diff --git a/libtransmission/crypto.c b/libtransmission/crypto.c
index e6cc1d1d0..96987b5f2 100644
--- a/libtransmission/crypto.c
+++ b/libtransmission/crypto.c
@@ -382,7 +382,7 @@ tr_ssha1_matches( const char * source, const char * pass )
     /* extract the salt */
     if( sourcelen < 2*SHA_DIGEST_LENGTH-1 )
         return false;
-    saltlen = sourcelen - SHA_DIGEST_LENGTH-1;
+    saltlen = sourcelen - 2*SHA_DIGEST_LENGTH-1;
     salt = tr_malloc( saltlen );
     memcpy( salt, source + 2*SHA_DIGEST_LENGTH+1, saltlen );