diff --git a/Tremolo/treminfo.c b/Tremolo/treminfo.c
index 4f72728..09cb874 100644
--- a/Tremolo/treminfo.c
+++ b/Tremolo/treminfo.c
@@ -233,6 +233,7 @@
   for(i=0;i<vc->comments;i++){
     int len=oggpack_read(opb,32);
     if(len<0)goto err_out;
+    if(len>1000000)goto err_out; /* disallow fields larger than 10 MB */
 	vc->comment_lengths[i]=len;
     vc->user_comments[i]=(char *)_ogg_calloc(len+1,1);
     if(!vc->user_comments[i])goto err_out;