diff --git a/shadowsocks/obfsplugin/verify_simple.py b/shadowsocks/obfsplugin/verify_simple.py
index 22eb787..6b90a5a 100644
--- a/shadowsocks/obfsplugin/verify_simple.py
+++ b/shadowsocks/obfsplugin/verify_simple.py
@@ -422,7 +422,7 @@ class auth_simple(verify_base):
     def client_pre_encrypt(self, buf):
         ret = b''
         if not self.has_sent_header:
-            datalen = max(len(buf), common.ord(os.urandom(1)[0]) % 32 + 4)
+            datalen = min(len(buf), common.ord(os.urandom(1)[0]) % 32 + 4)
             ret += self.pack_data(self.auth_data() + buf[:datalen])
             buf = buf[datalen:]
             self.has_sent_header = True