@@ -1579,15 +1583,29 @@
 	bcopy(&d->data[0], &s->data[0], 2048);
 	break;
 
-    case DVD_STRUCT_BCA:
-	s->length = ntohs(d->length);
-	bcopy(&d->data[0], &s->data[0], s->length);
+    case DVD_STRUCT_BCA: {
+	u_int32_t copylen = ntohs(d->length);
+
+	if (copylen > length - 4)
+	    copylen = length - 4;
+	if (copylen > sizeof(s->data))
+	    copylen = sizeof(s->data);
+	s->length = copylen;
+	bcopy(&d->data[0], &s->data[0], copylen);
 	break;
+    }
 
-    case DVD_STRUCT_MANUFACT:
-	s->length = ntohs(d->length);
-	bcopy(&d->data[0], &s->data[0], s->length);
+    case DVD_STRUCT_MANUFACT: {
+	u_int32_t copylen = ntohs(d->length);
+
+	if (copylen > length - 4)
+	    copylen = length - 4;
+	if (copylen > sizeof(s->data))
+	    copylen = sizeof(s->data);
+	s->length = copylen;
+	bcopy(&d->data[0], &s->data[0], copylen);
 	break;
+    }
 		
     default:
 	error = EINVAL;