diff --git a/src/linux_sysfs.c b/src/linux_sysfs.c
index 8c3cf67..ae9f38e 100644
--- a/src/linux_sysfs.c
+++ b/src/linux_sysfs.c
@@ -338,6 +338,10 @@ pci_device_linux_sysfs_read_rom( struct pci_device * dev, void * buffer )
     if ( rom_size == 0 )
 	rom_size = 0x10000;
 
+    /* The caller has allocated dev->rom_size so cap the read amount. */
+    if ( rom_size > dev->rom_size )
+	rom_size = dev->rom_size;
+
     /* This is a quirky thing on Linux.  Even though the ROM and the file
      * for the ROM in sysfs are read-only, the string "1" must be written to
      * the file to enable the ROM.  After the data has been read, "0" must be