diff --git a/src/compression/http_compression_response.c b/src/compression/http_compression_response.c
index 89b7d29..9db50b4 100644
--- a/src/compression/http_compression_response.c
+++ b/src/compression/http_compression_response.c
@@ -118,6 +118,7 @@ static void merge_vary_accept_encoding(HashTable *ht)
             }
         }
         /* Build "<cur>, Accept-Encoding" in one allocation, store it. */
+        if (cl > SIZE_MAX - AE_LEN - 2) { return; }
         zend_string *merged = zend_string_alloc(cl + 2 + AE_LEN, 0);
         memcpy(ZSTR_VAL(merged), cur, cl);
         memcpy(ZSTR_VAL(merged) + cl, ", ", 2);