diff --git a/taglib/flac/flacpicture.cpp b/taglib/flac/flacpicture.cpp
index 73abd343..25b1ed20 100644
--- a/taglib/flac/flacpicture.cpp
+++ b/taglib/flac/flacpicture.cpp
@@ -72,7 +72,7 @@ bool FLAC::Picture::parse(const ByteVector &data)
   pos += 4;
   unsigned int mimeTypeLength = data.toUInt(pos);
   pos += 4;
-  if(pos + mimeTypeLength + 24 > data.size()) {
+  if(mimeTypeLength > data.size() - pos - 24) {
     debug("Invalid picture block.");
     return false;
   }
@@ -80,7 +80,7 @@ bool FLAC::Picture::parse(const ByteVector &data)
   pos += mimeTypeLength;
   unsigned int descriptionLength = data.toUInt(pos);
   pos += 4;
-  if(pos + descriptionLength + 20 > data.size()) {
+  if(descriptionLength > data.size() - pos - 20) {
     debug("Invalid picture block.");
     return false;
   }
@@ -96,7 +96,7 @@ bool FLAC::Picture::parse(const ByteVector &data)
   pos += 4;
   unsigned int dataLength = data.toUInt(pos);
   pos += 4;
-  if(pos + dataLength > data.size()) {
+  if(dataLength > data.size() - pos) {
     debug("Invalid picture block.");
     return false;
   }
diff --git a/taglib/toolkit/tbytevector.cpp b/taglib/toolkit/tbytevector.cpp
index 6dd30dd7..874d46ea 100644
--- a/taglib/toolkit/tbytevector.cpp
+++ b/taglib/toolkit/tbytevector.cpp
@@ -134,8 +134,12 @@ T toNumber(const ByteVector &v, size_t offset, bool mostSignificantByteFirst)
   const bool isBigEndian = Utils::systemByteOrder() == Utils::BigEndian;
   const bool swap = mostSignificantByteFirst != isBigEndian;
 
-  if(offset + sizeof(T) > v.size())
-    return toNumber<T>(v, offset, v.size() - offset, mostSignificantByteFirst);
+  if(offset >= v.size())
+    return toNumber<T>(v, offset, 0, mostSignificantByteFirst);
+
+  const size_t remaining = v.size() - offset;
+  if(sizeof(T) > remaining)
+    return toNumber<T>(v, offset, remaining, mostSignificantByteFirst);
 
   // Uses memcpy instead of reinterpret_cast to avoid an alignment exception.
   T tmp;