diff --git a/src/internal.c b/src/internal.c
index 2f822d081f..6bf9927a54 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -22127,7 +22127,8 @@ static int DoAlert(WOLFSSL* ssl, byte* input, word32* inOutIdx, int* type)
         dataSz -= ssl->keys.padSz;
 
     /* make sure can read the message */
-    if (dataSz != ALERT_SIZE) {
+    if (dataSz != ALERT_SIZE ||
+            *inOutIdx + ALERT_SIZE > ssl->buffers.inputBuffer.length) {
 #ifdef WOLFSSL_EXTRA_ALERTS
         SendAlert(ssl, alert_fatal, unexpected_message);
 #endif