diff --git a/demux/demux_mkv.c b/demux/demux_mkv.c
index acbd75f6d929f..51e6323d30f86 100644
--- a/demux/demux_mkv.c
+++ b/demux/demux_mkv.c
@@ -1819,10 +1819,12 @@ static void parse_vorbis_chmap(struct mp_chmap *channels, unsigned char *data,
     if (size < 4)
         return;
     uint32_t vendor_length = AV_RL32(data);
-    if (vendor_length + 4 > size) // also check for the next AV_RB32 below
+    if (vendor_length + 4 > size)
         return;
     size -= vendor_length + 4;
     data += vendor_length + 4;
+    if (size < 4)
+        return;
     uint32_t num_headers = AV_RL32(data);
     size -= 4;
     data += 4;