diff --git a/libopenjpeg/cio.c b/libopenjpeg/cio.c
index c0cb028..6fefde7 100644
--- a/libopenjpeg/cio.c
+++ b/libopenjpeg/cio.c
@@ -30,6 +30,7 @@
  */
 
 #include "opj_includes.h"
+#include <assert.h>
 
 /* ----------------------------------------------------------------------- */
 
@@ -127,6 +128,11 @@ unsigned char *cio_getbp(opj_cio_t *cio) {
  * Write a byte.
  */
 opj_bool cio_byteout(opj_cio_t *cio, unsigned char v) {
+	if (cio->bp < cio->start) {
+		opj_event_msg(cio->cinfo, EVT_ERROR, "read error: trying to read from before the start of the codestream (start = %d, current = %d, end = %d\n", cio->start, cio->bp, cio->end);
+		abort();
+		return 0;
+	}
 	if (cio->bp >= cio->end) {
 		opj_event_msg(cio->cinfo, EVT_ERROR, "write error\n");
 		return OPJ_FALSE;
@@ -173,7 +179,7 @@ unsigned int cio_read(opj_cio_t *cio, int n) {
 	unsigned int v;
 	v = 0;
 	for (i = n - 1; i >= 0; i--) {
-		v += cio_bytein(cio) << (i << 3);
+		v += (unsigned int)cio_bytein(cio) << (i << 3);
 	}
 	return v;
 }
@@ -184,6 +190,7 @@ unsigned int cio_read(opj_cio_t *cio, int n) {
  * n : number of bytes to skip
  */
 void cio_skip(opj_cio_t *cio, int n) {
+	assert((cio->bp + n) >= cio->bp);
 	cio->bp += n;
 }
 
diff --git a/libopenjpeg/jp2.c b/libopenjpeg/jp2.c
index 531bbfc..68f4dad 100644
--- a/libopenjpeg/jp2.c
+++ b/libopenjpeg/jp2.c
@@ -176,6 +176,9 @@ static opj_bool jp2_read_boxhdr(opj_common_ptr cinfo, opj_cio_t *cio, opj_jp2_bo
 	if (box->length < 0) {
 		opj_event_msg(cinfo, EVT_ERROR, "Integer overflow in box->length\n");
 		return OPJ_FALSE; // TODO: actually check jp2_read_boxhdr's return value
+	} else if (box->length < 0) {
+		opj_event_msg(cinfo, EVT_ERROR, "Invalid, negative, size of box\n");
+		return OPJ_FALSE;
 	}
 	
 	return OPJ_TRUE;