diff --git a/src/upb_string.c b/src/upb_string.c
index e6ea5893a5..81b152dc70 100644
--- a/src/upb_string.c
+++ b/src/upb_string.c
@@ -73,6 +73,11 @@ void upb_string_substr(upb_string *str, upb_string *target_str,
                        upb_strlen_t start, upb_strlen_t len) {
   if(str->ptr) *(char*)0 = 0;
   assert(str->ptr == NULL);
+  assert(start + len <= upb_string_len(target_str));
+  if (target_str->src) {
+    start += (target_str->ptr - target_str->src->ptr);
+    target_str = target_str->src;
+  }
   str->src = upb_string_getref(target_str);
   str->ptr = upb_string_getrobuf(target_str) + start;
   str->len = len;