diff --git a/dnscrypt-proxy/common.go b/dnscrypt-proxy/common.go
index 6dfdb191..e4b2850c 100644
--- a/dnscrypt-proxy/common.go
+++ b/dnscrypt-proxy/common.go
@@ -65,7 +65,7 @@ func ReadPrefixed(conn *net.TCPConn) ([]byte, error) {
 				return buf, errors.New("Packet too short")
 			}
 		}
-		if pos >= 2+packetLength {
+		if packetLength >= 0 && pos >= 2+packetLength {
 			return buf[2 : 2+packetLength], nil
 		}
 	}