Trust the user less, check the package length.