diff --git a/epan/proto.c b/epan/proto.c
index f675dfc37d..963da1e653 100644
--- a/epan/proto.c
+++ b/epan/proto.c
@@ -1184,6 +1184,14 @@ proto_tree_add_text_internal(proto_tree *tree, tvbuff_t *tvb, gint start, gint l
 	va_list		   ap;
 	header_field_info *hfinfo;
 
+	if (length == -1) {
+		/* If we're fetching until the end of the TVB, only validate
+		 * that the offset is within range.
+		 */
+		length = 0;
+	}
+	tvb_ensure_bytes_exist(tvb, start, length);
+
 	CHECK_FOR_NULL_TREE(tree);
 
 	TRY_TO_FAKE_THIS_ITEM(tree, hf_text_only, hfinfo);
@@ -1207,6 +1215,14 @@ proto_tree_add_text_valist_internal(proto_tree *tree, tvbuff_t *tvb, gint start,
 	proto_item        *pi;
 	header_field_info *hfinfo;
 
+	if (length == -1) {
+		/* If we're fetching until the end of the TVB, only validate
+		 * that the offset is within range.
+		 */
+		length = 0;
+	}
+	tvb_ensure_bytes_exist(tvb, start, length);
+
 	CHECK_FOR_NULL_TREE(tree);
 
 	TRY_TO_FAKE_THIS_ITEM(tree, hf_text_only, hfinfo);