Index: apps/plugins/pictureflow.c
===================================================================
--- apps/plugins/pictureflow.c	(revision 20573)
+++ apps/plugins/pictureflow.c	(working copy)
@@ -656,10 +656,10 @@
 
     for(l=0;l<MAX_TRACKS;l++)
         temp_titles[l][0] = '\0';
-    while (rb->tagcache_get_next(&tcs) && track_count  < MAX_TRACKS)
+    while (rb->tagcache_get_next(&tcs) && track_count < MAX_TRACKS)
     {
         track_num = rb->tagcache_get_numeric(&tcs, tag_tracknumber) - 1;
-        if (track_num >= 0)
+        if (track_num >= 0 && track_num < MAX_TRACKS)
         {
             rb->snprintf(temp_titles[track_num],sizeof(temp_titles[track_num]),
                          "%d:  %s", track_num+1, tcs.result);