diff --git a/python_modules/demarshal.py b/python_modules/demarshal.py
index 7b53361f189144e6bee95f9979e58df43cb78b0f..5a237a6b7f097cb3d02c4aada0e3200d480acd7e 100644
--- a/python_modules/demarshal.py
+++ b/python_modules/demarshal.py
@@ -331,6 +331,7 @@ def write_validate_array_item(writer, container, item, scope, parent_scope, star
         writer.assign(nelements, array.size)
     elif array.is_remaining_length():
         if element_type.is_fixed_nw_size():
+            writer.error_check("%s > message_end" % item.get_position())
             if element_type.get_fixed_nw_size() == 1:
                 writer.assign(nelements, "message_end - %s" % item.get_position())
             else:
diff --git a/tests/test-marshallers.c b/tests/test-marshallers.c
index ad45e36e482ab3d4698098798ab509c0e5f0b1a7..02fbcd1108500d2e6d7408bec6a4b951d84aa3ba 100644
--- a/tests/test-marshallers.c
+++ b/tests/test-marshallers.c
@@ -150,6 +150,14 @@ int main(int argc G_GNUC_UNUSED, char **argv G_GNUC_UNUSED)
 
     test_overflow(marshaller);
 
+    len = 4;
+    data = g_new0(uint8_t, len);
+    memset(data, 0, len);
+    msg = (SpiceMsgMainShortDataSubMarshall *) spice_parse_msg(data, data + len, 1, 3, 0,
+                                                               &msg_len, &free_message);
+    g_assert_null(msg);
+    g_free(data);
+
     spice_marshaller_destroy(marshaller);
 
     return 0;
diff --git a/tests/test-marshallers.h b/tests/test-marshallers.h
index 99877c008d043ffc865b96eccbd31c29d25f185a..4eab90fb6d18c6f1bd069790111a7477d2433e80 100644
--- a/tests/test-marshallers.h
+++ b/tests/test-marshallers.h
@@ -21,5 +21,10 @@ typedef struct SpiceMsgChannels {
     uint16_t channels[0];
 } SpiceMsgChannels;
 
+typedef struct {
+    uint32_t dummy[2];
+    uint8_t data[0];
+} SpiceMsgMainLenMessage;
+
 #endif /* _H_TEST_MARSHALLERS */
 
diff --git a/tests/test-marshallers.proto b/tests/test-marshallers.proto
index c75134e13082e0b4f32640b94c7cc3d46a9da88d..34cc892c7509d9be239505a1b07e7d821a4a0685 100644
--- a/tests/test-marshallers.proto
+++ b/tests/test-marshallers.proto
@@ -19,6 +19,11 @@ channel TestChannel {
         uint32 num_of_channels;
         uint16 channels[num_of_channels] @end;
     } @ctype(SpiceMsgChannels) channels_list;
+
+    message {
+        uint32 dummy[2];
+        uint8 data[] @end;
+    } LenMessage;
 };
 
 protocol Spice {