diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 7c1f95e..77c7940 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -100,7 +100,7 @@
 {
     ((void) ssl);
 
-    MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2);
+    MBEDTLS_SSL_CHK_BUF_READ_PTR( buf, end, 2 );
     if( buf[0] != MBEDTLS_SSL_MAJOR_VERSION_3 ||
         buf[1] != MBEDTLS_SSL_MINOR_VERSION_4 )
     {
@@ -111,6 +111,14 @@
         return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
     }
 
+    if( &buf[2] != end )
+    {
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "supported_versions ext data length incorrect" ) );
+        MBEDTLS_SSL_PEND_FATAL_ALERT( MBEDTLS_SSL_ALERT_MSG_DECODE_ERROR,
+                                      MBEDTLS_ERR_SSL_DECODE_ERROR );
+        return( MBEDTLS_ERR_SSL_DECODE_ERROR );
+    }
+
     return( 0 );
 }