diff --git a/test/badcode/test/tests.c b/test/badcode/test/tests.c
index 05e51c7..506a0c3 100644
--- a/test/badcode/test/tests.c
+++ b/test/badcode/test/tests.c
@@ -20,4 +20,8 @@ void test_giant_rom(void) {
     TEST_ASSERT_EQUAL(false, uvm32_load(&vmst, rom_bin, UVM32_MEMORY_SIZE+1)); // if it reads off end of rom_bin, will crash
 }
 
+void test_negative_rom_length(void) {
+    uvm32_init(&vmst);
+    TEST_ASSERT_EQUAL(false, uvm32_load(&vmst, rom_bin, -1));
+}
 
diff --git a/uvm32/uvm32.c b/uvm32/uvm32.c
index d5e629b..8ba18b9 100644
--- a/uvm32/uvm32.c
+++ b/uvm32/uvm32.c
@@ -121,8 +121,8 @@ void uvm32_init(uvm32_state_t *vmst) {
 }
 
 bool uvm32_load(uvm32_state_t *vmst, const uint8_t *rom, int len) {
-    if (len > UVM32_MEMORY_SIZE) {
-        // too big
+    if (len < 0 || len > UVM32_MEMORY_SIZE) {
+        // invalid length
         return false;
     }