diff --git a/lib/service.c b/lib/service.c
index 1163a13b..8941536e 100644
--- a/lib/service.c
+++ b/lib/service.c
@@ -967,6 +967,9 @@ read:
 					eff_buf.token_len = context->pt_serv_buf_size;
 				}
 
+				if (eff_buf.token_len > context->pt_serv_buf_size)
+					eff_buf.token_len = context->pt_serv_buf_size;
+
 				eff_buf.token_len = lws_ssl_capable_read(wsi,
 					(unsigned char *)eff_buf.token, pending ? pending :
 					eff_buf.token_len);