--- /n/sources/plan9/sys/src/cmd/jpg/readjpg.c	Wed Jun  7 17:23:05 2000
+++ /sys/src/cmd/jpg/readjpg.c	Fri Jan 16 01:46:22 2026
@@ -474,12 +474,14 @@
 
 static
 int
-huffmantable(Header *h, uchar *b)
+huffmantable(Header *h, uchar *b, int nb)
 {
 	Huffman *t;
 	int Tc, th, n, nsize, i, j, k, v, cnt, code, si, sr, m;
 	int *maxcode;
 
+	if(nb < 17)
+		jpgerror(h, "ReadJPG: truncated Huffman table");
 	nibbles(b[0], &Tc, &th);
 	if(Tc > 1)
 		jpgerror(h, "ReadJPG: unknown Huffman table class %d", Tc);
@@ -494,6 +496,8 @@
 	nsize = 0;
 	for(i=0; i<16; i++)
 		nsize += b[1+i];
+	if(nb < 17+nsize)
+		jpgerror(h, "ReadJPG: truncated Huffman table");
 	t->size = jpgmalloc(h, (nsize+1)*sizeof(int), 1);
 	k = 0;
 	for(i=1; i<=16; i++){
@@ -585,7 +589,7 @@
 	int l, mt;
 
 	for(l=0; l<n; l+=17+mt)
-		mt = huffmantable(h, &b[l]);
+		mt = huffmantable(h, &b[l], n-l);
 }
 
 static