diff --git a/src/dnssec.c b/src/dnssec.c
index 4eb6e53..afdedf3 100644
--- a/src/dnssec.c
+++ b/src/dnssec.c
@@ -543,10 +543,14 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
 
 	   *ttl_out = ttl;
 	 }
-       
+
+      /* Don't trust rdlen not to be too small and give us a negative sig_len
+	 It has already been checked that it doesn't run us off the end
+	 of the packet. */
+      if ((sig_len = rdlen - (p - psav)) <= 0)
+	return STAT_BOGUS;
+
       sig = p;
-      sig_len = rdlen - (p - psav);
-              
       nsigttl = htonl(orig_ttl);
       
       hash->update(ctx, 18, psav);