diff --git a/gio/gmemoryoutputstream.c b/gio/gmemoryoutputstream.c
index 242130a..f04b645 100644
--- a/gio/gmemoryoutputstream.c
+++ b/gio/gmemoryoutputstream.c
@@ -17,7 +17,9 @@
  * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
  * Boston, MA 02111-1307, USA.
  *
- * Author: Christian Kellner <gicmo@gnome.org>
+ * Authors:
+ *   Christian Kellner <gicmo@gnome.org>
+ *   Krzysztof Kosiński <tweenk.pl@gmail.com>
  */
 
 #include "config.h"
@@ -44,18 +46,35 @@
 
 #define MIN_ARRAY_SIZE  16
 
+enum {
+  PROP_0,
+  PROP_DATA,
+  PROP_SIZE,
+  PROP_DATA_SIZE,
+  PROP_REALLOC_FUNCTION,
+  PROP_DESTROY_FUNCTION
+};
+
 struct _GMemoryOutputStreamPrivate {
   
-  gpointer       data;
-  gsize          len;
+  gpointer       data; /* Write buffer */
+  gsize          len; /* Current length of the data buffer. Can change with resizing. */
   gsize          valid_len; /* The part of data that has been written to */
-
-  goffset        pos;
+  gsize          pos; /* Current position in the stream. Distinct from valid_len,
+                         because the stream is seekable. */
 
   GReallocFunc   realloc_fn;
   GDestroyNotify destroy;
 };
 
+static void     g_memory_output_stream_set_property (GObject      *object,
+                                                     guint         prop_id,
+                                                     const GValue *value,
+                                                     GParamSpec   *pspec);
+static void     g_memory_output_stream_get_property (GObject      *object,
+                                                     guint         prop_id,
+                                                     GValue       *value,
+                                                     GParamSpec   *pspec);
 static void     g_memory_output_stream_finalize     (GObject      *object);
 
 static gssize   g_memory_output_stream_write       (GOutputStream *stream,
@@ -115,7 +134,9 @@ g_memory_output_stream_class_init (GMemoryOutputStreamClass *klass)
   g_type_class_add_private (klass, sizeof (GMemoryOutputStreamPrivate));
 
   gobject_class = G_OBJECT_CLASS (klass);
-  gobject_class->finalize = g_memory_output_stream_finalize;
+  gobject_class->set_property = g_memory_output_stream_set_property;
+  gobject_class->get_property = g_memory_output_stream_get_property;
+  gobject_class->finalize     = g_memory_output_stream_finalize;
 
   ostream_class = G_OUTPUT_STREAM_CLASS (klass);
 
