diff --git a/lib/client-parser.c b/lib/client-parser.c
index 12096a43..845e6f44 100644
--- a/lib/client-parser.c
+++ b/lib/client-parser.c
@@ -309,7 +309,7 @@ spill:
 			}
 
 			/* control packets can only be < 128 bytes long */
-			if (wsi->u.ws.rx_user_buffer_head > 128 - 4) {
+			if (wsi->u.ws.rx_user_buffer_head > 128 - 3) {
 				lwsl_parser("DROP PING payload too large\n");
 				goto ping_drop;
 			}
diff --git a/lib/parsers.c b/lib/parsers.c
index adcdc294..ed36ecde 100644
--- a/lib/parsers.c
+++ b/lib/parsers.c
@@ -1025,7 +1025,7 @@ spill:
 			}
 process_as_ping:
 			/* control packets can only be < 128 bytes long */
-			if (wsi->u.ws.rx_user_buffer_head > 128 - 4) {
+			if (wsi->u.ws.rx_user_buffer_head > 128 - 3) {
 				lwsl_parser("DROP PING payload too large\n");
 				goto ping_drop;
 			}
diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h
index 8647919d..07fb2a1f 100644
--- a/lib/private-libwebsockets.h
+++ b/lib/private-libwebsockets.h
@@ -839,7 +839,7 @@ struct _lws_websocket_related {
 	unsigned int rx_user_buffer_head;
 	unsigned char mask_nonce[4];
 	/* Also used for close content... control opcode == < 128 */
-	unsigned char ping_payload_buf[128 - 4 + LWS_SEND_BUFFER_PRE_PADDING];
+	unsigned char ping_payload_buf[128 - 3 + LWS_SEND_BUFFER_PRE_PADDING];
 
 	unsigned char ping_payload_len;
 	unsigned char frame_mask_index;