diff --git a/lib/service.c b/lib/service.c
index 1e9f825e..dca214b2 100644
--- a/lib/service.c
+++ b/lib/service.c
@@ -918,6 +918,9 @@ read:
 					eff_buf.token_len = LWS_MAX_SOCKET_IO_BUF;
 				}
 
+				if (eff_buf.token_len > LWS_MAX_SOCKET_IO_BUF)
+					eff_buf.token_len = LWS_MAX_SOCKET_IO_BUF;
+
 				eff_buf.token_len = lws_ssl_capable_read(wsi,
 					(unsigned char *)eff_buf.token, pending ? pending :
 					eff_buf.token_len);