diff --git a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt
index cfc8256d21..9478cc986f 100644
--- a/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt
+++ b/libsignal-service/src/main/java/org/whispersystems/signalservice/api/crypto/AttachmentCipherInputStream.kt
@@ -362,7 +362,11 @@ object AttachmentCipherInputStream {
 
   private class CombinedKeyMaterial(val aesKey: ByteArray, val macKey: ByteArray) {
     companion object {
+      @Throws(InvalidMessageException::class)
       fun from(combinedKeyMaterial: ByteArray): CombinedKeyMaterial {
+        if (combinedKeyMaterial.size != CIPHER_KEY_SIZE + MAC_KEY_SIZE) {
+          throw InvalidMessageException("Invalid combined key material size: ${combinedKeyMaterial.size}")
+        }
         val parts = Util.split(combinedKeyMaterial, CIPHER_KEY_SIZE, MAC_KEY_SIZE)
         return CombinedKeyMaterial(parts[0], parts[1])
       }