diff --git a/lib/luks1/keymanage.c b/lib/luks1/keymanage.c
index 1da00895..abedf02a 100644
--- a/lib/luks1/keymanage.c
+++ b/lib/luks1/keymanage.c
@@ -1228,6 +1228,10 @@ int LUKS_wipe_header_areas(struct luks_phdr *hdr,
 	uint64_t offset, length;
 	size_t wipe_block;
 
+	r = LUKS_check_device_size(ctx, hdr, 1);
+	if (r)
+		return r;
+
 	/* Wipe complete header, keyslots and padding areas with zeroes. */
 	offset = 0;
 	length = (uint64_t)hdr->payloadOffset * SECTOR_SIZE;
diff --git a/lib/luks2/luks2_json_format.c b/lib/luks2/luks2_json_format.c
index ec3fe8ca..d7287344 100644
--- a/lib/luks2/luks2_json_format.c
+++ b/lib/luks2/luks2_json_format.c
@@ -362,6 +362,10 @@ int LUKS2_wipe_header_areas(struct crypt_device *cd,
 		wipe_block = 4096;
 	}
 
+	r = device_check_size(cd, crypt_metadata_device(cd), length, 1);
+	if (r)
+		return r;
+
 	log_dbg(cd, "Wiping LUKS areas (0x%06" PRIx64 " - 0x%06" PRIx64") with zeroes.",
 		offset, length + offset);