diff --git a/openbsc/src/nat/bsc_filter.c b/openbsc/src/nat/bsc_filter.c
index d3de5f7..099b07a 100644
--- a/openbsc/src/nat/bsc_filter.c
+++ b/openbsc/src/nat/bsc_filter.c
@@ -93,6 +93,13 @@
 
 	msg->l2h = &hh->data[0];
 
+	/* do a size check on the input */
+	if (ntohs(hh->len) != msgb_l2len(msg)) {
+		LOGP(DINP, LOGL_ERROR, "Wrong input length?\n");
+		talloc_free(parsed);
+		return NULL;
+	}
+
 	/* analyze sccp down here */
 	if (parsed->ipa_proto == IPAC_PROTO_SCCP) {
 		memset(&result, 0, sizeof(result));