diff --git a/kernel-module/xt_RTPENGINE.c b/kernel-module/xt_RTPENGINE.c
index 8eb500b48..1ca262849 100644
--- a/kernel-module/xt_RTPENGINE.c
+++ b/kernel-module/xt_RTPENGINE.c
@@ -5082,7 +5082,7 @@ drop:
 /* XXX shared code */
 static void parse_rtp(struct rtp_parsed *rtp, struct sk_buff *skb) {
 	struct rtp_extension *ext;
-	int ext_len;
+	size_t ext_len;
 
 	if (skb->len < sizeof(*rtp->rtp_header))
 		goto error;
@@ -5103,7 +5103,7 @@ static void parse_rtp(struct rtp_parsed *rtp, struct sk_buff *skb) {
 		if (rtp->payload_len < sizeof(*ext))
 			goto error;
 		ext = (void *) rtp->payload;
-		ext_len = 4 + ntohs(ext->length) * 4;
+		ext_len = sizeof(*ext) + 4 + ntohs(ext->length) * 4;
 		if (rtp->payload_len < ext_len)
 			goto error;
 		rtp->payload += ext_len;
diff --git a/lib/rtplib.c b/lib/rtplib.c
index 9f6359e4e..f6cc3e26c 100644
--- a/lib/rtplib.c
+++ b/lib/rtplib.c
@@ -91,7 +91,7 @@ int rtp_payload(struct rtp_header **out, str *p, const str *s) {
 			goto error;
 		ext = (void *) p->s;
 		err = "short packet (header extensions)";
-		if (str_shift(p, 4 + ntohs(ext->length) * 4))
+		if (str_shift(p, sizeof(*ext) + 4 + ntohs(ext->length) * 4))
 			goto error;
 	}