diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c
index 86ef6c7f3e..d0966ac2f4 100644
--- a/tools/xenstore/xs.c
+++ b/tools/xenstore/xs.c
@@ -1141,6 +1141,12 @@ static int read_message(struct xs_handle *h, int nonblocking)
 		goto error_freemsg;
 	}
 
+	/* Sanity check message body length. */
+	if (msg->hdr.len > XENSTORE_PAYLOAD_MAX) {
+		saved_errno = E2BIG;
+		goto error_freemsg;
+	}
+
 	/* Allocate and read the message body. */
 	body = msg->body = malloc(msg->hdr.len + 1);
 	if (body == NULL)