diff --git a/src/encauth/ocb3/ocb3_decrypt_verify_memory.c b/src/encauth/ocb3/ocb3_decrypt_verify_memory.c
index 486168d..066b62c 100644
--- a/src/encauth/ocb3/ocb3_decrypt_verify_memory.c
+++ b/src/encauth/ocb3/ocb3_decrypt_verify_memory.c
@@ -51,8 +51,11 @@ int ocb3_decrypt_verify_memory(int cipher,
    /* default to zero */
    *stat = 0;
 
+   /* limit taglen */
+   taglen = MIN(taglen, MAXBLOCKSIZE);
+
    /* allocate memory */
-   buf = XMALLOC(MIN(taglen, MAXBLOCKSIZE));
+   buf = XMALLOC(taglen);
    ocb = XMALLOC(sizeof(ocb3_state));
    if (ocb == NULL || buf == NULL) {
       if (ocb != NULL) {