diff --git a/src/preview.cpp b/src/preview.cpp

index c34c8bd..69f8e01 100644

--- a/src/preview.cpp

+++ b/src/preview.cpp

@@ -36,6 +36,7 @@ EXIV2_RCSID("@(#) $Id$")

 #include "preview.hpp"

 #include "futils.hpp"

+#include "enforce.hpp"

 #include "image.hpp"

 #include "cr2image.hpp"

@@ -807,13 +808,14 @@ namespace {

                 else {

                     // FIXME: the buffer is probably copied twice, it should be optimized

                     DataBuf buf(size_);

-                    Exiv2::byte* pos = buf.pData_;

+                    uint32_t idxBuf = 0;

                     for (int i = 0; i < sizes.count(); i++) {

                         uint32_t offset = dataValue.toLong(i);

                         uint32_t size = sizes.toLong(i);

-                        if (offset + size <= static_cast<uint32_t>(io.size()))

-                            memcpy(pos, base + offset, size);

-                        pos += size;

+                        enforce(idxBuf + size < size_, kerCorruptedMetadata);

+                        if (size!=0 && offset + size <= static_cast<uint32_t>(io.size()))

+                            memcpy(&buf.pData_[idxBuf], base + offset, size);

+                        idxBuf += size;

                     }

                     dataValue.setDataArea(buf.pData_, buf.size_);

                 }