1 files changed, 2 insertions, 0 deletions

diff --git a/src/bplist.c b/src/bplist.c
index 1a40556..0cfe5fe 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -530,6 +530,8 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
                 return NULL;
             (*object)++;
             next_size = 1 << next_size;
+            if (*object + next_size >= bplist->data + bplist->size)
+                return NULL;
             size = UINT_TO_HOST(*object, next_size);
             (*object) += next_size;
             break;