diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index faf807f..8fe74f1 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -8292,8 +8292,8 @@
 {
     const unsigned char *p = buf;
     size_t protocol_name_list_len;
-
-    const unsigned char *protocol_name;
+    const unsigned char *protocol_name_list;
+    const unsigned char *protocol_name_list_end;
     size_t protocol_name_len;
 
     /* If ALPN not configured, just ignore the extension */
@@ -8319,36 +8319,46 @@
     protocol_name_list_len = MBEDTLS_GET_UINT16_BE( p, 0 );
     p += 2;
     MBEDTLS_SSL_CHK_BUF_READ_PTR( p, end, protocol_name_list_len );
+    protocol_name_list = p;
+    protocol_name_list_end = p + protocol_name_list_len;
 
     /* Validate peer's list (lengths) */
-    for( protocol_name = p; protocol_name != end;
-         protocol_name += protocol_name_len )
+    while( p < protocol_name_list_end )
     {
-        protocol_name_len = *protocol_name++;
-        MBEDTLS_SSL_CHK_BUF_READ_PTR( protocol_name, end, protocol_name_len );
+        protocol_name_len = *p++;
+        MBEDTLS_SSL_CHK_BUF_READ_PTR( p, protocol_name_list_end,
+                                      protocol_name_len );
         if( protocol_name_len == 0 )
+        {
+            MBEDTLS_SSL_PEND_FATAL_ALERT(
+                MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+                MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
             return( MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER );
+        }
+
+        p += protocol_name_len;
     }
 
     /* Use our order of preference */
     for( const char **alpn = ssl->conf->alpn_list; *alpn != NULL; alpn++ )
     {
         size_t const alpn_len = strlen( *alpn );
-        for( protocol_name = p; protocol_name != end;
-             protocol_name += protocol_name_len )
+        p = protocol_name_list;
+        while( p < protocol_name_list_end )
         {
-            protocol_name_len = *protocol_name++;
-
+            protocol_name_len = *p++;
             if( protocol_name_len == alpn_len &&
-                memcmp( protocol_name, *alpn, alpn_len ) == 0 )
+                memcmp( p, *alpn, alpn_len ) == 0 )
             {
                 ssl->alpn_chosen = *alpn;
                 return( 0 );
             }
+
+            p += protocol_name_len;
         }
     }
 
-    /* If we get hhere, no match was found */
+    /* If we get here, no match was found */
     MBEDTLS_SSL_PEND_FATAL_ALERT(
             MBEDTLS_SSL_ALERT_MSG_NO_APPLICATION_PROTOCOL,
             MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL );
@@ -8361,6 +8371,7 @@
                                 size_t *out_len )
 {
     unsigned char *p = buf;
+    size_t protocol_name_len;
     *out_len = 0;
 
     if( ssl->alpn_chosen == NULL )
@@ -8368,7 +8379,8 @@
         return( 0 );
     }
 
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 + strlen( ssl->alpn_chosen ) );
+    protocol_name_len = strlen( ssl->alpn_chosen );
+    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 + protocol_name_len );
 
     MBEDTLS_SSL_DEBUG_MSG( 3, ( "server side, adding alpn extension" ) );
     /*
@@ -8380,14 +8392,13 @@
      */
     MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_ALPN, p, 0 );
 
-    *out_len = 7 + strlen( ssl->alpn_chosen );
+    *out_len = 7 + protocol_name_len;
 
-    MBEDTLS_PUT_UINT16_BE( *out_len - 4, p, 2 );
-    MBEDTLS_PUT_UINT16_BE( *out_len - 6, p, 4 );
-    p[6] = MBEDTLS_BYTE_0( *out_len - 7 );
-    p += 7;
+    MBEDTLS_PUT_UINT16_BE( protocol_name_len + 3, p, 2 );
+    MBEDTLS_PUT_UINT16_BE( protocol_name_len + 1, p, 4 );
+    p[6] = MBEDTLS_BYTE_0( protocol_name_len );
 
-    memcpy( p, ssl->alpn_chosen, *out_len - 7 );
+    memcpy( p + 7, ssl->alpn_chosen, protocol_name_len );
     return ( 0 );
 }
 #endif /* MBEDTLS_SSL_ALPN */