diff --git a/src/wps/ndef.c b/src/wps/ndef.c
index 5604b0a5d..50d018f94 100644
--- a/src/wps/ndef.c
+++ b/src/wps/ndef.c
@@ -48,6 +48,8 @@ static int ndef_parse_record(const u8 *data, u32 size,
 		if (size < 6)
 			return -1;
 		record->payload_length = WPA_GET_BE32(pos);
+		if (record->payload_length > size - 6)
+			return -1;
 		pos += sizeof(u32);
 	}
 
@@ -68,7 +70,8 @@ static int ndef_parse_record(const u8 *data, u32 size,
 	pos += record->payload_length;
 
 	record->total_length = pos - data;
-	if (record->total_length > size)
+	if (record->total_length > size ||
+	    record->total_length < record->payload_length)
 		return -1;
 	return 0;
 }