diff --git a/libavformat/hls_sample_encryption.c b/libavformat/hls_sample_encryption.c
index 26de098dda..c41de3143b 100644
--- a/libavformat/hls_sample_encryption.c
+++ b/libavformat/hls_sample_encryption.c
@@ -374,6 +374,13 @@ static int decrypt_audio_frame(enum AVCodecID codec_id, HLSCryptoContext *crypto
         ret = get_next_sync_frame(codec_id, &ctx, &frame);
         if (ret < 0)
             return ret;
+        if (frame.length < frame.header_length ||
+            frame.length > ctx.buf_end - frame.data) {
+            av_log(NULL, AV_LOG_ERROR,
+                   "Sample-AES: declared frame length %d exceeds packet data\n",
+                   frame.length);
+            return AVERROR_INVALIDDATA;
+        }
         if (frame.length - frame.header_length > 31) {
             ret = decrypt_sync_frame(codec_id, crypto_ctx, &frame);
             if (ret < 0)