diff --git a/readium/streamer/src/main/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscator.kt b/readium/streamer/src/main/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscator.kt
index c0dc70b29b..0896042ae3 100644
--- a/readium/streamer/src/main/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscator.kt
+++ b/readium/streamer/src/main/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscator.kt
@@ -27,9 +27,7 @@ internal class EpubDeobfuscator(
     @Suppress("Unused_parameter")
     fun transform(url: Url, resource: Resource): Resource =
         resource.flatMap {
-            val algorithm = resource.sourceUrl
-                ?.let { encryptionData[it] }
-                ?.algorithm
+            val algorithm = encryptionData[url]?.algorithm
             if (algorithm != null && algorithm2length.containsKey(algorithm)) {
                 DeobfuscatingResource(resource, algorithm)
             } else {
@@ -71,9 +69,10 @@ internal class EpubDeobfuscator(
     )
 
     private fun deobfuscate(bytes: ByteArray, obfuscationKey: ByteArray, obfuscationLength: Int) {
-        val toDeobfuscate = 0 until obfuscationLength
-        for (i in toDeobfuscate)
+        val toDeobfuscate = 0 until obfuscationLength.coerceAtMost(bytes.size)
+        for (i in toDeobfuscate) {
             bytes[i] = bytes[i].xor(obfuscationKey[i % obfuscationKey.size])
+        }
     }
 
     private fun getHashKeyAdobe(pubId: String) =
diff --git a/readium/streamer/src/test/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscatorTest.kt b/readium/streamer/src/test/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscatorTest.kt
index 4e4c2c8227..8b6dc2b187 100644
--- a/readium/streamer/src/test/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscatorTest.kt
+++ b/readium/streamer/src/test/java/org/readium/r2/streamer/parser/epub/EpubDeobfuscatorTest.kt
@@ -45,8 +45,8 @@ class EpubDeobfuscatorTest {
 
     private fun deobfuscate(url: Url, resource: Resource, algorithm: String?): Resource {
         val encryptionData =
-            if (resource.sourceUrl != null && algorithm != null) {
-                mapOf(resource.sourceUrl as Url to Encryption(algorithm = algorithm))
+            if (algorithm != null) {
+                mapOf(url to Encryption(algorithm = algorithm))
             } else {
                 emptyMap()
             }