diff --git a/mysys_ssl/my_crypt.cc b/mysys_ssl/my_crypt.cc
index 49bd9af..9ed223c 100644
--- a/mysys_ssl/my_crypt.cc
+++ b/mysys_ssl/my_crypt.cc
@@ -168,6 +168,8 @@ class MyCTX_gcm : public MyCTX
     */
     if (!ctx.encrypt)
     {
+      if (slen < MY_AES_BLOCK_SIZE)
+        return MY_AES_BAD_DATA;
       slen-= MY_AES_BLOCK_SIZE;
       if(!EVP_CIPHER_CTX_ctrl(&ctx, EVP_CTRL_GCM_SET_TAG, MY_AES_BLOCK_SIZE,
                               (void*)(src + slen)))