diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 4c7ce1e..5f5ea39 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -8987,7 +8987,7 @@
     const size_t hash_len = PSA_HASH_LENGTH(hash_alg);
     const unsigned char *secret = ssl->session->app_secrets.exporter_master_secret;
 
-    if (key_len > 0xff || label_len > 250) {
+    if (key_len > 0xffff || label_len > 250) {
         return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
     }