diff --git a/TinyEXIF.cpp b/TinyEXIF.cpp
index f39695a..3cf1ed8 100644
--- a/TinyEXIF.cpp
+++ b/TinyEXIF.cpp
@@ -205,7 +205,10 @@ public:
 	bool Fetch(uint16_t& val, uint32_t idx) const {
 		if (!IsShort() || length <= idx)
 			return false;
-		val = parse16(buf + GetSubIFD() + idx*2, alignIntel);
+		const uint32_t offset = GetSubIFD() + idx*2;
+		if (offset + 2 > len)
+			return false;
+		val = parse16(buf + offset, alignIntel);
 		return true;
 	}
 	bool Fetch(uint32_t& val) const {
@@ -229,7 +232,10 @@ public:
 	bool Fetch(double& val, uint32_t idx) const {
 		if (!IsRational() || length <= idx)
 			return false;
-		val = parseRational(buf + GetSubIFD() + idx*8, alignIntel, IsSRational());
+		const uint32_t offset = GetSubIFD() + idx*8;
+		if (offset + 8 > len)
+			return false;
+		val = parseRational(buf + offset, alignIntel, IsSRational());
 		return true;
 	}