diff --git a/src/quic.c b/src/quic.c
index d178f66bce..1b123b9c3e 100644
--- a/src/quic.c
+++ b/src/quic.c
@@ -849,6 +849,11 @@ static int wolfSSL_quic_send_internal(WOLFSSL* ssl)
         }
         else {
             /* at start of a TLS Record */
+            if (length < RECORD_HEADER_SZ) {
+                WOLFSSL_MSG("WOLFSSL_QUIC_SEND application failed");
+                ret = FWRITE_ERROR;
+                goto cleanup;
+            }
             rl = (RecordLayerHeader*)output;
             ato16(rl->length, &rlen);
             output += RECORD_HEADER_SZ;