diff --git a/crypto/dh/dh_ctrl.c b/crypto/dh/dh_ctrl.c
index 6fddd271a889970a6ccab4d55f56e4cbec15c95e..0db5eba50523929831b23dcce62f1f3d65f88bfe 100644
--- a/crypto/dh/dh_ctrl.c
+++ b/crypto/dh/dh_ctrl.c
@@ -500,6 +500,9 @@ int EVP_PKEY_CTX_set0_dh_kdf_ukm(EVP_PKEY_CTX *ctx, unsigned char *ukm, int len)
     int ret;
     OSSL_PARAM params[2], *p = params;
 
+    if (len <= 0)
+        return -1;
+
     ret = dh_param_derive_check(ctx);
     if (ret != 1)
         return ret;