diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 2f4ae6925..1e2fb6221 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -990,7 +990,9 @@ static int ssl_write_certificate_request( ssl_context *ssl )
     {
         dn_size = crt->subject_raw.len;
 
-        if( end < p || (size_t)( end - p ) < 2 + dn_size )
+        if( end < p ||
+            (size_t)( end - p ) < dn_size ||
+            (size_t)( end - p ) < 2 + dn_size )
         {
             SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
             break;