diff --git a/minix/net/inet/generic/tcp_lib.c b/minix/net/inet/generic/tcp_lib.c
index a25671beb..0306e6d3a 100644
--- a/minix/net/inet/generic/tcp_lib.c
+++ b/minix/net/inet/generic/tcp_lib.c
@@ -90,6 +90,8 @@ size_t *mssp;
 		if (i+2 > tcp_hdr_len)
 			break;	/* No length field */
 		len= cp[1];
+		if (len < 2)
+			break;	/* Length too short */
 		if (i+len > tcp_hdr_len)
 			break;	/* Truncated option */
 		i += len;