diff --git a/lib/krb5/crypto.c b/lib/krb5/crypto.c
index 4a3d4ecaf..c7a61e21f 100644
--- a/lib/krb5/crypto.c
+++ b/lib/krb5/crypto.c
@@ -3162,6 +3162,11 @@ krb5_encrypt_iov_ivec(krb5_context context,
     const struct encryption_type *et = crypto->et;
     krb5_crypto_iov *tiv, *piv, *hiv;
 
+    if (num_data < 0) {
+        krb5_clear_error_message(context);
+	return KRB5_CRYPTO_INTERNAL;
+    }
+
     if(!derived_crypto(context, crypto)) {
 	krb5_clear_error_message(context);
 	return KRB5_CRYPTO_INTERNAL;
@@ -3363,6 +3368,11 @@ krb5_decrypt_iov_ivec(krb5_context context,
     struct encryption_type *et = crypto->et;
     krb5_crypto_iov *tiv, *hiv;
 
+    if (num_data < 0) {
+        krb5_clear_error_message(context);
+	return KRB5_CRYPTO_INTERNAL;
+    }
+
     if(!derived_crypto(context, crypto)) {
 	krb5_clear_error_message(context);
 	return KRB5_CRYPTO_INTERNAL;
@@ -3518,6 +3528,11 @@ krb5_create_checksum_iov(krb5_context context,
     size_t len;
     char *p, *q;
 
+    if (num_data < 0) {
+        krb5_clear_error_message(context);
+	return KRB5_CRYPTO_INTERNAL;
+    }
+
     if(!derived_crypto(context, crypto)) {
 	krb5_clear_error_message(context);
 	return KRB5_CRYPTO_INTERNAL;