diff --git a/tests/api.c b/tests/api.c
index 8f331acd0..65fc68ed8 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -18319,6 +18319,7 @@ static int test_wc_PKCS7_DecodeEncryptedKeyPackage(void)
                     pkcs7->encryptionKeySz = sizeof(key);
                 }
             }
+            ExpectIntEQ(wc_PKCS7_DecodeEncryptedKeyPackage(pkcs7, NULL, ekp_cms_der_size, out, sizeof(out)), WC_NO_ERR_TRACE(BAD_FUNC_ARG));
             result = wc_PKCS7_DecodeEncryptedKeyPackage(pkcs7, ekp_cms_der, ekp_cms_der_size, out, sizeof(out));
             if (result == WC_NO_ERR_TRACE(WC_PKCS7_WANT_READ_E)) {
                 result = wc_PKCS7_DecodeEncryptedKeyPackage(pkcs7, ekp_cms_der, ekp_cms_der_size, out, sizeof(out));
diff --git a/wolfcrypt/src/pkcs7.c b/wolfcrypt/src/pkcs7.c
index d8dcee92c..66fc41f09 100644
--- a/wolfcrypt/src/pkcs7.c
+++ b/wolfcrypt/src/pkcs7.c
@@ -14888,6 +14888,11 @@ WOLFSSL_API int wc_PKCS7_DecodeEncryptedKeyPackage(wc_PKCS7 * pkcs7,
     int length = 0;
 
     do {
+        if (pkiMsg == NULL) {
+            ret = BAD_FUNC_ARG;
+            break;
+        }
+
         /* Expect a SEQUENCE header to start the EncryptedKeyPackage ContentInfo. */
         if (GetSequence_ex(pkiMsg, &pkiIndex, &length, pkiMsgSz, 1) < 0) {
             ret = ASN_PARSE_E;