diff --git a/shadowsocks/packet.go b/shadowsocks/packet.go
index d8a3962d..d1f30f9d 100644
--- a/shadowsocks/packet.go
+++ b/shadowsocks/packet.go
@@ -33,6 +33,9 @@ var zeroNonce [12]byte
 // function will panic.
 func Pack(dst, plaintext []byte, cipher shadowaead.Cipher) ([]byte, error) {
 	saltSize := cipher.SaltSize()
+	if len(dst) < saltSize {
+		return nil, io.ErrShortBuffer
+	}
 	salt := dst[:saltSize]
 	if err := RandomSaltGenerator.GetSalt(salt); err != nil {
 		return nil, err