diff --git a/src/engine/dataErrors.h b/src/engine/dataErrors.h
new file mode 100644
index 000000000..3d0a52cdd
--- /dev/null
+++ b/src/engine/dataErrors.h
@@ -0,0 +1,8 @@
+#ifndef _DATA_ERRORS_H
+#define _DATA_ERRORS_H
+enum DivDataErrors {
+  DIV_DATA_SUCCESS=0,
+  DIV_DATA_INVALID_HEADER=1,
+  DIV_DATA_INVALID_DATA=2
+};
+#endif
diff --git a/src/engine/engine.cpp b/src/engine/engine.cpp
index accf06c38..89d8958bf 100644
--- a/src/engine/engine.cpp
+++ b/src/engine/engine.cpp
@@ -1,3 +1,4 @@
+#include "dataErrors.h"
 #include <cstdint>
 #define _USE_MATH_DEFINES
 #include "engine.h"
@@ -1424,18 +1425,15 @@ bool DivEngine::loadFur(unsigned char* file, size_t len) {
 
     // read wavetables
     for (int i=0; i<ds.waveLen; i++) {
-      reader.seek(wavePtr[i],SEEK_SET);
-      reader.read(magic,4);
-      if (strcmp(magic,"WAVE")!=0) {
-        logE("%d: invalid wavetable header!\n",i);
-        lastError="invalid wavetable header!";
-        delete[] file;
-        return false;
-      }
       DivWavetable* wave=new DivWavetable;
       reader.seek(wavePtr[i],SEEK_SET);
 
-      wave->readWaveData(reader,ds.version);
+      if (wave->readWaveData(reader,ds.version)!=DIV_DATA_SUCCESS) {
+        lastError="invalid wavetable header/data!";
+        delete wave;
+        delete[] file;
+        return false;
+      }
 
       ds.wave.push_back(wave);
     }
@@ -3126,15 +3124,13 @@ bool DivEngine::addWaveFromFile(const char* path) {
       reader.seek(16,SEEK_SET);
       short version=reader.readS();
       reader.readS(); // reserved
-      reader.read(magic,4);
-      if (memcmp(magic,"WAVE",4)!=0) {
-        logE("invalid wavetable header!\n");
-        lastError="invalid wavetable header!";
+      reader.seek(20,SEEK_SET);
+      if (wave->readWaveData(reader,version)!=DIV_DATA_SUCCESS) {
+        lastError="invalid wavetable header/data!";
+        delete wave;
         delete[] buf;
         return false;
       }
-      reader.seek(20,SEEK_SET);
-      wave->readWaveData(reader,version);
     } else {
       try {
         // read as .dmw
diff --git a/src/engine/engine.h b/src/engine/engine.h
index f42b1d695..460cf3637 100644
--- a/src/engine/engine.h
+++ b/src/engine/engine.h
@@ -2,6 +2,7 @@
 #define _ENGINE_H
 #include "song.h"
 #include "dispatch.h"
+#include "dataErrors.h"
 #include "safeWriter.h"
 #include "../audio/taAudio.h"
 #include "blip_buf.h"
diff --git a/src/engine/wavetable.cpp b/src/engine/wavetable.cpp
index 5bfa540f3..ad32ed1e5 100644
--- a/src/engine/wavetable.cpp
+++ b/src/engine/wavetable.cpp
@@ -1,3 +1,4 @@
+#include "dataErrors.h"
 #include "engine.h"
 #include "wavetable.h"
 #include "../ta-log.h"
@@ -16,15 +17,24 @@ void DivWavetable::putWaveData(SafeWriter* w) {
   }
 }
 
-void DivWavetable::readWaveData(SafeReader& reader, short version) {
-  reader.readI();
-  reader.readI();
+DivDataErrors DivWavetable::readWaveData(SafeReader& reader, short version) {
+  char magic[4];
+  reader.read(magic,4);
+  if (memcmp(magic,"WAVE",4)!=0) {
+    return DIV_DATA_INVALID_HEADER;
+  }
+  reader.readI(); // reserved
 
   reader.readString(); // ignored for now
   len=reader.readI();
   min=reader.readI();
   max=reader.readI();
+
+  if (len>256 || min!=0 || max>255) return DIV_DATA_INVALID_DATA;
+
   reader.read(data,4*len);
+
+  return DIV_DATA_SUCCESS;
 }
 
 bool DivWavetable::save(const char* path) {
diff --git a/src/engine/wavetable.h b/src/engine/wavetable.h
index cba38d7c2..b6c1dc5dd 100644
--- a/src/engine/wavetable.h
+++ b/src/engine/wavetable.h
@@ -1,13 +1,14 @@
 #ifndef _WAVETABLE_H
 #define _WAVETABLE_H
 #include "safeWriter.h"
+#include "dataErrors.h"
 
 struct DivWavetable {
   int len, min, max;
   int data[256];
 
   void putWaveData(SafeWriter* w);
-  void readWaveData(SafeReader& reader, short version);
+  DivDataErrors readWaveData(SafeReader& reader, short version);
   bool save(const char* path);
   DivWavetable():
     len(32),
diff --git a/src/gui/gui.cpp b/src/gui/gui.cpp
index 9b5e6ef28..108387260 100644
--- a/src/gui/gui.cpp
+++ b/src/gui/gui.cpp
@@ -3922,6 +3922,12 @@ bool FurnaceGUI::loop() {
               curFileDialog==GUI_FILE_EXPORT_AUDIO_PER_CHANNEL) {
             checkExtension(".wav");
           }
+          if (curFileDialog==GUI_FILE_INS_SAVE) {
+            checkExtension(".fui");
+          }
+          if (curFileDialog==GUI_FILE_WAVE_SAVE) {
+            checkExtension(".fuw");
+          }
           String copyOfName=fileName;
           switch (curFileDialog) {
             case GUI_FILE_OPEN: