diff --git a/g10/call-agent.c b/g10/call-agent.c
index f29e1b131..ea530e7ac 100644
--- a/g10/call-agent.c
+++ b/g10/call-agent.c
@@ -383,7 +383,7 @@ unhexify_fpr (const char *hexstr, unsigned char *fpr)
     ;
   if ((*s && *s != ' ') || (n != 40))
     return 0; /* no fingerprint (invalid or wrong length). */
-  for (s=hexstr, n=0; *s; s += 2, n++)
+  for (s=hexstr, n=0; *s && n < 20; s += 2, n++)
     fpr[n] = xtoi_2 (s);
 
   return 1; /* okay */