diff --git a/libavcodec/vp3.c b/libavcodec/vp3.c
index 59698d2e093db0d35f995fa6d70853c9d5b24779..9268d5e7afda0b3f09aa768f08d23e142eede025 100644
--- a/libavcodec/vp3.c
+++ b/libavcodec/vp3.c
@@ -461,17 +461,21 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
 
         /* unpack the list of partially-coded superblocks */
         bit = get_bits1(gb);
-        /* toggle the bit because as soon as the first run length is
-         * fetched the bit will be toggled again */
-        bit ^= 1;
         while (current_superblock < s->superblock_count) {
-            if (current_run-- == 0) {
-                bit ^= 1;
                 current_run = get_vlc2(gb,
-                    s->superblock_run_length_vlc.table, 6, 2);
-                if (current_run == 33)
+                    s->superblock_run_length_vlc.table, 6, 2) + 1;
+                if (current_run == 34)
                     current_run += get_bits(gb, 12);
 
+            if (current_superblock + current_run > s->superblock_count) {
+                av_log(s->avctx, AV_LOG_ERROR, "Invalid partially coded superblock run length\n");
+                return -1;
+            }
+
+            memset(s->superblock_coding + current_superblock, bit, current_run);
+
+            current_superblock += current_run;
+
                 /* if any of the superblocks are not partially coded, flag
                  * a boolean to decode the list of fully-coded superblocks */
                 if (bit == 0) {
@@ -482,8 +486,8 @@ static int unpack_superblocks(Vp3DecodeContext *s, GetBitContext *gb)
                      * superblocks */
                     decode_partial_blocks = 1;
                 }
-            }
-            s->superblock_coding[current_superblock++] = bit;
+
+                bit ^= 1;
         }
 
         /* unpack the list of fully coded superblocks if any of the blocks were