diff --git a/HISTORY b/HISTORY
index 17fa92fe..6ca76bc1 100644
--- a/HISTORY
+++ b/HISTORY
@@ -2433,3 +2433,7 @@ Video Disk Recorder Revision History
   full (suggested by Emil Naepflein).
 - Channel IDs are now checked when reading 'channels.conf' to avoid later
   problems with timers.
+
+2003-10-19: Version 1.2.6pre2
+
+- Improved cDvbDevice::StillPicture() (thanks to Thomas Heiligenmann).
diff --git a/config.h b/config.h
index a5b33541..6faca7c5 100644
--- a/config.h
+++ b/config.h
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: config.h 1.176 2003/10/17 12:35:23 kls Exp $
+ * $Id: config.h 1.176.1.1 2003/10/19 11:43:07 kls Exp $
  */
 
 #ifndef __CONFIG_H
@@ -19,7 +19,7 @@
 #include "device.h"
 #include "tools.h"
 
-#define VDRVERSION  "1.2.6pre1"
+#define VDRVERSION  "1.2.6pre2"
 #define VDRVERSNUM   10206  // Version * 10000 + Major * 100 + Minor
 
 #define MAXPRIORITY 99
diff --git a/dvbdevice.c b/dvbdevice.c
index fd0a0d0d..0dedfe81 100644
--- a/dvbdevice.c
+++ b/dvbdevice.c
@@ -4,7 +4,7 @@
  * See the main source file 'vdr.c' for copyright information and
  * how to reach the author.
  *
- * $Id: dvbdevice.c 1.67 2003/10/17 15:36:13 kls Exp $
+ * $Id: dvbdevice.c 1.67.1.1 2003/10/19 11:41:07 kls Exp $
  */
 
 #include "dvbdevice.h"
@@ -957,10 +957,14 @@ void cDvbDevice::StillPicture(const uchar *Data, int Length)
                  // skip header extension
                  if ((Data[i + 6] & 0xC0) == 0x80) {
                     // MPEG-2 PES header
+                    if (Data[i + 8] >= Length)
+                       break;
                     offs += 3;
                     offs += Data[i + 8];
                     len -= 3;
                     len -= Data[i + 8];
+                    if (len < 0 || offs + len >= Length)
+                       break;
                     }
                  else {
                     // MPEG-1 PES header
@@ -968,19 +972,19 @@ void cDvbDevice::StillPicture(const uchar *Data, int Length)
                           offs++;
                           len--;
                           }
-                    if ((Data[offs] & 0xC0) == 0x40) {
+                    if (offs <= Length - 2 && len >= 2 && (Data[offs] & 0xC0) == 0x40) {
                        offs += 2;
                        len -= 2;
                        }
-                    if ((Data[offs] & 0xF0) == 0x20) {
+                    if (offs <= Length - 5 && len >= 5 && (Data[offs] & 0xF0) == 0x20) {
                        offs += 5;
                        len -= 5;
                        }
-                    else if ((Data[offs] & 0xF0) == 0x30) {
+                    else if (offs <= Length - 10 && len >= 10 && (Data[offs] & 0xF0) == 0x30) {
                        offs += 10;
                        len -= 10;
                        }
-                    else if (Data[offs] == 0x0F) {
+                    else if (offs < Length && len > 0) {
                        offs++;
                        len--;
                        }