diff --git a/library/bignum.c b/library/bignum.c
index 3ed2a12..bc3491c 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -1191,6 +1191,12 @@
     for( n = B->n; n > 0; n-- )
         if( B->p[n - 1] != 0 )
             break;
+    if( n > A->n )
+    {
+        /* B >= (2^ciL)^n > A */
+        ret = MBEDTLS_ERR_MPI_NEGATIVE_VALUE;
+        goto cleanup;
+    }
 
     carry = mpi_sub_hlp( n, X->p, B->p );
     if( carry != 0 )