diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 7005704..1a5594d 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1674,7 +1674,9 @@
   while (CBS_len(&protocol_name_list_copy) > 0) {
     CBS protocol_name;
 
-    if (!CBS_get_u8_length_prefixed(&protocol_name_list_copy, &protocol_name)) {
+    if (!CBS_get_u8_length_prefixed(&protocol_name_list_copy, &protocol_name) ||
+        /* Empty protocol names are forbidden. */
+        CBS_len(&protocol_name) == 0) {
       goto parse_error;
     }
   }
@@ -2118,6 +2120,8 @@
       if (!CBS_get_u16_length_prefixed(&extension, &protocol_name_list) ||
           CBS_len(&extension) != 0 ||
           !CBS_get_u8_length_prefixed(&protocol_name_list, &protocol_name) ||
+          /* Empty protocol names are forbidden. */
+          CBS_len(&protocol_name) == 0 ||
           CBS_len(&protocol_name_list) != 0) {
         *out_alert = SSL_AD_DECODE_ERROR;
         return 0;