@@ -125,6 +146,116 @@ g_memory_output_stream_class_init (GMemoryOutputStreamClass *klass)
   ostream_class->write_finish = g_memory_output_stream_write_finish;
   ostream_class->close_async  = g_memory_output_stream_close_async;
   ostream_class->close_finish = g_memory_output_stream_close_finish;
+
+  g_object_class_install_property (gobject_class,
+                                   PROP_DATA,
+                                   g_param_spec_pointer ("data",
+                                                         P_("Data Buffer"),
+                                                         P_("Pointer to buffer where data will be written."),
+                                                         G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY |
+                                                         G_PARAM_STATIC_STRINGS));
+
+  g_object_class_install_property (gobject_class,
+                                   PROP_SIZE,
+                                   g_param_spec_ulong ("size",
+                                                       P_("Data Buffer Size"),
+                                                       P_("Current size of the data buffer."),
+                                                       0, G_MAXULONG, 0,
+                                                       G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY |
+                                                       G_PARAM_STATIC_STRINGS));
+
+  g_object_class_install_property (gobject_class,
+                                   PROP_DATA_SIZE,
+                                   g_param_spec_ulong ("data-size",
+                                                       P_("Data Size"),
+                                                       P_("Size of data written to the buffer."),
+                                                       0, G_MAXULONG, 0,
+                                                       G_PARAM_READABLE |
+                                                       G_PARAM_STATIC_STRINGS));
+
+  g_object_class_install_property (gobject_class,
+                                   PROP_REALLOC_FUNCTION,
+                                   g_param_spec_pointer ("realloc-function",
+                                                         P_("Memory Reallocation Function"),
+                                                         P_("Function with realloc semantics called to enlarge the buffer."),
+                                                         G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY |
+                                                         G_PARAM_STATIC_STRINGS));
+
+  g_object_class_install_property (gobject_class,
+                                   PROP_DESTROY_FUNCTION,
+                                   g_param_spec_pointer ("destroy-function",
+                                                         P_("Destroy Notification Function"),
+                                                         P_("Function called with the buffer as argument when the stream is destroyed."),
+                                                         G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY |
+                                                         G_PARAM_STATIC_STRINGS));
+}
+
+static void
+g_memory_output_stream_set_property (GObject      *object,
+                                     guint         prop_id,
+                                     const GValue *value,
+                                     GParamSpec   *pspec)
+{
+  GMemoryOutputStream        *stream;
+  GMemoryOutputStreamPrivate *priv;
+
+  stream = G_MEMORY_OUTPUT_STREAM (object);
+  priv = stream->priv;
+
+  switch (prop_id)
+    {
+    case PROP_DATA:
+      priv->data = g_value_get_pointer (value);
+      break;
+    case PROP_SIZE:
+      priv->len = g_value_get_ulong (value);
+      break;
+    /* PROP_DATA_SIZE should never be set. */
+    case PROP_REALLOC_FUNCTION:
+      priv->realloc_fn = g_value_get_pointer (value);
+      break;
+    case PROP_DESTROY_FUNCTION:
+      priv->destroy = g_value_get_pointer (value);
+      break;
+    default:
+      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+      break;
+    }
+}
+
+static void
+g_memory_output_stream_get_property (GObject      *object,
+                                     guint         prop_id,
+                                     GValue       *value,
+                                     GParamSpec   *pspec)
+{
+  GMemoryOutputStream        *stream;
+  GMemoryOutputStreamPrivate *priv;
+
+  stream = G_MEMORY_OUTPUT_STREAM (object);
+  priv = stream->priv;
+
+  switch (prop_id)
+    {
+    case PROP_DATA:
+      g_value_set_pointer (value, priv->data);
+      break;
+    case PROP_SIZE:
+      g_value_set_ulong (value, priv->len);
+      break;
+    case PROP_DATA_SIZE:
+      g_value_set_ulong (value, priv->valid_len);
+      break;
+    case PROP_REALLOC_FUNCTION:
+      g_value_set_pointer (value, priv->realloc_fn);
+      break;
+    case PROP_DESTROY_FUNCTION:
+      g_value_set_pointer (value, priv->destroy);
+      break;
+    default:
+      G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+      break;
+    }
 }
 
 static void
@@ -159,15 +290,17 @@ g_memory_output_stream_init (GMemoryOutputStream *stream)
   stream->priv = G_TYPE_INSTANCE_GET_PRIVATE (stream,
                                               G_TYPE_MEMORY_OUTPUT_STREAM,
                                               GMemoryOutputStreamPrivate);
+  stream->priv->pos = 0;
+  stream->priv->valid_len = 0;
 }
 
 /**
  * g_memory_output_stream_new:
  * @data: pointer to a chunk of memory to use, or %NULL
- * @len: the size of @data
- * @realloc_fn: a function with realloc() semantics to be called when 
+ * @size: the size of @data
+ * @realloc_function: a function with realloc() semantics to be called when 
  *     @data needs to be grown, or %NULL
- * @destroy: a function to be called on @data when the stream is finalized,
+ * @destroy_function: a function to be called on @data when the stream is finalized,
  *     or %NULL
  *
  * Creates a new #GMemoryOutputStream. 
@@ -189,24 +322,18 @@ g_memory_output_stream_init (GMemoryOutputStream *stream)
  **/
 GOutputStream *
 g_memory_output_stream_new (gpointer       data,
-                            gsize          len,
-                            GReallocFunc   realloc_fn,
-                            GDestroyNotify destroy)
+                            gsize          size,
+                            GReallocFunc   realloc_function,
+                            GDestroyNotify destroy_function)
 {
   GOutputStream *stream;
-  GMemoryOutputStreamPrivate *priv;
-
-  stream = g_object_new (G_TYPE_MEMORY_OUTPUT_STREAM, NULL);
-
-  priv = G_MEMORY_OUTPUT_STREAM (stream)->priv;
-
-  priv->data = data;
-  priv->len = len;
-  priv->realloc_fn = realloc_fn;
-  priv->destroy = destroy;
 
