diff --git a/libavcodec/vmdav.c b/libavcodec/vmdav.c
index 1e5f2caab8..2b491ad86a 100644
--- a/libavcodec/vmdav.c
+++ b/libavcodec/vmdav.c
@@ -319,8 +319,12 @@ static void vmd_decode(VmdVideoContext *s)
                             len = rle_unpack(gb.buffer, &dp[ofs],
                                              len, bytestream2_get_bytes_left(&gb),
                                              frame_width - ofs);
-                        else
+                        else {
+                            if (ofs + len > frame_width ||
+                                bytestream2_get_bytes_left(&gb) < len)
+                                return;
                             bytestream2_get_buffer(&gb, &dp[ofs], len);
+                        }
                         bytestream2_skip(&gb, len);
                     } else {
                         /* interframe pixel copy */