diff --git a/tools/tools/netmap/pkt_hash.c b/tools/tools/netmap/pkt_hash.c
index 3071935e11ef..eb9704fd2058 100644
--- a/tools/tools/netmap/pkt_hash.c
+++ b/tools/tools/netmap/pkt_hash.c
@@ -150,7 +150,9 @@ decode_ip_n_hash(const struct ip *iph, uint8_t hash_split, uint8_t seed)
 {
 	uint32_t rc = 0;
 
-	if (hash_split == 2) {
+	if (iph->ip_hl < 5 || iph->ip_hl * 4 > iph->ip_len) {
+		rc = 0;
+	} else if (hash_split == 2) {
 		rc = sym_hash_fn(ntohl(iph->ip_src.s_addr),
 			ntohl(iph->ip_dst.s_addr),
 			ntohs(0xFFFD) + seed,