diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 83920f6..fcab63e 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -3298,6 +3298,9 @@
     } else
 #endif /* MBEDTLS_SSL_PROTO_DTLS */
     {
+        if (ssl->in_hsfraglen > ssl->in_hslen) {
+            return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+        }
         int ret;
         const size_t hs_remain = ssl->in_hslen - ssl->in_hsfraglen;
         MBEDTLS_SSL_DEBUG_MSG(3,