diff --git a/libavb/avb_descriptor.c b/libavb/avb_descriptor.c
index 1f451ca..222a616 100644
--- a/libavb/avb_descriptor.c
+++ b/libavb/avb_descriptor.c
@@ -114,6 +114,10 @@
   desc_end = desc_start + desc_size;
 
   for (p = desc_start; p < desc_end;) {
+    if (p + sizeof(AvbDescriptor) > desc_end) {
+      avb_error("Invalid descriptor length.\n");
+      goto out;
+    }
     const AvbDescriptor* dh = (const AvbDescriptor*)p;
     uint64_t nb_following;
     uint64_t nb_total = 0;