diff --git a/lib/Epub/Epub/Page.cpp b/lib/Epub/Epub/Page.cpp
index bf0e2159..907ad492 100644
--- a/lib/Epub/Epub/Page.cpp
+++ b/lib/Epub/Epub/Page.cpp
@@ -160,6 +160,10 @@ std::unique_ptr<PageTableFragment> PageTableFragment::deserialize(FsFile& file)
       serialization::readPod(file, cell.isHeader);
       uint8_t lineCount;
       serialization::readPod(file, lineCount);
+      if (lineCount > MAX_CELL_LINES) {
+        LOG_ERR("PGE", "TableFragment: invalid lineCount %u at row %u cell %u", lineCount, r, c);
+        return nullptr;
+      }
       cell.lines.reserve(lineCount);
       for (uint8_t l = 0; l < lineCount; l++) {
         auto tb = TextBlock::deserialize(file);
diff --git a/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp b/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp
index c844f54f..adc1d355 100644
--- a/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp
+++ b/lib/Epub/Epub/parsers/ChapterHtmlSlimParser.cpp
@@ -1315,6 +1315,7 @@ void XMLCALL ChapterHtmlSlimParser::endElement(void* userData, const XML_Char* n
   if (self->currentTable && self->currentTable->depth > 1 && strcmp(name, "table") == 0) {
     self->partWordBufferIndex = 0;
     self->currentTable->depth -= 1;
+    self->depth -= 1;
     LOG_DBG("EHP", "nested table end, depth now %d", self->currentTable->depth);
     return;
   }