diff --git a/library/bignum.c b/library/bignum.c
index 2feb727..f133f6c 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -1354,6 +1354,12 @@
     for( n = B->n; n > 0; n-- )
         if( B->p[n - 1] != 0 )
             break;
+    if( n > A->n )
+    {
+        /* B >= (2^ciL)^n > A */
+        ret = MBEDTLS_ERR_MPI_NEGATIVE_VALUE;
+        goto cleanup;
+    }
 
     carry = mpi_sub_hlp( n, X->p, B->p );
     if( carry != 0 )