diff --git a/ChangeLog b/ChangeLog
index cf6331f..a02f6df 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -11,8 +11,14 @@
      with flag MBEDTLS_X509_BADCERT_BAD_PK even when the key type was correct.
      In the context of SSL, this resulted in handshake failure. #1351
 
+Changes
+   * Add guard to validate that out_left can not be negative. Raised by 
+     samoconnor in #1245.
+
+
 = mbed TLS 2.1.10 branch released 2018-02-03
 
+
 Security
    * Fix a heap corruption issue in the implementation of the truncated HMAC
      extension. When the truncated HMAC extension is enabled and CBC is used,
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 7193809..7f51bee 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -2449,6 +2449,12 @@
         if( ret <= 0 )
             return( ret );
 
+        if( (size_t)ret > ssl->out_left )
+        {
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "f_send returned value greater than out left size" ) );
+            return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
+        }
+
         ssl->out_left -= ret;
     }