diff --git a/src/gsm/tlv_parser.c b/src/gsm/tlv_parser.c
index 7930d64..967539e 100644
--- a/src/gsm/tlv_parser.c
+++ b/src/gsm/tlv_parser.c
@@ -232,7 +232,10 @@
 		  const uint8_t *buf, int buf_len)
 {
 	uint8_t tag;
-	int len;
+	int len; /* number of bytes consumed by TLV entry */
+
+	if (buf_len < 1)
+		return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
 
 	tag = *buf;
 	*o_tag = tag;
@@ -265,56 +268,54 @@
 		break;
 	case TLV_TYPE_TLV:
 tlv:		/* GSM TS 04.07 11.2.4: Type 4 TLV */
-		if (buf + 1 > buf + buf_len)
+		if (buf_len < 2)
 			return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
 		*o_val = buf+2;
 		*o_len = *(buf+1);
 		len = *o_len + 2;
-		if (len > buf_len)
-			return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
 		break;
 	case TLV_TYPE_vTvLV_GAN:	/* 44.318 / 11.1.4 */
 		/* FIXME: variable-length TAG! */
+		if (buf_len < 2)
+			return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
 		if (*(buf+1) & 0x80) {
-			/* like TL16Vbut without highest bit of len */
-			if (2 > buf_len)
+			if (buf_len < 3)
 				return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
+			/* like TL16Vbut without highest bit of len */
 			*o_val = buf+3;
 			*o_len = (*(buf+1) & 0x7F) << 8 | *(buf+2);
 			len = *o_len + 3;
-			if (len > buf_len)
-				return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
 		} else {
 			/* like TLV */
 			goto tlv;
 		}
 		break;
 	case TLV_TYPE_TvLV:
+		if (buf_len < 2)
+			return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
 		if (*(buf+1) & 0x80) {
 			/* like TLV, but without highest bit of len */
-			if (buf + 1 > buf + buf_len)
-				return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
 			*o_val = buf+2;
 			*o_len = *(buf+1) & 0x7f;
 			len = *o_len + 2;
-			if (len > buf_len)
-				return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
 			break;
 		}
 		/* like TL16V, fallthrough */
 	case TLV_TYPE_TL16V:
-		if (2 > buf_len)
+		if (buf_len < 3)
 			return OSMO_TLVP_ERR_OFS_BEYOND_BUFFER;
 		*o_val = buf+3;
 		*o_len = *(buf+1) << 8 | *(buf+2);
 		len = *o_len + 3;
-		if (len > buf_len)
-			return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
 		break;
 	default:
 		return OSMO_TLVP_ERR_UNKNOWN_TLV_TYPE;
 	}
 
+	if (buf_len < len) {
+		*o_val = NULL;
+		return OSMO_TLVP_ERR_OFS_LEN_BEYOND_BUFFER;
+	}
 	return len;
 }