You have to, but you probably shouldn’t do it by trying to add the inputs. That opens a door for DDOS attacks.

Returning an error on inputs that are too long (for some definition of it) is the way to go.