diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 90995c0..2cdf227 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -791,25 +791,33 @@
         return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
 
     /*
-     * Use our order of preference
+     * Validate peer's list (lengths)
      */
     start = buf + 2;
     end = buf + len;
+    for( theirs = start; theirs != end; theirs += cur_len )
+    {
+        cur_len = *theirs++;
+
+        /* Current identifier must fit in list */
+        if( cur_len > (size_t)( end - theirs ) )
+            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+
+        /* Empty strings MUST NOT be included */
+        if( cur_len == 0 )
+            return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
+    }
+
+    /*
+     * Use our order of preference
+     */
     for( ours = ssl->alpn_list; *ours != NULL; ours++ )
     {
         ours_len = strlen( *ours );
         for( theirs = start; theirs != end; theirs += cur_len )
         {
-            /* If the list is well formed, we should get equality first */
-            if( theirs > end )
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-
             cur_len = *theirs++;
 
-            /* Empty strings MUST NOT be included */
-            if( cur_len == 0 )
-                return( POLARSSL_ERR_SSL_BAD_HS_CLIENT_HELLO );
-
             if( cur_len == ours_len &&
                 memcmp( theirs, *ours, cur_len ) == 0 )
             {