diff --git a/libavformat/nutdec.c b/libavformat/nutdec.c
index 3d07eb250a..bc2ee7bcd5 100644
--- a/libavformat/nutdec.c
+++ b/libavformat/nutdec.c
@@ -280,6 +280,11 @@ static int decode_main_header(NUTContext *nut)
     for (i = 0; i < 256;) {
         int tmp_flags  = ffio_read_varlen(bc);
         int tmp_fields = ffio_read_varlen(bc);
+        if (tmp_fields < 0) {
+            av_log(s, AV_LOG_ERROR, "fields %d is invalid\n", tmp_fields);
+            ret = AVERROR_INVALIDDATA;
+            goto fail;
+        }
 
         if (tmp_fields > 0)
             tmp_pts = get_s(bc);