Index: apps/plugins/pictureflow.c
===================================================================
--- apps/plugins/pictureflow.c	(Revision 18359)
+++ apps/plugins/pictureflow.c	(working copy)
@@ -416,13 +416,13 @@
     if ( slide_index == track_index ) {
         return -1;
     }
-
     if (!rb->tagcache_search(&tcs, tag_title))
         return -1;
 
     int ret = 0;
     char temp_titles[MAX_TRACKS][AVG_TRACK_NAME_LENGTH*4];
     int temp_seeks[MAX_TRACKS];
+    char temp_title[AVG_TRACK_NAME_LENGTH*4];
 
     rb->tagcache_search_add_filter(&tcs, tag_album, album[slide_index].seek);
     track_count=0;
@@ -436,18 +436,28 @@
         track_num = rb->tagcache_get_numeric(&tcs, tag_tracknumber) - 1;
         if (track_num >= 0)
         {
-            rb->snprintf(temp_titles[track_num],sizeof(temp_titles[track_num]), "%d:  %s",
+            rb->snprintf(temp_title, sizeof(temp_title), "%d:  %s",
                          track_num+1, tcs.result);
-            temp_seeks[track_num] = tcs.result_seek;
+            if (track_num >= MAX_TRACKS)
+                track_num = MAX_TRACKS - 1;
         }
         else
         {
             track_num = 0;
-            while (temp_titles[track_num][0] != '\0')
-                track_num++;
-            rb->strcpy(temp_titles[track_num], tcs.result);
-            temp_seeks[track_num] = tcs.result_seek;
+            rb->strncpy(temp_title, tcs.result, sizeof(temp_title));
         }
+
+        /* find not used track number (there must be one - see
+         * "track_count < MAX_TRACKS" condition in main loop)
+         */
+        while (track_num < MAX_TRACKS - 1 && temp_titles[track_num][0] != '\0')
+            track_num++;
+        while (track_num > 0 && temp_titles[track_num][0] != '\0')
+            track_num--;
+
+        rb->strcpy(temp_titles[track_num], temp_title);
+        temp_seeks[track_num] = tcs.result_seek;
+
         if (track_num > heighest_index)
             heighest_index = track_num;
         track_count++;
@@ -459,7 +469,7 @@
     /* now fix the track list order */
     l = 0;
     track_count = 0;
-    while (l < heighest_index && 
+    while (l <= heighest_index && 
            string_index <  MAX_TRACKS*AVG_TRACK_NAME_LENGTH)
     {
         if (temp_titles[l][0] != '\0')