diff --git a/src/hb-ot-tag.cc b/src/hb-ot-tag.cc
index c5630fb31..8d63eb791 100644
--- a/src/hb-ot-tag.cc
+++ b/src/hb-ot-tag.cc
@@ -195,6 +195,10 @@ subtag_matches (const char *lang_str,
 		const char *subtag)
 {
   unsigned subtag_len = strlen (subtag);
+
+  if (likely ((unsigned) (limit - lang_str) < subtag_len))
+    return false;
+
   do {
     const char *s = strstr (lang_str, subtag);
     if (!s || s >= limit)