diff --git a/libexif/exif-data.c b/libexif/exif-data.c
index 6504bc5..034f40d 100644
--- a/libexif/exif-data.c
+++ b/libexif/exif-data.c
@@ -50,6 +50,7 @@
 #define JPEG_MARKER_APP1 0xe1
 #undef JPEG_HEADER_LEN
 #define JPEG_HEADER_LEN 6
+#define ENTRY_SIZE 12
 
 #define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize ))
 
@@ -606,6 +607,13 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd,
 
 	for (i = 0; i < n; i++) {
 
+		/* Check if we have enough data. */
+		if (CHECKOVERFLOW(offset + ENTRY_SIZE * i, ds, sizeof(ExifShort))) {
+			exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
+					"Tag data past end of buffer (%u+2 > %u)", offset + ENTRY_SIZE * i, ds);
+			return;
+		}
+
 		tag = exif_get_short (d + offset + 12 * i, data->priv->order);
 		switch (tag) {
 		case EXIF_TAG_EXIF_IFD_POINTER: