diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c
index 9f37fdc..ff116ad 100644
--- a/library/ssl_tls12_client.c
+++ b/library/ssl_tls12_client.c
@@ -1774,9 +1774,10 @@
         return MBEDTLS_ERR_SSL_DECODE_ERROR;
     }
 
-    /* xxdh_psa_peerkey is sized after maximum supported FFDH public key.
-     * PSA_VENDOR_FFDH_MAX_KEY_BITS is always larger than EC public key, so
-     * we can skip the buffer size check before the memcpy-ing data into it. */
+    if (ecpoint_len > PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)) {
+        return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
+    }
+
     memcpy(handshake->xxdh_psa_peerkey, *p, ecpoint_len);
     handshake->xxdh_psa_peerkey_len = ecpoint_len;
     *p += ecpoint_len;