diff --git a/ChangeLog b/ChangeLog
index 1b926428..600f20f9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+18/5/16 started 8.3.2
+- more robust vips image reading
+
 15/4/16 started 8.3.1
 - rename vips wrapper script, it was still vips-8.2, thanks Benjamin
 - export C++ operator overloads for MSVC linking [Lovell]
diff --git a/configure.ac b/configure.ac
index 201a893e..14424b8a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@
 
 # also update the version number in the m4 macros below
 
-AC_INIT([vips], [8.3.1], [vipsip@jiscmail.ac.uk])
+AC_INIT([vips], [8.3.2], [vipsip@jiscmail.ac.uk])
 # required for gobject-introspection
 AC_PREREQ(2.62)
 
@@ -18,7 +18,7 @@ AC_CONFIG_MACRO_DIR([m4])
 # user-visible library versioning
 m4_define([vips_major_version], [8])
 m4_define([vips_minor_version], [3])
-m4_define([vips_micro_version], [1])
+m4_define([vips_micro_version], [2])
 m4_define([vips_version],
           [vips_major_version.vips_minor_version.vips_micro_version])
 
@@ -38,7 +38,7 @@ VIPS_VERSION_STRING=$VIPS_VERSION-`date`
 #   binary interface changes not backwards compatible?: reset age to 0
 
 LIBRARY_CURRENT=46
-LIBRARY_REVISION=1
+LIBRARY_REVISION=2
 LIBRARY_AGE=4
 
 # patched into include/vips/version.h
diff --git a/libvips/iofuncs/header.c b/libvips/iofuncs/header.c
index 5e913759..8d748507 100644
--- a/libvips/iofuncs/header.c
+++ b/libvips/iofuncs/header.c
@@ -196,8 +196,7 @@ const guint64 vips__image_sizeof_bandformat[] = {
 guint64 
 vips_format_sizeof( VipsBandFormat format )
 {
-	g_assert( format >= 0 && 
-		format < VIPS_FORMAT_LAST ); 
+	format = VIPS_CLIP( 0, format, VIPS_FORMAT_DPCOMPLEX ); 
 
 	return( vips__image_sizeof_bandformat[format] );
 }
diff --git a/libvips/iofuncs/image.c b/libvips/iofuncs/image.c
index 3fc640e5..da7bcecd 100644
--- a/libvips/iofuncs/image.c
+++ b/libvips/iofuncs/image.c
@@ -2786,7 +2786,8 @@ vips_image_ispartial( VipsImage *image )
 int
 vips_image_write_prepare( VipsImage *image )
 {	
-	g_assert( vips_object_sanity( VIPS_OBJECT( image ) ) );
+	if( !vips_object_sanity( VIPS_OBJECT( image ) ) )
+		return( -1 ); 
 
 	if( image->Xsize <= 0 || 
 		image->Ysize <= 0 || 
@@ -3046,7 +3047,8 @@ vips_image_wio_input( VipsImage *image )
 {	
 	VipsImage *t1;
 
-	g_assert( vips_object_sanity( VIPS_OBJECT( image ) ) );
+	if( !vips_object_sanity( VIPS_OBJECT( image ) ) )
+		return( -1 ); 
 
 #ifdef DEBUG_IO
 	printf( "vips_image_wio_input: wio input for %s\n", 
@@ -3269,8 +3271,9 @@ vips_image_inplace( VipsImage *image )
  */
 int
 vips_image_pio_input( VipsImage *image )
-{	
-	g_assert( vips_object_sanity( VIPS_OBJECT( image ) ) );
+{
+	if( !vips_object_sanity( VIPS_OBJECT( image ) ) )
+		return( -1 ); 
 
 #ifdef DEBUG_IO
 	printf( "vips_image_pio_input: enabling partial input for %s\n", 
diff --git a/libvips/iofuncs/threadpool.c b/libvips/iofuncs/threadpool.c
index 3826177a..c70ec47d 100644
--- a/libvips/iofuncs/threadpool.c
+++ b/libvips/iofuncs/threadpool.c
@@ -692,7 +692,7 @@ vips_threadpool_new( VipsImage *im )
 	VipsThreadpool *pool;
 	int tile_width;
 	int tile_height;
-	int n_tiles;
+	gint64 n_tiles;
 	int n_lines;
 
 	/* Allocate and init new thread block.
@@ -716,7 +716,9 @@ vips_threadpool_new( VipsImage *im )
 	 * the number of threads we create.
 	 */
 	vips_get_tile_size( im, &tile_width, &tile_height, &n_lines );
-	n_tiles = (1 + im->Xsize / tile_width) * (1 + im->Ysize / tile_height);
+	n_tiles = (1 + (gint64) im->Xsize / tile_width) * 
+		(1 + (gint64) im->Ysize / tile_height);
+	n_tiles = VIPS_CLIP( 0, n_tiles, MAX_THREADS ); 
 	pool->nthr = VIPS_MIN( pool->nthr, n_tiles ); 
 
 	/* Attach tidy-up callback.