diff -Naur foremost-1.5.6.orig/extract.c foremost-1.5.6/extract.c --- foremost-1.5.6.orig/extract.c 2009-05-06 03:56:16.000000000 +0000 +++ foremost-1.5.6/extract.c 2009-06-07 19:59:12.000000000 +0000 @@ -1794,7 +1794,12 @@ if (((foundat + headersize) - buf) > buflen){ return NULL; } foundat += headersize; - + + if (foundat >= (buf + buflen)) + { + return buf + needle->header_len; + } + if (foundat[2] != (unsigned char)'\xff') { break;