diff --git a/native/com_wolfssl_WolfSSLSession.c b/native/com_wolfssl_WolfSSLSession.c
index 901f433..b271072 100644
--- a/native/com_wolfssl_WolfSSLSession.c
+++ b/native/com_wolfssl_WolfSSLSession.c
@@ -3904,21 +3904,22 @@ JNIEXPORT jint JNICALL Java_com_wolfssl_WolfSSLSession_useCertificateChainBuffer
 {
     int ret = WOLFSSL_FAILURE;
     byte* buff = NULL;
-    word32 buffSz = 0;
     WOLFSSL* ssl = (WOLFSSL*)(uintptr_t)sslPtr;
     (void)jcl;
-    (void)sz;
 
     if (jenv == NULL || ssl == NULL || in == NULL) {
         return (jint)BAD_FUNC_ARG;
     }
 
-    buff = (byte*)(*jenv)->GetByteArrayElements(jenv, in, NULL);
-    buffSz = (*jenv)->GetArrayLength(jenv, in);
+    if (sz <= 0 || sz > (jlong)(*jenv)->GetArrayLength(jenv, in)) {
+        return (jint)BAD_FUNC_ARG;
+    }
 
-    if (buff != NULL && buffSz > 0) {
+    buff = (byte*)(*jenv)->GetByteArrayElements(jenv, in, NULL);
+
+    if (buff != NULL) {
         ret = wolfSSL_use_certificate_chain_buffer_format(
-                ssl, buff, buffSz, format);
+                ssl, buff, (long)sz, format);
     }
 
     if (buff != NULL) {
diff --git a/src/test/com/wolfssl/test/WolfSSLSessionTest.java b/src/test/com/wolfssl/test/WolfSSLSessionTest.java
index f04504d..6bc803d 100644
--- a/src/test/com/wolfssl/test/WolfSSLSessionTest.java
+++ b/src/test/com/wolfssl/test/WolfSSLSessionTest.java
@@ -288,6 +288,9 @@ public class WolfSSLSessionTest {
             ssl.usePrivateKeyBuffer(null, 0, WolfSSL.SSL_FILETYPE_PEM));
         assertEquals(WolfSSL.BAD_FUNC_ARG,
             ssl.useCertificateChainBuffer(null, 0));
+        assertEquals(WolfSSL.BAD_FUNC_ARG,
+            ssl.useCertificateChainBufferFormat(null, 0,
+                WolfSSL.SSL_FILETYPE_PEM));
         ssl.freeSSL();
 
         /* correct sz loads, zero/oversized rejected, sub-array (sz < len)
@@ -328,6 +331,19 @@ public class WolfSSLSessionTest {
         assertEquals(WolfSSL.BAD_FUNC_ARG,
             ssl.useCertificateChainBuffer(certPem, certBadSz));
         ssl.freeSSL();
+
+        /* useCertificateChainBufferFormat: correct sz loads, others rejected */
+        ssl = new WolfSSLSession(ctx);
+        assertUseBufferOk("useCertificateChainBufferFormat",
+            ssl.useCertificateChainBufferFormat(certPem, certPem.length,
+                WolfSSL.SSL_FILETYPE_PEM));
+        assertEquals(WolfSSL.BAD_FUNC_ARG,
+            ssl.useCertificateChainBufferFormat(certPem, 0,
+                WolfSSL.SSL_FILETYPE_PEM));
+        assertEquals(WolfSSL.BAD_FUNC_ARG,
+            ssl.useCertificateChainBufferFormat(certPem, certBadSz,
+                WolfSSL.SSL_FILETYPE_PEM));
+        ssl.freeSSL();
     }
 
     class TestPskClientCb implements WolfSSLPskClientCallback