diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c
index b8c2e930c314bfb0ae5a7e51f5015accfdfcbc92..193df25e2fa711d9b571d9bb80e072c315f6c624 100644
--- a/libavformat/swfdec.c
+++ b/libavformat/swfdec.c
@@ -362,6 +362,11 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
             default:
                 av_assert0(0);
             }
+
+            if (linesize * height > pkt->size) {
+                res = AVERROR_INVALIDDATA;
+                goto bitmap_end;
+            }
             memcpy(pkt->data, buf + colormapsize*colormapbpp, linesize * height);
 
             res = pkt->size;