-  priv->pos = 0;
-  priv->valid_len = 0;
+  stream = g_object_new (G_TYPE_MEMORY_OUTPUT_STREAM,
+                         "data", data,
+                         "size", size,
+                         "realloc-function", realloc_function,
+                         "destroy-function", destroy_function,
+                         NULL);
 
   return stream;
 }
@@ -276,29 +403,10 @@ g_memory_output_stream_get_data_size (GMemoryOutputStream *ostream)
   return ostream->priv->valid_len;
 }
 
-
-static gboolean
-array_check_boundary (GMemoryOutputStream  *stream,
-                      goffset               size,
-                      GError              **error)
-{
-  if (size > G_MAXUINT)
-    {
-      g_set_error_literal (error,
-                           G_IO_ERROR,
-                           G_IO_ERROR_FAILED,
-                           _("Reached maximum data array limit"));
-
-      return FALSE;
-    }
-
-  return TRUE;
-}
-
 static gboolean
 array_resize (GMemoryOutputStream  *ostream,
               gsize                 size,
-	      gboolean              allow_partial,
+              gboolean              allow_partial,
               GError              **error)
 {
   GMemoryOutputStreamPrivate *priv;
@@ -307,17 +415,14 @@ array_resize (GMemoryOutputStream  *ostream,
 
   priv = ostream->priv;
 
-  if (!array_check_boundary (ostream, size, error))
-    return FALSE;
-
   if (priv->len == size)
     return TRUE;
 
   if (!priv->realloc_fn)
     {
       if (allow_partial &&
-	  priv->pos < priv->len)
-	return TRUE; /* Short write */
+          priv->pos < priv->len)
+        return TRUE; /* Short write */
       
       g_set_error_literal (error,
                            G_IO_ERROR,
@@ -332,8 +437,8 @@ array_resize (GMemoryOutputStream  *ostream,
   if (size > 0 && !data) 
     {
       if (allow_partial &&
-	  priv->pos < priv->len)
-	return TRUE; /* Short write */
+          priv->pos < priv->len)
+        return TRUE; /* Short write */
       
       g_set_error_literal (error,
                            G_IO_ERROR,
@@ -383,15 +488,29 @@ g_memory_output_stream_write (GOutputStream  *stream,
   if (count == 0)
     return 0;
 
+  /* Check for address space overflow, but only if the buffer is resizable.
+     Otherwise we just do a short write and don't worry. */
+  if (priv->realloc_fn && priv->pos + count < priv->pos)
+    goto overflow;
+
   if (priv->pos + count > priv->len) 
     {
       /* At least enought to fit the write, rounded up
-	 for greater than linear growth */
+	     for greater than linear growth.
+         TODO: This wastes a lot of memory at large stream sizes.
+               Figure out a more rational allocation strategy. */
       new_size = g_nearest_pow (priv->pos + count);
+      /* Check for overflow again. We have only checked if
+         pos + count > G_MAXSIZE, but it only catches the case of writing
+         more than 4GiB total on a 32-bit system. There's still the problem
+         of g_nearest_pow overflowing above 0x7fffffff, so we're
+         effectively limited to 2GiB. */
+      if (new_size < priv->len)
+        goto overflow;
+
       new_size = MAX (new_size, MIN_ARRAY_SIZE);
-      
       if (!array_resize (ostream, new_size, TRUE, error))
-	return -1;
+        return -1;
     }
 
