diff --git a/src/de.rs b/src/de.rs
index 1836b77..f9f237f 100644
--- a/src/de.rs
+++ b/src/de.rs
@@ -116,13 +116,15 @@ impl<'a> Decoder<'a> {
             FALSE_TAG => Ok(Value::Bool(false)),
             STRING_TAG => {
                 let offset = jentry.length as usize;
-                let s = unsafe { std::str::from_utf8_unchecked(&self.buf[..offset]) };
+                let string = &self.buf.get(..offset).ok_or(Error::InvalidUtf8)?;
+                let s = unsafe { std::str::from_utf8_unchecked(string) };
                 self.buf = &self.buf[offset..];
                 Ok(Value::String(Cow::Borrowed(s)))
             }
             NUMBER_TAG => {
                 let offset = jentry.length as usize;
-                let n = Number::decode(&self.buf[..offset])?;
+                let number = &self.buf.get(..offset).ok_or(Error::InvalidJsonbNumber)?;
+                let n = Number::decode(number)?;
                 self.buf = &self.buf[offset..];
                 Ok(Value::Number(n))
             }
diff --git a/tests/it/decode.rs b/tests/it/decode.rs
index 699190d..e1cfaa3 100644
--- a/tests/it/decode.rs
+++ b/tests/it/decode.rs
@@ -176,3 +176,12 @@ fn test_decode_object() {
         }
     }
 }
+
+#[test]
+fn test_decode_corrupted() {
+    let json = "{\"a\": 1, \"b\": \"123\"}";
+    let jsonb = jsonb::parse_value(json.as_bytes()).unwrap().to_vec();
+    let corrupted = jsonb[0..jsonb.len() - 1].to_vec();
+    let value = from_slice(corrupted.as_slice());
+    assert!(value.is_err());
+}