diff --git a/consumer.go b/consumer.go
index 2c269f4..b5b94b3 100644
--- a/consumer.go
+++ b/consumer.go
@@ -216,7 +216,7 @@ func (c *Consumer) source(
 		}
 	}
 
-	if match.sourcesInd >= 0 {
+	if match.sourcesInd >= 0 && match.sourcesInd < int32(len(m.Sources)) {
 		source = m.Sources[match.sourcesInd]
 	}
 	if match.namesInd >= 0 {
diff --git a/consumer_test.go b/consumer_test.go
index 7fc84f3..6f4c888 100644
--- a/consumer_test.go
+++ b/consumer_test.go
@@ -141,6 +141,30 @@ func testSourceMap(t *testing.T, json string) {
 	}
 }
 
+func TestSourceWithOutOfRangeSourcesInd(t *testing.T) {
+	// mappings "ACAA" decode to genCol=0, sourcesInd=1, sourceLine=0,
+	// sourceCol=0. With a sources array of length 1 this used to panic with
+	// "index out of range" when indexing m.Sources[match.sourcesInd].
+	var jsmap = `{
+  "version": 3,
+  "sources": ["a.js"],
+  "mappings": "ACAA"
+}`
+
+	smap, err := sourcemap.Parse("noname", []byte(jsmap))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	source, _, _, _, ok := smap.Source(1, 1)
+	if !ok {
+		t.Fatal("expected a match for line 1 col 1")
+	}
+	if source != "" {
+		t.Fatalf("unexpected source %q for out-of-range sourcesInd", source)
+	}
+}
+
 func TestSourceRootURL(t *testing.T) {
 	jsonStr := sourceMapJSON
 	jsonStr = strings.Replace(jsonStr, "/the/root", "http://the/root", 1)