diff --git a/library/ccm.c b/library/ccm.c
index 969c6c781b..b16b47117e 100644
--- a/library/ccm.c
+++ b/library/ccm.c
@@ -488,6 +488,11 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx,
         return MBEDTLS_ERR_CCM_BAD_INPUT;
     }
 
+    if ((tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) ||
+        (tag_len != ctx->tag_len)) {
+        return MBEDTLS_ERR_CCM_BAD_INPUT;
+    }
+
     /*
      * Authentication: reset counter and crypt/mask internal tag
      */