diff --git a/src/core/version.go b/src/core/version.go
index e01fe10c..332e18c8 100644
--- a/src/core/version.go
+++ b/src/core/version.go
@@ -101,6 +101,9 @@ func (m *version_metadata) decode(r io.Reader, password []byte) bool {
 		return false
 	}
 
+	if len(bs) < ed25519.SignatureSize {
+		return false
+	}
 	sig := bs[len(bs)-ed25519.SignatureSize:]
 	bs = bs[:len(bs)-ed25519.SignatureSize]