diff --git a/library/lms.c b/library/lms.c
index c115dac..de38c02 100644
--- a/library/lms.c
+++ b/library/lms.c
@@ -322,11 +322,6 @@
         return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
     }
 
-    if( sig_size != MBEDTLS_LMS_SIG_LEN(ctx->params.type, ctx->params.otstype) )
-    {
-        return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
-    }
-
     if( ctx->params.type
         != MBEDTLS_LMS_SHA256_M32_H10 )
     {
@@ -339,6 +334,16 @@
         return( MBEDTLS_ERR_LMS_BAD_INPUT_DATA );
     }
 
+    if( sig_size != MBEDTLS_LMS_SIG_LEN(ctx->params.type, ctx->params.otstype) )
+    {
+        return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
+    }
+
+    if( sig_size < SIG_OTS_SIG_OFFSET + MBEDTLS_LMOTS_TYPE_LEN )
+    {
+        return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
+    }
+
     if( mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMOTS_TYPE_LEN,
             sig + SIG_OTS_SIG_OFFSET + MBEDTLS_LMOTS_SIG_TYPE_OFFSET )
         != MBEDTLS_LMOTS_SHA256_N32_W8 )
@@ -346,6 +351,11 @@
         return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
     }
 
+    if( sig_size < SIG_TYPE_OFFSET(ctx->params.otstype) + MBEDTLS_LMS_TYPE_LEN )
+    {
+        return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
+    }
+
     if( mbedtls_lms_network_bytes_to_unsigned_int( MBEDTLS_LMS_TYPE_LEN,
             sig + SIG_TYPE_OFFSET(ctx->params.otstype))
         != MBEDTLS_LMS_SHA256_M32_H10 )
@@ -376,7 +386,7 @@
             sizeof( Kc_candidate_ots_pub_key ), NULL );
     if( ret != 0 )
     {
-        return( ret );
+        return( MBEDTLS_ERR_LMS_VERIFY_FAILED );
     }
 
     create_merkle_leaf_value(