diff --git a/library/rsa.c b/library/rsa.c
index ed1f45b..278686b 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -646,7 +646,7 @@
                     return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
             }
 
-            if( nb_pad < 8 )
+            if( ( nb_pad < 8 ) || ( nb_pad > olen ) )
                 return( POLARSSL_ERR_RSA_BAD_INPUT_DATA );
 
             *p++ = 0;