diff --git a/src/backend/wayland/wl_framebuf.c b/src/backend/wayland/wl_framebuf.c
index ecb4340..4223ffb 100644
--- a/src/backend/wayland/wl_framebuf.c
+++ b/src/backend/wayland/wl_framebuf.c
@@ -636,6 +636,13 @@ wl_frame_paint(struct WFrameWindow *fwin)
         if (img) {
             uint32_t *dst = pixman_image_get_data(tb_img);
             int dst_stride = pixman_image_get_stride(tb_img) / 4;
+            int dst_h = pixman_image_get_height(tb_img);
+            if (tb_h > dst_h || tb_w > dst_stride) {
+                wwarning("OVERFLOW: tb_w=%d tb_h=%d dst_stride=%d dst_h=%d fb=%dx%d tb_fb=%p",
+                         tb_w, tb_h, dst_stride, dst_h, total_w, total_h, (void*)tb_fb);
+                RReleaseImage(img);
+                goto skip_titlebar;
+            }
             int x, y;
             if (img->format == RRGBAFormat) {
                 for (y = 0; y < tb_h && y < img->height; y++) {
@@ -704,6 +711,7 @@ wl_frame_paint(struct WFrameWindow *fwin)
         }
     }
 
+skip_titlebar:
     /* --- Titlebar buttons --- */
     if (fwin->titlebar && fwin->top_width > 0) {
         if (fwin->left_button && !fwin->flags.hide_left_button &&