diff --git a/src/dpp-util.c b/src/dpp-util.c
index aaca2c48..8ea3d498 100644
--- a/src/dpp-util.c
+++ b/src/dpp-util.c
@@ -297,7 +297,7 @@ bool dpp_attr_iter_next(struct dpp_attr_iter *iter,
 			const uint8_t **data_out)
 {
 	enum dpp_attribute_type type;
-	size_t len;
+	uint16_t len;
 
 	if (iter->pos + 4 > iter->end)
 		return false;
@@ -307,7 +307,7 @@ bool dpp_attr_iter_next(struct dpp_attr_iter *iter,
 
 	iter->pos += 4;
 
-	if (iter->pos + len > iter->end)
+	if (iter->end - iter->pos < len)
 		return false;
 
 	*type_out = type;