diff --git a/libavformat/icodec.c b/libavformat/icodec.c
index 128a495948..0444975266 100644
--- a/libavformat/icodec.c
+++ b/libavformat/icodec.c
@@ -114,7 +114,7 @@ static int read_header(AVFormatContext *s)
         avio_skip(pb, 5);
 
         ico->images[i].size   = avio_rl32(pb);
-        if (ico->images[i].size <= 0) {
+        if (ico->images[i].size <= 0 || ico->images[i].size > INT_MAX - 14) {
             av_log(s, AV_LOG_ERROR, "Invalid image size %d\n", ico->images[i].size);
             goto fail;
         }