diff --git a/libavcodec/vp56.h b/libavcodec/vp56.h
index 84b2f6c94b..65cf46870a 100644
--- a/libavcodec/vp56.h
+++ b/libavcodec/vp56.h
@@ -89,6 +89,7 @@ typedef struct VP56RangeCoder {
     const uint8_t *buffer;
     const uint8_t *end;
     unsigned int code_word;
+    int end_reached;
 } VP56RangeCoder;
 
 typedef struct VP56RefDc {
@@ -235,7 +236,9 @@ int ff_vp56_init_range_decoder(VP56RangeCoder *c, const uint8_t *buf, int buf_si
  */
 static av_always_inline int vpX_rac_is_end(VP56RangeCoder *c)
 {
-    return c->end <= c->buffer && c->bits >= 0;
+    if (c->end <= c->buffer && c->bits >= 0)
+        c->end_reached ++;
+    return c->end_reached > 10;
 }
 
 static av_always_inline unsigned int vp56_rac_renorm(VP56RangeCoder *c)
diff --git a/libavcodec/vp56rac.c b/libavcodec/vp56rac.c
index e70302bf85..64fb6a99b4 100644
--- a/libavcodec/vp56rac.c
+++ b/libavcodec/vp56rac.c
@@ -43,6 +43,7 @@ int ff_vp56_init_range_decoder(VP56RangeCoder *c, const uint8_t *buf, int buf_si
     c->bits = -16;
     c->buffer = buf;
     c->end = buf + buf_size;
+    c->end_reached = 0;
     if (buf_size < 1)
         return AVERROR_INVALIDDATA;
     c->code_word = bytestream_get_be24(&c->buffer);
diff --git a/tests/ref/fate/vp5 b/tests/ref/fate/vp5
index 2469a3ec21..09ebe62b25 100644
--- a/tests/ref/fate/vp5
+++ b/tests/ref/fate/vp5
@@ -249,4 +249,4 @@
 0,        243,        243,        1,   233472, 0x6f530ac6
 0,        244,        244,        1,   233472, 0x94f7466c
 0,        245,        245,        1,   233472, 0xa8c1d365
-0,        246,        246,        1,   233472, 0xbf73f1b7
+0,        246,        246,        1,   233472, 0x4f3ef38c