diff --git a/httpstaticserver.go b/httpstaticserver.go
index 23ae12a..8238d07 100644
--- a/httpstaticserver.go
+++ b/httpstaticserver.go
@@ -181,6 +181,25 @@ type FileJSONInfo struct {
 	Extra   interface{} `json:"extra,omitempty"`
 }
 
+// path should be absolute
+func parseApkInfo(path string) (ai *ApkInfo) {
+	defer func() {
+		if err := recover(); err != nil {
+			log.Println("parse-apk-info panic:", err)
+		}
+	}()
+	apkf, err := apk.OpenFile(path)
+	if err != nil {
+		return
+	}
+	ai = &ApkInfo{}
+	ai.MainActivity, _ = apkf.MainAcitivty()
+	ai.PackageName = apkf.PackageName()
+	ai.Version.Code = apkf.Manifest().VersionCode
+	ai.Version.Name = apkf.Manifest().VersionName
+	return
+}
+
 func (s *HTTPStaticServer) hInfo(w http.ResponseWriter, r *http.Request) {
 	path := mux.Vars(r)["path"]
 	relPath := filepath.Join(s.Root, path)
@@ -205,15 +224,7 @@ func (s *HTTPStaticServer) hInfo(w http.ResponseWriter, r *http.Request) {
 		fji.Type = "markdown"
 	case ".apk":
 		fji.Type = "apk"
-		apkf, err := apk.OpenFile(relPath)
-		if err == nil {
-			ai := ApkInfo{}
-			ai.MainActivity, _ = apkf.MainAcitivty()
-			ai.PackageName = apkf.PackageName()
-			ai.Version.Code = apkf.Manifest().VersionCode
-			ai.Version.Name = apkf.Manifest().VersionName
-			fji.Extra = ai
-		}
+		fji.Extra = parseApkInfo(relPath)
 	default:
 		fji.Type = "text"
 	}
@@ -563,6 +574,7 @@ func (s *HTTPStaticServer) findIndex(text string) []IndexFileItem {
 func (s *HTTPStaticServer) defaultAccessConf() AccessConf {
 	return AccessConf{
 		Upload: s.Upload,
+		Delete: s.Delete,
 	}
 }
 
diff --git a/main.go b/main.go
index 6068fab..898c705 100644
--- a/main.go
+++ b/main.go
@@ -32,6 +32,7 @@ type Configure struct {
 	Theme           string   `yaml:"theme"`
 	XHeaders        bool     `yaml:"xheaders"`
 	Upload          bool     `yaml:"upload"`
+	Delete          bool     `yaml:"delete"`
 	PlistProxy      string   `yaml:"plistproxy"`
 	Title           string   `yaml:"title"`
 	Debug           bool     `yaml:"debug"`
@@ -103,6 +104,7 @@ func parseFlags() error {
 	kingpin.Flag("auth-openid", "OpenID auth identity url").StringVar(&gcfg.Auth.OpenID)
 	kingpin.Flag("theme", "web theme, one of <black|green>").StringVar(&gcfg.Theme)
 	kingpin.Flag("upload", "enable upload support").BoolVar(&gcfg.Upload)
+	kingpin.Flag("delete", "enable delete support").BoolVar(&gcfg.Delete)
 	kingpin.Flag("xheaders", "used when behide nginx").BoolVar(&gcfg.XHeaders)
 	kingpin.Flag("cors", "enable cross-site HTTP request").BoolVar(&gcfg.Cors)
 	kingpin.Flag("debug", "enable debug mode").BoolVar(&gcfg.Debug)
@@ -140,6 +142,7 @@ func main() {
 	ss.Title = gcfg.Title
 	ss.GoogleTrackerId = gcfg.GoogleTrackerId
 	ss.Upload = gcfg.Upload
+	ss.Delete = gcfg.Delete
 	ss.AuthType = gcfg.Auth.Type
 
 	if gcfg.PlistProxy != "" {
diff --git a/vendor/github.com/shogo82148/androidbinary/common.go b/vendor/github.com/shogo82148/androidbinary/common.go
index 02026bc..6f3bc73 100644
--- a/vendor/github.com/shogo82148/androidbinary/common.go
+++ b/vendor/github.com/shogo82148/androidbinary/common.go
@@ -3,6 +3,7 @@ package androidbinary
 import (
 	"bytes"
 	"encoding/binary"
+	"fmt"
 	"io"
 	"os"
 	"unicode/utf16"
@@ -150,6 +151,9 @@ func readUTF16(sr *io.SectionReader) (string, error) {
 	if err != nil {
 		return "", nil
 	}
+	if size > 2000 {
+		return "", fmt.Errorf("invalid string length: %d", size)
+	}
 
 	// read string value
 	buf := make([]uint16, size)