diff --git a/av1/decoder/obu.c b/av1/decoder/obu.c
index 644352a..2ab5d35 100644
--- a/av1/decoder/obu.c
+++ b/av1/decoder/obu.c
@@ -363,6 +363,10 @@
     }
 #endif  // CONFIG_OBU_SIZE_AFTER_HEADER
 
+    if (data_end < data + length_field_size) {
+      cm->error.error_code = AOM_CODEC_CORRUPT_FRAME;
+      return;
+    }
     av1_init_read_bit_buffer(pbi, &rb, data + length_field_size, data_end);
 
     if (read_obu_header(&rb, &obu_header) != AOM_CODEC_OK) {
@@ -439,6 +443,11 @@
           cm->error.error_code = AOM_CODEC_CORRUPT_FRAME;
           return;
         }
+        if (data_end < data + obu_payload_offset ||
+            data_end < data + payload_size) {
+          cm->error.error_code = AOM_CODEC_CORRUPT_FRAME;
+          return;
+        }
         decoded_payload_size += read_one_tile_group_obu(
             pbi, &rb, is_first_tg_obu_received, data + obu_payload_offset,
             data + payload_size, p_data_end, &frame_decoding_finished);