diff --git a/include/nfc/nfc.h b/include/nfc/nfc.h
index a5f40a6..544dfb3 100644
--- a/include/nfc/nfc.h
+++ b/include/nfc/nfc.h
@@ -85,7 +85,7 @@ extern  "C" {
   NFC_EXPORT int nfc_initiator_deselect_target(nfc_device *pnd);
   NFC_EXPORT int nfc_initiator_transceive_bytes(nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, const size_t szRx, int timeout);
   NFC_EXPORT int nfc_initiator_transceive_bits(nfc_device *pnd, const uint8_t *pbtTx, const size_t szTxBits, const uint8_t *pbtTxPar, uint8_t *pbtRx, uint8_t *pbtRxPar);
-  NFC_EXPORT int nfc_initiator_transceive_bytes_timed(nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, uint32_t *cycles);
+  NFC_EXPORT int nfc_initiator_transceive_bytes_timed(nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, const size_t szRx, uint32_t *cycles);
   NFC_EXPORT int nfc_initiator_transceive_bits_timed(nfc_device *pnd, const uint8_t *pbtTx, const size_t szTxBits, const uint8_t *pbtTxPar, uint8_t *pbtRx, uint8_t *pbtRxPar, uint32_t *cycles);
   NFC_EXPORT int nfc_initiator_target_is_present(nfc_device *pnd, const nfc_target nt);
 
diff --git a/libnfc/chips/pn53x.c b/libnfc/chips/pn53x.c
index 3b89252..cb04523 100644
--- a/libnfc/chips/pn53x.c
+++ b/libnfc/chips/pn53x.c
@@ -1554,7 +1554,7 @@ pn53x_initiator_transceive_bits_timed(struct nfc_device *pnd, const uint8_t *pbt
 }
 
 int
-pn53x_initiator_transceive_bytes_timed(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, uint32_t *cycles)
+pn53x_initiator_transceive_bytes_timed(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, const size_t szRx, uint32_t *cycles)
 {
   uint16_t i;
   uint8_t sz;
@@ -1602,7 +1602,7 @@ pn53x_initiator_transceive_bytes_timed(struct nfc_device *pnd, const uint8_t *pb
   }
 
   // Recv data
-  size_t szRx = 0;
+  size_t szRxLen = 0;
   // we've to watch for coming data until we decide to timeout.
   // our PN53x timer saturates after 4.8ms so this function shouldn't be used for
   // responses coming very late anyway.
@@ -1632,10 +1632,17 @@ pn53x_initiator_transceive_bytes_timed(struct nfc_device *pnd, const uint8_t *pb
     if ((res = pn53x_transceive(pnd, abtReadRegisterCmd, BUFFER_SIZE(abtReadRegisterCmd), abtRes, szRes, -1)) < 0) {
       return res;
     }
-    for (i = 0; i < sz; i++) {
-      pbtRx[i + szRx] = abtRes[i + off];
+    if (pbtRx != NULL) {
+      if ((szRxLen + sz) > szRx) {
+        log_put(LOG_CATEGORY, NFC_PRIORITY_ERROR, "Buffer size is too short: %zuo available(s), %zuo needed", szRx, szRxLen + sz);
+        return NFC_EOVFLOW;
+      }
+      // Copy the received bytes
+      for (i = 0; i < sz; i++) {
+        pbtRx[i + szRxLen] = abtRes[i + off];
+      }
     }
-    szRx += (size_t)(sz & SYMBOL_FIFO_LEVEL);
+    szRxLen += (size_t)(sz & SYMBOL_FIFO_LEVEL);
     sz = abtRes[sz + off];
     if (sz == 0)
       break;
@@ -1653,7 +1660,7 @@ pn53x_initiator_transceive_bytes_timed(struct nfc_device *pnd, const uint8_t *pb
   } else {
     *cycles = __pn53x_get_timer(pnd, pbtTx[szTx - 1]);
   }
-  return szRx;
+  return szRxLen;
 }
 
 int
diff --git a/libnfc/chips/pn53x.h b/libnfc/chips/pn53x.h
index d03688f..8acf2ae 100644
--- a/libnfc/chips/pn53x.h
+++ b/libnfc/chips/pn53x.h
@@ -335,7 +335,7 @@ int    pn53x_initiator_transceive_bytes(struct nfc_device *pnd, const uint8_t *p
 int    pn53x_initiator_transceive_bits_timed(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTxBits,
                                              const uint8_t *pbtTxPar, uint8_t *pbtRx, uint8_t *pbtRxPar, uint32_t *cycles);
 int    pn53x_initiator_transceive_bytes_timed(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx,
-                                              uint8_t *pbtRx, uint32_t *cycles);
+                                              uint8_t *pbtRx, const size_t szRx, uint32_t *cycles);
 int    pn53x_initiator_deselect_target(struct nfc_device *pnd);
 int    pn53x_initiator_target_is_present(struct nfc_device *pnd, const nfc_target nt);
 
diff --git a/libnfc/nfc-internal.h b/libnfc/nfc-internal.h
index 15503ec..ba40e29 100644
--- a/libnfc/nfc-internal.h
+++ b/libnfc/nfc-internal.h
@@ -129,7 +129,7 @@ struct nfc_driver {
   int (*initiator_deselect_target)(struct nfc_device *pnd);
   int (*initiator_transceive_bytes)(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, const size_t szRx, int timeout);
   int (*initiator_transceive_bits)(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTxBits, const uint8_t *pbtTxPar, uint8_t *pbtRx, uint8_t *pbtRxPar);
-  int (*initiator_transceive_bytes_timed)(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, uint32_t *cycles);
+  int (*initiator_transceive_bytes_timed)(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, const size_t szRx, uint32_t *cycles);
   int (*initiator_transceive_bits_timed)(struct nfc_device *pnd, const uint8_t *pbtTx, const size_t szTxBits, const uint8_t *pbtTxPar, uint8_t *pbtRx, uint8_t *pbtRxPar, uint32_t *cycles);
   int (*initiator_target_is_present)(struct nfc_device *pnd, const nfc_target nt);
 
diff --git a/libnfc/nfc.c b/libnfc/nfc.c
index 55454a9..638726b 100644
--- a/libnfc/nfc.c
+++ b/libnfc/nfc.c
@@ -705,9 +705,9 @@ nfc_initiator_transceive_bits(nfc_device *pnd, const uint8_t *pbtTx, const size_
  * @warning The configuration option \a NP_HANDLE_PARITY must be set to \c true (the default value).
  */
 int
-nfc_initiator_transceive_bytes_timed(nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, uint32_t *cycles)
+nfc_initiator_transceive_bytes_timed(nfc_device *pnd, const uint8_t *pbtTx, const size_t szTx, uint8_t *pbtRx, const size_t szRx, uint32_t *cycles)
 {
-  HAL(initiator_transceive_bytes_timed, pnd, pbtTx, szTx, pbtRx, cycles);
+  HAL(initiator_transceive_bytes_timed, pnd, pbtTx, szTx, pbtRx, szRx, cycles);
 }
 
 /** @ingroup initiator