diff --git a/mp4.go b/mp4.go
index 05fcee6..b823c70 100644
--- a/mp4.go
+++ b/mp4.go
@@ -220,6 +220,10 @@ func readCustomAtom(r io.ReadSeeker, size uint32) (string, uint32, error) {
 			if err != nil {
 				return "", 0, err
 			}
+
+			if len(b) < 4 {
+				return "", 0, fmt.Errorf("expected at least %d bytes, got %d", 4, len(b))
+			}
 			subNames[subName] = string(b[4:])
 
 		case "data":