diff --git a/library/rsa.c b/library/rsa.c
index 40ef2a9..c8c6d99 100644
--- a/library/rsa.c
+++ b/library/rsa.c
@@ -1369,7 +1369,11 @@
             return( MBEDTLS_ERR_RSA_INVALID_PADDING );
         p++;
     }
-    p++;
+    p++; /* skip 00 byte */
+
+    /* We've read: 00 01 PS 00 where PS must be at least 8 bytes */
+    if( p - buf < 11 )
+        return( MBEDTLS_ERR_RSA_INVALID_PADDING );
 
     len = siglen - ( p - buf );