diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c
index 3e51a3e793..86be97792e 100644
--- a/libavcodec/faxcompr.c
+++ b/libavcodec/faxcompr.c
@@ -170,10 +170,12 @@ static int decode_group3_2d_line(AVCodecContext *avctx, GetBitContext *gb,
             return -1;
         }
         if(!cmode){//pass mode
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             run = run_off - offs;
             offs= run_off;
-            run_off += *ref++;
+            if(run_off < width)
+                run_off += *ref++;
             if(offs > width){
                 av_log(avctx, AV_LOG_ERROR, "Run went out of bounds\n");
                 return -1;