   /* Make sure we handle short writes if the array_resize
@@ -406,6 +525,15 @@ g_memory_output_stream_write (GOutputStream  *stream,
     priv->valid_len = priv->pos;
 
   return count;
+
+  overflow:
+  /* Overflow: buffer size would need to be bigger than G_MAXSIZE. */
+  g_error_set_literal (error,
+                       G_IO_ERROR,
+                       G_IO_ERROR_NO_SPACE,
+                       _("Amount of memory required to process the write is "
+                         "larger than available address space"));
+  return -1;
 }
 
 static gboolean
@@ -560,12 +688,18 @@ g_memory_output_stream_seek (GSeekable    *seekable,
       g_set_error_literal (error,
                            G_IO_ERROR,
                            G_IO_ERROR_INVALID_ARGUMENT,
-                           _("Invalid seek request"));
+                           _("Requested seek before the beginning of the stream"));
       return FALSE;
     }
 
-  if (!array_check_boundary (stream, absolute, error)) 
-    return FALSE;  
+  if (absolute > priv->len)
+    {
+      g_set_error_literal (error,
+                           G_IO_ERROR,
+                           G_IO_ERROR_INVALID_ARGUMENT,
+                           _("Requested seek beyond the end of the stream"));
+      return FALSE;
+    }
 
   priv->pos = absolute;
 
diff --git a/gio/gmemoryoutputstream.h b/gio/gmemoryoutputstream.h
index d2f5b7f..ddb4051 100644
--- a/gio/gmemoryoutputstream.h
+++ b/gio/gmemoryoutputstream.h
@@ -85,9 +85,9 @@ typedef gpointer (* GReallocFunc) (gpointer data,
 GType          g_memory_output_stream_get_type      (void) G_GNUC_CONST;
 
 GOutputStream *g_memory_output_stream_new           (gpointer             data,
-                                                     gsize                len,
-                                                     GReallocFunc         realloc_fn,
-                                                     GDestroyNotify       destroy);
+                                                     gsize                size,
+                                                     GReallocFunc         realloc_function,
+                                                     GDestroyNotify       destroy_function);
 gpointer       g_memory_output_stream_get_data      (GMemoryOutputStream *ostream);
 gsize          g_memory_output_stream_get_size      (GMemoryOutputStream *ostream);
 gsize          g_memory_output_stream_get_data_size (GMemoryOutputStream *ostream);
diff --git a/gio/tests/memory-output-stream.c b/gio/tests/memory-output-stream.c
index cc1e1ea..c30e96f 100644
--- a/gio/tests/memory-output-stream.c
+++ b/gio/tests/memory-output-stream.c
@@ -85,6 +85,42 @@ test_data_size (void)
   g_object_unref (mo);
 }
 
+static void
+test_properties (void)
+{
+  GOutputStream *mo;
+  GDataOutputStream *o;
+  int i;
+  GError *error = NULL;
+
+  g_test_bug ("605733");
+
+  mo = (GOutputStream*) g_object_new (G_TYPE_MEMORY_OUTPUT_STREAM,
+                                      "realloc-function", g_realloc,
+                                      "destroy-function", g_free,
+                                      NULL);
+  o = g_data_output_stream_new (mo);
+
+  for (i = 0; i < 1000; i++)
+    {
+      g_data_output_stream_put_byte (o, 1, NULL, &error);
+      g_assert_no_error (error);
+    }
+
+  gsize data_size_fun = g_memory_output_stream_get_data_size (G_MEMORY_OUTPUT_STREAM (mo));
+  gsize data_size_prop;
+  g_object_get (mo, "data-size", &data_size_prop, NULL);
+  g_assert_cmpint (data_size_fun, ==, data_size_prop);
+
+  gpointer data_fun = g_memory_output_stream_get_data (G_MEMORY_OUTPUT_STREAM (mo));
+  gpointer data_prop;
+  g_object_get (mo, "data", &data_prop, NULL);
+  g_assert_cmphex (data_fun, ==, data_prop);
+
+  g_object_unref (o);
+  g_object_unref (mo);
+}
+
 int
 main (int   argc,
       char *argv[])
@@ -95,6 +131,7 @@ main (int   argc,
 
   g_test_add_func ("/memory-output-stream/truncate", test_truncate);
   g_test_add_func ("/memory-output-stream/get-data-size", test_data_size);
+  g_test_add_func ("/memory-output-stream/properties", test_properties);
 
   return g_test_run();
 }
