diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c
index 0fca282918..f3946f508c 100644
--- a/libavcodec/vp5.c
+++ b/libavcodec/vp5.c
@@ -48,6 +48,8 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
     ff_vp56_init_dequant(s, vp56_rac_gets(c, 6));
     if (s->frames[VP56_FRAME_CURRENT]->key_frame)
     {
+        int render_x, render_y;
+
         vp56_rac_gets(c, 8);
         if(vp56_rac_gets(c, 5) > 5)
             return AVERROR_INVALIDDATA;
@@ -63,8 +65,11 @@ static int vp5_parse_header(VP56Context *s, const uint8_t *buf, int buf_size)
                    cols << 4, rows << 4);
             return AVERROR_INVALIDDATA;
         }
-        vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
-        vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
+        render_y = vp56_rac_gets(c, 8);  /* number of displayed macroblock rows */
+        render_x = vp56_rac_gets(c, 8);  /* number of displayed macroblock cols */
+        if (render_x == 0 || render_x > cols ||
+            render_y == 0 || render_y > rows)
+            return AVERROR_INVALIDDATA;
         vp56_rac_gets(c, 2);
         if (!s->macroblocks || /* first frame */
             16*cols != s->avctx->coded_width ||