diff --git a/src/cmdu.c b/src/cmdu.c
index 6bd254fd7868f3af3491b53299617b747a2a6593..676e444f312baea1a30ee35b50c5012c5cc8227b 100644
--- a/src/cmdu.c
+++ b/src/cmdu.c
@@ -101,11 +101,16 @@ void tlv_free_linear(struct tlv *t)
 
 int tlv_ok(struct tlv *t, int rem)
 {
-	uint16_t l = buf_get_be16(&((uint8_t *)t)[1]);
-	if (rem >= sizeof(struct tlv) && l <= rem - 3)
-		return 1;
+	uint16_t l;
 
-	return 0;
+	if (rem < sizeof(struct tlv))
+		return 0;
+
+	l = buf_get_be16(&((uint8_t *)t)[1]);
+	if (l + 3 > rem)
+		return 0;
+
+	return 1;
 }
 
 struct tlv *tlv_next(struct tlv *t, int *rem)