diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index 05d82c3da..2a535c0b9 100644
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -14986,6 +14986,9 @@ static int DecodeKeyUsage(const byte* input, int sz, DecodedCert* cert)
     if (ret != 0)
         return ret;
 
+    if (length == 0 || length > 2)
+        return ASN_PARSE_E;
+
     cert->extKeyUsage = (word16)(input[idx]);
     if (length == 2)
         cert->extKeyUsage |= (word16)(input[idx+1] << 8);