diff --git a/test/unit/mqtt/test_mqtt.c b/test/unit/mqtt/test_mqtt.c
index 7cff13ea..70ce2918 100644
--- a/test/unit/mqtt/test_mqtt.c
+++ b/test/unit/mqtt/test_mqtt.c
@@ -106,10 +106,144 @@ START_TEST(basic_connect)
 }
 END_TEST
 
+START_TEST(illegal_header_size)
+{
+  mqtt_client_t* client;
+  struct netif netif;
+  err_t err;
+  struct mqtt_connect_client_info_t client_info = {
+    "dumm",
+    NULL, NULL,
+    10,
+    NULL, NULL, 0, 0
+  };
+  struct pbuf *p, *p1, *p2;
+  const size_t buf_size1 = 5;
+  const size_t buf_size2 = 4 * 1024; /* Large enough to cause trouble */
+  size_t i;
+  unsigned char* rxbuf1 = (unsigned char*)mem_malloc(buf_size1);
+  unsigned char* rxbuf2 = (unsigned char*)mem_malloc(buf_size2);
+  LWIP_UNUSED_ARG(_i);
+
+  test_mqtt_init_netif(&netif, &test_mqtt_local_ip, &test_mqtt_netmask);
+
+  client = mqtt_client_new();
+  fail_unless(client != NULL);
+  err = mqtt_client_connect(client, &test_mqtt_remote_ip, 1234, test_mqtt_connection_cb, NULL, &client_info);
+  fail_unless(err == ERR_OK);
+
+  client->conn->connected(client->conn->callback_arg, client->conn, ERR_OK);
+  i = 0;
+  /*
+   * First byte is msg type / control header.
+   * MQTT_MSG_TYPE_PINGRESP is simply ignored. We do not care for now.
+   */
+  rxbuf1[i++] = 12 /*MQTT_MSG_TYPE_PINGRESP*/ ;
+  /* Next 4 bytes are the optional length extension.
+   * Must be 0x80 to let continuation work */
+  rxbuf1[i++] = 0x80 | 0x00; /* 0x00 => 0x00 << 7*0 => 0 */
+  rxbuf1[i++] = 0x80 | 0x7f; /* 0x7f => 0x7f << 7*1 => +16384 */
+  rxbuf1[i++] = 0x80 | 0x00; /* 0x00 => 0x00 << 7*2 => +0 */
+  rxbuf1[i++] = 0x80 | 0x00; /* 0x00 => 0x00 << 7*3 => +0 */
+
+  /* Start next pbuf */
+
+  /* We must make the internal count MQTT_VAR_HEADER_BUFFER_LEN + 1 or larger.
+   * The difference between previous packet size and the offset we are at in
+   * the full pbuf chain is the overflow size. So here we have 6 - 254
+   * => underflows.
+   *
+   *
+   * Note that we are also overwriting the struct mqtt_ringbuf_t output.
+   * Perhaps that could be used for information leakage, by manipulating the
+   * length variables _put_ and _get_.
+   */
+  for(i = 0; i < 254 - buf_size1; i++) {
+     /* As long as we set 0x80 it will be accepted
+      * and we can overflow the rx_buffer. */
+     rxbuf2[i] = 0x80;
+  }
+  /* Fill the remainder of the packet with 'a' */
+  for(; i < buf_size2; i++) {
+     rxbuf2[i] = 'a';
+  }
+
+  /* Create the two pbufs and chain them together */
+  p1 = pbuf_alloc_reference(rxbuf1, buf_size1, PBUF_REF);
+  fail_unless(p1 != NULL);
+  p2 = pbuf_alloc_reference(rxbuf2, buf_size2, PBUF_REF);
+  fail_unless(p2 != NULL);
+  pbuf_cat(p1, p2);
+  p = p1;
+
+  /* since we hack the rx path, we have to hack the rx window, too: */
+  client->conn->rcv_wnd -= p->tot_len;
+  if (client->conn->recv(client->conn->callback_arg, client->conn, p, ERR_OK) != ERR_OK) {
+    pbuf_free(p);
+  }
+
+  mqtt_disconnect(client);
+  /* fixme: mqtt_client_fre() is missing... */
+  mem_free(client);
+  mem_free(rxbuf1);
+  mem_free(rxbuf2);
+}
+
+START_TEST(internal_loop)
+{
+  mqtt_client_t* client;
+  struct netif netif;
+  err_t err;
+  struct mqtt_connect_client_info_t client_info = {
+    "dumm",
+    NULL, NULL,
+    10,
+    NULL, NULL, 0, 0
+  };
+  struct pbuf *p;
+  size_t buf_len = 256 + 1 ;
+  unsigned char* rxbuf = (unsigned char*)mem_malloc(buf_len);
+  LWIP_UNUSED_ARG(_i);
+
+  test_mqtt_init_netif(&netif, &test_mqtt_local_ip, &test_mqtt_netmask);
+
+  client = mqtt_client_new();
+  fail_unless(client != NULL);
+  err = mqtt_client_connect(client, &test_mqtt_remote_ip, 1234, test_mqtt_connection_cb, NULL, &client_info);
+  fail_unless(err == ERR_OK);
+
+  client->conn->connected(client->conn->callback_arg, client->conn, ERR_OK);
+  /* Just fill the buffer with 0x80:
+   * 0x80 means: the next byte also contains length.
+   * This should be limited to 4 bytes after the intial header, but alas that
+   * was not the case.
+   * This caused an infinite loop and the test would fail.
+   */
+  memset(rxbuf, 0x80, buf_len);
+
+  p = pbuf_alloc(PBUF_RAW, buf_len, PBUF_REF);
+  fail_unless(p != NULL);
+  p->payload = rxbuf;
+
+  /* since we hack the rx path, we have to hack the rx window, too: */
+  client->conn->rcv_wnd -= p->tot_len;
+  if (client->conn->recv(client->conn->callback_arg, client->conn, p, ERR_OK) != ERR_OK) {
+    pbuf_free(p);
+  }
+
+  mqtt_disconnect(client);
+  /* fixme: mqtt_client_fre() is missing... */
+  mem_free(client);
+  mem_free(rxbuf);
+}
+END_TEST
+
 Suite* mqtt_suite(void)
 {
   testfunc tests[] = {
     TESTFUNC(basic_connect),
+    TESTFUNC(illegal_header_size),
+    TESTFUNC(internal_loop),
   };
   return create_suite("MQTT", tests, sizeof(tests)/sizeof(testfunc), mqtt_setup, mqtt_teardown);
 }
