diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 82fa2d4..3dc39f4 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -2409,7 +2409,9 @@
     {
         dn_size = crt->subject_raw.len;
 
-        if( end < p || (size_t)( end - p ) < 2 + dn_size )
+        if( end < p ||
+            (size_t)( end - p ) < dn_size ||
+            (size_t)( end - p ) < 2 + dn_size )
         {
             SSL_DEBUG_MSG( 1, ( "skipping CAs: buffer too short" ) );
             break;