diff --git a/src/filo.ads b/src/filo.ads
index 93985b1..96f4281 100644
--- a/src/filo.ads
+++ b/src/filo.ads
@@ -20,17 +20,22 @@
 
    function Read_LE16 (Buf : Buffer_Type; Off : Index_Type16) return Unsigned_16
    is
-     (Shift_Left (Unsigned_16 (Buf (Off + 1)), 8) or Unsigned_16 (Buf (Off)))
+     (Shift_Left (Unsigned_16 (Buf (Buf'First + Off + 1)), 8) or
+      Unsigned_16 (Buf (Buf'First + Off)))
    with
-      Pre => Buf'First <= Off and Off + 1 <= Buf'Last;
+      Pre =>
+         Buf'First <= Index_Type16'Last - Off and
+         Buf'First + Off + 1 <= Buf'Last;
 
    function Read_LE32 (Buf : Buffer_Type; Off : Index_Type32) return Unsigned_32
    is
-     (Shift_Left (Unsigned_32 (Buf (Off + 3)), 24) or
-      Shift_Left (Unsigned_32 (Buf (Off + 2)), 16) or
-      Shift_Left (Unsigned_32 (Buf (Off + 1)),  8) or
-      Unsigned_32 (Buf (Off)))
+     (Shift_Left (Unsigned_32 (Buf (Buf'First + Off + 3)), 24) or
+      Shift_Left (Unsigned_32 (Buf (Buf'First + Off + 2)), 16) or
+      Shift_Left (Unsigned_32 (Buf (Buf'First + Off + 1)),  8) or
+      Unsigned_32 (Buf (Buf'First + Off)))
    with
-      Pre => Buf'First <= Off and Off + 3 <= Buf'Last;
+      Pre =>
+         Buf'First <= Index_Type32'Last - Off and
+         Buf'First + Off + 3 <= Buf'Last;
 
 end FILO;