor_assert_nonfatal_unreached();
+                tor_free(*result);
+                return NULL;
+                /* LCOV_EXCL_STOP */
               }
 
               *out++ = ((x1<<4) + x2);
@@ -2868,7 +2872,11 @@ unescape_string(const char *s, char **result, size_t *size_out)
             cp += 2;
             break;
           default:
+            /* LCOV_EXCL_START */
+            /* we caught this above in the initial loop. */
+            tor_assert_nonfatal_unreached();
             tor_free(*result); return NULL;
+            /* LCOV_EXCL_STOP */
           }
         break;
       default:
diff --git a/src/test/test_util.c b/src/test/test_util.c
index 55aff31046..c3d76c56d2 100644
--- a/src/test/test_util.c
+++ b/src/test/test_util.c
@@ -1228,6 +1228,41 @@ test_util_config_line_escaped_content(void *arg)
   tt_ptr_op(str,OP_EQ, NULL);
   tor_free(k); tor_free(v);
 
+  /* more things to try. */
+  /* Bad hex: */
+  strlcpy(buf1, "Foo \"\\x9g\"\n", sizeof(buf1));
+  strlcpy(buf2, "Foo \"\\xg0\"\n", sizeof(buf2));
+  strlcpy(buf3, "Foo \"\\xf\"\n", sizeof(buf3));
+  /* bad escape */
+  strlcpy(buf4, "Foo \"\\q\"\n", sizeof(buf4));
+  /* missing endquote */
+  strlcpy(buf5, "Foo \"hello\n", sizeof(buf5));
+
+  str=buf1;
+  str = parse_config_line_from_str(str, &k, &v);
+  tt_ptr_op(str,OP_EQ, NULL);
+  tor_free(k); tor_free(v);
+
+  str=buf2;
+  str = parse_config_line_from_str(str, &k, &v);
+  tt_ptr_op(str,OP_EQ, NULL);
+  tor_free(k); tor_free(v);
+
+  str=buf3;
+  str = parse_config_line_from_str(str, &k, &v);
+  tt_ptr_op(str,OP_EQ, NULL);
+  tor_free(k); tor_free(v);
+
+  str=buf4;
+  str = parse_config_line_from_str(str, &k, &v);
+  tt_ptr_op(str,OP_EQ, NULL);
+  tor_free(k); tor_free(v);
+
+  str=buf5;
+  str = parse_config_line_from_str(str, &k, &v);
+  tt_ptr_op(str,OP_EQ, NULL);
+  tor_free(k); tor_free(v);
+
  done:
   tor_free(k);
   tor_free(v);