diff --git a/src/ssl_crypto.c b/src/ssl_crypto.c
index 864b621bade..ce85f3b1e71 100644
--- a/src/ssl_crypto.c
+++ b/src/ssl_crypto.c
@@ -2611,7 +2611,8 @@ WOLFSSL_DES_LONG wolfSSL_DES_cbc_cksum(const unsigned char* in,
     WOLFSSL_ENTER("wolfSSL_DES_cbc_cksum");
 
     /* Validate parameters. */
-    if ((in == NULL) || (out == NULL) || (sc == NULL) || (iv == NULL)) {
+    if ((in == NULL) || (out == NULL) || (sc == NULL) || (iv == NULL)
+        || length <= 0) {
         WOLFSSL_MSG("Bad argument passed in");
         err = 1;
     }
diff --git a/tests/api/test_ossl_cipher.c b/tests/api/test_ossl_cipher.c
index c618d45c4d7..9cbb79c43ca 100644
--- a/tests/api/test_ossl_cipher.c
+++ b/tests/api/test_ossl_cipher.c
@@ -147,6 +147,9 @@ int test_wolfSSL_DES(void)
     ExpectIntEQ((DES_cbc_cksum(msg, NULL, sizeof(msg), &myDes, &iv)), 0);
     ExpectIntEQ((DES_cbc_cksum(msg, &key, sizeof(msg), NULL, &iv)), 0);
     ExpectIntEQ((DES_cbc_cksum(msg, &key, sizeof(msg), &myDes, NULL)), 0);
+    ExpectIntEQ((DES_cbc_cksum(msg, &key, 0, &myDes, &iv)), 0);
+    ExpectIntEQ((DES_cbc_cksum(msg, &key, -1, &myDes, &iv)), 0);
+
     /* DES_cbc_cksum should return the last 4 of the last 8 bytes after
      * DES_cbc_encrypt on the input */
     XMEMSET(iv, 0, sizeof(DES_cblock));