diff --git a/internal/multiplex/obfs.go b/internal/multiplex/obfs.go
index 0a18e5e..c997e90 100644
--- a/internal/multiplex/obfs.go
+++ b/internal/multiplex/obfs.go
@@ -89,7 +89,11 @@ func MakeDeobfs(salsaKey [32]byte, payloadCipher cipher.AEAD) Deobfser {
 		closing := header[8]
 		extraLen := header[9]
 
-		outputPayload := make([]byte, len(payload)-int(extraLen))
+		outputLen := len(payload) - int(extraLen)
+		if outputLen < 0 {
+			return nil, errors.New("extra length is greater than total payload length")
+		}
+		outputPayload := make([]byte, outputLen)
 
 		if payloadCipher == nil {
 			copy(outputPayload, payload)