diff --git a/src/suricata.c b/src/suricata.c
index 7433bcadd5..217c9f1382 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -583,6 +583,7 @@ static void SetBpfStringFromFile(char *filename)
         exit(EXIT_FAILURE);
     }
     fclose(fp);
+    DEBUG_VALIDATE_BUG_ON(nm >= bpf_len); // help scan-build
     bpf_filter[nm] = '\0';
 
     if(strlen(bpf_filter) > 0) {