diff --git a/library/x509_create.c b/library/x509_create.c
index 056bbaa786343393a0d27336076fe407c2f1c886..1d8283f07fa0c1577688a08061eff680fb19ab5c 100644
--- a/library/x509_create.c
+++ b/library/x509_create.c
@@ -209,6 +209,9 @@ int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid,
                         int critical, const unsigned char *val, size_t val_len )
 {
     mbedtls_asn1_named_data *cur;
+    if (val_len > (SIZE_MAX  - 1)) {
+        return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
+    }
 
     if( ( cur = mbedtls_asn1_store_named_data( head, oid, oid_len,
                                        NULL, val_len + 1 ) ) == NULL )