diff --git a/library/pk.c b/library/pk.c
index de0f7af..855b6e1 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -410,6 +410,9 @@
                                   hash_len, sig, sig_len );
         psa_destroy_key( key_id );
 
+        if( status == PSA_SUCCESS && sig_len > mbedtls_pk_get_len( ctx ) )
+            return( MBEDTLS_ERR_PK_SIG_LEN_MISMATCH );
+
         return( status == PSA_ERROR_INVALID_SIGNATURE?
                               MBEDTLS_ERR_RSA_VERIFY_FAILED :
                               mbedtls_psa_err_translate_pk( status ) );