diff --git a/tests/api/test_evp.c b/tests/api/test_evp.c
index 172bf3d2c1..109a508030 100644
--- a/tests/api/test_evp.c
+++ b/tests/api/test_evp.c
@@ -385,6 +385,18 @@ int test_wolfSSL_EVP_DecodeUpdate(void)
     );
     ExpectIntEQ( outl, 0);
 
+    /* pass negative length */
+    ExpectIntEQ(
+        EVP_DecodeUpdate(
+            ctx,
+            decOutBuff,
+            &outl,
+            enc1,
+            -1),             /* negative inl */
+        -1                    /* expected result code -1: fail */
+    );
+    ExpectIntEQ( outl, 0);
+
     ExpectIntEQ(EVP_DecodeBlock(NULL, NULL, 0), -1);
 
     /* pass zero length input */
diff --git a/wolfcrypt/src/evp.c b/wolfcrypt/src/evp.c
index 5001288338..7851e9d842 100644
--- a/wolfcrypt/src/evp.c
+++ b/wolfcrypt/src/evp.c
@@ -13457,7 +13457,7 @@ int  wolfSSL_EVP_DecodeUpdate(WOLFSSL_EVP_ENCODE_CTX* ctx,
     if (outl == NULL)
         return -1;
 
-    if (ctx == NULL || out == NULL || in == NULL) {
+    if (ctx == NULL || out == NULL || in == NULL || inl < 0) {
         *outl = 0;
         return -1;
     }