diff --git a/src/openvpn/push.c b/src/openvpn/push.c
index 8dfe0d5..ad95a0f 100644
--- a/src/openvpn/push.c
+++ b/src/openvpn/push.c
@@ -733,11 +733,6 @@
     }
 }
 
-#if defined(__GNUC__) || defined(__clang__)
-#pragma GCC diagnostic push
-#pragma GCC diagnostic ignored "-Wconversion"
-#endif
-
 static bool
 send_push_options(struct context *c, struct buffer *buf, struct push_list *push_list, int safe_cap,
                   bool *push_sent, bool *multi_push)
@@ -748,8 +743,13 @@
     {
         if (e->enable)
         {
-            const int l = strlen(e->option);
-            if (BLEN(buf) + l >= safe_cap)
+            const size_t l = strlen(e->option);
+            if (!buf_size_valid(l))
+            {
+                msg(M_WARN, "--push option is too long");
+                return false;
+            }
+            if (BLEN(buf) + (int)l >= safe_cap)
             {
                 buf_printf(buf, ",push-continuation 2");
                 {
@@ -764,7 +764,7 @@
                     buf_printf(buf, "%s", push_reply_cmd);
                 }
             }
-            if (BLEN(buf) + l >= safe_cap)
+            if (BLEN(buf) + (int)l >= safe_cap)
             {
                 msg(M_WARN, "--push option is too long");
                 return false;
@@ -776,10 +776,6 @@
     return true;
 }
 
-#if defined(__GNUC__) || defined(__clang__)
-#pragma GCC diagnostic pop
-#endif
-
 void
 send_push_reply_auth_token(struct tls_multi *multi)
 {