diff --git a/src/libcharon/plugins/eap_radius/eap_radius_xauth.c b/src/libcharon/plugins/eap_radius/eap_radius_xauth.c
index 4c4428b48..9793657f2 100644
--- a/src/libcharon/plugins/eap_radius/eap_radius_xauth.c
+++ b/src/libcharon/plugins/eap_radius/eap_radius_xauth.c
@@ -184,7 +184,10 @@ METHOD(xauth_method_t, process, status_t,
 			/* trim password to any null termination. As User-Password
 			 * uses null padding, we can't have any null in it, and some
 			 * clients actually send null terminated strings (Android). */
-			pass.len = strnlen(pass.ptr, pass.len);
+			if (pass.ptr)
+			{
+				pass.len = strnlen(pass.ptr, pass.len);
+			}
 		}
 	}
 	enumerator->destroy(enumerator);