diff --git a/bootp.c b/bootp.c
index baa6380..810da0c 100644
--- a/bootp.c
+++ b/bootp.c
@@ -129,6 +129,9 @@
             if (p >= p_end)
                 break;
             len = *p++;
+            if (p + len > p_end) {
+                break;
+            }
             DPRINTF("dhcp: tag=%d len=%d\n", tag, len);
 
             switch (tag) {