diff --git a/servers/slapd/passwd.c b/servers/slapd/passwd.c
index 94cbeac0cf..4bc064a0ad 100644
--- a/servers/slapd/passwd.c
+++ b/servers/slapd/passwd.c
@@ -88,6 +88,11 @@ int slap_passwd_parse( struct berval *reqdata,
 		return LDAP_SUCCESS;
 	}
 
+	if( reqdata->bv_len == 0 ) {
+		*text = "empty request data field";
+		return LDAP_PROTOCOL_ERROR;
+	}
+
 	/* ber_init2 uses reqdata directly, doesn't allocate new buffers */
 	ber_init2( ber, reqdata, 0 );
 
@@ -204,7 +209,6 @@ decoding_error:
 			(long) len, 0, 0 );
 #endif
 
-
 		*text = "data decoding error";
 		rc = LDAP_PROTOCOL_ERROR;
 	}