diff --git a/src/core/dhcp.c b/src/core/dhcp.c
index 70121039..ec649d97 100644
--- a/src/core/dhcp.c
+++ b/src/core/dhcp.c
@@ -1471,8 +1471,14 @@ decode_next:
     if (offset >= q->len) {
       offset -= q->len;
       offset_max -= q->len;
-      q = q->next;
-      options = (u8_t*)q->payload;
+      if (offset < offset_max && offset_max) {
+        q = q->next;
+        LWIP_ASSERT("next pbuf was null", q);
+        options = (u8_t*)q->payload;
+      } else {
+        // We've run out of bytes, probably no end marker. Don't proceed.
+        break;
+      }
     }
   }
   /* is this an overloaded message? */