diff --git a/headers/private/package/hpkg/ReaderImplBase.h b/headers/private/package/hpkg/ReaderImplBase.h
index 1341a6e495..57f386a2cb 100644
--- a/headers/private/package/hpkg/ReaderImplBase.h
+++ b/headers/private/package/hpkg/ReaderImplBase.h
@@ -451,6 +451,13 @@ ReaderImplBase::Init(BPositionIO* file, bool keepFile, Header& header, uint32 fl
 		fileSize = -1;
 	}
 
+	// validate file is longer than header (when not a stream)
+	if (fileSize >= 0 && fileSize < (off_t)sizeof(header)) {
+		ErrorOutput()->PrintError("Error: Invalid %s file: Length shorter than "
+			"header!\n", fFileType);
+		return B_BAD_DATA;
+	}
+
 	// read the header
 	if ((error = ReadBuffer(0, &header, sizeof(header))) != B_OK)
 		return error;