diff --git a/libfreerdp/codec/rfx.c b/libfreerdp/codec/rfx.c
index ea044232e..16daad05a 100644
--- a/libfreerdp/codec/rfx.c
+++ b/libfreerdp/codec/rfx.c
@@ -1150,6 +1150,7 @@ BOOL rfx_process_message(RFX_CONTEXT* context, const BYTE* data, UINT32 length,
 		REGION16 clippingRects;
 		const RECTANGLE_16* updateRects;
 		const DWORD formatSize = GetBytesPerPixel(context->pixel_format);
+		const UINT32 dstWidth = dstStride / formatSize;
 		region16_init(&clippingRects);
 
 		for (i = 0; i < message->numRects; i++)
@@ -1185,6 +1186,12 @@ BOOL rfx_process_message(RFX_CONTEXT* context, const BYTE* data, UINT32 length,
 				UINT32 nWidth = MIN(64, updateRects[j].right - updateRects[j].left);
 				UINT32 nHeight = MIN(64, updateRects[j].bottom - updateRects[j].top);
 
+				if (nXDst + nWidth > dstWidth)
+					nWidth = MAX(0, dstWidth - nXDst);
+
+				if (nYDst + nHeight > dstHeight)
+					nHeight = MAX(0, dstHeight - nYDst);
+
 				if (!freerdp_image_copy(dst, dstFormat, dstStride,
 				                        nXDst, nYDst, nWidth, nHeight,
 				                        tile->data, context->pixel_format, stride, nXSrc, nYSrc, NULL, FREERDP_FLIP_NONE))