diff --git a/library/psa_util.c b/library/psa_util.c
index 9e21602..0349873 100644
--- a/library/psa_util.c
+++ b/library/psa_util.c
@@ -494,7 +494,7 @@
     }
 
     /* Skip possible leading zero */
-    if (*p == 0x00) {
+    if ((*p == 0x00) && (unpadded_len > 0)) {
         p++;
         unpadded_len--;
         /* It should never happen that the input number is all zeros. */
@@ -503,9 +503,13 @@
         }
     }
 
-    if (unpadded_len < coordinate_size) {
+    if (unpadded_len > coordinate_size) {
+        /* Parsed number is longer than the maximum expected value. */
+        return MBEDTLS_ERR_ASN1_INVALID_DATA;
+    } else {
         padding_len = coordinate_size - unpadded_len;
-        memset(raw, 0x00, padding_len);
+        /* raw buffer was already zeroed in mbedtls_ecdsa_der_to_raw() so
+         * zero-padding operation is skipped here. */
     }
     memcpy(raw + padding_len, p, unpadded_len);
     p += unpadded_len;
diff --git a/tests/suites/test_suite_psa_crypto_util.data b/tests/suites/test_suite_psa_crypto_util.data
index 45a3cb5..40f6391 100644
--- a/tests/suites/test_suite_psa_crypto_util.data
+++ b/tests/suites/test_suite_psa_crypto_util.data
@@ -52,7 +52,7 @@
 
 ECDSA DER -> Raw, 256bit, Wrong r integer length (too large)
 depends_on:PSA_WANT_ECC_SECP_K1_256
-ecdsa_der_to_raw:256:"30440221111111111111111111111111111111111111111111111111111111111111111102202222222222222222222222222222222222222222222222222222222222222222":"11111111111111111111111111111111111111111111111111111111111111112222222222222222222222222222222222222222222222222222222222222222":MBEDTLS_ERR_ASN1_UNEXPECTED_TAG
+ecdsa_der_to_raw:256:"30440221111111111111111111111111111111111111111111111111111111111111111102202222222222222222222222222222222222222222222222222222222222222222":"11111111111111111111111111111111111111111111111111111111111111112222222222222222222222222222222222222222222222222222222222222222":MBEDTLS_ERR_ASN1_INVALID_DATA
 
 ECDSA DER -> Raw, 256bit, Wrong s integer length (too small)
 depends_on:PSA_WANT_ECC_SECP_K1_256