diff --git a/libavcodec/xbmdec.c b/libavcodec/xbmdec.c
index e03ff31fbb..143e3a2831 100644
--- a/libavcodec/xbmdec.c
+++ b/libavcodec/xbmdec.c
@@ -82,10 +82,10 @@ static int xbm_decode_frame(AVCodecContext *avctx, void *data,
         return ret;
 
     // goto start of image data
-    next = ptr + strcspn(ptr, "{");
-    if (!*next)
-        next = ptr + strcspn(ptr, "(");
-    if (!*next)
+    next = memchr(ptr, '{', avpkt->size);
+    if (!next)
+        next = memchr(ptr, '(', avpkt->size);
+    if (!next)
         return AVERROR_INVALIDDATA;
     ptr = next + 1;
 
@@ -95,7 +95,10 @@ static int xbm_decode_frame(AVCodecContext *avctx, void *data,
         for (j = 0; j < linesize; j++) {
             uint8_t val;
 
-            ptr += strcspn(ptr, "x$") + 1;
+            while (ptr < end && *ptr != 'x' && *ptr != '$')
+                ptr++;
+
+            ptr ++;
             if (ptr < end && av_isxdigit(*ptr)) {
                 val = convert(*ptr++);
                 if (av_isxdigit(*ptr))