diff --git a/libavcodec/sga.c b/libavcodec/sga.c
index 00752a5843..7e6bea530c 100644
--- a/libavcodec/sga.c
+++ b/libavcodec/sga.c
@@ -232,7 +232,7 @@ static int lzss_decompress(AVCodecContext *avctx,
 
                 if (offset <= 0)
                     offset = 1;
-                if (oi < offset)
+                if (oi < offset || oi + count * 2 > dst_size)
                     return AVERROR_INVALIDDATA;
                 for (int j = 0; j < count * 2; j++) {
                     dst[oi] = dst[oi - offset];